ops-warden/AGENTS.md

# ops-warden — Agent Instructions

## Repo Identity

**Purpose:** SSH CA and certificate lifecycle manager — signs short-lived certs for adm/agt/atm actors; provides the cert_command interface consumed by ops-bridge.

**Domain:** infotech
**Repo slug:** ops-warden
**Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a`
**Workplan prefix:** `WARDEN-WP-`

---

## State Hub Integration

The Custodian State Hub tracks work across all domains. Interact via HTTP REST —
there is no MCP server for Codex agents.

| Context | URL |
|---------|-----|
| Local workstation | `http://127.0.0.1:8000` |
| Remote (railiance01, in-cluster) | `http://10.43.68.154:8000` |
| Optional local edge relay | http://127.0.0.1:18080 |

When an operator has enabled the edge relay, set API_BASE to the relay URL.
Queueable writes return an explicit queued receipt if the central hub is
unreachable. Treat that as pending local evidence, then ask the operator to run
statehub outbox status/replay after connectivity returns.

### Orient at session start

```bash
# Offline brief — works without hub connection
cat .custodian-brief.md

# Active workplans for this domain
curl -s "http://127.0.0.1:8000/workplans/?topic_id=cee7bedf-2b48-46ef-8601-006474f2ad7a&status=active" \
  | python3 -m json.tool

# Check inbox
curl -s "http://127.0.0.1:8000/messages/?to_agent=ops-warden&unread_only=true" \
  | python3 -m json.tool
```

Mark a message read:
```bash
curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
  -H "Content-Type: application/json" -d '{}'
```

### Log progress (required at session close)

```bash
curl -s -X POST http://127.0.0.1:8000/progress/ \
  -H "Content-Type: application/json" \
  -d '{
    "summary": "what was done",
    "event_type": "note",
    "author": "codex",
    "workplan_id": "<uuid>",
    "task_id": "<uuid>"
  }'
```

Omit `workplan_id` / `task_id` when not applicable.

### Update task status

```bash
curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"status": "progress"}'
# values: wait | todo | progress | done | cancel
```

### Flag a task for human review

```bash
curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"needs_human": true, "intervention_note": "reason"}'
```

---

## Session Protocol

**Start:**
1. `cat .custodian-brief.md` — domain goal and open workplans (offline-safe)
2. Check inbox: `GET /messages/?to_agent=ops-warden&unread_only=true`; mark read
3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks
4. Check human-needed tasks: `GET /tasks/?needs_human=true`

**During work:**
- Update task statuses in workplan files as tasks progress
- Record significant decisions via `POST /decisions/`

**Close:**
1. Update workplan file task statuses to reflect progress
2. Log: `POST /progress/` with a summary of what changed
3. After workplan file changes, run:
   ```bash
   statehub fix-consistency
   ```
   Coding agents should run this directly; ask the operator only if the CLI or
   State Hub API is unavailable. This syncs task status from files into the hub DB.

---

## Credential and access routing

**Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect**
for inference. Run this check **before** requesting secrets, API keys, SSH access,
login tokens, or database passwords — in any repo, not only `ops-warden`.

ops-warden **issues SSH certificates only** (`warden sign`, `cert_command`). Every
other credential need belongs to another subsystem. **Do not** message
`ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key.

### Lookup (do this first)

**Always plan before drafting any founder credential step** (WARDEN-WP-0029):

```bash
warden plan "<describe your need>" --json
# verdict: autonomous | founder_required | unroutable
# autonomous → run the commands (usually warden access --exec/--out/--wrap)
# founder_required → escalate exactly one act via warden desk (not /tmp file drops)
# unroutable → propose a CCR / catalog lane; do not improvise
```

Supporting lookups:

```bash
warden route find "<describe your need>" --json
warden route show <catalog-id> --json
warden route list   # human output includes catalog source/hash freshness
```

Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run warden`).
If `warden plan` misses a known lane, the installed catalog may be stale (bundled
fallback) — reinstall from checkout and re-run plan.

| Agent runtime | How to orient |
| --- | --- |
| **Codex / Grok** (shell, HTTP State Hub) | `warden plan` first; inbox `to_agent=ops-warden` is for coordination, not secret vending |
| **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workplans; **still** use `warden plan` / `warden route` for credential ownership |
| **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by `warden plan` |

