feat: Phase 1 FDA host-operator Role and railiance01 pilot (WP-0009 T02–T07)
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
ci / test (push) Failing after 9s

Lock DEC-FDA-001 working defaults; add roles/host-operator package with
OS/security and load protocols; scaffold eng-coulomb-railiance01-ho-001
with bound agent, vault, ramp checklists, and Kai quote/ledger.
This commit is contained in:
tegwick 2026-07-16 10:47:52 +02:00
parent ca7e4ead77
commit 2d347d062f
31 changed files with 1171 additions and 58 deletions

10
engagements/README.md Normal file
View file

@ -0,0 +1,10 @@
# Engagements
File-based **forward-deployed agency** engagements (KAIZEN-WP-0009, DEC-FDA-001).
| Path | Purpose |
|------|---------|
| `pilots/` | Supplier-repo Phase 1 pilot trees (scaffolding; operational knowledge still treated as client-confidential) |
| (future) client repos | Production vaults under client custody |
See [docs/forward-deployed-engagement-architecture.md](../docs/forward-deployed-engagement-architecture.md).

View file

@ -0,0 +1,51 @@
apiVersion: kaizen.agentic/v1
kind: Engagement
metadata:
id: eng-coulomb-railiance01-ho-001
request_id: engreq-coulomb-railiance01-ho-001
created: "2026-07-16"
updated: "2026-07-16"
workplan: KAIZEN-WP-0009
status:
phase: staffing
# requested | quoting | funded | staffing | ramp_up | operating
# renewing | ramp_down | closed | cancelled
notes: "Phase 1 scaffold complete; pending access verify to enter ramp_up"
spec:
client:
id: coulomb
billing_account: coulomb-ops-kai
role:
id: host-operator
version: "0.1.0"
targets:
- kind: host
id: railiance01
agent_definition:
path: agent-host-operator.md
derived_from: roles/host-operator/agent-definition.md
base_craft: agents/agent-sys-medic.md
vault:
root: vault/
memory: vault/memory.md
schedule:
path: schedule.yml
checklists:
ramp_up: checklists/ramp-up-status.md
ramp_down: checklists/ramp-down-status.md
policy:
confidentiality: client_owned
contribute_metrics: false
contribute_lesson: false
human_approval_for:
- privileged_ops
- package_upgrade
- firewall_change
- reboot
redaction_profile: default-host-ops
commercial:
currency: kai
seat_product: expert_seat_4x
capability_tier: 4
ledger_ref: commercial/ledger.jsonl
quote_ref: commercial/quote.yaml

View file

@ -0,0 +1,33 @@
# Access plan — eng-coulomb-railiance01-ho-001
**Target:** host `railiance01`
**Classes requested:** `host_observe`, `privileged_ops` (gated)
**Secrets:** never stored in this tree
## Intended path
| Step | Action | Owner |
|------|--------|-------|
| 1 | Inventory / facts from `railiance-hosts` (read-only) | operator |
| 2 | SSH cert via ops-warden (`warden sign` / `cert_command`) identity hint `agt` | operator |
| 3 | Tunnel if needed (`ops-bridge`, e.g. state-hub-railiance01) | operator |
| 4 | Observe session: non-destructive health/load/os checks | host-operator agent |
| 5 | Privileged ops only after human approval recorded in vault | human + agent |
## Credential routing
- SSH certificates → **ops-warden**
- API keys / DB passwords → **OpenBao** via `warden route` (not this agent)
- Do **not** message ops-warden for secret values
## Verification log
| Date | Result | Notes |
|------|--------|-------|
| _pending_ | | RU-01 not yet complete |
## Revocation
| Date | Action |
|------|--------|
| _open_ | On ramp-down: stop renewing agent certs; set schedule disabled; mark here |

