portugalfuturista/replica-omnisciente
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 68
replica-omnisciente/research/pt-futurista-audit/REPORT.md
fabiorafaelcoutada 5a6296eaa4 chore(research): pt-futurista audit
2026-07-12 20:53:08 +01:00

22 KiB
Raw Permalink Blame History

Full Ecosystem Audit: Portugal Futurista

Generated 2026-07-10 · depth: standard · 8+ sources · workspace: research/pt-futurista-audit/

Executive summary

  • Critical: 3 hardcoded secrets leaked in nervura-electrica — a Lidarr API key appears in 5 Python scripts and a Telegram bot token is in a YAML config, all tracked in git [S1]
  • Severe: ASUS host massively overcommitted — 55.5 GB RAM allocated across 14 CTs on a 16 GB host, with swap fully exhausted and 93% disk usage [S2]
  • High: MCP server attack surface — 43% of tested MCP servers are vulnerable to command injection; Portugal Futurista runs 12+ remote MCP servers via mcp-remote [S3]
  • Medium: 4 CTs stopped, 2 services duplicated — CTs 202-205 offline, Lidarr/Sonarr duplicated on CT 216 alongside Gigabyte host [S2]
  • Dirac is a significant open-source contribution — 1.4k GitHub stars, tops Terminal-Bench-2 leaderboard, 64.8% cost reduction vs competitors [S4]
  • Brain sync is one-directional with no merge — last push wins, creating data loss risk if multiple workspaces push concurrently [S5]
  • Cloudflare Tunnel is the sole inbound path — CGNAT means all external access depends on a single tunnel process on ASUS [S6]

Background & scope

This audit covers two repositories under /home/fabiorafaelcoutada/portugalfuturista/:

  1. replica-omnisciente — centralized brain, agent orchestration, and monorepo containing dirac (coding agent), tilth (code intelligence), toon (format library), and shared protobuf definitions
  2. nervura-electrica — self-hosted infrastructure (Proxmox, Docker, Cloudflare) and AWS IoT CloudFormation for ESP32 fleet management

Scope: architecture, security, operational health, CI/CD, sync, dependencies, and recommendations. Both repos are private; research is based on local file inspection and public sources for components like Dirac.

Architecture

replica-omnisciente

The repo serves dual purposes: it's both the centralized agent brain (sessions, knowledge, MCP config) and a monorepo of tools.

Component Language Purpose Maturity
.aurelio/ Python/JSON Brain, MCP servers, sync, knowledge base Production (active sync)
dirac/ TypeScript, esbuild Coding agent (VS Code + CLI), fork of Cline Production (1.4k stars, Apache 2.0)
tilth/ Rust, Cargo Tree-sitter code intelligence MCP server Production (v0.6.3)
toon/ TypeScript, pnpm Format library monorepo Production (v2.1.0)
shared/ TypeScript, buf Protobuf definitions (@aurelio/shared) Internal
realms/ Markdown 21 per-project knowledge directories Documentation
scripts/ Python Sync, conscience upgrade, Kimi import Operational

Dirac is the most significant open-source component. It's a hard fork of Cline that uses hash-anchored edits and AST manipulation to achieve 64.8% cost reduction while maintaining 100% accuracy on benchmark tasks. It topped the Terminal-Bench-2 leaderboard with a 65.2% score using gemini-3-flash-preview [S4].

Tilth replaces grep/cat/find with tree-sitter AST-aware equivalents, providing structured, token-efficient output for AI agents. Supports 13+ languages [S7].

