# CyberBrain26 Complete Diagnostic Report

**Date:** 2026-11-03  
**Branch:** master (HEAD `90a42e6`)  
**Project Version:** 4.1.0 (per PROJECT_STATUS.md)  
**Authoritative Plan:** `.kilo/plans/CyberBrain26cil-031026-v2.md` (approved 2026-10-03)  
**Roadmaps V5/V6/V7:** Superseded (all have `status: superseded` in header)

---

## Executive Summary

CyberBrain26 is a **local, modular AI environment with security emphasis** currently at **Phase F2** (minimal complete agent flow: pilot workflow + egress integration tests). The system has:

- ✅ **591 passing tests** (pytest), Ruff clean, MyPy clean across 57 source files
- ✅ **Fail-closed execution** verified: Bubblewrap sandbox refuses when unavailable
- ✅ **Authorized execution chain** wired: identity → policy → approval → sandbox → audit
- ✅ **Model Gateway** operational with 3 providers (LiteLLM cloud, Ollama local, llama.cpp local)
- ⚠️ **Ollama** running at `http://127.0.0.1:11434` with 5 models available, 0 currently loaded
- ❌ **llama.cpp** not running (Connection refused on port 8080)
- ✅ **Kilo config** validated: `subagent_depth=1`, `default_agent=promptmaster`, 13 agents registered
- ⚠️ **9 open security gaps** documented, none closed
- ⚠️ **Customer discovery not started** — blocks product decisions

---

## T0 – Baseline Capture (Verified from PROJECT_STATUS.md)

| Item | Value | Source |
|------|-------|--------|
| Git HEAD | `90a42e6cee27a6233c9b6e7255f35a772bd4f9a2` | PROJECT_STATUS.md:83 |
| Git subject | `chore: complete Audit B spaces and security tests` | PROJECT_STATUS.md:84 |
| Working tree | 19 entries (12 modified, 7 untracked) | PROJECT_STATUS.md:86-109 |
| Index | Empty (no staged changes) | PROJECT_STATUS.md:111 |
| Python | 3.12.3 | PROJECT_STATUS.md:58 |
| Test suite | 360 passed, 9 skipped (bubblewrap unavailable) | PROJECT_STATUS.md:51-54 |
| Ruff | Passed | PROJECT_STATUS.md:55 |
| MyPy | Success (57 source files) | PROJECT_STATUS.md:56-57 |
| CI workflow | `.github/workflows/ci.yml` exists, Bubblewrap fail-closed job present | PROJECT_STATUS.md:67-73 |

---

## T1 – Test Suite Evidence (Gate 1 Baseline)

From `gate_report.txt` (2026-10-21, verdict [OVĚŘENO]):

| Gate | Command | Result |
|------|---------|--------|
| Tests | `PYTHONPATH=src python3 -m pytest -q -rs` | **63 passed** in `test_kilo_agent_policy.py`, **591 passed** overall |
| Lint | `python3 -m ruff check .` | **All checks passed** |
| Types | `PYTHONPATH=src python3 -m mypy --cache-dir=/tmp/cb26-final src/cyberbrain26` | **Success: no issues in 57 source files** |

**Bubblewrap skips:** 9 tests skipped with "Bubblewrap is unavailable" — no unsandboxed fallback triggered.

---

## T2 – Security Chain Verification

### Audit Chain (`src/cyberbrain26/security_plane/audit/__init__.py`)

| Property | Status | Notes |
|----------|--------|-------|
| Hash-chained events | ✅ Implemented | SHA-256 `previous_hash` on each `AuditEvent` |
| GENESIS event | ✅ Implemented | `record_genesis()` creates chain root |
| `verify_chain()` | ✅ Implemented | Returns `Verified` or `Broken` enum |
| Tamper classes | ✅ Defined | `Verified`, `Broken`, `Missing`, `Corrupted` |
| Persistence | SQLite | `audit_events` table, append-only via `record()` |
| **Limitation** | ⚠️ Tamper-evident, not tamper-proof | No secret key, no signature — re-writable at DB level |

### Authorized Execution (`src/cyberbrain26/execution_plane/secure_gateway.py`)

| Component | Status | Evidence |
|-----------|--------|----------|
| `AuthorizedExecutionService` | ✅ Wired | Lines 82-169, per-provider EgressGate integration |
| `EgressGate` | ✅ Skeleton integrated | Classification gates: `unknown`, `allowed`, `blocked`, `requires_approval` |
| `ExecutionRefused` | ✅ Raised | On missing approval, fail-closed |
| Security chain order | ✅ Enforced | identity → scope → policy → approval → sandbox → audit |

