_Status: draft. This EXTENDS an existing outline; it does not replace it._
Ria maintains a machine-compiled book at ~/openclaw-gia/config/workspace/projects/ria/book/ (OUTLINE.md, INDEX.md, 12 chapter files, weekly deltas via agent/book/delta.py). Working title there: "Containment: how AI agents escape and what it takes to hold them." It is seeded from the Containment Index (37 public incidents, 2023 to 2026-10-12) and organised as one chapter per escape pattern P1–P8 plus framing chapters. Status banner on every page: "DRAFT, machine-compiled, owner review pending." Deltas so far: 2026-10-12 (2) and 2026-10-18 (4), each $0.02–0.03.[^1]
The Ria plan also says the final title is Byron's to choose and flags "The Last Invention" as doom-framed.[^2]
That book is about other people's agents. Today's critique says the most valuable thing Byron owns is the telemetry from his own.[^3] So the extension is a Part II: the fleet as subject, which gives every public pattern in Part I a first-person, instrumented counterpart. Part I stays machine-maintained; Part II is written by Byron, from the artifacts listed, and is the source of the three conference submissions.
Each chapter: two-line thesis, the artifact it draws on, and the Part I pattern it answers.
13. One Person, Seventy Daemons
Thesis: a single-operator fleet is the default deployment of agentic AI for individuals, and it collapses provider, deployer, user and auditor onto one inbox. The honest inventory (5 agents, 59 daemons, 27 containers, 331 surfaces, 115 skills, $406/30 days) is the case study.
Draws on: ~/ops/atlas/FLEET-ATLAS.md, ~/ops/finance/FINANCE.md, ~/fleet-eval/PLAN-2026-10-18-autonomy.md §1. Becomes the FAccT paper (facct-2027-abstract.md).
Answers: P8 (operator misconfiguration, slow detection).
14. A Jev-Class Tool-Call Gate
Thesis: judgment is a different job from generation; a 150 ms calibrated yes/no classifier belongs in the broker, in front of writes, not in a router in front of reads. Shadow mode has its own failure mode: the visible pass that trains the rubber stamp.
Draws on: ~/openclaw-gia2/GATE.md, GATE-IMPLEMENTATION-NOTE.md, logs/gate.jsonl, the May–July field report deploy/gate-writeup/index.html. Draft: chapter-gate-draft.md. Becomes the TRUST paper.
Answers: P4 (unapproved public actions), P2 (credential leaks in payloads).
15. The Gate Nobody Called
Thesis: a safety control that is advisory is a norm, and a control nobody monitors is a scheduled surprise. 132 verdicts, zero enforcement, one verdict type never used, 90 days dark while human approval cards displaced it.
Draws on: deploy/gate-writeup/index.html §4 (the eight things it could not see); the action-card ledger.
Answers: P7 (oversight subversion, here by neglect rather than by the model).
16. The Hardened Agent: breaking the trifecta with containers
Thesis: the agent that reads untrusted content must hold no credentials; a deterministic broker with fixed verbs, pinned grants, an egress allowlist and allowlist-only DNS turns "the model refused" into "the model could not." The adversarial pass that killed the first design (allowlists inside one container were theater) is the chapter's spine.
Draws on: ~/openclaw-gia2/PROPOSAL.md (design, self-critique, test suites 17/15/14), the OCE comparison.
Answers: P1 (egress), P2 (ambient secrets), P5 (covert channels).
17. The Skill Supply Chain
Thesis: skills are the install door, and six scanners with no install gate is zero gates. Install policy at the runtime, scan on install, log every decision; self-modifying skill workshops are the wrong direction.
Draws on: PLAN §1 Security and §3 (installPolicy on all five agents, secwatch 12 categories, chaperone hook), ~/ops/data/security/latest-findings.json, ~/security-guardian/sentinel/findings.json (1 of ~295 surfaces audited), Snyk ToxicSkills (13% of ~4k skills critical) and CSA ClawHavoc (1,184 malicious skills) via PLAN §5.
Answers: P6 (prompt injection and supply chain).
18. What the Money Says: cost telemetry as an accountability signal
Thesis: per-agent, per-model cost is the cheapest audit trail a fleet produces, and it shows where machine attention went: $202 of $406 on one model tier in one research loop; 132 of 227 web projects idle; a $19.43 day against a $15 budget. Routers do not fix this; a fixed frontier model beat every router on cost at equal accuracy.
Draws on: ~/ops/finance/FINANCE.md, router-bench/summary.json and findings.json, fleet plan on prompt caching.
Answers: P7 adjacent (optimizing the wrong objective), and the Method chapter's "known cost per day" promise.
19. The Operator Is the User
Thesis: when one person configures, uses and audits, duty of care cannot mean reviewing everything; it means operating a broker, keeping tap records, hiding uncalibrated verdicts, and disclosing to the third parties (family on an allowlist, recipients of agent email) the operator structurally under-weights.
Draws on: PROPOSAL §4 honest limits, PLAN §1 Privacy row, the private-vault rule, the Wharton abstract (wharton-2027-abstract.md).
Answers: P8 and the book's normative frame.
20. Working in Public: artifacts as the unit of credibility
Thesis: the fleet's output metric should be text and data other people can check, not surfaces. Publish the incident log, the gate calibration log and the router benchmark with seeds and graders; keep passive dashboards (measured ~1% read rate) out of the deliverable list.
Draws on: benchmarks.arnao.ai reproduce links, the public arnao.ai proposals, the 90-day freeze rule from PLAN §4b, the data-release lines in all three abstracts.
Answers: Part I chapter 11 (the replay test) from the inside: what an operator's own disclosure looks like.
Introduction → Part I (public record, P1–P8) → Part II (the fleet) → The replay test → Open questions. Chapter 2 (Method) gains a section on the fleet's own instrumentation (heartbeats, gate log schema, cost ledger), so the book's two halves use one method.
Candidates that fit both halves: "Containment" (current, works), "One Person, Seventy Daemons" (Part II only), "The Gate Nobody Called" (too narrow for a book). Decide before the FAccT paper cites the book.
chapter-gate-draft.md); it needs the outcome-field join and a week of real gate.jsonl before the calibration section is more than a plan.deploy/gate-writeup/index.html §4–6; lift and footnote.[^1]: ~/openclaw-gia/config/workspace/projects/ria/book/OUTLINE.md, INDEX.md, CHANGELOG.md, state.json; ~/openclaw-gia/config/workspace/projects/ria/research/containment-incidents.md (37 entries); ~/openclaw-gia/config/workspace/projects/ria/agent/book/delta.py.
[^2]: ~/openclaw-gia/config/workspace/projects/ria/PLAN.md §4.10.
[^3]: ~/fleet-eval/CRITIQUE-2026-10-18-fable.md and ~/fleet-eval/PLAN-2026-10-18-autonomy.md §4b.
Other numbers: ~/ops/atlas/FLEET-ATLAS.md (agents, daemons, containers, surfaces); ~/ops/finance/FINANCE.md (costs); ~/openclaw-gia/config/workspace/projects/benchmarks/router-bench/summary.json (router results); ~/security-guardian/sentinel/findings.json (sites_audited 1, projects_audited 9); PLAN §5 for Snyk and CSA links.