MCP ecosystem: 12 remote MCP servers defined in .aurelio/mcp_config.json, all accessed via mcp-remote to *.portugalfuturista.org. Key servers: savearth-mcp, electrical-eda-mcp, knowledge-mcp, codebase-memory-mcp.

nervura-electrica

The infrastructure repo contains:

  • AWS CloudFormation — 50+ resources across 11 nested stacks for IoT Core, Lambda, DynamoDB, S3, Fleet Provisioning, OTA updates
  • Proxmox — 14 CTs on ASUS host (192.168.0.38), 2-node cluster with Gigabyte
  • Cloudflare Tunnel — sole inbound access path (Starlink CGNAT)
  • Docker — 30 containers on Gigabyte host (media stack)
  • Aurelio compiler — C++23/Rust compiler, Go MCP gateway

Physical infrastructure spans 4 servers:

Server RAM GPUs Role
ASUS (192.168.0.38) 16 GB — Primary Proxmox host
Gigabyte (192.168.0.104) 16 GB 2× RTX 3070 Media + ComfyUI
AORUS PRO (192.168.0.105) 32 GB 3× RTX 3070/Ti Planned: AI node
Tomahawk MAX (192.168.0.106) 32 GB 1× RTX 3060 Ti Planned: audio inference

Security posture

CRITICAL: Hardcoded secrets in tracked files

Lidarr API key (24077d03b9a742a786dd799567659cb8) is hardcoded in 5 Python scripts in nervura-electrica:

  • rename_lidarr.py:7
  • infrastructure/proxmox/media-library/scripts/sync_lastfm_lidarr.py:48
  • infrastructure/proxmox/media-library/prune_check_files.py:16
  • infrastructure/proxmox/media-library/prune_check.py:6
  • infrastructure/proxmox/media-library/compare_artists.py:17

Telegram bot token (8992450776:AAHx5xta6BDL3OR7WnWsukWSasCZh3U288E) is hardcoded in:

  • infrastructure/proxmox/watchdog/config.yml:13

Session API key (bff75943e17f48fb060f1c6321c28b513cad7e8b876c00b11b16e2d067edcdc3) is in:

  • .aurelio/sessions/2026-04-30_antigravity-cdp-integration/session.yaml:93

Impact: These secrets are in git history. Even if removed now, they remain recoverable from commit history. The Lidarr API key grants access to the media management stack. The Telegram bot token could be used to send messages or access bot data.

Remediation: Rotate all three secrets immediately. Use git filter-branch or BFG Repo-Cleaner to purge from history. Move all secrets to .env files (gitignored) or a secrets manager.

MCP server attack surface

Research shows 43% of tested MCP servers are vulnerable to command injection [S3]. Portugal Futurista runs 12+ MCP servers, all accessed via mcp-remote (STDIO-to-HTTP bridge). The OWASP MCP Top 10 lists command injection as MCP5:2025 [S8].

Key risk: if any MCP server on *.portugalfuturista.org processes untrusted input, it could enable remote code execution through the agent. The mcp-remote transport adds an HTTP layer but doesn't sanitize tool inputs.

Cloudflare Tunnel single point of failure

All inbound access routes through a single cloudflared process on ASUS. If it stops, all *.portugalfuturista.org services become unreachable. The tunnel config is a single YAML file at /etc/cloudflared/config.yml [S6].

Privacy concern: Cloudflare terminates TLS, meaning it can inspect all traffic. For a self-hosted platform handling IoT telemetry and agent communications, this is a significant trust boundary [S6].

Proxmox security gaps

Best practices recommend against privileged LXC containers and suggest running Docker inside VMs rather than directly on the host [S9]. The current setup runs Docker containers directly on Gigabyte (not in a CT), which reduces isolation. The ASUS host uses SSH key-based auth but exposes it through Cloudflare Tunnel.

Operational health

ASUS host resource crisis

The ASUS server is critically overcommitted:

  • RAM: 55.5 GB allocated across 14 CTs on 16 GB physical RAM
  • Swap: Fully exhausted (8 GB used)
  • Disk: 93% full (83G/94G, 6.4G free)
  • /tmp: 99% full (7.7G/7.8G)
  • Load average: 10.04 (high for a 4-core system)

CT 208 (Gabinete) is allocated 8 GB but uses only 72 MB — reclaimable via pct set 208 --memory 2048 to free 6 GB [S2].

