ops-warden/AGENTS.md

ops-warden — Agent Instructions

Repo Identity

Purpose: SSH CA and certificate lifecycle manager — signs short-lived certs for adm/agt/atm actors; provides the cert_command interface consumed by ops-bridge.

Domain: infotech Repo slug: ops-warden Topic ID: cee7bedf-2b48-46ef-8601-006474f2ad7a Workplan prefix: WARDEN-WP-

---

State Hub Integration

The Custodian State Hub tracks work across all domains. Interact via HTTP REST — there is no MCP server for Codex agents.

Context	URL
Local workstation	http://127.0.0.1:8000
Remote via tunnel	http://127.0.0.1:18000
Optional local edge relay	http://127.0.0.1:18080

When an operator has enabled the edge relay, set API_BASE to the relay URL. Queueable writes return an explicit queued receipt if the central hub is unreachable. Treat that as pending local evidence, then ask the operator to run statehub outbox status/replay after connectivity returns.

Orient at session start

# Offline brief — works without hub connection
cat .custodian-brief.md

# Active workplans for this domain
curl -s "http://127.0.0.1:8000/workplans/?topic_id=cee7bedf-2b48-46ef-8601-006474f2ad7a&status=active" \
  | python3 -m json.tool

# Check inbox
curl -s "http://127.0.0.1:8000/messages/?to_agent=ops-warden&unread_only=true" \
  | python3 -m json.tool

Mark a message read:

curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
  -H "Content-Type: application/json" -d '{}'

Log progress (required at session close)

curl -s -X POST http://127.0.0.1:8000/progress/ \
  -H "Content-Type: application/json" \
  -d '{
    "summary": "what was done",
    "event_type": "note",
    "author": "codex",
    "workplan_id": "<uuid>",
    "task_id": "<uuid>"
  }'

Omit workplan_id / task_id when not applicable.

Update task status

curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"status": "progress"}'
# values: wait | todo | progress | done | cancel

Flag a task for human review

curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"needs_human": true, "intervention_note": "reason"}'

---

Session Protocol

Start:

1. cat .custodian-brief.md — domain goal and open workplans (offline-safe)
2. Check inbox: GET /messages/?to_agent=ops-warden&unread_only=true; mark read
3. Scan workplans: ls workplans/ — note status: ready, active, or blocked files and open tasks
4. Check human-needed tasks: GET /tasks/?needs_human=true

During work:

• Update task statuses in workplan files as tasks progress
• Record significant decisions via POST /decisions/

Close:

1. Update workplan file task statuses to reflect progress
2. Log: POST /progress/ with a summary of what changed
3. After workplan file changes, run:

   statehub fix-consistency
   

   Coding agents should run this directly; ask the operator only if the CLI or State Hub API is unavailable. This syncs task status from files into the hub DB.

---

Credential and access routing

Audience: Codex, Claude Code, Grok, and custodian agents that call llm-connect for inference. Run this check before requesting secrets, API keys, SSH access, login tokens, or database passwords — in any repo, not only ops-warden.

ops-warden issues SSH certificates only (warden sign, cert_command). Every other credential need belongs to another subsystem. Do not message ops-warden on State Hub expecting a secret value; the reply is a pointer, not a key.

Lookup (do this first)

Always plan before drafting any founder credential step (WARDEN-WP-0029):

warden plan "<describe your need>" --json
# verdict: autonomous | founder_required | unroutable
# autonomous → run the commands (usually warden access --exec/--out/--wrap)
# founder_required → escalate exactly one act via warden desk (not /tmp file drops)
# unroutable → propose a CCR / catalog lane; do not improvise

Supporting lookups:

warden route find "<describe your need>" --json
warden route show <catalog-id> --json
warden route list   # human output includes catalog source/hash freshness

Requires the warden CLI from ~/ops-warden (uv tool install . or uv run warden). If warden plan misses a known lane, the installed catalog may be stale (bundled fallback) — reinstall from checkout and re-run plan.

