The things asura would actually flag:
1. Shell-exec as the primary interface. request_command / run_script / exec_container are the "dispatching to shell" pattern verbatim. The relay isn't a protocol — it's ssh $host $cmd with a web approval form. Every new capability means another shell incantation, not a typed contract.
2. The relay is a god-mode middlebox. One container (CTID 131) holds SSH keys to every other container + Trello tokens + Forgejo tokens. Compromise the relay, own the homelab. Real agent-to-agent would have each container run its own small agent with scoped creds, not a central shell-exec proxy.
3. http_request with token substitution re-implements auth that Trello already has. Trello's API has scopes and rate limits. You're wrapping it in a second auth layer (relay approval) that duplicates work and adds attack surface. The "right" version: Claude talks to a Trello-side agent that already has its own scoped creds, no token plumbing through a middlebox.
**4. The wik