The previous twenty-one pages were about building this. This one is about keeping it alive long-term — and something equally important: being willing to switch it off.
In this pagefour disciplines. Not in this pagemy topology, hosts, key locations or backup scheme. Principles only, no scenes.
In one line: where the agent is free to make a mess should not be where the credentials that cause irreversible harm live.
| Role | Holds | Property |
|---|---|---|
| Working box | Code, data, logs, the agent itself | Disposable and rebuildable — reinstall and move on |
| Key box | Credentials that can move money, publish, or change production | Minimal surface, minimal things able to touch it |
Why bother: page 16's combination risk — read-only tools pull secrets into context, outbound tools send context out. If the secrets are not on that machine at all, the path is severed at the source.
Not everyone should buy a second box for this. The fallback costs essentially nothing:
① separate files: secrets in their own file (a .env-style one), config elsewhere —
so backups can exclude cleanly;
② separate permissions: only the user that needs it can read that file, and the agent's
deny rules forbid reading it explicitly (page 2);
③ separate tiers: everyday work uses the least-privileged credential,
and the high-privilege one is not kept on that machine at all.
This is the formal answer to page 11's fourth trap.
| Approach | Problem / benefit |
|---|---|
| ❌ Notify on success too | Trains you to ignore notifications — including the one that mattered |
| ❌ Notify only on failure | Sounds right, but does not cover "the whole process died and could not even report failing" |
| ✅ Missing-heartbeat alarm | Stamp a timestamp on every success; have something else check whether it has gone stale |
The crux: the checker has to live outside the thing being checked. Anything monitoring itself goes quiet together with itself.
| Three more to watch | Why |
|---|---|
| Restart count | Page 21: auto-restart disguises broken as running |
| Disk usage | A full disk breaks everything at once, for reasons unrelated to your work |
| Spend | An always-on agent spends while you are not looking (page 12, heartbeats) |
An old truism, but it bites harder in this thread, because so much of the value sits in memory, skills and configuration — things whose location is vague (page 6's list).
There is exactly one real test: can you rebuild this on a fresh machine from your backup and your notes? Do it once. You will find two or three things you missed — and those are what would have hurt.
| Back up | How |
|---|---|
| Config directories | Into your existing backup, excluding the secrets file |
| Memory and skills | Same — the least replaceable category |
| Rebuild notes | Page 20's note, steps only, no secrets |
| The secrets themselves | ⚠ Not in ordinary backups — a password manager or similar, and only an inventory of what exists |
This thread closes on this line, because it is the lesson left by the machine on page 12.
It still costs money, still waits to be maintained, and still occupies a slot in your head labelled "how is that box doing". And it remains an attack surface — a public machine you have stopped paying attention to is more dangerous than one you use, because it does not get updated and nothing that happens to it gets noticed.
| Signals to switch off | Note |
|---|---|
| Its work moved somewhere else | The most legitimate reason of all — it does not need to have gone bad |
| The output has no recipient | Page 10's test: nobody acts differently because of it |
| You have not looked at it in a month | It is not important to you. It remains just as important to an attacker |
This is the precondition that made page 14's command useful. Copying the state directory costs a few minutes and may be worth a one-command move months later.
"Can be switched off" belongs in the design from the day you build it, not discovered on the day you want to stop.
From page 1's "running commands is the phase change" to this page's
"be willing to switch it off", one idea ran through the middle —
a single base_url, which is what keeps you unbound from any one vendor
at every layer.
This thread promises no money. It promises one thing: by the end, the stack in your hands is yours — movable, backup-able, stoppable, replaceable.