From d949f3e93ef36408fb577eab66a1f6d7d57113b7 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 18 May 2026 16:55:47 +0200 Subject: [PATCH] Refresh agent instruction files --- .claude/rules/agents.md | 20 ++++ .claude/rules/architecture.md | 36 +----- .claude/rules/first-session.md | 38 +++++++ .claude/rules/repo-boundary.md | 10 +- .claude/rules/repo-identity.md | 6 +- .claude/rules/session-protocol.md | 86 ++++++++++---- .claude/rules/stack-and-commands.md | 43 ++----- .claude/rules/workplan-convention.md | 30 ++++- AGENTS.md | 162 +++++++++++++++++++++++++++ CLAUDE.md | 3 + 10 files changed, 334 insertions(+), 100 deletions(-) create mode 100644 .claude/rules/agents.md create mode 100644 .claude/rules/first-session.md create mode 100644 AGENTS.md diff --git a/.claude/rules/agents.md b/.claude/rules/agents.md new file mode 100644 index 0000000..0e8a5d9 --- /dev/null +++ b/.claude/rules/agents.md @@ -0,0 +1,20 @@ +## Kaizen Agents + +Specialized agent personas available on demand via the state-hub MCP. + +**Discover:** `list_kaizen_agents()` — returns all agents with name, description, category +**Load:** `get_kaizen_agent("tdd-workflow")` — returns full instructions; read and follow them + +Common agents: + +| Agent | Category | When to use | +|-------|----------|-------------| +| `tdd-workflow` | testing | Step-by-step TDD8 workflow for any feature | +| `code-refactoring` | quality | Code quality analysis and safe refactoring | +| `test-maintenance` | testing | Diagnose and fix failing tests | +| `requirements-engineering` | process | Prevent interface/mock mismatches upfront | +| `keepaTodofile` | process | Maintain TODO.md during work | +| `project-management` | process | Track status, determine next steps | +| `datamodel-optimization` | quality | Optimize dataclasses and data structures | + +All 17 agents: call `list_kaizen_agents()` for the full list. diff --git a/.claude/rules/architecture.md b/.claude/rules/architecture.md index 74f3cc4..7c2a645 100644 --- a/.claude/rules/architecture.md +++ b/.claude/rules/architecture.md @@ -1,38 +1,8 @@ ## Architecture -OpsBridge has two logical components: - -**1. OpsBridge — tunnel lifecycle manager** (this repo) -Manages named SSH reverse tunnels defined in `~/.config/bridge/tunnels.yaml`. -Each tunnel runs in a subprocess with a reconnect backoff loop; PIDs are tracked -in `~/.local/state/bridge/`. Bridge states: `stopped → starting → connected → -degraded → failed`. The `degraded` state means SSH is up but the optional HTTP -health check is failing. - -**2. OpsCatalog — operations knowledge repository** (planned extension) -A Git-backed YAML catalog of operations domains, targets, bridges, and actor -classes. OpsBridge consumes this catalog to resolve bridge identifiers and -orient operators. Schema examples are in `wiki/OpsCatalogSpecification.md`. -The catalog layout follows: `opscatalog/domains//{domain.yaml, -targets/, bridges/, docs/}`. - -Key design constraints: -- OpsBridge owns lifecycle management only; it does not own credential issuance or CA - operations (those belong to `ops-warden`) -- Each tunnel is identified by name (e.g. `state-hub-coulombcore`); names used - in config, CLI args, and log filenames must stay consistent -- Actor attribution is tracked per bridge using the three-actor vocabulary from the - AccessManagementDirective: `adm` (human), `agt` (LLM agent), `atm` (automation); - actor names must carry the matching prefix (`adm-*`, `agt-*`, `atm-*`) (FRS §5.7) -- Two credential modes are first-class and must remain independently functional: - 1. **Static key mode** (default) — `ssh_key` only; no TTL, no cert logic - 2. **cert_command mode** — a pluggable shell command that issues a CA-signed cert - before each SSH launch; TTL parsed from the cert; pre-emptive refresh ~5 min - before expiry; `cert_identity` logged in every `BRIDGE_CONNECTED` event - -Specification docs are in `wiki/`: PRD (`OpsBridgePrd.md`), FRS -(`OpsBridgeFrs.md`), and OpsCatalog spec (`OpsCatalogSpecification.md`). + ## Quick Reference -`~/the-custodian/state-hub/mcp_server/TOOLS.md` +`~/state-hub/mcp_server/TOOLS.md` — MCP tool reference diff --git a/.claude/rules/first-session.md b/.claude/rules/first-session.md new file mode 100644 index 0000000..a3ea385 --- /dev/null +++ b/.claude/rules/first-session.md @@ -0,0 +1,38 @@ +## First Session Protocol + +Triggered when `get_domain_summary("custodian")` shows **no workstreams**. +The project is registered but work has not yet been structured. + +**Step 1 — Read, don't write** +- `~/the-custodian/canon/projects/custodian/project_charter_v0.1.md` — purpose, scope +- `~/the-custodian/canon/projects/custodian/roadmap_v0.1.md` — planned phases +- Scan repo root: README, directory structure, existing code or docs + +**Step 2 — Survey in-progress work** +Look for TODOs, open branches, half-finished files. Note done vs. started but incomplete. + +**Step 3 — Propose workstreams to Bernd** +Propose 1–3 workstreams — each a coherent strand, weeks to months, anchored to a +roadmap phase. **Wait for approval before creating.** + +**Step 4 — Create workplan file first, then DB record (ADR-001)** +``` +workplans/ops-bridge-WP-NNNN-.md ← write this first +``` +Then register in the hub: +``` +create_workstream(topic_id="cee7bedf-2b48-46ef-8601-006474f2ad7a", title="...", owner="...", description="...") +create_task(workstream_id="", title="...", priority="high|medium|low") +``` + +**Step 5 — Record the setup** +``` +add_progress_event( + summary="First session: structured custodian into N workstreams, M tasks", + event_type="milestone", + topic_id="cee7bedf-2b48-46ef-8601-006474f2ad7a", + detail={"workstreams": [...], "tasks_created": M} +) +``` + + diff --git a/.claude/rules/repo-boundary.md b/.claude/rules/repo-boundary.md index 85cfd71..fd93caa 100644 --- a/.claude/rules/repo-boundary.md +++ b/.claude/rules/repo-boundary.md @@ -1,6 +1,8 @@ ## Repo boundary -This repo owns **tunnel lifecycle management only**. It does not own: -- State hub code → `the-custodian/state-hub/` -- SSH key management → `railiance-infra/` (S1) or user dotfiles -- Ansible/provisioning → `railiance-infra/` +This repo owns **ops-bridge** only. It does not own: + + diff --git a/.claude/rules/repo-identity.md b/.claude/rules/repo-identity.md index 2a0576d..48b7e04 100644 --- a/.claude/rules/repo-identity.md +++ b/.claude/rules/repo-identity.md @@ -1,7 +1,5 @@ -**Purpose:** SSH reverse tunnel lifecycle manager. Keeps remote execution -environments (COULOMBCORE, Railiance nodes) connected to the local Custodian -State Hub so Claude Code sessions on those machines have full MCP connectivity. +**Purpose:** SSH reverse tunnel lifecycle manager. Keeps remote execution environments (COULOMBCORE, Railiance nodes) connected to the local state hub. Small CLI tool: bridge up/down/status/logs per named tunnel config. **Domain:** custodian **Repo slug:** ops-bridge -**Repo ID:** 1bf99f56-6e94-4379-a9ea-295a4c181889 +**Topic ID:** cee7bedf-2b48-46ef-8601-006474f2ad7a diff --git a/.claude/rules/session-protocol.md b/.claude/rules/session-protocol.md index f17a011..0b02e53 100644 --- a/.claude/rules/session-protocol.md +++ b/.claude/rules/session-protocol.md @@ -1,38 +1,84 @@ -## Custodian State Hub Integration +## Session Protocol State Hub: http://127.0.0.1:8000 -### Session Protocol - -**Step 0 — Tunnel health** - -Before anything else: -```bash -bridge status -``` -Bring up any stopped or stale tunnels before accessing remote services. - **Step 1 — Orient** -Read the offline-safe brief first: +Read the offline-safe brief first — it works without a live hub connection: ```bash cat .custodian-brief.md ``` -Then call the MCP tool for richer context (skip if unreachable): +Then