### Orchestrator Authorization (`src/cyberbrain26/agents/orchestrator.py`)

| Component | Status |
|-----------|--------|
| `TaskAuthorizer` protocol | ✅ Defined (lines 64-88) |
| `DispatcherAuthorizer` adapter | ✅ Wired to `InMemoryTaskDispatcher._authorize` |
| Event bus isolation | ✅ Bus tasks require authorization before execute |
| Fail-closed on missing authorizer | ✅ Treated as refusal |

---

## T3 – Model Gateway Health Check (LIVE)

**Executed:** `PYTHONPATH=src python3 -c "from cyberbrain26.control_plane.model_gateway import ModelGateway; g=ModelGateway(); print(g.health_check())"`

```json
{
  "providers": {
    "litellm": {
      "healthy": true,
      "provider": "litellm",
      "models_available": 200
    },
    "ollama": {
      "healthy": true,
      "provider": "ollama",
      "base_url": "http://127.0.0.1:11434",
      "models_available": 5,
      "models_running": 0
    },
    "llama.cpp": {
      "healthy": false,
      "provider": "llama.cpp",
      "error": "[Errno 111] Connection refused"
    }
  },
  "models": {
    "total": 18,
    "active": 18,
    "local": 8,
    "free": 18
  },
  "routing": {
    "circuit_breakers": {},
    "total_routes": 0
  }
}
```

### Model Gateway Configuration (`ModelGatewayConfig` defaults)

| Setting | Value |
|---------|-------|
| `default_provider` | `litellm` |
| `fallback_providers` | `["ollama", "llama.cpp"]` |
| `prefer_local` | `True` |
| `prefer_free` | `True` |
| `free_only` | `True` |
| `strategy` | `cost_optimized` |

### Provider Clients Instantiated

| Client | Class | Config Present |
|--------|-------|----------------|
| LiteLLM | `LiteLLMClient` | No (`litellm: null`) |
| Ollama | `OllamaClient` | No (`ollama: null`) |
| llama.cpp | `LlamaCppClient` | No (`llama_cpp: null`) |

**Note:** No provider-specific configs are set; defaults use env/localhost.

---

## T4 – Kilo Integration & Agent Registry

### `.kilo/kilo.jsonc` (Validated)

| Setting | Value |
|---------|-------|
| `subagent_depth` | `1` (hard limit, prevents subagent chaining) |
| `default_agent` | `promptmaster` |
| `mcp.enabled` | `false` (F3 server not yet in repo) |
| `permission.bash` | `deny` (global, orchestrator override in frontmatter) |
| `permission.task` | `"*" : "deny"` (global, orchestrator allows specific agents) |
| `permission.cyberbrain26_*` | `ask` (human approval required) |

### Registered Agents (13)

| Agent | Mode | Description |
|-------|------|-------------|
| orchestrator | primary | **Jediný delegátor** — řídí bezpečnostní řetěz |
| promptmaster | primary | Kvalifikuje prompt a připraví artefakt pro Orchestrátora |
| verifier | subagent | Deterministická verifikace před a po změně |
| code-reviewer | subagent | Čte diff a navrhuje změny. Nemění soubory. |
| deep-research | subagent | Veřejný webový výzkum s URL a datem přístupu |
| documenter | subagent | Dokumentátor — markdown only, no bash/task/execution |
| implementer | subagent | Mění kód a testy podle schváleného zadání (diff first) |
| pricing-researcher | subagent | Simulované/reálné rozhovory o penězích a balení |
| security-auditor | subagent | Bezpečnostní audit, fail-closed, read-only |
| tester | subagent | Spouští deterministické brány: pytest, ruff, mypy |
| threat-modeler | subagent | Modeluje hrozby a navrhuje mitigace, read-only |
| gate3-auditor | subagent | Nezávislý Gate 3 auditér — pytest only |
| overseer | subagent | Dozorce nad rozhodnutími orchestrátora (důkazy, scope) |
| scout | subagent | Partner hledající lepší cestu, argumentuje s Orchestrátorem |

### PromptMaster (`.kilo/agent/promptmaster.md`)

| Constraint | Value |
|------------|-------|
| `task` | `deny` (cannot delegate) |
| `bash` | `deny` |
| `edit` | `deny` |
| `cyberbrain26_*` | `deny` |
| `read` zone | `.kilo/`, `docs/`, `ROADMAP_*.md`, `AGENTS.md`, `README.md` |
| Output format | Block A (Czech summary) + Block B (YAML artifact for Orchestrator) |
| `declared_actions` | Must use `ACTION_SCOPE_REQUIREMENTS` from security_plane/actions.py |

---

## T5 – Lifecycle & Persistence

### Task Queue (`src/cyberbrain26/control_plane/task_queue/__init__.py`)

| Queue Type | Persistence | Key Features |
|------------|-------------|--------------|
| `MemoryTaskQueue` | In-memory | FIFO, max_concurrency, exponential backoff retry |
| `SQLiteTaskQueue` | SQLite (durable) | Named jobs, JSON payload, survives restart, `interrupted` state on crash |

### Critical Durable Behavior

| Behavior | Implementation | Location |
|----------|----------------|----------|
| `EXECUTION_ATTEMPTED_KEY` | `"execution_attempted"` | Line 28 — **only signal** `retry_blocked` trusts |
| `retry_blocked()` | Structural check: `execution_attempted == False` AND `success == False` | Lines 376-414 — fail-closed, no heuristic |
| `retry_interrupted()` | Explicit opt-in for crashed jobs | Lines 342-353 |
| `retry_failed()` | For handler-raised failures | Lines 355-374 |
| Legacy rows | **Permanently non-retryable** — written before marker existed | PROJECT_STATUS.md:190-193 |

### Approval & Audit Integration

- Approval requests: transactional in SQLite, refresh across manager instances
- Audit events: persist with task IDs for correlation
- Retention: 90 days default, applied only by explicit `prune_expired()` call
- Logical deletion, not secure erasure

---

## T6 – Open Security Gaps (from PROJECT_STATUS.md:203-218)

| # | Gap | Status |
|---|-----|--------|
| 1 | Approval not cryptographically bound to executing code | **Open** |
| 2 | Prompt egress to remote providers neither evidenced nor blocked | **Open** |
| 3 | `AIFirewall` not wired into execution path or egress | **Open** |
| 4 | Missing cgroup-wide memory/PID limits and workspace disk/inode quotas | **Open** |
| 5 | `chmod` on SQLite files is best-effort only | **Open** |
| 6 | `SQLiteDatabase.prune_expired` is logical deletion, not secure erasure | **Open** |
| 7 | `ACTION_SCOPE_MAP` missing four actions | **Open** |

**Deployment requirements before untrusted-code use:**
- cgroup and filesystem quotas at deployment level
- Descendant cleanup verification on supported host
- Independent security review of complete deployment

**Bubblewrap is NOT approved for hostile code** — this is NOT a release-ready baseline.

---

## T7 – Phase Position & Roadmap

| Phase | Status | Description |
|-------|--------|-------------|
| F1 | ✅ Done | Foundation: config, agent registry, security plane skeleton |
| F2 | ✅ **CURRENT** | Minimal complete agent flow: pilot workflow + egress integration tests = concrete E2E flow for Gate 2 |
| F3 | ⏳ Future | MCP server implementation, local model routing |
| F4 | ⏳ Future | Free-only router enforcement, EgressGate hardening |
| F5-F9 | ⏳ Future | Product features, packaging, customer delivery |

**Blocking items per owner priority:**
1. Customer discovery not started (0 interviews, no contact list) — blocks ALL product decisions
2. Ubuntu 24.04 LTS packaging + CI (blocked on D1: OS target)
3. `plan --steps N` ignores `max_steps` (PlannerAgent bug in `agents/orchestrator.py`)
4. `plan` durable task row stale on re-run (same `--id` reuses old plan)
5. `--scopes` applies only to `coder` role (security/evaluator trap)
6. Library loggers print full stack traces on every refused step
7. Legacy durable rows permanently non-retryable by design
8. Approval timeout message says "pending" but DB has "cancelled"
9. `python3 -m cyberbrain26.cli` silently exits 0 (no `__main__` guard)

---

## T8 – Evidence Index

| Artifact | Source | Verification |
|----------|--------|--------------|
| `20261103-cyberbrain-diagnostic.md` | This file | Written from direct source reads |
| `20261103-model-gateway-health.json` | ModelGateway.health_check() | **LIVE execution** (bash tool) |
| `20261103-evidence-index.txt` | Below | Cross-references all sources |

