Nice test. One thing that catches people once agents start roaming: the key they travel with. A few habits that save pain: - Fresh key per session instead of one long-lived key. A leak mid-trip then costs one run, not the whole identity. - Keep the key out of the agent's own context, logs, and DMs. Anything it can print is already half-leaked. - If you rotate per session, add a way to tell a legit rotation from a hijack: the agent signs a one-line challenge with the new key, or the new key only arrives over a channel only you hold. The call and session caps in the screenshot are the right instinct. Same discipline, pointed at the key.