call the MCP tool for richer cross-domain context when MCP tools are exposed: ``` get_domain_summary("custodian") ``` - -**Step 2 — Scan workplans** +If MCP tools are unavailable in the current agent session, use the REST API: +```bash +curl -s "http://127.0.0.1:8000/state/summary" | python3 -m json.tool ``` +If the hub is offline: `cd ~/state-hub && make api` + +**Step 2 — Check inbox** +With MCP tools: +``` +get_messages(to_agent="ops-bridge", unread_only=True) +``` +Mark read with `mark_message_read(message_id)`. Reply or act on coordination +requests before proceeding. + +Without MCP tools: +```bash +curl -s "http://127.0.0.1:8000/messages/?to_agent=ops-bridge&unread_only=true" \ + | python3 -m json.tool +curl -s -X PATCH "http://127.0.0.1:8000/messages//read" \ + -H "Content-Type: application/json" -d '{}' +``` + +**Step 3 — Scan workplans** +```bash ls workplans/ ``` +For each file with `status: ready`, `active`, or `blocked`, note pending +`todo`/`in_progress` tasks. -**During work:** use `record_decision()`, `add_progress_event()`, `resolve_decision()`. +**Step 4 — Present brief** -**Session close:** `add_progress_event()` with workstream_id. +1. **Active workstreams** for `custodian` — title, task counts, blocking decisions +2. **Pending tasks** from `workplans/` + any `[repo:ops-bridge]` hub tasks +3. **Goal guidance** — if `goal_guidance` in summary: + - `needs_workplan`: surface as top action — *"Repo goal '{title}' has no workplan yet"* + - `alignment_warnings`: flag if active work is not aligned with current goal +4. **Suggested next action** — highest-priority open item +5. **SBOM status** — flag if `last_sbom_at` is unset for this repo -If workplan files were modified, run from `~/the-custodian/state-hub/`: -```bash -make fix-consistency REPO=ops-bridge +If no workstreams: follow First Session Protocol (`first-session.md`). + +**During work:** `record_decision()` · `add_progress_event()` · `resolve_decision()` + +> State Hub is a *read model*. Bootstrap tools (`create_workstream`, `create_task`) +> are First Session Protocol only. Work structure belongs in repo files (ADR-001). + +**Session close:** +With MCP tools: ``` +add_progress_event(summary="...", topic_id="cee7bedf-2b48-46ef-8601-006474f2ad7a", workstream_id="") +``` +Without MCP tools: +```bash +curl -s -X POST http://127.0.0.1:8000/progress/ \ + -H "Content-Type: application/json" \ + -d '{"topic_id":"cee7bedf-2b48-46ef-8601-006474f2ad7a","workstream_id":"","event_type":"note","summary":"what changed","author":"codex"}' +``` +If workplan files were modified, ensure the local copy is up to date first: +```bash +git -C pull --ff-only +cd ~/state-hub && make fix-consistency REPO=ops-bridge +``` +For repos where implementation runs on a remote machine (e.g. CoulombCore), +use the combined target which pulls before fixing: +```bash +cd ~/state-hub && make fix-consistency-remote REPO=ops-bridge +``` +**C-15** (DB task ahead of file) is normal in multi-machine workflows — writeback +will sync the file to match DB. **C-16** (repo behind remote) blocks all writes +until you pull — intentional to prevent clobbering remote progress. diff --git a/.claude/rules/stack-and-commands.md b/.claude/rules/stack-and-commands.md index db04aa8..dc53ac6 100644 --- a/.claude/rules/stack-and-commands.md +++ b/.claude/rules/stack-and-commands.md @@ -1,46 +1,19 @@ -## What this repo builds - -A CLI tool (`bridge`) that manages named SSH reverse tunnels: - -``` -bridge up [TUNNEL] # start tunnel(s) -bridge down [TUNNEL] # stop tunnel(s) -bridge restart [TUNNEL] # restart tunnel(s) -bridge status # show all tunnels: state, uptime, last health check -bridge logs [TUNNEL] # tail reconnect log -``` - -Config file: `~/.config/bridge/tunnels.yaml` - -Each tunnel: -- Named (e.g. `state-hub-coulombcore`) -- Reverse SSH port-forward: `ssh -R remote_port:127.0.0.1:local_port