coulomb/kaizen-agentic
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: consolidate agent execution and custody
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
ci / test (push) Successful in 52s
Details

Browse source
This commit is contained in:
tegwick 2026-08-20 22:43:55 +02:00
parent 6ed5708c21
commit d691135c4a
19 changed files with 372 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/integrations/forward-deployed-engagement-playbook.md
View file

@ -87,7 +87,10 @@ kaizen-agentic engagement close-session eng-... \
### 7. Operate cadence
- Enable entries in engagement `schedule.yml` (manual prepare until activity-core)
- Enable entries in engagement `schedule.yml`; they declare intent but do not
activate unattended work by themselves
- Continue manual prepare until an engagement-specific activity-core definition
and rein-aharness profile have passed a bounded smoke test
- Daily: health + load; weekly: OS/security pass (privileged changes still gated)
### 8. Ramp-down (when ending)
@ -116,7 +119,7 @@ Friction and resolutions from `eng-coulomb-railiance01-ho-001` / KAIZEN-WP-0009.
| `k3s kubectl` ServiceUnavailable under memory pressure | Record as finding; avoid hammering API; re-sample after capacity relief |
| Nested `.kaizen/metrics` under engagement is correct for custody | Root `.gitignore` `.kaizen/metrics/` only ignores repo-root metrics; pilot metrics are commit-able |
| Privileged work tempting on Critical host | RU-08 = **proposal dry-run only** until human approval table filled |
| Pilot vault in supplier repo | Treat as client confidential; export to client ops repo before multi-tenant scale |
| Pilot vault in supplier repo | Treat as client confidential; target `railiance-infra` for Railiance01 and require receiver acceptance before source cleanup |
| activity-core not required for Phase 1 | Manual `prepare` + `close-session`; schedule.yml documents intent |
| Kai charges felt real only after close-session | Always close-session after live duties; quote alone is not spend |
| High load makes remote `du`/`apt` slow | Prefer short command batches; timeout ≥60s for full assessments |
@ -152,14 +155,19 @@ ssh railiance01 "sudo ufw allow from <PUBLIC_IP> to any port 6443 proto tcp comm
---
## Optional activity-core wiring (Phase 3)
## Optional unattended wiring (Phase 3)
Not required for operate. When ready:
1. Customer or engagement repo owns ActivityDefinition copies that shell out to
`kaizen-agentic engagement prepare <id>` then start a coding-agent session
2. Resolver points at engagement id / host Target (new work — not WP-0009)
3. Keep privilege gates in the agent definition regardless of cron fire
1. Customer or engagement repo owns the ActivityDefinition that identifies the
engagement and emits idempotent, claimable `ops_run` work in activity-core.
2. The run carries `agent-session` approach metadata and a compatible
rein-aharness profile reference; it does not carry secrets or raw prompts.
3. rein-aharness claims the run, resolves credentials and policy, and executes
`kaizen-agentic engagement prepare <id>` inside the bounded session.
4. Completion links the `ops_run`, engagement report, metrics, and State Hub
progress without duplicating confidential content into coordination records.
5. Keep privilege gates in the agent definition regardless of schedule fire.
---