core-hub/AGENTS.md

# Core Hub - Agent Instructions

## Repo Identity

**Purpose:** 3rd-generation production interaction framework for Coulomb / Helixforge. Reimagines and replaces the 2nd-generation Inter-Hub framework goals on a practical contract-first Python/FastAPI/Postgres platform.

**Domain:** infotech
**Repo slug:** core-hub
**Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a`
**Workplan prefix:** `CORE-WP-`

---

## State Hub Integration

The Custodian State Hub tracks work across all domains. Interact via HTTP REST - there is no MCP server for Codex agents.

| Context | URL |
|---------|-----|
| Local workstation | `http://127.0.0.1:8000` |
| Remote via tunnel | `http://127.0.0.1:18000` |

### Orient at session start

```bash
cat .custodian-brief.md
curl -s "http://127.0.0.1:8000/workstreams/?topic_id=cee7bedf-2b48-46ef-8601-006474f2ad7a&status=active" | python3 -m json.tool
curl -s "http://127.0.0.1:8000/messages/?to_agent=core-hub&unread_only=true" | python3 -m json.tool
```

Mark a message read:

```bash
curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
  -H "Content-Type: application/json" -d '{}'
```

### Log progress at session close

```bash
curl -s -X POST http://127.0.0.1:8000/progress/ \
  -H "Content-Type: application/json" \
  -d '{
    "summary": "what was done",
    "event_type": "note",
    "author": "codex",
    "workstream_id": "<uuid>",
    "task_id": "<uuid>"
  }'
```

Omit `workstream_id` / `task_id` when not applicable.

### Update task status

```bash
curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"status": "progress"}'
```

Status values: `wait | todo | progress | done | cancel`.

---

## Session Protocol

**Start:**
1. `cat .custodian-brief.md` - domain goal and open workstreams.
2. Check inbox: `GET /messages/?to_agent=core-hub&unread_only=true`; mark read when acted on.
3. Scan workplans: `ls workplans/` and inspect `ready`, `active`, or `blocked` files.
4. Check human-needed tasks: `GET /tasks/?needs_human=true` when the work may touch operational gates.

**During work:**
- Update workplan files first; State Hub is the read/cache/index layer.
- Record significant decisions via `POST /decisions/` when available.
- Keep secrets out of Git, State Hub, workplans, logs, and chat.

**Close:**
1. Update workplan statuses.
2. From `~/state-hub`, run `make fix-consistency REPO=core-hub` after workplan changes.
3. Log progress with `POST /progress/`.

---

## Credential and Access Routing

Before requesting secrets, API keys, SSH access, login tokens, or database passwords, route the need through ops-warden/OpenBao/key-cape ownership.

```bash
warden route find "<describe your need>" --json
warden route show <catalog-id> --json
```

ops-warden issues SSH certificates only. API keys, DB passwords, provider tokens, login/OIDC/MFA, authorization decisions, and OpenBao leases belong to their owning subsystems. Do not paste secrets into Git, State Hub, workplans, logs, or chat.

---

## Workplan Convention (ADR-001)

Work items originate as files in this repo, not in the hub. The hub rebuilds from files.

**File location:** `workplans/CORE-WP-NNNN-<slug>.md`

**Archived location:** finished workplans may move to `workplans/archived/YYMMDD-CORE-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is the completion/archive date; the frontmatter `id` does not change.

**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use `workplans/ADHOC-YYYY-MM-DD.md` with task ids `ADHOC-YYYY-MM-DD-T01`, etc. Use this only for low-risk work completed directly.

**Frontmatter:**

```yaml
---
id: CORE-WP-NNNN
type: workplan
title: "..."
domain: infotech
repo: core-hub
status: proposed | ready | active | blocked | backlog | finished | archived
owner: codex
topic_slug: custodian
created: "YYYY-MM-DD"
updated: "YYYY-MM-DD"
state_hub_workstream_id: "<uuid>"   # written by fix-consistency - do not edit
---
```

Task block format:

````markdown
## Task Title

```task
id: CORE-WP-NNNN-T01
status: wait | todo | progress | done | cancel
priority: high | medium | low
state_hub_task_id: "<uuid>"         # written by fix-consistency - do not edit
```

Task description text.
````

Status progression: `todo` -> `progress` -> `done`; use `wait` for waiting/blocked work and `cancel` for stopped work.