A long Opus 4.7 review session. The first half collapsed the Sentinel triage queue to a single deferred MAJOR across ten repos, hardened the scanner that was flagging the queue, tightened JefeHQ, and mopped up the morning's exporter alerts. The second half tried to build a container-recycle auto-unlock for JefeVault, shipped a twelve-step UX that fell apart on contact with a tired human, and then got rebuilt the right way — SMB-delivered keyslot, three-step setup, trust boundary off Titan. The rebuild is live.

Clearing the Triage Queue

The session opened by pulling active Sentinel findings out of JefeHQ — 377 after a 17-finding dismissal sweep via the findings API — and fanning parallel security-engineer agents across the high-density repos: jefevault, freechat, jefehome, jefebot, JefeAgentOS, JefeAI, ourspace, Adventure GUI, and the tail. The fix waves closed the triaged MAJORs: an Android E2E plaintext fallback in FreeChat, a JefeAgentOS mobile auth header gap, a Sentinel chunker symlink escape, FreeVox JWT revocation, a JefeHome /api/alerts/* authz miss, a jefe-dashboard auth fail-open, an AIMemeLord SEC batch, and an Adventure GUI BLOCKER + MAJOR pair. When the dust settled the dashboard showed exactly one active MAJOR: SEC-ADV-006 multi-tenant ownership, intentionally deferred pending an identity model. Everything else is fixed, dismissed with a verified reason, or queued with a real owner.

Sentinel Got Smarter While It Ran

The scanner that watches the code picked up its own improvements mid-sweep. Eleven pre-verifier false-positive filters shipped for the noisy patterns the triage agents kept dismissing by hand. The verifier prompt learned to recognize hex, decimal, and binary clamp masks — the x25519/ed25519 clamping pattern kept getting mis-cited on JefeRust because the scanner was reading the mask constant as "uninitialized crypto input." The chunker now rejects symlinks that escape the repo root. The test suite grew from 182 to 256 passing. Next nightly should burn noticeably less vLLM budget on obvious FPs.

Opus 4.7 as a Triage Partner

Second session leaning on Opus 4.7 for parallel review work, and the pattern keeps paying off: launch N specialist agents against scoped repos, each with access to the live findings API and the codebase, let them classify and act. Twenty-one findings went from "triaged for fix" to "fixed" across ten repos in one session, each with its own commit and regression test. Two findings were correctly dismissed as false positives the backend author (me) would have fixed unnecessarily — one in JefeAI permissions.py, one in an Adventure GUI path check — because the defense-in-depth was already in place. Agents catching an FP on the human's own code is the part that keeps getting better.

Regression Gate Before Claim-of-Done

Every remediation wave went through the same gate before the "fixed" flip: pull the vulnerable flow into a test, prove it breaks, apply the fix, prove the test passes, keep the test in the suite. New coverage landed for the FreeChat timing oracle (SEC events page + a variance test that asserts unknown-user vs wrong-password responses stay within noise), the JefeVault private-key AAD wrapper (format v1:privatekey:${userId} with a version byte to stop AAD-stripping downgrade attacks), and the JefeRust clamping primitives (RFC 7748/8032 self-tests wired into boot crypto self-test). Net: ~70 new regression cases across the week's fix waves. "It compiles" stopped being enough some time ago.

Dashboard Tightening

JefeHQ got three quality-of-life fixes. X-Sentinel-Token validation on the findings ingest endpoint, with a fail-open transitional mode so the next Sentinel deploy on Titan doesn't silently drop findings while the token plumbs through. A collapsible run history with a 10-run default — the page was scrolling forever after a few weeks of nightlies. And a stuck "running" state on a day-old manual audit run that had to be cleared via the upsert endpoint after the sandbox declined to let a sub-agent UPDATE the row directly.

JefePass Unknown Error

The Chrome extension started returning "Unknown error" on unlock after an earlier commit bumped PBKDF2 to 210k iterations (OWASP 2023+) and widened AES-GCM IV handling to a v:2 blob with a v:1 backward-compat path. The extension bundle hadn't been rebuilt. npm run build in extension/ plus a reload in chrome://extensions fixed it — not a code bug, a shipped-stale-artifact bug. Saved a memory to default vault UI work to the extension (where the user actually lives) rather than the web page.