### Quick routing table

| I need… | Owner | ops-warden executes? |
| --- | --- | --- |
| SSH cert (`adm`/`agt`/`atm`) | ops-warden | **Yes** — `warden sign` |
| API key, DB password, provider token | OpenBao (`railiance-platform`) | No — route only |
| Login / OIDC / MFA | key-cape / Keycloak | No — route only |
| Authorization decision | flex-auth | No — route only |
| activity-core → issue-core emission | activity-core + issue-core | No — `warden route show activity-core-issue-sink` |
| SSH tunnel | ops-bridge (+ `cert_command` from warden) | No — route only |

### Anti-patterns (do not do these)

- Drafting founder steps ("paste PAT to `/tmp`", "click Forgejo admin UI") **without**
  `warden plan` first (WP-0029)
- `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc.
- Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist
- Pasting secrets into Git, State Hub, workplans, logs, or chat
- **Reading a secret value onto a captured stdout.** Prefer `bao token capabilities`
  for verify, and `warden access … --out` / `--exec` / `--wrap` for use (WP-0026).
- Steady-state credential **file drops** (`/tmp/…-token`); use desk paste-once or
  sanctioned transports instead

### Agent read-boundary + EXPOSED taint (WP-0026 T04/T05)

- High-risk lanes (`risk: high` in catalog): with `WARDEN_AGENT_ID` set, raw value
  streaming is refused. Use sanctioned transports only.
- `warden taint <id>` reports EXPOSED metadata without reading secret data.
- Playbooks: `wiki/playbooks/agent-read-boundary.md`, `wiki/playbooks/exposed-taint.md`.

### Other capabilities (reuse-surface)

Non-credential capabilities are usually discovered through **reuse-surface** federation
(`reuse-surface` registry / `capability.*` indexes). Credential routing is inlined in
every repo's agent instructions because it is high-frequency, high-risk, and easy to
get wrong.

**Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`

<!-- REPO-AGENTS-EXTENSIONS -->
<!-- Append repo-specific agent instructions below this marker.
     The state-hub template sync preserves content after this line. -->

## Experiential memory (WARDEN-WP-0024)

ops-warden shares a **phase-memory** store across worker ticks, coding agent
sessions, and operator CLI use.

**Default:** phase-memory loads automatically on every `warden` command when
`phase-memory` is available. No separate activation step is required.

**Agent sessions** should set runtime identity once per session:

```bash
export WARDEN_AGENT_ID=grok   # or claude, codex
```

Then use normal `warden route` / `warden access` / `warden sign` / `warden worker`.
Episodes are recorded automatically unless `WARDEN_MEMORY=0`.

`warden memory activate` is optional introspection/refresh, not a prerequisite.

**Store:** `~/.local/share/warden/memory/` (override: `WARDEN_MEMORY_STORE`).

**Worker:** `warden worker run --brain llm` skips OpenRouter when stabilized
routing memory matches. See `wiki/OpsWardenMemory.md`.

Install bundled memory: `make install-all` then `make check-memory` from
`~/ops-warden`. Contract: `phase-memory/docs/ops-warden-memory-contract.md`.

---

## Workplan Convention (ADR-001)

Work items originate as files in this repo — not in the hub. The hub is a
read/cache/index layer that rebuilds from files.

**File location:** `workplans/OPS-WP-NNNN-<slug>.md`

**Archived location:** finished workplans may move to
`workplans/archived/YYMMDD-OPS-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is
the completion/archive date; the frontmatter `id` does not change.

**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use
`workplans/ADHOC-YYYY-MM-DD.md` with task ids `ADHOC-YYYY-MM-DD-T01`, etc. Use
this only for low-risk work completed directly; create a normal workplan for
anything needing analysis, design, approval, dependencies, or multiple phases.

**Frontmatter:**

```yaml
---
id: OPS-WP-NNNN
type: workplan
title: "..."
domain: infotech
repo: ops-warden
status: proposed | ready | active | blocked | backlog | finished | archived
owner: codex
topic_slug: ...
created: "YYYY-MM-DD"
updated: "YYYY-MM-DD"
state_hub_workstream_id: "<uuid>"   # written by fix-consistency — do not edit
---
```

Use `proposed` for a new draft, `ready` after review against current repo
state, and `finished` after implementation. `stalled` and `needs_review` are
derived health labels, not frontmatter statuses.

**Task block format** (one per `##` section):

```
## Task Title

` ` `task
id: OPS-WP-NNNN-T01
status: wait | todo | progress | done | cancel
priority: high | medium | low
state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
` ` `

Task description text.
```

Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blocked work and `cancel` for stopped work.

To create a new workplan:
1. Write the file following the format above
2. Notify the custodian operator to run `make fix-consistency REPO=ops-warden`
   (or send a message to the hub agent via `POST /messages/`)