Episode 9: an ops triage agent that proposes but never executes

The agent runs in n8n on the box and reaches its model over the mesh from
episode five, so no prompt leaves the network. It gets three read-only tools
(recent commits, monitor status, wiki search) and returns one suggested
action as a field. A switch compares that field against three allowed values,
and only one of them reaches ops-actions, a small runner holding its own
hard-coded allowlists for actions and targets.

Measured while building this: the same prompt injection was harmless in every
place the agent reached through a tool (twenty runs, no hits) and worked every
time it arrived in the alert itself, through a poisoned monitor name (thirteen
of thirteen). The allowlist rejected all thirteen. It guards the action field
only, so the attacker-written summary still reached the wiki unchanged; the
triage note now truncates and strips every field it did not write itself.

compose.yml

@@ -261,6 +261,29 @@ services:
       - wg_data:/etc/wireguard
     networks: [proxy]
 
+
+  # The only thing in this stack that is allowed to change state (episode 9).
+  # The agent never talks to it. n8n does, and only after a switch node has
+  # matched the model's proposed action against a fixed list. This service
+  # checks the same thing again, plus a second list of containers it may
+  # touch at all. Two locks on one door cost nothing.
+  #
+  # Start it with:  docker compose --profile agent up -d
+  ops-actions:
+    image: docker:cli
+    profiles: [agent]
+    restart: unless-stopped
+    environment:
+      OPS_ACTIONS_TOKEN: ${OPS_ACTIONS_TOKEN}
+    volumes:
+      - ./ops-actions/runner.py:/runner.py:ro
+      # Yes, this is the docker socket. That is exactly why the allowlists are
+      # inside this container and not in a workflow anyone can edit.
+      - /var/run/docker.sock:/var/run/docker.sock
+    entrypoint: ["sh", "-c"]
+    command: ["apk add --no-cache python3 >/dev/null && exec python3 -u /runner.py"]
+    networks: [proxy]
+
   # --- CI (episode 2) -- start with: docker compose --profile ci up -d ---
 
   docker-in-docker: