[Placeholder: this project is being planned. The roles and intent are set; the content, code and evidence are not written yet. Name is provisional.]
What it is
The agents from agent-lab grow into a team. Each one has a single job and only the access that job needs, and an orchestrator ties them into one workflow.
| Agent | Job | Access |
|---|---|---|
| Monitor (from agent-lab) | Watches the lab and flags what looks wrong | Read-only |
| Triage | Gathers the evidence, decides how serious it is and who needs to know | Read-only, changes nothing |
| Vulnerability | Checks versions against known vulnerabilities and ranks the risk | Read-only, changes nothing |
| Troubleshooter | Diagnoses the problem and proposes a fix | Proposes only; a person approves before anything runs |
| Communicator | Explains what happened and what was done, in plain language, to the right person | Sends messages, changes nothing |
| Coder | Writes or changes scripts when a fix needs code | Proposes only; a person approves before anything runs |
| Orchestrator | Moves each event through the workflow, in order | Coordinates the agents, every step logged |
| More later | [TBD] | [TBD] |
Why the roles are split
Splitting the roles means the agent that watches can’t act, and no agent that acts can act alone. The workflow follows my usual pattern: diagnose (monitor and troubleshooter), propose (troubleshooter and coder), verify (a person approves, the monitor confirms), and communicate.
Tools
[TBD: orchestration, and how the agents pass work to each other.]
How it runs
It starts from The NetState Lab Network’s own Compose file, alongside the network: docker compose --profile workflow up -d. One file runs the whole lab.
The pieces
Each project is laid out in the same order: the problem that started it, the documents that plan it, what was built, and the proof that it works. Open any card to read it.
How it connects
The projects build on each other, in order. Each one starts from what the one before it produced.
Phases
| Phase | Scope | Status |
|---|---|---|
| v1 | Triage and alerts: a ban checked against the firewall log for an earlier port scan, then routed by severity to the Network Administrator or escalated to the IT Coordinator, with evidence prepared by a script. | planned |
| v2 | Response scripts: reviewed scripts a person runs, such as extra logging on a source address that expires on its own, and a verified unlock for a real user who locked themselves out. | planned |
| v3 | Vulnerability agent: service and application versions checked against known vulnerabilities, ranked by severity, and fixed through a reviewed release. | planned |
| v4 | Respond and "What would AI do?!": the person sees the evidence first and asks for the AI's recommendation only if they want it, then agrees or disagrees. | planned |
| v5 | Troubleshoot: diagnoses a problem and proposes a fix; a person approves before anything runs. | planned |
| v6 | Coder and orchestration: proposed code changes, and the agents tied together into one workflow, every step logged. | planned |