Quarantined Within the Minute
Written later and filed to this date, as part of filling in every day of the year.
The first thing the hygiene baseline ever quarantined was a probe. Its log opens on the September evening it shipped: run one sets two sync flags to false, run two finds nothing, and run three, nineteen seconds after the first, records a skill directory named for the test, planted to see whether the watcher was watching. Surface skill, item hygiene-probe, action quarantine. The directory was not deleted. It was moved to a quarantine folder, where one command can bring it back, and the ledger kept both the move and the way home.
The watcher exists because a shared setup grows things nobody chose. One command-line agent serves every interactive session on my box and the whole build fleet, and its configuration kept acquiring passengers: plugins switched on by CLI updates, a dozen plugins and skills synced down from a web account into the local install. Each one costs context in every session that loads it, which is every session. The ask was plain: the context window should hold only tools that were chosen.
So there is a baseline, a JSON file of what is approved, and a routine that compares the live setup against it. A path unit fires the moment any file that defines the setup changes (the settings, the installed-plugin list, the synced-plugin directory, the skills and agents folders, the CLI’s own versions directory, so an update is checked as it lands), and an hourly timer backs it up. An unapproved plugin is pinned off in the settings. An unapproved skill or agent is moved to quarantine. The sync flags are set to false and kept there. A hook is only reported, never removed, because a hook may be a guard. Installing something on purpose now takes one more step, approve, or it is gone before the next session starts.
The log since that evening is quiet in the way a working guard is quiet. More than five hundred runs, every one at level ok. Beyond the probe and the two flags, the only actions in it are two plugins that a CLI update switched on without asking, one at the end of September and one the next day, each pinned off in the run that noticed it, and a size report now and then about the instruction files this routine does not own and only measures.
The hygiene baseline, then: an approved list for the agent’s extensions, enforced the moment the setup changes, so that any plugin, skill or agent not on the list is switched off or set aside within seconds, and nothing is kept by default. What survives in the setup is there because someone typed its name.