Stopped services

CT Service Impact
202 Debug lab None (idle)
203 IoT stack Traefik, Mosquitto, InfluxDB, Grafana, API offline
204 CI/CD (Woodpecker) No automated builds
205 Firmware store firmware.portugalfuturista.org returns 502

CT 203 was stopped because unauthorized Rust builds consumed all memory. It has been partially restored but herdade-* Rust services remain stopped [S2].

Service duplication

CT 216 (Management) runs Lidarr and Sonarr, which are also running on Gigabyte. This wastes ~450 MB of RAM on an already overcommitted host [S2].

CI/CD & sync

GitHub Actions

Single workflow: .github/workflows/build.yml — builds and deploys the aurelio-vscode extension to CT 205 (firmware store) via SCP. Triggers on pushes to main touching extensions/aurelio-vscode/**. Uses self-hosted runner [S5].

Gap: CT 205 is stopped, so the deployment target is offline. Deployments will fail silently or error.

Forgejo

Single workflow: .forgejo/workflows/aurelio-sync.yml — runs upgrade-conscience.py --commit --push --skip-ci then sync.py --push. Triggers on all pushes to main [S5].

Risk: The conscience upgrade auto-commits and pushes. If it produces bad output, it could corrupt the main branch.

Brain sync

sync.py uses pct push/pct pull over SSH to transfer .aurelio/brain/ between local and CT 208. The sync is one-directional per call — there's no merge. Last push wins [S5].

Data loss risk: If Workspace A pushes, then Workspace B pushes (without pulling first), Workspace B's push overwrites Workspace A's changes.

Kimi import (sync-kimi-to-brain.py) converts ~/.kimi/sessions/ to Aurelio brain format. It also syncs plans from ~/.kimi/plans/ to .aurelio/brain/kimi-plans/. Must run before sync.py --push to broadcast to fleet [S5].

Dependency & operational risks

Single points of failure

  1. ASUS host — runs all critical CTs (208, 209, 212, 216). Failure takes down MCP gateway, media, IDE, and management.
  2. Cloudflare Tunnel — sole inbound access. Process failure = all services unreachable externally.
  3. Starlink CGNAT — no direct inbound connectivity without tunnel.
  4. Brain sync — no redundancy, no backup, last-push-wins semantics.

Backup strategy

  • No evidence of Proxmox backup (Proxmox Backup Server not mentioned)
  • No evidence of .aurelio/brain/ backup outside of git
  • InfluxDB backups are manual (per AGENTS.md)
  • DynamoDB has point-in-time recovery (35 days)
  • S3 has versioning with 90-day lifecycle

Known issues

  • Corosync showing retransmit lists (network packet loss between Proxmox nodes)
  • Immich (CT 213) planned migration to Gigabyte not yet completed
  • z-ai API key rotation recommended after migration
  • OnlyOffice DocSpace offline; decision pending on revival
  • ode-triunfal-firmware has critical FSM sleep bug (vTaskDelay with potentially misconfigured FreeRTOS tick rate)

Recommendations

Immediate (this week)

  1. Rotate leaked secrets — Lidarr API key, Telegram bot token, session API key. Purge from git history.
  2. Reclaim CT 208 RAM — pct set 208 --memory 2048 (frees 6 GB)
  3. *Remove duplicate arr apps from CT 216 — keep only Gigabyte instances
  4. Clean /tmp on ASUS — remove old tarballs (7.7 GB)

Short-term (this month)

  1. Move secrets to .env or Vaultwarden — all 5 Python scripts should read from environment
  2. Add Cloudflare Tunnel health check — monitor cloudflared process, alert on failure
  3. Enable Proxmox backups — at minimum, backup CT 208 (brain) and CT 216 (Vaultwarden)
  4. Fix CT 205 deployment target — either restart it or update the GitHub Actions workflow