View file

@ -0,0 +1,105 @@
---
name: host-operator
engagement_id: eng-coulomb-railiance01-ho-001
role_id: host-operator
role_version: "0.1.0"
description: Host operator for railiance01 (coulomb pilot engagement)
category: infrastructure
memory: enabled
memory_path: engagements/pilots/eng-coulomb-railiance01-ho-001/vault/memory.md
targets:
- kind: host
id: railiance01
confidentiality: client_owned
phase: staffing
access_classes: [host_observe, privileged_ops]
human_approval_for: [privileged_ops, package_upgrade, firewall_change, reboot]
base_agent: sys-medic
model: inherit
---
# Session Start Protocol
1. Confirm engagement `eng-coulomb-railiance01-ho-001` and target **railiance01** only.
2. Read vault memory at `memory_path` (client confidential — do not copy into supplier `agents/`).
3. Read `access-plan.md` and `ENGAGEMENT.yaml` phase.
4. If phase is `ramp_up`, follow `roles/host-operator/ramp-up.md` and update `checklists/ramp-up-status.md`.
5. If phase is `operating`, run the scheduled duty protocol(s).
6. If phase is `ramp_down`, follow `roles/host-operator/ramp-down.md`.
7. Acknowledge charter, open threads, and last session log line in your opening brief.
8. Never store secrets, private keys, or API tokens in the vault or reports.
# Session Close Protocol
1. Update Host Profiles, OS & Patch State, Security Posture, Load & Workload Envelope as needed.
2. Update Recurring Findings / Cleared Issues / Open Threads.
3. Append Session Log: `YYYY-MM-DD · railiance01 · <key finding> · <outcome>`.
4. Write report under `reports/` for completed duties.
5. Bump memory frontmatter `last_updated` and `session_count`.
6. Append Kai ledger entry in `commercial/ledger.jsonl` for the duty (billing metadata only).
---
You are **Host Operator** for engagement **eng-coulomb-railiance01-ho-001**.
## Engagement binding
| Field | Value |
|-------|-------|
| Client | coulomb |
| Target | host `railiance01` (k3s production; forgejo/apps) |
| Role | host-operator 0.1.0 (tier 4) |
| Base craft | SysMedic (`agents/agent-sys-medic.md`) |
| Vault | `vault/` (client confidential) |
| Inventory anchor | `railiance-hosts` |
## Charter (pilot)
**In scope**
- OS package currency and reboot planning (with approval)
- Security hygiene: listeners, basic firewall posture, cert expiry awareness
- Load average, CPU, memory, disk; workload identification
- k3s node health signals (sys-medic protocol)
- Documentation in the engagement vault
- Recommendations and gated remediation proposals
**Out of scope**
- Application feature development
- Unilateral production data deletion
- Hosts other than railiance01
- Secret value retrieval into chat or git
- Expanding blast radius without engagement amendment
## Protocols
| Duty | Protocol path |
|------|----------------|
| Health assessment | `agents/protocols/sys-medic/k3s-node-health-assessment.md` |
| Load & workload | `roles/host-operator/protocols/load-workload-review.md` |
| OS & security | `roles/host-operator/protocols/os-security-pass.md` |
## Privilege gate
Before any of `privileged_ops`, `package_upgrade`, `firewall_change`, `reboot`:
1. Write an Action Proposal (blast radius, rollback, evidence)
2. Obtain human approval recorded in vault session log
3. Execute only within the approved scope
4. Record outcome under Cleared Issues or Findings
## Output quality
Use SysMedic report structure for assessments (Executive Summary, Health Status,
Findings, Safe Actions, Escalation, Suggested Commands). Prefer inspect commands
first; label change commands as optional and approval-gated.
## Full Role prompt
Operational principles and safety rules inherit from:
- `roles/host-operator/agent-definition.md`
- `agents/agent-sys-medic.md`
When instructions conflict, **engagement binding and safety gates win**.

View file

@ -0,0 +1,15 @@
# Ramp-down status — eng-coulomb-railiance01-ho-001
Source checklist: `roles/host-operator/ramp-down.md`
| ID | Criterion | Status | Evidence |
|----|-----------|--------|----------|
| RD-01 | Open threads triaged | todo | vault/memory.md Open Threads |
| RD-02 | Handoff pack written | todo | vault/handoff/README.md |
| RD-03 | Outstanding risks listed | todo | vault/handoff/risks.md |
| RD-04 | Access revoked | todo | access-plan.md |
| RD-05 | Schedule disabled | todo | schedule.yml |
| RD-06 | Client vault custody confirmed | todo | ENGAGEMENT.yaml note |
| RD-07 | Supplier workspace scrubbed | todo | operator attestation |
**Phase gate:** all `done` → set status.phase to `closed`; finalise ledger.

View file

@ -0,0 +1,16 @@
# Ramp-up status — eng-coulomb-railiance01-ho-001
Source checklist: `roles/host-operator/ramp-up.md`
| ID | Criterion | Status | Evidence |
|----|-----------|--------|----------|
| RU-01 | Access path verified | todo | access-plan.md |
| RU-02 | Host baseline documented | todo | vault/baselines/railiance01.md |
| RU-03 | Coach / orientation brief filed | done | reports/orientation.md (scaffold) |
| RU-04 | First health review complete | todo | reports/*-health-review.md |
| RU-05 | Security snapshot initial | todo | vault/memory.md Security Posture |
| RU-06 | Load envelope initial | todo | vault/memory.md Load & Workload Envelope |
| RU-07 | Escalation contacts confirmed | done | vault/memory.md Engagement Charter |
| RU-08 | Human approval path tested | todo | vault/session-log/ or session log |
**Phase gate:** all `done` → set `ENGAGEMENT.yaml` status.phase to `operating` and enable schedule entries.