Agent runtime	How to orient
Codex / Grok (shell, HTTP State Hub)	warden plan first; inbox to_agent=ops-warden is for coordination, not secret vending
Claude Code (MCP when available)	get_domain_summary("custodian") for workplans; still use warden plan / warden route for credential ownership
llm-connect (inference service)	Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by warden plan

Quick routing table

I need…	Owner	ops-warden executes?
SSH cert (adm/agt/atm)	ops-warden	Yes — warden sign
API key, DB password, provider token	OpenBao (railiance-platform)	No — route only
Login / OIDC / MFA	key-cape / Keycloak	No — route only
Authorization decision	flex-auth	No — route only
activity-core → issue-core emission	activity-core + issue-core	No — warden route show activity-core-issue-sink
SSH tunnel	ops-bridge (+ cert_command from warden)	No — route only

Anti-patterns (do not do these)

• Drafting founder steps ("paste PAT to /tmp", "click Forgejo admin UI") without warden plan first (WP-0029)
• POST /messages/ to ops-warden asking for ISSUE_CORE_API_KEY, OPENROUTER_API_KEY, etc.
• Inventing warden secret, warden login, warden bao, warden tunnel — they do not exist
• Pasting secrets into Git, State Hub, workplans, logs, or chat
• Reading a secret value onto a captured stdout. Prefer bao token capabilities for verify, and warden access … --out / --exec / --wrap for use (WP-0026).
• Steady-state credential file drops (/tmp/…-token); use desk paste-once or sanctioned transports instead

Agent read-boundary + EXPOSED taint (WP-0026 T04/T05)

• High-risk lanes (risk: high in catalog): with WARDEN_AGENT_ID set, raw value streaming is refused. Use sanctioned transports only.
• warden taint <id> reports EXPOSED metadata without reading secret data.
• Playbooks: wiki/playbooks/agent-read-boundary.md, wiki/playbooks/exposed-taint.md.

Other capabilities (reuse-surface)

Non-credential capabilities are usually discovered through reuse-surface federation (reuse-surface registry / capability.* indexes). Credential routing is inlined in every repo's agent instructions because it is high-frequency, high-risk, and easy to get wrong.

Canon: ~/ops-warden/wiki/CredentialRouting.md · catalog ~/ops-warden/registry/routing/catalog.yaml

Experiential memory (WARDEN-WP-0024)

ops-warden shares a phase-memory store across worker ticks, coding agent sessions, and operator CLI use.

Default: phase-memory loads automatically on every warden command when phase-memory is available. No separate activation step is required.

Agent sessions should set runtime identity once per session:

export WARDEN_AGENT_ID=grok   # or claude, codex

Then use normal warden route / warden access / warden sign / warden worker. Episodes are recorded automatically unless WARDEN_MEMORY=0.

warden memory activate is optional introspection/refresh, not a prerequisite.

Store: ~/.local/share/warden/memory/ (override: WARDEN_MEMORY_STORE).

Worker: warden worker run --brain llm skips OpenRouter when stabilized routing memory matches. See wiki/OpsWardenMemory.md.

Install bundled memory: make install-all then make check-memory from ~/ops-warden. Contract: phase-memory/docs/ops-warden-memory-contract.md.

---

Workplan Convention (ADR-001)

Work items originate as files in this repo — not in the hub. The hub is a read/cache/index layer that rebuilds from files.

File location: workplans/OPS-WP-NNNN-<slug>.md

Archived location: finished workplans may move to workplans/archived/YYMMDD-OPS-WP-NNNN-<slug>.md. The YYMMDD prefix is the completion/archive date; the frontmatter id does not change.

Ad Hoc Tasks: small opportunistic fixes discovered during a session use workplans/ADHOC-YYYY-MM-DD.md with task ids ADHOC-YYYY-MM-DD-T01, etc. Use this only for low-risk work completed directly; create a normal workplan for anything needing analysis, design, approval, dependencies, or multiple phases.

Frontmatter:

---
id: OPS-WP-NNNN
type: workplan
title: "..."
domain: infotech
repo: ops-warden
status: proposed | ready | active | blocked | backlog | finished | archived
owner: codex
topic_slug: ...
created: "YYYY-MM-DD"
updated: "YYYY-MM-DD"
state_hub_workstream_id: "<uuid>"   # written by fix-consistency — do not edit
---

Use proposed for a new draft, ready after review against current repo state, and finished after implementation. stalled and needs_review are derived health labels, not frontmatter statuses.

Task block format (one per ## section):

## Task Title

` ` `task
id: OPS-WP-NNNN-T01
status: wait | todo | progress | done | cancel
priority: high | medium | low
state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
` ` `

Task description text.

Status progression: todo → progress → done; use wait for waiting/blocked work and cancel for stopped work.

To create a new workplan:

1. Write the file following the format above
2. Notify the custodian operator to run make fix-consistency REPO=ops-warden (or send a message to the hub agent via POST /messages/)