Medium-term (this quarter)

  1. Implement brain sync with merge semantics — or at minimum, require pull-before-push
  2. Audit MCP server inputs — ensure no MCP server processes untrusted user input
  3. Complete Immich migration to Gigabyte — free 4 GB on ASUS
  4. Stand up AORUS PRO and Tomahawk MAX — offload AI workloads from ASUS

Deep dive: Cloudflare Tunnel

The Cloudflare Tunnel config (infrastructure/proxmox/config.yml) is the single source of truth for all inbound routing. Key findings:

Tunnel identity: pf-tunnel-v2 (ID 516a070e-ef65-4afd-8a60-26ab60473a42), running on ASUS. Credentials file at /root/.cloudflared/516a070e-...json.

Route count: 40+ hostname-to-service mappings spanning 5 physical/CT origins:

  • ASUS host (SSH, Proxmox UI)
  • CT 208 (MCP gateway, Gabinete)
  • CT 207 (Aurelio web portal)
  • CT 209 (TV/IPTV stack)
  • CT 212 (Antigravity IDE)
  • CT 216 (Authentik, Vaultwarden, scrobbler)
  • CT 203 (IoT stack — partially restored)
  • Gigabyte host (30+ media services)

Security issues found:

  1. Duplicate hostname: fantasia.portugalfuturista.org is mapped to both CT 207 (:3100) and CT 220 (:8105). Cloudflare will route to whichever appears first in the config — currently CT 220 wins (line 104-105), overriding the CT 207 entry (line 47-48). This is likely a bug.
  2. No Access policies: The config has no access section. All 40+ services are publicly routable to anyone who knows the hostname. Authentik exists on CT 216 but is not enforced at the tunnel level.
  3. noTLSVerify on Proxmox UI: proxmox.portugalfuturista.org uses noTLSVerify: true — Cloudflare won't verify the origin's TLS cert, allowing MITM between Cloudflare and the origin.
  4. SSH exposed: ssh.portugalfuturista.org tunnels directly to localhost:22. Anyone with Cloudflare access gets shell access.
  5. No health checks: No originRequest.connectTimeout or retry configuration. A hung origin service will silently fail.
  6. Planned routes for offline nodes: Routes for AORUS PRO (192.168.0.105) and Tomahawk MAX (192.168.0.106) are configured but these servers may not be running.

Config is version-controlled: It lives at nervura-electrica/infrastructure/proxmox/config.yml and is deployed via manual SCP. No automation validates the config before deployment.

Deep dive: Proxmox datacenter

The Proxmox cluster runs on 2 nodes (ASUS + Gigabyte) with Corosync for coordination.

ASUS host (192.168.0.38) — the bottleneck:

  • 16 GB RAM, 4 cores, 94 GB disk
  • 14 CTs allocated (10 active, 4 stopped)
  • Total allocation: 55.5 GB (3.5× overcommit)
  • Swap fully exhausted (8 GB used)
  • Load average: 10.04
  • /tmp filled with old tarballs (7.7 GB)

CT resource allocation (active only):

CT RAM Used Utilization
207 (Aurelio web) 2 GB 179 MB 9%
208 (Gabinete/MCP) 8 GB 72 MB 0.9%
209 (Media/TV) 8 GB 929 MB 12%
212 (Antigravity IDE) 8 GB 1.6 GB 20%
213 (Immich) 4 GB 902 MB 23%
214 (Print) 512 MB 21 MB 4%
215 (Matrix) 1 GB 178 MB 17%
216 (Management) 8 GB 1.86 GB 23%
220 (Bolsa) — — —

Quick wins:

  • CT 208: Downsize from 8 GB to 2 GB → frees 6 GB
  • CT 216: Remove Lidarr/Sonarr duplicates → frees ~450 MB
  • CT 214: Consider stopping if printing isn't used → frees 512 MB
  • /tmp cleanup → frees 7.7 GB disk