View file

@ -0,0 +1,33 @@
# Commercial — Kai trial ledger
- **Quote:** [quote.yaml](quote.yaml) — month-1 estimate (~72800 Kai)
- **Ledger:** [ledger.jsonl](ledger.jsonl) — append-only charges/credits
- **Schema:** architecture §10 (`KaiLedgerEntry`)
## Rules
- No secrets or full shell transcripts in ledger lines
- Seat/ramp charges when phase transitions are accepted
- Duty charges on session close
- Empty account pauses new duties (ramp-down still allowed)
## Example duty charge
```json
{
"apiVersion": "kaizen.agentic/v1",
"kind": "KaiLedgerEntry",
"id": "kai-YYYYMMDDTHHMMSSZ-001",
"account": "coulomb-ops-kai",
"engagement_id": "eng-coulomb-railiance01-ho-001",
"type": "duty_charge",
"product": "standard_review",
"capability_tier": 4,
"access_surcharge_product": "host_observe",
"amount_kai": 1700,
"currency": "KAI",
"session_ref": "reports/YYYY-MM-DD-health-review.md",
"created_at": "YYYY-MM-DDTHH:MM:SSZ",
"metadata": {"target": "railiance01", "phase": "operating"}
}
```

View file

@ -0,0 +1 @@
{"apiVersion":"kaizen.agentic/v1","kind":"KaiLedgerEntry","id":"kai-20260716-quote-open","account":"coulomb-ops-kai","engagement_id":"eng-coulomb-railiance01-ho-001","type":"note","product":"quote_snapshot","capability_tier":4,"amount_kai":0,"currency":"KAI","created_at":"2026-07-16T08:00:00Z","metadata":{"total_quoted_kai":72800,"phase":"staffing","note":"Month-1 estimate recorded; no charge until fund/ramp"}}

View file

@ -0,0 +1,35 @@
# Kai quote — eng-coulomb-railiance01-ho-001 (trial month-1 estimate)
# FX calibration only: 1000 Kai ≈ 1 EUR list (see business model)
apiVersion: kaizen.agentic/v1
kind: KaiQuote
metadata:
engagement_id: eng-coulomb-railiance01-ho-001
created: "2026-07-16"
currency: KAI
trial: true
spec:
capability_tier: 4
account: coulomb-ops-kai
line_items:
- product: expert_seat_4x
description: Host-operator seat (1 month)
amount_kai: 10000
- product: ramp_up_package
description: Ramp-up (half tier weight per business model)
amount_kai: 10000
- product: standard_review
description: Daily review × 20 business days × tier 4
amount_kai: 32000
detail: "20 * 400 * 4"
- product: deep_assessment
description: Weekly OS/security × 4 × tier 4
amount_kai: 19200
detail: "4 * 1200 * 4"
- product: privileged_ops_surcharge
description: Est. 4 privileged sessions × 400
amount_kai: 1600
total_kai: 72800
notes:
- Internal coulomb quarterly grant illustrative budget 200000 Kai
- Actual charges posted to ledger.jsonl as duties complete
- Token pass-through waived for pure internal pilot

View file

@ -0,0 +1,33 @@
# Orientation brief — eng-coulomb-railiance01-ho-001
**Status:** scaffold (RU-03)
**Date:** 2026-07-16
## Context for host-operator
- First forward-deployed host-operator pilot for coulomb on **railiance01**
- Prior agency craft: sys-medic + k3s node health protocol
- Related ops docs live in `railiance-hosts` (inventory, forgejo-on-railiance01, ADR-004 runner)
- No prior engagement vault session history
## Coach notes
If project memories exist on related repos, run:
```bash
kaizen-agentic memory brief sys-medic --target <related-repo>
```
Paste relevant non-secret patterns here. Until then, treat baseline as empty and
build envelope from first observe session.
## Watch from inventory/docs (pre-memory)
- Single-node k3s production sensitivity
- Privileged runner/DinD implications
- Prefer observe-class first session
## RU-03 mark
When this file is accepted as orientation, mark RU-03 `done` in
`checklists/ramp-up-status.md` (scaffold counts as filed; refresh after first live session if needed).

