Deek Strategic Action Posters

These cards present source-grounded next-action choices for Deek. They are navigation aids, not claims that any action has shipped, been deployed, or passed its outcome check.

Each SVG is followed by an AI-generated concept illustration. The illustration is explanatory artwork, not operational evidence; the SVG and linked owner carry the facts.

Start with A, then continue through B, C, D, and E unless the linked owner identifies a blocking condition.

Choose your entry point

• A — Secure baseline when Deek needs a durable release starting point. Outcome: a durable, reviewable release baseline.
• B — Make deployment truth executable when deployment controls can drift without a failing check. Outcome: dangerous deployment drift cannot stay green.
• C — Prove recovery when a backup exists but rollback has not been exercised. Outcome: rollback confidence before live changes.
• D — Delegate once to OMP when a bounded experiment can test one-shot delegation. Outcome: Deek’s first real OMP delegation.
• E — Quarantine unreadable attachments when an unreadable historical image can block an otherwise usable session. Outcome: the usable session continues safely.

Proposal-era assumptions

The following assumptions belong to the cards’ historical proposal context; this page provides no reliable creation date. The original statements “OMP is not deployed” and “Current Deek remains single-user” must not be read as current installation or platform-wide account claims.

• Proposal status: The cards describe proposed actions and desired outcomes, not accepted completion receipts. OMP and Hermes owns the published installed-runtime record and its separate model, permission, and inference prerequisites.
• One-shot output: The selected fresh-child ACP mechanism returns final assistant text, not thoughts, tool traffic, plans, or persistent OMP history.
• Shared workspace: A shared cwd provides filesystem visibility, not synchronization.
• Identity: One shared Harness process/resource pool is one trust domain. Private Accounts and Service Publishing describes separate owner processes; that is different from safely pooling mutually untrusted users inside one process.

This documentation comparison did not launch a child, inspect an owner runtime, configure a child model, or authorize inference. Installing an executable is not any of those proofs, and a fresh child is not persistent ACP, collab projection, or shared memory.

A — Secure baseline

Open poster A at full size.

Choose this when: Deek needs a durable, reviewable starting point before later deployment and recovery work.

• Move it outside the repo: keep session HTML exports in private storage without opening or tracking them.
• Prevent recurrence: ignore future omp-session-*.html exports.
• Establish Deek’s remote: keep the upstream source separate from the release lane.
• Record the release: push tracked commits and capture both source and deployed revisions.

Done when: private session exports remain untracked, reviewed commits have an owned remote, and source plus deployed revisions identify one durable release baseline.

Canonical owner: private page (sign-in required).

B — Make deployment truth executable

Open poster B at full size.

Choose this when: the documented deployment requirements could drift while ordinary checks remain green.

• Cross-check the stack: compare the systemd, nginx, Cordis, and Authelia owners.
• Add one source verifier: read only committed, non-secret facts.
• Mutation-prove controls: break bind, proof, host, cookie, and authentication cases and confirm rejection.
• Wire required gates: keep static checks and their documentation aligned in the release path.

Done when: a dangerous deployment drift makes the required check fail with a direct correction, and the restored configuration passes. Source checks supplement, rather than replace, live proof.

Canonical owner: private page (sign-in required).

C — Prove recovery

Open poster C at full size.

Choose this when: a backup exists, but no controlled restore has proved that its state and application revision are compatible.

• Label the backup: bind state to the compatible application revision.
• Restore safely: use an isolated clone or a controlled maintenance window.
• Exercise the boundary: verify the edge, bootstrap, API, WebSocket, and workspace.
• Capture a clean receipt: record outcomes without recording secrets.

Done when: the matching immutable release and state restore successfully, every required boundary check passes, and the receipt exposes no credential material.

Canonical owner: private page (sign-in required).

D — Delegate once to OMP

Open poster D at full size.

Choose this when: Deek is ready for a bounded Phase 1 experiment that needs only one fresh OMP run and a terminal answer.

• Pin the runtime: install the reviewed OMP executable at a service-readable immutable path.
• Register provider omp: use an absolute command, args: ['acp'], and permission rejection first.
• Add a separate tool: keep the action one-shot, provider-depth managed, and without continuation.
• Prove real behavior: use the same cwd in a fresh session and confirm that only final assistant text returns.

Done when: one fresh child completes, Deek receives final assistant text only, and the operator treats every retry as a new session and every shared-cwd change as an unsynchronized filesystem effect.

Canonical owner: OMP Integration Cheat Sheet — Phase 1.

E — Quarantine unreadable attachments

Open poster E at full size.

Choose this when: an unreadable historical image would otherwise make every later model request fail even though the remaining session is usable.

• Record quarantine: append one durable transition for the exact unreadable attachment and failure class.
• Project a stable placeholder: preserve append-only history while later requests skip the quarantined read.
• Retry only what is retryable: retry a general read failure once without ignoring cancellation; quarantine only the classified failure.
• Recover after verification: restore projection only after the original reference passes digest and metadata checks.

Done when: restart and fork reconstruct the same placeholder, later requests continue without rereading the failed object, and verified recovery restores the original image reference.

Proposal owner: Attachment quarantine Agent Note; evidence map: private page (sign-in required).