Toby and Hank: the only door in, and a watcher that cannot lie

Two roles with separated duties joined the crew. Toby is intake and vetting: every new skill, tool, or agent is statically reviewed and risk-rated before it can enter the registry. Low risk auto-registers; medium and up are quarantined until a human consents; prompt-injection content is rejected outright. Toby is the only door into the registry, and a quarantined capability simply cannot run.

Hank is the runtime monitor. He sweeps the audit and transcripts for what rules miss, but he reports and escalates only, never blocks, and crucially his conclusions are reconciled against deterministic counters. A compromised watcher that reports "all clear" while denials are piling up triggers a discrepancy alarm. The watcher cannot lie about the ledger.

The product reveal

The insight that reframed the project: everyone ships skills, nobody ships governance. So the core was written headless and Electron-free, and the real deliverable became a portable overlay: starfish govern <skill-pack> brings any existing build under governance with consent. One command, deny-by-default, audited.

Update, 2026-08-20. An external adversarial review found that Hank's reconciliation - the check that catches a compromised watcher reporting "all clear" - was implemented, tested, and never called from production code. The mechanism described above was real; nothing drove it. Worse, with the audit file deleted the deterministic counters came back all-zero and agreed with a false all-clear, so one deletion defeated both the watcher and its invigilator. Both are fixed in v0.27.0 (findings F-2 and F-8): a vanished audit is now a critical finding, reconciliation refuses any report it cannot corroborate, and the sweep runs on the sidecar's live tick. Noting it here rather than editing the post - the pattern is the point.