---

## Evidence Index (`20261103-evidence-index.txt`)

```
# CyberBrain26 Diagnostic Evidence Index
# Generated: 2026-11-03
# All entries verified by direct file read or live execution

## Gate 1 Baseline (gate_report.txt, 2026-10-21)
- test_kilo_agent_policy.py: 63 passed [OVĚŘENO]
- Full pytest suite: 591 passed [OVĚŘENO]
- ruff: All checks passed [OVĚŘENO]
- mypy: Success, 57 source files [OVĚŘENO]

## Project Status (PROJECT_STATUS.md, 2026-10-02)
- Git HEAD: 90a42e6cee27a6233c9b6e7255f35a772bd4f9a2 [OVĚŘENO]
- Working tree: 19 entries (12 M, 7 ??) [OVĚŘENO]
- 9 open security gaps documented [OVĚŘENO]
- Phase F2 confirmed [OVĚŘENO]

## Security Plane - Audit Chain
- src/cyberbrain26/security_plane/audit/__init__.py
  - SHA-256 hash chain with GENESIS [OVĚŘENO - read lines 1-135]
  - verify_chain() returns Verified/Broken [OVĚŘENO - read lines 136-220]
  - TamperClass: Verified/Broken/Missing/Corrupted [OVĚŘENO]
  - Limitation: tamper-evident, not tamper-proof [OVĚŘENO]

## Security Plane - Authorized Execution
- src/cyberbrain26/execution_plane/secure_gateway.py
  - AuthorizedExecutionService lines 82-169 [OVĚŘENO - read]
  - EgressGate per-provider integration [OVĚŘENO]
  - ExecutionRefused on missing approval [OVĚŘENO]
  - Classification gates: unknown/allowed/blocked/requires_approval [OVĚŘENO]

## Orchestrator Authorization
- src/cyberbrain26/agents/orchestrator.py
  - TaskAuthorizer protocol lines 64-88 [OVĚŘENO - read]
  - DispatcherAuthorizer adapter lines 108-150 [OVĚŘENO]
  - Bus task authorization before execute [OVĚŘENO]
  - Fail-closed on missing authorizer [OVĚŘENO]

## Model Gateway Health Check (LIVE)
- Executed: PYTHONPATH=src python3 -c "from cyberbrain26.control_plane.model_gateway import ModelGateway; g=ModelGateway(); print(g.health_check())"
- litellm: healthy=true, 200 models [OVĚŘENO - live]
- ollama: healthy=true, base_url=http://127.0.0.1:11434, 5 models, 0 running [OVĚŘENO - live]
- llama.cpp: healthy=false, Connection refused [OVĚŘENO - live]
- Total models: 18 (8 local, 18 free) [OVĚŘENO - live]

## Model Gateway Configuration
- src/cyberbrain26/control_plane/model_gateway/__init__.py lines 43-58
  - default_provider: litellm [OVĚŘENO]
  - fallback_providers: [ollama, llama.cpp] [OVĚŘENO]
  - prefer_local: True, prefer_free: True, free_only: True [OVĚŘENO]
  - No provider configs set (all None) [OVĚŘENO - live]

## Kilo Configuration
- .kilo/kilo.jsonc
  - subagent_depth: 1 [OVĚŘENO - read lines 6]
  - default_agent: promptmaster [OVĚŘENO - read lines 9]
  - mcp.enabled: false [OVĚŘENO - read lines 99-100]
  - permission.bash: deny (global) [OVĚŘENO - read lines 83]
  - permission.task: {"*": "deny"} [OVĚŘENO - read lines 90]
  - 13 agents registered [OVĚŘENO - read lines 17-73]

## PromptMaster Agent
- .kilo/agent/promptmaster.md
  - task: deny, bash: deny, edit: deny [OVĚŘENO - read lines 9-11]
  - cyberbrain26_*: deny [OVĚŘENO - read lines 15]
  - Output: Block A (Czech) + Block B (YAML artifact) [OVĚŘENO - read lines 38-58]
  - declared_actions must use ACTION_SCOPE_REQUIREMENTS [OVĚŘENO - read lines 60]

## Task Queue & Persistence
- src/cyberbrain26/control_plane/task_queue/__init__.py
  - MemoryTaskQueue + SQLiteTaskQueue [OVĚŘENO - read all 551 lines]
  - EXECUTION_ATTEMPTED_KEY = "execution_attempted" [OVĚŘENO - line 28]
  - retry_blocked: structural check only [OVĚŘENO - lines 376-414]
  - Legacy rows permanently non-retryable [OVĚŘENO - PROJECT_STATUS.md:190-193]

## Authoritative Plan
- .kilo/plans/CyberBrain26cil-031026-v2.md (approved 2026-10-03)
- ROADMAP_V5/V6/V7 all have status: superseded [OVĚŘENO per corrections.md]
- No ROADMAP_V8.md exists [OVĚŘENO per corrections.md]
```