---
name: harden-a3b8781cbeb1
description: 'Audit Oracle configuration for safety, governance, and hardening. Use when user says "harden", "audit", "security check", "governance", or wants to verify oracle setup.'
argument-hint: "[--full | --secrets | --rules | --fix]"
zombie: true
archived_reason: 'moved to zombie tier via #327 (usage audit, 3,685 sessions mined)'
archived_date: 2026-05-13
metadata:
  internal: true
---

# /harden — Oracle Governance Audit

> Sharp instruments need safe sheaths. The Whetstone hardens what it sharpens.

Audit an Oracle's configuration for safety, governance compliance, and operational hardening. Catches misconfigurations before they become incidents.

## Usage

```
/harden                # Quick audit — check all, report issues
/harden --full         # Deep audit — check all + suggest fixes
/harden --secrets      # Secrets scan only — .env, keys, tokens
/harden --rules        # Golden rules compliance check
/harden --fix          # Auto-fix safe issues (with confirmation)
```

---

## Step 0: Detect Oracle Root

```bash
date "+🕐 %H:%M %Z (%A %d %B %Y)" && ORACLE_ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
if [ -n "$ORACLE_ROOT" ] && [ -f "$ORACLE_ROOT/CLAUDE.md" ] && { [ -d "$ORACLE_ROOT/ψ" ] || [ -L "$ORACLE_ROOT/ψ" ]; }; then
  PSI="$ORACLE_ROOT/ψ"
  echo "✅ Oracle root: $ORACLE_ROOT"
else
  echo "❌ Not in an oracle repo. /harden requires CLAUDE.md + ψ/ directory."
  exit 1
fi
```

---

## Step 1: Secrets Scan

Check for leaked secrets in tracked files:

```bash
# Check for common secret patterns in git-tracked files
cd "$ORACLE_ROOT"

echo "🔍 Scanning for secrets..."

# .env files that shouldn't be tracked
git ls-files | grep -E '\.env($|\.)' | grep -v '\.example' | while read f; do
  echo "🚨 CRITICAL: $f is tracked by git!"
done

# Common secret patterns in tracked files (excluding binary)
git ls-files | xargs grep -l -E '(PRIVATE_KEY|API_KEY|SECRET_KEY|password|token|Bearer [a-zA-Z0-9]|sk-[a-zA-Z0-9]{20,})' 2>/dev/null | grep -v -E '(node_modules|\.lock|SKILL\.md|CLAUDE\.md)' | while read f; do
  echo "⚠️ Possible secret in: $f"
done
```

### .gitignore Checks

```bash
# Essential ignores for oracle repos
MISSING_IGNORES=""
for pattern in ".env" "node_modules/" ".DS_Store" "ψ/active/" "ψ/memory/logs/"; do
  if ! grep -qF "$pattern" "$ORACLE_ROOT/.gitignore" 2>/dev/null; then
    MISSING_IGNORES="$MISSING_IGNORES\n  ❌ Missing: $pattern"
  fi
done

if [ -n "$MISSING_IGNORES" ]; then
  echo "📋 .gitignore gaps:$MISSING_IGNORES"
else
  echo "✅ .gitignore covers essentials"
fi
```

---

## Step 2: Golden Rules Compliance

Read CLAUDE.md and verify the 5 Principles + Rule 6 are present:

```bash
echo "📜 Checking Golden Rules..."
CLAUDE_MD="$ORACLE_ROOT/CLAUDE.md"
```

Check for:

| Rule | Search Pattern | Required |
|------|---------------|----------|
| Nothing is Deleted | `Nothing is Deleted` | Yes |
| Patterns Over Intentions | `Patterns Over Intentions` | Yes |
| External Brain | `External Brain` | Yes |
| Curiosity Creates | `Curiosity Creates` | Yes |
| Form and Formless | `Form and Formless` | Yes |
| Rule 6 (Transparency) | `Oracle Never Pretends` | Yes |
| No force push | `force` or `--force` in golden rules | Yes |
| No rm -rf | `rm -rf` in golden rules | Yes |
| No secrets | `secrets` or `.env` in golden rules | Yes |

Report missing principles as warnings.

