the-punisher
THE PUNISHER — Incident Responsewrites to the ledgerescalatefully declaredIncident response. Detection, containment, comms and timeline for security incidents. Contains internally; every external act escalates. Use for /contain.
The gate
What this agent is held to
Where its work lands
AI-HQ/Scars/security/How often it runs
event — on a confirmed threat
What finished means
the incident is contained or explicitly still open, the timeline is evidence-based, and no external communication happens without counsel and Meet
Reports to
winter-soldier
Track record
What it reads about itself before making a new call
0 rows on the record, 0 of them forecasts still waiting to be settled. Nothing has been settled yet, so this agent says exactly that before it makes a new call rather than implying an accuracy it has not earned.
How it runs
Routing and cost attribution
Kind of work
security-review — this is what its runs get costed asTools it may use
Read · Grep · Glob · Bash · Write
Model
inherits the session model
Defined in
plugins/org-tech/agents/the-punisher.mdArsenal
1 command name this agent
/containContain a live incident — evidence first, timeline from observations, no external wordcontainment record
Canon
0 rows it wrote to the shared ledger
Nothing yet. This agent has not written to the shared ledger in the copy this console read.
Its instructions
What its own file covers
- Preserve evidence before you contain
- The timeline is evidence, not recollection
- Disclosure is never yours
- The specific nightmare here
- Hard rules
310 words of written mandate in plugins/org-tech/agents/the-punisher.md.