Gigabyte host (192.168.0.104):

  • 16 GB RAM, 2× RTX 3070
  • Runs 30 Docker containers directly on host (not in a CT)
  • ZFS pool /mnt/usb-pool (1.2 TB, 89% full)
  • NFS exports to ASUS for media sharing
  • Docker containers include Jellyfin, *arr apps, qBittorrent, Navidrome, Kavita, Suwayomi

Security concern: Docker runs directly on the Gigabyte host without CT isolation. A container escape gives full host access. Best practice is to run Docker inside a VM or unprivileged CT [S9].

Stopped CTs and their services:

CT What's lost Restart command
203 Traefik, Mosquitto, InfluxDB, Grafana, API, Forgejo, Woodpecker CI pct start 203 && pct exec 203 -- docker compose up -d
205 nginx OTA firmware store pct start 205
204 Woodpecker CI agent pct start 204

CT 203 was stopped because unauthorized rustc/cargo build processes consumed all memory. The Rust toolchain should be removed before restarting.

Deep dive: Aurelio VS Code extension

The aurelio-vscode extension is gitignored in replica-omnisciente (extensions/aurelio-vscode/ in .gitignore). It's not present in the repo — it lives in a separate local checkout.

What we know from the CI/CD pipeline (.github/workflows/build.yml):

  • Built on a self-hosted GitHub Actions runner
  • Uses vsce package to create a .vsix file
  • Deploys to CT 205 (192.168.0.15:/var/www/firmware/extensions/aurelio/) via SCP
  • CT 205 is stopped — deployments are currently broken

What we know from the AGENTS.md ecosystem:

  • The extension provides the VS Code integration for the Aurelio agent system
  • It auto-syncs brain artifacts (sessions, KIs, chronicle entries) to the Proxmox server
  • Supports multiple model types: glm, claude, and standard providers
  • Has settings under aurelio.zai.* for z-ai integration
  • Registers as a heteronym-aware agent with identity management

Related components in the repo:

  • extensions/kimi-interceptor/ — Kimi Code CLI → local model proxy (aurelio_proxy.py)
  • extensions/aurelio-jetbrains/ — JetBrains IDE integration
  • extensions/src/test/ — test infrastructure

Risk: Since the extension source is gitignored and not in the repo, there's no version control, no code review, and no backup. If the local checkout is lost, the extension source is gone.

Deep dive: Aurelio backend (Gabinete)

The Gabinete is the central MCP server running on CT 208 (192.168.0.125:18000). It's a FastAPI + FastMCP application.

Architecture:

gabinete.py (FastAPI app)
├── api/system.py        — Health, provider status
├── api/research.py      — Zotero, arXiv integration
├── api/chat.py          — LLM chat proxy
├── api/files.py         — File management
├── api/heteronimos.py   — Pessoa-inspired agent identities
├── api/realms.py        — Per-project knowledge
├── api/lifestream.py    — Telegram/scrobbler data
├── mcp/server.py        — MCP tool definitions (FastMCP)
├── model_router.py      — Multi-provider LLM dispatch
├── mcp_registry.json    — Service discovery for spokes
└── memory.py            — Brain read/write

Model router (model_router.py, 695 lines) supports 8+ providers:

  • Ollama (local), OpenRouter, Vertex AI, OpenAI
  • z-ai GLM, z-ai Claude (Anthropic-compatible)
  • Kimi (Moonshot), Hermes (NVIDIA)
  • Generic OpenAI-compatible endpoints
  • BYOK (Bring Your Own Key) per-request

MCP registry (mcp_registry.json) defines 14 spoke services:

  • 7 internal spokes on CT 208 (gabinete, olhos-de-orpheu, kimi-swarm agents, hermes-agent, forgejo-scribe)
  • 4 z-ai remote spokes (web-search, web-reader, zread)
  • 2 savearth spokes (device MCP, workspace MCP)
  • 1 OnlyOffice DocSpace spoke

