It looks like HarmChOM ought to be doable with INCEPTION - if tweaked to be more Aegis-aware. For example, CAP::sys_admin can be requested in order to be able to mount things, and CAP::sys_chroot in order to chroot. For "traditional" root access, UID::root, GID::root, and CAP::* can be obtained.

The trick of using SSH as root in order to obtain a shell probably needs to go - replacing those files will cause a MALF and it isn't really necessary.