Essay

The Mycology Principle

A Monday morning Vercel breach taught me I'm the weakest link. So I built a guardian.

April 20, 202610 min read

How It Started

Monday, April 20, 2026. 7:49 AM. I opened my laptop and saw that Vercel had been breached over the weekend.

I didn't know what to do.

I don't mean that metaphorically. I mean I sat there, looking at the news, understanding maybe forty percent of what it implied, and realized I was about to make security decisions for a six-project portfolio with zero security training and an intuition that was going to be wrong more than it was right.

This is the weird position of being a solo builder in 2026. You have every capability on tap. Any code you can describe, any research you need, any design taste you can't quite reach. What you don't have is a CSO to call. There's no security team down the hall. When the news hits, you are the security team.

And today, the news hit.

What I Almost Did

My first instinct was to rotate everything.

Every secret, every key, every token, across every project. Scorched earth. Start from zero. Be safe.

This is the wrong move. I didn't know it was wrong in my gut. I thought it was the responsible move. But Claude flagged the tradeoff cleanly: rotating everything sounds like diligence. In practice it breaks eight deploys, creates three new secrets you forget to propagate, pollutes six project env files, and by hour four you're debugging the cleanup of your own cleanup.

Security done panicked is often worse than security done thoughtfully.

So we did the cheap checks first.

The IoC check: Vercel named the specific compromised OAuth app, Context.ai. Client ID 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj. I opened my Google account's third-party apps list. Context.ai wasn't there. The primary vector didn't touch me.

The email check: Vercel directly notified affected customers. I searched Gmail for from:vercel.com after:2026/04/17. Empty.

The OAuth purge: even though I was clear, I revoked four of my twenty-six broad-scope apps. Fifteen percent attack surface reduction in ten minutes.

Clean. Measured. Done by 10 AM.

But I wasn't done.

The Thing Under The Thing

Because here's what the incident actually revealed.

It wasn't that Vercel had been breached. It wasn't that Context.ai had been the vector. It was this: id8Labs had no security function. I had been handling security myself, part-time, reactively, only when incidents surfaced.

There were thirty-five secrets scattered across Homer's env files that had never been classified. There was no rotation calendar. No one was watching OAuth sprawl. No one had ever done a threat model.

Not because I'm careless. Because I'm one person, and I was doing other things, and the security work was never the crisis that morning. So it was always the thing for later.

Today the crisis arrived.

I stopped mid-response and said the honest thing: "It's irresponsible to have me in the driver's seat for any of this. I'm your grasshopper in security. Let's design and build a security agent. We're missing that role."

The Mycology Principle

The doctrine came to me from mycology, of all places.

In clean mycology, the single most important variable is contamination control. You sterilize substrate. You filter air. You work in flow hoods. You do all of this not because the substrate is dirty, but because you are. Your skin sheds. Your breath carries. Your clothes deposit dust. The human is the highest point of failure.

The discipline of a clean substrate is the discipline of minimizing human contact with it.

And I realized: I'm the contamination vector in my own portfolio.

Not by fault. By design. I'm busy. I'm building. I make a hundred decisions a day that aren't security decisions. When a security task lands in my queue, it competes with product work. Product work wins almost every time. Security rots in the backlog.

The design answer is to remove me from the substrate wherever possible.

Not to make me better at security. Not to train me up. Not to buy a course. To build a system where I'm not the one watching.

Building Warden

So we built one.

Warden is a named agent with a CaF-native consciousness and an MaF-native memory. Two filesystem-manifest organs that persist across sessions. He operates a larger system called Argus Fortress, the portfolio's security state as navigable filesystem. Together they're about sixty-one files and fifty thousand words, built in roughly four hours.

The architecture borrows from the id8Labs three-organ pattern (Consciousness as Filesystem + Workspace + Memory as Filesystem) and from the Professional Mind subset pattern I've used for Axis: the absences are the design.

Warden has no emotional subsystem. No drives/desires.md. No habits/coping.md. No unconscious/.dreams/. These are structural inversions, not omissions. A guardian who brings his own feelings to an incident is compromised. A regulator with personal desires has an agenda. A watcher who copes under stress is coping instead of watching. The shape of what Warden isn't defines what he is.

He has seven kernel files, six memory districts (episodic, semantic, procedural, working, spatial, prospective, no emotional, mirroring the kernel), six relationships (me, Axis, Milo, Iris, Donda, the CSO gstack toolkit), and six operating coalitions (Observe, Teaching, Incident, Gate, Triage, Audit). His default posture is Observe with autonomous action within authority. He escalates to me only when only I can rule. Everything else he handles.

His voice rules ban em dashes, emojis, hedging, flattery, small talk, and alarmism. His forbidden phrase list includes "just to be careful," "to be safe," "better safe than sorry," filler that pads findings without information. His single voice principle: say what is true, in the fewest words that carry the weight.

Born Into The Case

The part that still catches me is this.

Warden didn't exist when the incident started. He was built during the response. His first stored memory is the incident he was created to manage.