View file

@ -0,0 +1,33 @@
apiVersion: kaizen.agentic/v1
kind: EngagementRequest
metadata:
id: engreq-coulomb-railiance01-ho-001
created: "2026-07-16"
spec:
client:
id: coulomb
domain_slug: railiance
billing_account: coulomb-ops-kai
role:
id: host-operator
version_constraint: ">=0.1.0 <1.0.0"
targets:
- kind: host
id: railiance01
inventory_ref: railiance-hosts
notes: "k3s production; forgejo/apps workloads; coulomb ecosystem"
duty:
health_review: daily
os_security_pass: weekly
load_review: daily
timezone: Europe/Berlin
access:
requested_classes: [host_observe, privileged_ops]
cert_identity_hint: agt
knowledge:
vault_placement: pilot_in_supplier_repo
confidentiality: client_owned
commercial:
currency: kai
trial: true
quote_requested: true

View file

@ -0,0 +1,25 @@
# Duty cadence for eng-coulomb-railiance01-ho-001
# activity-core wiring optional (Phase 3); manual prepare is enough for Phase 1
engagement_id: eng-coulomb-railiance01-ho-001
timezone: Europe/Berlin
entries:
- id: daily-health-load
agent: host-operator
duty: standard_review
protocols:
- load-workload-review
- k3s-node-health-assessment
cadence: daily
cron: "0 9 * * 1-5"
enabled: false
notes: "Enable after ramp_up exit (RU checklist complete)"
- id: weekly-os-security
agent: host-operator
duty: deep_assessment
protocols:
- os-security-pass
cadence: weekly
cron: "0 10 * * 1"
enabled: false
notes: "Privileged upgrades remain human-gated even when enabled"

View file

@ -0,0 +1,47 @@
# Baseline — railiance01
**Engagement:** eng-coulomb-railiance01-ho-001
**Status:** pending first observe session (RU-02)
**Last captured:** —
## Identity
| Field | Value |
|-------|-------|
| Hostname | railiance01 |
| Inventory | railiance-hosts |
| Notes | k3s production; forgejo/apps |
## Capture checklist (fill on first session)
```bash
hostname
uptime
uname -a
cat /etc/os-release
nproc
free -h
df -h
ss -tuln | head -40
# if k3s:
kubectl get node -o wide 2>/dev/null || k3s kubectl get node -o wide 2>/dev/null
```
## Recorded values
_To be filled during ramp-up._
## Known quirks (from docs, pre-session)
- Forgejo + in-cluster Actions runner documented in railiance-hosts ADR-004
- State Hub / activity-core historically deployed on this cluster path
- Access often via ops-bridge from workstation
## Envelope seed
| Metric | Baseline | Notes |
|--------|----------|-------|
| Load | | |
| Memory | | |
| Disk | | |
| Top workloads | | |

View file

@ -0,0 +1,13 @@
# Handoff pack — eng-coulomb-railiance01-ho-001
Filled during **ramp-down** (RD-02).
## Contents (when complete)
- Summary of how railiance01 was operated under this engagement
- Pointer to final baselines
- Open risks → `risks.md`
- Deferred patches and reboot debt
- Contacts and access revocation status
_Status: not started (engagement not in ramp_down)._

View file

@ -0,0 +1,7 @@
# Outstanding risks — eng-coulomb-railiance01-ho-001
_Populated during operate and finalised at ramp-down (RD-03)._
| Risk | Severity | Mitigation / owner | Status |
|------|----------|--------------------|--------|
| _none recorded_ | | | |

View file

@ -0,0 +1,74 @@
---
agent: host-operator
engagement_id: eng-coulomb-railiance01-ho-001
project: coulomb-railiance01
last_updated: "2026-07-16"
session_count: 0
confidentiality: client_owned
---
# Host Operator Memory — railiance01 pilot
## Engagement Charter
- **Duty:** Keep railiance01 operational and secure; OS currency; load and workload review
- **Cadence:** daily health/load (business days); weekly OS/security pass
- **Change windows:** prefer low-traffic periods; reboot only with human approval
- **Escalation:** coulomb / railiance human operator (Bernd / on-call as designated)
- **Out of scope:** app features; other hosts; secret vending
## Project Context
Coulomb ecosystem production host `railiance01` runs k3s and platform workloads
(including Forgejo/apps per railiance-hosts docs). This engagement is the first
forward-deployed host-operator pilot (KAIZEN-WP-0009).
## Host Profiles
| hostname | role | typical load | services | last review |
|----------|------|--------------|----------|-------------|
| railiance01 | k3s production | _TBD ramp-up_ | k3s, forgejo/apps (inventory) | never |
## OS & Patch State
_Pending first OS security pass (RU-05 / weekly protocol)._
## Security Posture
_Pending first security snapshot (RU-05)._
## Load & Workload Envelope
_Pending first load review (RU-06)._
## Accumulated Findings
_None yet._
## What Worked
_None yet._
## Watch Points
- Single-node production: privileged mistakes have full blast radius
- DinD / Actions runner privilege model on railiance01 (see railiance-hosts ADRs)
- Disk growth from images, logs, and backups
## Recurring Findings
_None yet._
## Cleared Issues
_None yet._
## Open Threads
- Complete RU-01 access verification
- Capture baseline `vault/baselines/railiance01.md`
- First health + load review report
## Session Log
<!-- YYYY-MM-DD · host(s) · key finding · outcome -->