railiance-master/AGENTS.md

# railiance-master — Agent Instructions

## Repo Identity

**Purpose:** Railiance framework architecture home: repository taxonomy, architectural boundaries, framework-level ADRs, and cross-repo workplans for changes spanning multiple Railiance repositories.

**Domain:** financials
**Repo slug:** railiance-master
**Topic ID:** `ca369340-a64e-442e-98f1-a4fa7dc74a38`
**Workplan prefix:** `RMASTER-WP-`

---

## State Hub Integration

The Custodian State Hub tracks work across all domains. Interact via HTTP REST —
there is no MCP server for Codex agents.

| Context | URL |
|---------|-----|
| Local workstation | `http://127.0.0.1:8000` |
| Remote (railiance01, in-cluster) | `http://10.43.68.154:8000` |
| Optional local edge relay | `http://127.0.0.1:18080` |

When an operator has enabled the edge relay, set `API_BASE` to the relay URL.
Queueable writes return an explicit queued receipt if the central hub is
unreachable. Treat that as pending local evidence, then ask the operator to run
`statehub outbox status` or `statehub outbox replay` after connectivity returns.

### Orient at session start

```bash
# Offline brief — works without hub connection
cat .custodian-brief.md

# Active workplans for this domain
python3 - <<'PY'
import json, urllib.request
with urllib.request.urlopen("http://127.0.0.1:8000/workplans/?topic_id=ca369340-a64e-442e-98f1-a4fa7dc74a38&status=active") as r:
    print(json.dumps(json.loads(r.read().decode()), indent=2))
PY

# Check inbox
python3 - <<'PY'
import json, urllib.request
with urllib.request.urlopen("http://127.0.0.1:8000/messages/?to_agent=railiance-master&unread_only=true") as r:
    print(json.dumps(json.loads(r.read().decode()), indent=2))
PY
```

Mark a message read:

```bash
python3 - <<'PY'
import json, urllib.request
req = urllib.request.Request(
    "http://127.0.0.1:8000/messages/<id>/read",
    data=b"{}",
    headers={"Content-Type": "application/json"},
    method="PATCH",
)
with urllib.request.urlopen(req) as r:
    print(r.read().decode())
PY
```

### Log progress (required at session close)

```bash
python3 - <<'PY'
import json, urllib.request
payload = {
    "summary": "what was done",
    "event_type": "note",
    "author": "codex",
    "workplan_id": "<uuid>",
    "task_id": "<uuid>",
}
req = urllib.request.Request(
    "http://127.0.0.1:8000/progress/",
    data=json.dumps(payload).encode(),
    headers={"Content-Type": "application/json"},
    method="POST",
)
with urllib.request.urlopen(req) as r:
    print(r.read().decode())
PY
```

Omit `workplan_id` or `task_id` when not applicable.

### Update task status

```bash
python3 - <<'PY'
import json, urllib.request
req = urllib.request.Request(
    "http://127.0.0.1:8000/tasks/<task_id>",
    data=json.dumps({"status": "progress"}).encode(),
    headers={"Content-Type": "application/json"},
    method="PATCH",
)
with urllib.request.urlopen(req) as r:
    print(r.read().decode())
PY
# values: wait | todo | progress | done | cancel
```

### Flag a task for human review

```bash
python3 - <<'PY'
import json, urllib.request
req = urllib.request.Request(
    "http://127.0.0.1:8000/tasks/<task_id>",
    data=json.dumps({"needs_human": True, "intervention_note": "reason"}).encode(),
    headers={"Content-Type": "application/json"},
    method="PATCH",
)
with urllib.request.urlopen(req) as r:
    print(r.read().decode())
PY
```

---

## Session Protocol

**Start:**
1. `cat .custodian-brief.md` — domain goal and open workplans (offline-safe)
2. Check inbox: `GET /messages/?to_agent=railiance-master&unread_only=true`; mark read
3. Scan `workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks
4. Check human-needed tasks: `GET /tasks/?needs_human=true`

**During work:**
- Update task statuses in workplan files as tasks progress
- Record significant decisions via `POST /decisions/`

**Close:**
1. Update workplan file task statuses to reflect progress
2. If finishing a workplan: hand off residuals as live work records first
3. Log `POST /progress/` with a summary of what changed
4. After workplan file changes, run:
   ```bash
   statehub fix-consistency
   ```
   Coding agents should run this directly; ask the operator only if the CLI or
   State Hub API is unavailable. This syncs task status from files into the hub DB.