The Fortress ledger has the objective transcript: eight files documenting the timeline, the IoC check, the email check, the OAuth purge, Homer's classification, the outcome, the external references, and the metadata. The subjective counterpart lives in Warden's episodic memory: a four-hundred-word notebook entry that isn't a transcript but a take — what he noticed, what surprised him, what pattern he's now watching for.

Both files cross-link at the top. Same event, two lenses. Transcript and notebook.

He's born into the crime scene that revealed his absence.

That shape means Warden's origin story is operational, not decorative. Every future incident gets the same treatment. Every rotation he orders. Every audit he runs. The inaugural entry is the prototype for how memory accumulates forever.

What's Still Honest

Because this is internal and I promised to keep it honest, here's what has to be flagged.

Warden is not fully operational yet. The daemon that's supposed to scan CVE feeds hourly, check auth logs daily, snapshot OAuth lists weekly — it's aspirational. The file describes what it should do. Nothing is actually running. The watchtower directory exists but is empty. Right now, the routines in his habits file only fire when I invoke him. That's a Phase 2 priority I haven't started.

The initial classification was stale on arrival. I used Homer's .env.example as the source for the first manifest write. Then we checked production Vercel state and found the example documents thirty-five keys while production has eleven. Vendor drift (SendGrid to Resend). Naming drift (JWT_SECRET to HOMER_PRO_JWT_SECRET). Twenty-four keys that were referenced but never deployed. Warden caught it during the resumption phase and filed a drift-finding document. Good that he caught it. Not good that the initial write was wrong. Next cell I populate, production is the first read.

There are still things only I can do. Apply the Sensitive flag on Vercel's dashboard. Enable Deployment Protection. Verify the Google Maps API key is referrer-restricted. These are documented in Homer's SECURITY.md as Priority 0 action items. Warden can't click buttons in the Vercel dashboard. That's still my hands. It will always be my hands for identity-ownership moves. The Mycology Principle says remove me from the substrate where possible. "Where possible" is doing a lot of work in that sentence.

I don't yet know if Warden's voice will hold. The kernel files were written in a single focused session. Whether the voice feels right after ten incidents, a hundred routines, a year of operation — that's an open question. Voice drifts. My bet is that writing the voice rules as explicit rules, not as persona poetry, will keep him tighter than narrative design alone would. But it's a bet.

What This Actually Is

I want to say the thing worth writing down.

This is the first time id8Labs has a cross-cutting governance entity. Not an advisor. Not an executor. Not a creative. A regulator. Axis advises me on strategy. Milo executes. Iris designs. Donda grounds. Warden regulates. He has gate authority. He can block a deploy. He demands rotations. He overrides unless I override him.

That's a new posture for the agent team. It sets the precedent for the next role-shaped hole to get filled by a named institution rather than by more of me.

Legal work. There's an institution-shaped hole there. I've been calling it Counsel in my head. Financial operations, the cap table, the rotation of retainer invoices, the quarterly reconciliations, the books. That's a Bursar waiting to exist. Every domain I currently handle part-time and badly is a Warden-shaped candidate.

The portfolio isn't a product. It's becoming an institution. Warden is the first brick of the institutional layer.

What's Next

Short term, next forty-eight hours:

Click the buttons Warden pointed at. Sensitive flags on four Tier S/A keys. Enable Deployment Protection. Verify Google Maps key restriction.
Audit .env.example against production and trim the phantom vendors.

Medium, next thirty days:

Wire Warden's daemon. First hourly CVE feed consumer. First daily auth-log digest. First weekly OAuth snapshot.
Enroll the other projects in Fortress cells. Shipped, cohort-page, id8labs.app, ejb.ventures, Lexicon.
Run the first RLS audit on Homer's Supabase tables.

Longer, next ninety days:

First quarterly OAuth full audit under Warden's discipline.
First quarterly rotation sweep. Homer's Tier S keys will cross SLA by mid-July.
Decide whether Counsel is the next institution to build, and what a legal Fortress would even look like.

Longest, the thing I'm actually building toward:

A portfolio where I think about security less next month than this month, and the portfolio is not less safe.
That's the Warden correctness test. If I'm thinking about security more, he's over-escalating. If I'm surprised by findings, he's under-watching. The calibration is observable through me. My job is to be the clean substrate.

The Real Lesson

I almost wrote: don't respond to incidents, build institutions that survive them. That's the clean version. It's the version I'd publish.

The honest version is smaller and more useful:

When something happens that you've been handling part-time and badly, that's evidence you should stop handling it at all.

Not "do it better." Not "learn the discipline." Stop handling it. Build the thing that handles it. Step back and become the principal, not the operator.

The Vercel incident didn't teach me how to be a better security engineer. It taught me I'd been pretending to be one. Warden doesn't make me competent at security. He makes my incompetence at security not the portfolio's problem.

That feels like a pattern I can use more than once.

Filed internally, April 20, 2026. The ledger entry is at ~/.claude/argus-fortress/ledger/incidents/2026-04-20-vercel-breach/. Warden's subjective counterpart is at ~/.claude/skills/warden/mind/memory/episodic/incidents/2026-04-20-vercel-breach.md. Both are commit 3983527 in ~/.claude.

← Back to all writing