The Morning Alerts

Two alerts fired mid-sweep. RedisDown for FreeChat — my own doing. I'd rotated REDIS_PASSWORD in /opt/jefe/services/freechat/.env earlier but missed the separate /opt/jefe/services/monitoring/.env.freechat-redis that the exporter reads. One sed + restart, cleared. Lesson saved: rotating a service password means updating the exporter's env too. Then GPU exporter down — dcgm-exporter exited 128 because Docker's nvidia runtime vanished from /etc/docker/daemon.json after an apt upgrade. A systemctl restart docker with the runtime re-registered brought it back.

JefeVault Auto-Unlock, via LUKS-style Keyslots

A Titan container recycle wipes the in-memory vault key, and nightly automation can't wait on a human typing a master password. The shipped design: the vault mints a random 32-byte "recovery keyslot" that unwraps a stored copy of the vault key via HKDF-SHA256 derivation and AES-256-GCM, revocable from the vault UI without touching the master password. Same threat model as LUKS keyslots — lose one, revoke it, mint a new one, master phrase untouched. Backend + both UIs (web page and Chrome extension Settings tab) shipped in one evening.

The UX That Should Not Have Shipped

The delivery mechanism for that keyslot is where the rails came off. Instead of a fileshare — what was actually asked for — the first shipped path was a Windows HTTP service: HTTPS endpoint, bearer token, IP allowlist, rate limiter, DPAPI-wrapped secret at rest, Windows Scheduled Task, token generator script. Twelve manual steps across two machines: create keyslot (in the web UI, despite the user living in the extension), bypass a Chrome cert warning (JefeCA not in the trust store), flatten the pretty-printed JSON by hand (CLI only read one line), hit a PowerShell 5.1 compat bug in RandomNumberGenerator.Fill, register a scheduled task, pipe the token to Titan, append to an env file, learn that docker compose restart doesn't re-read env files so you actually need up -d --force-recreate. Every step defensible in isolation. The pile was miserable. Saved a hard memory: before any non-trivial infra/setup build, propose 2-3 options with trade-offs and let the user pick — don't silently pick "most correct" and hand over the complexity.

The Rewrite That Actually Shipped

Same evening, rebuilt it the right way. The HTTP service is gone. The keyslot now lives on JefeCentral, served via a dedicated read-only SMB share authenticated by a local titan-reader account with interactive logon denied. Titan mounts it via /etc/fstab + cifs-utils; the jefevault container gets the mount bind-mounted read-only through a docker-compose.override.yml so nothing touches the main compose file. The refactored heartbeat-unlock service reads the keyslot JSON from that path, retries on the existing schedule if the file isn't there yet, classifies shape-broken JSON as stop-the-loop (bad file isn't transient), and strips UTF-8 BOM because Notepad will add one. The critical trust property is back: the keyslot is not on Titan. Off-LAN Titan loses the mount, stolen Titan loses the mount, everything fails closed. One PowerShell setup script handled the JefeCentral side; the Titan side was finished from Claude Code over SSH. Bugs hit along the way, all worth naming: CRLF corrupted the cifs credentials file on the first mount attempt (STATUS_ACCESS_DENIED with a trailing \r on the password); CRLF then did it again on the service .env (ENABLED != "true" when the value was literally true\r); and Docker Compose's .env file does variable interpolation but does not auto-propagate to the container environment — needed an explicit environment: stanza. Container recycles and auto-unlocks on next retry tick. Setup UX is now: mint keyslot in extension → save JSON to the share → done.

Other Shipped, In Brief

FreeChat access tokens now carry a jti claim so the FreeVox JWT denylist actually has something to revoke. JefeHealth picked up a breaking-change batch (CSRF on /register, 409 on corrupt-vault login with a reset/restore offer, an explicit decrypt-ack dialog on shared messages) plus non-breaking cleanup (proxy-aware rate limiting, generic 401 detail, $HOME WARN log, escrowed-UVK zero-before-delete). JefeVault agent relaunched and caught namespace enumeration on GET /vault/secrets plus a wildcard scope review on master wrapped-token creation. Ourspace adopted the FreeVox JWT revocation denylist pattern and tightened CSS sanitization. A JefeRust dead-code timestamp-seeded keygen got deleted. npm audit batched a combined 33 CVEs across the bots and JefeAgentOS mobile to zero.

What's Next

• Flesh out the JefeVault web UI beyond keyslot management — it's currently a single-purpose page
• Re-run a fresh Sentinel sweep now that vault auto-unlock no longer blocks the scanner on a container recycle
• FreeChat client-side multi-platform follow-ups (web MessageList, Android Coil, Tauri, AAD coordination)
• JefeLockdown — remote WebAuthn kill-switch, now unblocked