host` -- Auto-reconnects on drop (backoff loop) -- Optional HTTP health check to confirm the forwarded service is reachable - -PRD: `workplans/BRIDGE-WP-0001-initial-implementation.md` - ## Stack -- **Language:** Python 3.11+ -- **CLI framework:** Typer -- **Dependencies:** typer, pyyaml, httpx -- **Packaging:** `uv tool install` (single command install, no venv activation) -- **No system daemons** — process management is internal, PID tracked in - `~/.local/state/bridge/` + +- **Language:** +- **Key deps:** ## Dev Commands ```bash -# Install locally for development -uv tool install -e . +# TODO: Fill in the standard commands for this repo + +# Install dependencies # Run tests -uv run pytest -# Run a single test -uv run pytest tests/test_tunnel.py::test_name -v +# Lint / type check -# Lint -uv run ruff check . +# Build / package (if applicable) ``` diff --git a/.claude/rules/workplan-convention.md b/.claude/rules/workplan-convention.md index 67cd970..2d3e5f7 100644 --- a/.claude/rules/workplan-convention.md +++ b/.claude/rules/workplan-convention.md @@ -1,6 +1,28 @@ -### Workplan Convention (ADR-001) +## Workplan Convention (ADR-001) -File location: `workplans/BRIDGE-WP-NNNN-.md` -Prefix: `BRIDGE-WP` +File location: `workplans/ops-bridge-WP-NNNN-.md` +ID prefix: `OPS-WP` - +Work items originate as files in this repo **before** being registered in the hub. + +Canonical workplan/workstream frontmatter statuses are: +`proposed`, `ready`, `active`, `blocked`, `backlog`, `finished`, `archived`. +Use `proposed` for a newly drafted plan, `ready` after review against current +repo state, and `finished` when implementation is complete. `stalled` and +`needs_review` are derived health labels, not stored statuses. + +Closed workplans may be moved to `workplans/archived/` with a completion-date +prefix: `YYMMDD-ops-bridge-WP-NNNN-.md`. The frontmatter id remains +unchanged; the prefix is only for quick visual reference. + +Small opportunistic tasks discovered during another session use **Ad Hoc Tasks**: +`workplans/ADHOC-YYYY-MM-DD.md`, workstream slug `adhoc-YYYY-MM-DD`, and task ids +`ADHOC-YYYY-MM-DD-T01`, `T02`, etc. Use adhocs only for low-risk work completed +directly. Promote anything requiring analysis, design, approval, dependencies, or +multiple planned phases into a normal workplan. + +Ecosystem todos from other agents arrive as `[repo:ops-bridge]` hub tasks — +visible at session start. Pick one up by creating the workplan file, then registering +the workstream. + + diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..3676933 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,162 @@ +# ops-bridge — Agent Instructions + +## Repo Identity + +**Purpose:** SSH reverse tunnel lifecycle manager. Keeps remote execution environments (COULOMBCORE, Railiance nodes) connected to the local state hub. Small CLI tool: bridge up/down/status/logs per named tunnel config. + +**Domain:** custodian +**Repo slug:** ops-bridge +**Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a` +**Workplan prefix:** `OPS-WP-` + +--- + +## State Hub Integration + +The Custodian State Hub tracks work across all domains. Interact via HTTP REST — +there is no MCP server for Codex agents. + +| Context | URL | +|---------|-----| +| Local workstation | `http://127.0.0.1:8000` | +| Remote via tunnel | `http://127.0.0.1:18000` | + +### Orient at session start + +```bash +# Offline brief — works without hub connection +cat .custodian-brief.md + +# Active workstreams for this domain +curl -s "http://127.0.0.1:8000/workstreams/?topic_id=cee7bedf-2b48-46ef-8601-006474f2ad7a&status=active" \ + | python3 -m json.tool + +# Check inbox +curl -s "http://127.0.0.1:8000/messages/?to_agent=ops-bridge&unread_only=true" \ + | python3 -m json.tool +``` + +Mark a message read: +```bash +curl -s -X PATCH "http://127.0.0.1:8000/messages//read" \ + -H "Content-Type: application/json" -d '{}' +``` + +### Log progress (required at session close) + +```bash +curl -s -X POST http://127.0.0.1:8000/progress/ \ + -H "Content-Type: application/json" \ + -d '{ + "summary": "what was done", + "event_type": "note", + "author": "codex", + "workstream_id": "", + "task_id": "" + }' +``` + +Omit `workstream_id` / `task_id` when not applicable. + +### Update task status + +```bash +curl -s -X PATCH "http://127.0.0.1:8000/tasks/" \ + -H "Content-Type: application/json" \ + -d '{"status": "in_progress"}' +# values: todo | in_progress | done | blocked +``` + +### Flag a task for human review + +```bash +curl -s -X PATCH "http://127.0.0.1:8000/tasks/" \ + -H "Content-Type: application/json" \ + -d '{"needs_human": true, "intervention_note": "reason"}' +``` + +--- + +## Session Protocol + +**Start:** +1. `cat .custodian-brief.md` — domain goal and open workstreams (offline-safe) +2. Check inbox: `GET /messages/?to_agent=ops-bridge&unread_only=true`; mark read +3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks +4. Check blocked tasks: `GET /tasks/?needs_human=true` + +**During work:** +- Update task statuses in workplan files as tasks progress +- Record significant decisions via `POST /decisions/` + +**Close:** +1. Update workplan file task statuses to reflect progress +2. Log: `POST /progress/` with a summary of what changed +3. Note for the custodian operator: after workplan file changes, run from + `~/state-hub`: + ```bash + make fix-consistency REPO=ops-bridge + ``` + This syncs task status from files into the hub DB. + +--- + +## Workplan Convention (ADR-001) + +Work items originate as files in this repo — not in the hub. The hub is a +read/cache/index layer that rebuilds from files. + +**File location:** `workplans/OPS-WP-NNNN-.md` + +**Archived location:** finished workplans may move to +`workplans/archived/YYMMDD-OPS-WP-NNNN-.md`. The `YYMMDD` prefix is +the completion/archive date; the frontmatter `id` does not change. + +**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use +`workplans/ADHOC-YYYY-MM-DD.md` with task ids `ADHOC-YYYY-MM-DD-T01`, etc. Use +this only for low-risk work completed directly; create a normal workplan for +anything needing analysis, design, approval, dependencies, or multiple phases. + +**Frontmatter:** + +```yaml +--- +id: OPS-WP-NNNN +type: workplan +title: "..." +domain: custodian +repo: ops-bridge +status: proposed | ready | active | blocked | backlog | finished | archived +owner: codex +topic_slug: ... +created: "YYYY-MM-DD" +updated: "YYYY-MM-DD" +state_hub_workstream_id: "" # written by fix-consistency — do not edit +--- +``` + +Use `proposed` for a new draft, `ready` after review against current repo +state, and `finished` after implementation. `stalled` and `needs_review` are +derived health labels, not frontmatter statuses. + +**Task block format** (one per `##` section): + +``` +## Task Title + +` ` `task +id: OPS-WP-NNNN-T01 +status: todo | in_progress | done | blocked +priority: high | medium | low +state_hub_task_id: "" # written by fix-consistency — do not edit +` ` ` + +Task description text. +``` + +Status progression: `todo` → `in_progress` → `done` (or `blocked`) + +To create a new workplan: +1. Write the file following the format above +2. Notify the custodian operator to run `make fix-consistency REPO=ops-bridge` + (or send a message to the hub agent via `POST /messages/`) diff --git a/CLAUDE.md b/CLAUDE.md index 4cc7212..8b1d58b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,8 +1,11 @@ # ops-bridge — Claude Code Instructions +@SCOPE.md @.claude/rules/repo-identity.md @.claude/rules/session-protocol.md +@.claude/rules/first-session.md @.claude/rules/workplan-convention.md @.claude/rules/stack-and-commands.md @.claude/rules/architecture.md @.claude/rules/repo-boundary.md +@.claude/rules/agents.md