qonto-assistant/AGENTS.md

# qonto-assistant — Agent Instructions

## Repo Identity

**Purpose:** Policy-governed Qonto domain REST+MCP assistant: sole bank-key consumer, default-deny no-spend/no-volume-cost policy for multi-harness finance awareness.

**Domain:** infotech
**Repo slug:** qonto-assistant
**Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a`
**Workplan prefix:** `QONTO-WP-`

---

## State Hub Integration

The Custodian State Hub tracks work across all domains. Interact via HTTP REST —
there is no MCP server for Codex agents.

| Context | URL |
|---------|-----|
| Local workstation | `http://127.0.0.1:8000` |
| Remote via tunnel | `http://127.0.0.1:18000` |
| Optional local edge relay | http://127.0.0.1:18080 |

When an operator has enabled the edge relay, set API_BASE to the relay URL.
Queueable writes return an explicit queued receipt if the central hub is
unreachable. Treat that as pending local evidence, then ask the operator to run
statehub outbox status/replay after connectivity returns.

### Orient at session start

```bash
# Offline brief — works without hub connection
cat .custodian-brief.md

# Active workplans for this domain
curl -s "http://127.0.0.1:8000/workplans/?topic_id=cee7bedf-2b48-46ef-8601-006474f2ad7a&status=active" \
  | python3 -m json.tool

# Check inbox
curl -s "http://127.0.0.1:8000/messages/?to_agent=qonto-assistant&unread_only=true" \
  | python3 -m json.tool
```

Mark a message read:
```bash
curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
  -H "Content-Type: application/json" -d '{}'
```

### Log progress (required at session close)

```bash
curl -s -X POST http://127.0.0.1:8000/progress/ \
  -H "Content-Type: application/json" \
  -d '{
    "summary": "what was done",
    "event_type": "note",
    "author": "codex",
    "workplan_id": "<uuid>",
    "task_id": "<uuid>"
  }'
```

Omit `workplan_id` / `task_id` when not applicable.

### Update task status

```bash
curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"status": "progress"}'
# values: wait | todo | progress | done | cancel
```

### Flag a task for human review

```bash
curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"needs_human": true, "intervention_note": "reason"}'
```

---

## Session Protocol

**Start:**
1. `cat .custodian-brief.md` — domain goal and open workplans (offline-safe)
2. Check inbox: `GET /messages/?to_agent=qonto-assistant&unread_only=true`; mark read
3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks
4. Check human-needed tasks: `GET /tasks/?needs_human=true`

**During work:**
- Update task statuses in workplan files as tasks progress
- Record significant decisions via `POST /decisions/`

**Close:**
1. Update workplan file task statuses to reflect progress
2. Log: `POST /progress/` with a summary of what changed
3. After workplan file changes, run:
   ```bash
   statehub fix-consistency
   ```
   Coding agents should run this directly; ask the operator only if the CLI or
   State Hub API is unavailable. This syncs task status from files into the hub DB.

---

{CREDENTIAL_ROUTING}

<!-- REPO-AGENTS-EXTENSIONS -->
<!-- Append repo-specific agent instructions below this marker.
     The state-hub template sync preserves content after this line. -->

## Repo-specific orientation

| Doc | Role |
| --- | --- |
| `INTENT.md` | Why / never-become |
| `specs/ArchitectureBlueprint.md` | Architecture + phases |
| `research/` | Pattern research |
| `SCOPE.md` | In/out of scope |

**Security:** Never print or commit Qonto API keys. Service alone fetches
`tenants/binky/qonto-api` (`API_KEY`, `API_USER`). Clients use assistant URL +
workload identity only. Policy v1: **no spend / no volume-cost**.

**Local verification (Phase 1 runtime landed):**

Preferred, when `make` and local venv bootstrapping are available:

```bash
make install-dev
make test
make lint
make run
```

Verified fallback on this workstation:

```bash
# Reuse a sibling fleet venv that already contains FastAPI/httpx/pytest
PYTHONPATH=src ../state-hub/.venv/bin/python -m pytest

# Syntax-only fallback when ruff/dev deps are unavailable
python3 -m compileall src tests
```

Operational details live in `docs/operator-runbook.md`.

---

## Workplan Convention (ADR-001)

Work items originate as files in this repo — not in the hub. The hub is a
read/cache/index layer that rebuilds from files.

**File location:** `workplans/QONTO-WP-NNNN-<slug>.md`

**Archived location:** finished workplans may move to
`workplans/archived/YYMMDD-QONTO-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is
the completion/archive date; the frontmatter `id` does not change.

**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use
`workplans/ADHOC-YYYY-MM-DD.md` with task ids `ADHOC-YYYY-MM-DD-T01`, etc. Use
this only for low-risk work completed directly; create a normal workplan for
anything needing analysis, design, approval, dependencies, or multiple phases.

**Frontmatter:**

```yaml
---
id: QONTO-WP-NNNN
type: workplan
title: "..."
domain: infotech
repo: qonto-assistant
status: proposed | ready | active | blocked | backlog | finished | archived
owner: codex
topic_slug: ...
created: "YYYY-MM-DD"
updated: "YYYY-MM-DD"
state_hub_workstream_id: "<uuid>"   # fix-consistency — do not edit (legacy field name; workplan UUID)
---
```

Use `proposed` for a new draft, `ready` after review against current repo
state, and `finished` after implementation. `stalled` and `needs_review` are
derived health labels, not frontmatter statuses.

**Terminology:** workplan is the fleet term; `workstream` appears only in legacy
API/MCP/frontmatter bridges until `STATE-WP-0069` retires them — see
`the-custodian/canon/standards/workplan-terminology-fleet_v0.1.md`.

**Task block format** (one per `##` section):

```
## Task Title

` ` `task
id: QONTO-WP-NNNN-T01
status: wait | todo | progress | done | cancel
priority: high | medium | low
state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
` ` `

Task description text.
```

Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blocked work and `cancel` for stopped work.

To create a new workplan:
1. Write the file following the format above
2. Run `statehub fix-consistency` locally; ask the operator only if the CLI or
   State Hub API is unavailable.