identity-canon/AGENTS.md

# identity-canon — Agent Instructions

## Repo Identity

**Purpose:** Orthogonal vocabulary and canonical model for identity-related concepts.

**Domain:** canon
**Repo slug:** identity-canon
**Topic ID:** `fe2aaa78-9c20-4feb-b3d2-4fe0529572a3`
**Workplan prefix:** `IDENTITY-WP-`

---

## State Hub Integration

The Custodian State Hub tracks work across all domains. Interact via HTTP REST —
there is no MCP server for Codex agents.

| Context | URL |
|---------|-----|
| Local workstation | `http://127.0.0.1:8000` |
| Remote via tunnel | `http://127.0.0.1:18000` |

### Orient at session start

```bash
# Offline brief — works without hub connection
cat .custodian-brief.md

# Active workstreams for this domain
curl -s "http://127.0.0.1:8000/workstreams/?topic_id=fe2aaa78-9c20-4feb-b3d2-4fe0529572a3&status=active" \
  | python3 -m json.tool

# Check inbox
curl -s "http://127.0.0.1:8000/messages/?to_agent=identity-canon&unread_only=true" \
  | python3 -m json.tool
```

Mark a message read:
```bash
curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
  -H "Content-Type: application/json" -d '{}'
```

### Log progress (required at session close)

```bash
curl -s -X POST http://127.0.0.1:8000/progress/ \
  -H "Content-Type: application/json" \
  -d '{
    "summary": "what was done",
    "event_type": "note",
    "author": "codex",
    "workstream_id": "<uuid>",
    "task_id": "<uuid>"
  }'
```

Omit `workstream_id` / `task_id` when not applicable.

### Update task status

```bash
curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"status": "progress"}'
# values: wait | todo | progress | done | cancel
```

### Flag a task for human review

```bash
curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"needs_human": true, "intervention_note": "reason"}'
```

---

## Session Protocol

**Start:**
1. `cat .custodian-brief.md` — domain goal and open workstreams (offline-safe)
2. Check inbox: `GET /messages/?to_agent=identity-canon&unread_only=true`; mark read
3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks
4. Check human-needed tasks: `GET /tasks/?needs_human=true`

**During work:**
- Update task statuses in workplan files as tasks progress
- Record significant decisions via `POST /decisions/`

**Close:**
1. Update workplan file task statuses to reflect progress
2. Log: `POST /progress/` with a summary of what changed
3. Note for the custodian operator: after workplan file changes, run from
   `~/state-hub`:
   ```bash
   make fix-consistency REPO=identity-canon
   ```
   This syncs task status from files into the hub DB.

---

## Workplan Convention (ADR-001)

Work items originate as files in this repo — not in the hub. The hub is a
read/cache/index layer that rebuilds from files.

**File location:** `workplans/IDENTITY-WP-NNNN-<slug>.md`

**Archived location:** finished workplans may move to
`workplans/archived/YYMMDD-IDENTITY-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is
the completion/archive date; the frontmatter `id` does not change.

**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use
`workplans/ADHOC-YYYY-MM-DD.md` with task ids `ADHOC-YYYY-MM-DD-T01`, etc. Use
this only for low-risk work completed directly; create a normal workplan for
anything needing analysis, design, approval, dependencies, or multiple phases.

**Frontmatter:**

```yaml
---
id: IDENTITY-WP-NNNN
type: workplan
title: "..."
domain: canon
repo: identity-canon
status: proposed | ready | active | blocked | backlog | finished | archived
owner: codex
topic_slug: ...
created: "YYYY-MM-DD"
updated: "YYYY-MM-DD"
state_hub_workstream_id: "<uuid>"   # written by fix-consistency — do not edit
---
```

Use `proposed` for a new draft, `ready` after review against current repo
state, and `finished` after implementation. `stalled` and `needs_review` are
derived health labels, not frontmatter statuses.

**Task block format** (one per `##` section):

```
## Task Title

` ` `task
id: IDENTITY-WP-NNNN-T01
status: wait | todo | progress | done | cancel
priority: high | medium | low
state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
` ` `

Task description text.
```

Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blocked work and `cancel` for stopped work.

To create a new workplan:
1. Write the file following the format above
2. Notify the custodian operator to run `make fix-consistency REPO=identity-canon`
   (or send a message to the hub agent via `POST /messages/`)

---

## Local Developer Workflow

This repository is currently documentation-only. There is no package manifest,
runtime application, build system, executable test suite, or formatter/linter
configuration checked in.

### Install

No install step is required for normal repository work.

### Build

No build step exists. Treat Markdown and workplan edits as source artifacts.

### Test / lint

There is no project test runner or markdown linter configured yet. Use these
checks before closing a change:

```bash
# Confirm the repository file inventory still looks intentional
rg --files

# Catch whitespace errors in tracked and staged diffs
git diff --check
```

When workplan files change, sync ADR-001 file state into State Hub:

```bash
curl -s -X POST "http://127.0.0.1:8000/repos/identity-canon/sync?fix=true" \
  | python3 -m json.tool
```

If the HTTP sync endpoint is unavailable, run the consistency script from the
State Hub checkout:

```bash
cd ~/state-hub
.venv/bin/python scripts/consistency_check.py --repo identity-canon --fix
.venv/bin/python scripts/consistency_check.py --repo identity-canon
```

The generated instruction in older workplans says `make fix-consistency
REPO=identity-canon`; that is still valid when `uv` is installed and on PATH.
On this workstation, the `.venv/bin/python` fallback has been verified.

### Run

There is no local service to run from this repository.

### Documentation Review Checklist

- Keep `INTENT.md`, `SCOPE.md`, and `ResearchProposal.md` aligned on the
  repository's research-only boundary.
- Keep source-backed observations in `research/` and canonical candidate terms
  in `terminology/`, `canon/`, `model/`, and `scenarios/`.
- Mark draft concepts as candidate or draft until source notes contain real
  references and extracted terminology.
- Record implementation ideas in `DownstreamRecommendations.md`, not as code in
  this repository.