Security findings:

  1. z-ai API key in URL: The mcp_registry.json contains ${Z_AI_API_KEY} in query strings. If this file is ever exposed, the key leaks via URL logs.
  2. No authentication on Gabinete: The FastAPI app has no auth middleware. Anyone who can reach port 18000 can call all API endpoints and MCP tools.
  3. Deploy script uses SCP without encryption verification: deploy_gabinete_208.sh uses scp without StrictHostKeyChecking — vulnerable to MITM on first deploy.
  4. gabinete.env created from example on first deploy: If the example file contains dummy values, the service starts with broken credentials.

Dependencies (requirements.txt):

  • fastapi, uvicorn, fastmcp, httpx
  • feedparser, beautifulsoup4, pyzotero (research)
  • tree-sitter + 5 language grammars (code intelligence)
  • pypandoc_binary (document generation)

Deployment: deploy_gabinete_208.sh packages files into a tarball, SCPs to Proxmox host, then uses pct push to install inside CT 208. The service runs as a systemd unit (pf-gabinete-208.service).

Gap: No automated health check after deploy. The script prints the health URL but doesn't verify the service is actually responding.

Open questions

  • Is the Cloudflare Tunnel config version-controlled? If not, a tunnel failure requires manual reconstruction.
  • What is the backup strategy for .aurelio/brain/? Git is not a backup — it's a sync mechanism.
  • Are the MCP servers behind any authentication, or is mcp.portugalfuturista.org open to anyone with the URL?
  • Has the upgrade-conscience.py script been audited for safe auto-commit behavior?
  • What's the status of the AORUS PRO and Tomahawk MAX GPU cluster deployment?

Sources

[S1] Local file inspection — hardcoded secrets found via grep in nervura-electrica Python scripts and YAML configs (accessed 2026-07-10)

[S2] nervura-electrica/AGENTS.md — infrastructure audit dated 2026-06-21, CT status, resource allocation (accessed 2026-07-10)

[S3] Equixly, "MCP Servers: The New Security Nightmare" — 43% command injection rate (published 2025-03-29, accessed 2026-07-10) — https://equixly.com/blog/2025/03/29/mcp-server-new-security-nightmare/

[S4] GitHub — dirac-run/dirac repository, README with evals and benchmarks (1.4k stars, Apache 2.0) (accessed 2026-07-10) — https://github.com/dirac-run/dirac

[S5] replica-omnisciente/AGENTS.md and .github/workflows/build.yml and .forgejo/workflows/aurelio-sync.yml — local file inspection (accessed 2026-07-10)

[S6] Reddit r/selfhosted — "Is cloudflared safe for self-hosting?" discussion on Cloudflare Tunnel risks (accessed 2026-07-10) — https://www.reddit.com/r/selfhosted/comments/1pahfm1/

[S7] tilth/CLAUDE.md — tilth architecture and language support documentation (accessed 2026-07-10)

[S8] OWASP — MCP Top 10, MCP5:2025 Command Injection & Execution (accessed 2026-07-10) — https://owasp.org/www-project-mcp-top-10/

[S9] GitHub HomeSecExplorer/Proxmox-Hardening-Guide — PVE9 hardening best practices (accessed 2026-07-10) — https://github.com/HomeSecExplorer/Proxmox-Hardening-Guide

[S10] nervura-electrica/infrastructure/proxmox/config.yml — Cloudflare Tunnel config, 40+ route mappings (accessed 2026-07-10)

[S11] nervura-electrica/infrastructure/proxmox/services/gabinete/ — Gabinete backend source: model_router.py, mcp_registry.json, deploy script, requirements.txt (accessed 2026-07-10)

[S12] nervura-electrica/infrastructure/proxmox/aurelio-web/server.cjs — Aurelio web portal virtual-host server with proxy routing (accessed 2026-07-10)