---

## Credential and access routing

**Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect**
for inference. Run this check **before** requesting secrets, API keys, SSH access,
login tokens, or database passwords — in any repo, not only `ops-warden`.

`ops-warden` **issues SSH certificates only** (`warden sign`, `cert_command`).
Every other credential need belongs to another subsystem. Do not message
`ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key.

### Lookup

```bash
warden route find "<describe your need>" --json
warden route show <catalog-id> --json
```

Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run warden`).

### Quick routing table

| I need… | Owner | ops-warden executes? |
| --- | --- | --- |
| SSH cert (`adm`/`agt`/`atm`) | ops-warden | Yes — `warden sign` |
| API key, DB password, provider token | OpenBao (`railiance-platform`) | No — route only |
| Login / OIDC / MFA | key-cape / Keycloak | No — route only |
| Authorization decision | flex-auth | No — route only |
| SSH tunnel | ops-bridge (+ `cert_command` from warden) | No — route only |

### Anti-patterns

- `POST /messages/` to `ops-warden` asking for secret values
- inventing unsupported `warden` subcommands
- pasting secrets into Git, State Hub, workplans, logs, or chat

---

## Workplan Convention (ADR-001)

Work items originate as files in this repo — not in the hub. The hub is a
read/cache/index layer that rebuilds from files.

**File location:** `workplans/RMASTER-WP-NNNN-<slug>.md`

**Archived location:** finished workplans may move to
`workplans/archived/YYMMDD-RMASTER-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is
the completion/archive date; the frontmatter `id` does not change.

**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use
`workplans/ADHOC-YYYY-MM-DD.md` with task ids `ADHOC-YYYY-MM-DD-T01`, etc.
Use this only for low-risk work completed directly; create a normal workplan
for anything needing analysis, design, approval, dependencies, or multiple phases.

**Frontmatter:**

```yaml
---
id: RMASTER-WP-NNNN
type: workplan
title: "..."
domain: financials
repo: railiance-master
status: proposed | ready | active | blocked | backlog | finished | archived
owner: codex
topic_slug: ...
created: "YYYY-MM-DD"
updated: "YYYY-MM-DD"
state_hub_workstream_id: "<uuid>"   # written by fix-consistency — do not edit
---
```

Use `proposed` for a new draft, `ready` after review against current repo
state, and `finished` after implementation. `stalled` and `needs_review`
are derived health labels, not frontmatter statuses.

**Task block format** (one per `##` section):

```task
id: RMASTER-WP-NNNN-T01
status: wait | todo | progress | done | cancel
priority: high | medium | low
state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
```

Status progression: `todo` → `progress` → `done`; use `wait` for waiting or
blocked work and `cancel` for stopped work.

### Repo-specific guidance

Use `railiance-master` workplans for framework changes that span multiple
Railiance repos, especially repository taxonomy changes, architecture boundary
changes, and migrations introducing `rail-*`, `rapp-*`, or `reef-*` concepts.
IDs use `RMASTER-WP-` so they do not collide with `RAILIANCE-WP-` in
`railiance-platform` and other ownership repos.

Do not use this repo to track implementation work that belongs entirely inside
one concrete ownership repo such as `railiance-platform` or `railiance-apps`.

<!-- BEGIN EMERGENT-SECURITY-PILOT -->
## NetKingdom situational knowledge pilot

For security-related work, read the shared
[Emergent Security orientation](../emergent-security/knowledge/cards/start.md)
and the task's card in that package. From this repository root, validate and read:

```bash
PYTHONPATH=../emergent-security/src python3 -m emergent_security.knowledge --repositories .. show start --audience generic
```

Use the matching provider audience when known and retrieve the relevant card.
Record package version, digest and source status; reload after resume/compaction
or a repository switch. A withheld card requires source review; an offline
snapshot is orientation only. If the sibling checkout is absent, use the trusted
installed `emergent-knowledge` package or an explicitly reviewed exported bundle;
do not silently download or execute a replacement.

This pilot adds situational knowledge, not authority, live readiness or a change
to this repository's owner contracts. Work: `emergent-security/EMERGENT-WP-0002`.
<!-- END EMERGENT-SECURITY-PILOT -->