---

## Step 3: Brain Structure Audit

Verify ψ/ directory structure:

```bash
echo "🧠 Checking brain structure..."
PSI_REAL=$(readlink -f "$PSI" 2>/dev/null || echo "$PSI")

for dir in inbox memory writing lab learn active archive outbox; do
  if [ -d "$PSI_REAL/$dir" ]; then
    COUNT=$(find "$PSI_REAL/$dir" -type f 2>/dev/null | wc -l)
    echo "  ✅ ψ/$dir/ ($COUNT files)"
  else
    echo "  ⚠️ ψ/$dir/ missing"
  fi
done
```

### ψ/ Symlink Check

```bash
if [ -L "$ORACLE_ROOT/ψ" ]; then
  TARGET=$(readlink "$ORACLE_ROOT/ψ")
  echo "  🔗 ψ → $TARGET"
  if [ ! -d "$TARGET" ]; then
    echo "  🚨 Symlink target doesn't exist!"
  fi
else
  echo "  📁 ψ/ is a regular directory"
fi
```

---

## Step 4: Identity Verification

Check CLAUDE.md has required identity fields:

```bash
echo "🪪 Checking identity..."
```

| Field | Pattern | Required |
|-------|---------|----------|
| Name | `I am` or `name:` | Yes |
| Human | `Human:` | Yes |
| Purpose | `Purpose:` | Yes |
| Born | `Born:` | Recommended |
| Theme | `Theme:` | Recommended |
| Node | `Node:` | For fleet oracles |

---

## Step 5: Operational Checks

### Git Config

```bash
echo "⚙️ Checking git config..."
# Verify git user is set (not default)
GIT_USER=$(git config user.name 2>/dev/null)
GIT_EMAIL=$(git config user.email 2>/dev/null)
echo "  User: $GIT_USER <$GIT_EMAIL>"

# Check for dangerous aliases
git config --get-regexp alias 2>/dev/null | grep -E '(force|reset.*hard|clean.*-f)' && echo "  ⚠️ Dangerous git aliases found"
```

### Installed Skills Check

```bash
echo "🔧 Checking installed skills..."
if [ -d "$ORACLE_ROOT/.claude/settings" ] || [ -f "$ORACLE_ROOT/.claude/settings.json" ]; then
  echo "  ✅ Claude settings present"
else
  echo "  ⚠️ No Claude settings — skills may not be installed"
fi
```

### Contacts (if fleet oracle)

```bash
if [ -f "$PSI/contacts.json" ]; then
  CONTACT_COUNT=$(python3 -c "import json; print(len(json.load(open('$PSI/contacts.json')).get('contacts',{})))" 2>/dev/null || echo "?")
  echo "  📇 $CONTACT_COUNT contacts registered"
fi
```

---

## Step 6: Report

Output a summary table:

```
🛡️ /harden Audit Report — [oracle-name]

  Category         Status    Issues
  ──────────────── ───────── ──────
  Secrets          ✅ Clean   0
  Golden Rules     ⚠️ Gaps    2 missing
  Brain Structure  ✅ Complete 0
  Identity         ✅ Valid   0
  Operations       ⚠️ Check   1 warning
  .gitignore       ✅ Good    0

  Score: 4/6 ✅ | 2/6 ⚠️ | 0/6 🚨

  💡 Run /harden --fix to auto-fix safe issues
  💡 Run /harden --full for detailed recommendations
```

---

## Step 7: Auto-Fix (`--fix` mode)

**WAIT for user confirmation before any fix.**

Safe auto-fixes:
- Add missing .gitignore patterns
- Create missing ψ/ subdirectories
- Add missing identity fields to CLAUDE.md (with placeholder values)

Unsafe (manual only):
- Removing tracked secrets (requires `git rm` + history rewrite)
- Modifying golden rules
- Changing git config

---

## Rules

1. **Read-only by default** — never modify without `--fix` + confirmation
2. **Oracle root required** — refuse to run outside oracle repos
3. **No false positives on SKILL.md** — skill files legitimately contain words like "secret", "token", "key"
4. **Score honestly** — don't inflate for morale
5. **Actionable output** — every warning must include how to fix

---

ARGUMENTS: $ARGUMENTS


---
Source attribution: Soul-Brews-Studio
Original project: https://github.com/Soul-Brews-Studio/arra-oracle-skills-cli/blob/ea0e758759b56621ee3907089ed48476b88379e4/src/skills/.archive/harden/SKILL.md
License: MIT
License information: https://opensource.org/license/mit
Original upstream instructions; downloaded from Mega AI Hub.

## Upstream license notice

MIT License

Copyright (c) 2025-2026 Nat Weerawan

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.



# Mega AI Hub resource metadata

Creator / publisher: Soul-Brews-Studio
Original project: https://github.com/Soul-Brews-Studio/arra-oracle-skills-cli/blob/ea0e758759b56621ee3907089ed48476b88379e4/src/skills/.archive/harden/SKILL.md
Attribution basis: Source repository record

Fields of work: Development & Engineering
Roles: Backend Developer, DevOps / SRE, Security Engineer
Specialties: Backend
Tools: Oracle
Country applicability: Country not specified
Classification basis: Source catalog labels
Instruction SHA-256: 96a58dda32139de047f6400e1dff92640b5bee91796461a45acb166310025e0b