# {PROJECT_NAME} — Agent Instructions

## Repo Identity

**Purpose:** {PROJECT_DESCRIPTION}

**Domain:** {DOMAIN}
**Repo slug:** {REPO_SLUG}
**Topic ID:** `{TOPIC_ID}`
**Workplan prefix:** `{WP_PREFIX}-`

---

## State Hub Integration

The Custodian State Hub tracks work across all domains. Codex uses HTTP REST and
the `statehub` CLI by default. MCP is opt-in because the current Codex MCP bridge
adds severe call latency; the full administrative MCP surface remains available
to clients that need it.

| Context | URL |
|---------|-----|
| Local workstation | `http://127.0.0.1:8000` |
| Remote via tunnel | `http://127.0.0.1:18000` |
| Optional local edge relay | http://127.0.0.1:18080 |

When an operator has enabled the edge relay, set API_BASE to the relay URL.
Queueable writes return an explicit queued receipt if the central hub is
unreachable. Treat that as pending local evidence, then ask the operator to run
statehub outbox status/replay after connectivity returns.

Codex workspace-write sandboxes need network access enabled to reach the host's
loopback listener. Bootstrap this once with `make -C ~/state-hub configure-codex`
and restart Codex. The canonical REST health endpoint is `/state/health`, not
`/health`. If a sandboxed loopback probe fails, retry it with escalated execution
before declaring State Hub unavailable; a managed Codex permission profile may
still enforce isolated networking. Experimental MCP can be enabled explicitly
with `make -C ~/state-hub configure-codex WITH_MCP=1`.

Repository files cross machine boundaries through committed Forge revisions:
workstation agents push to Forgejo and cluster infrastructure reads a verified
commit into ephemeral storage. Neither side reads or writes the other's
checkout. `local_path` and `host_paths` describe host-local observations only.

### Orient at session start

```bash
# Offline brief — works without hub connection
cat .custodian-brief.md

# Active workplans for this domain
curl -s "http://127.0.0.1:8000/workplans/?topic_id={TOPIC_ID}&status=active" \
  | python3 -m json.tool

# Check inbox
curl -s "http://127.0.0.1:8000/messages/?to_agent={REPO_SLUG}&unread_only=true" \
  | python3 -m json.tool
```

Mark a message read:
```bash
curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read?reader={REPO_SLUG}" \
  -H "Content-Type: application/json" -d '{}'
# Standing notices (to_agent "broadcast", kind "standing") stay until acknowledged:
# curl -s -X POST "http://127.0.0.1:8000/messages/<id>/ack" -H "Content-Type: application/json" -d '{"agent":"{REPO_SLUG}"}'
```

### Log progress (required at session close)

```bash
curl -s -X POST http://127.0.0.1:8000/progress/ \
  -H "Content-Type: application/json" \
  -d '{
    "summary": "what was done",
    "event_type": "note",
    "author": "codex",
    "workplan_id": "<uuid>",
    "task_id": "<uuid>"
  }'
```

Omit `workplan_id` / `task_id` when not applicable.

### Update task status

```bash
curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"status": "progress"}'
# values: wait | todo | progress | done | cancel
```

### Flag a task for human review

```bash
curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"needs_human": true, "intervention_note": "reason"}'
```

---

## Session Protocol

**Start:**
1. `cat .custodian-brief.md` — domain goal and open workplans (offline-safe)
2. Check inbox: `GET /messages/?to_agent={REPO_SLUG}&unread_only=true`; mark read
3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks
4. Check human-needed tasks: `GET /tasks/?needs_human=true`

**During work:**
- Update task statuses and refine task structure after substantial work; record
  completed deliverables and split remaining scope (see Workplan Convention)
- Record significant decisions via `POST /decisions/`

**Close:**
1. Update workplan file task statuses to reflect progress
2. If finishing a workplan: hand off **residuals** as live work records first
   (intake with `origin: residual` + `origin_ref: <WP-id>`, or a next workplan /
   decision / engagement). Do not park leftovers only in prose or `SCOPE.md`.
   Canon: `the-custodian/canon/standards/work-record-types_v0.1.md` § Residuals.
3. Log: `POST /progress/` with a summary of what changed (name handoff ids)
4. After workplan file changes, run:
   ```bash
   uv run --project ~/repo-manager rmgr sync --path . --push
   ```
   This assigns only missing deterministic identifiers, verifies the pushed
   Forgejo commit and `primary/railliance01`, then requests one central
   reconciliation. A queued receipt is pending evidence; rerun after
   connectivity returns. Use `statehub fix-consistency` for a separate deep audit.

---

{CREDENTIAL_ROUTING}

<!-- REPO-AGENTS-EXTENSIONS -->
<!-- Append repo-specific agent instructions below this marker.
     The state-hub template sync preserves content after this line. -->

---

## Workplan Convention (ADR-001)

Work items originate as files in this repo — not in the hub. The hub is a
read/cache/index layer that rebuilds from files.

### Task refinement after substantial work (required)

At each substantive checkpoint and before session close, compare the completed
work and new knowledge with the current task structure. If substantial work was
completed while the workplan's task granularity stayed unchanged, **add completed
task records for those evidenced outcomes and refine the remaining tasks**.
A long progress note inside the same broad open task does not satisfy this rule.

- Give each substantial completed deliverable a task with its actual outcome,
  completion date, evidence and limits. Retrospective recording is allowed; do
  not invent completion dates, deliveries, native acceptance or approvals.
- Split remaining work into independently manageable deliverables with an owner,
  next action, completion criteria and real dependencies. Use `todo` for work
  that can start; use `wait` only with a concrete prerequisite and unblock condition.
- Preserve existing task IDs, Hub UUIDs and history. When narrowing an umbrella
  task, explain the split and map moved scope to the new task IDs. Do not mark
  the umbrella done unless its retained scope is complete; preserve externally
  referenced acceptance gates until their dependencies are satisfied.
- Keep task counts honest: extracting completed scope must not count the same
  outcome twice or imply an effort-based completion percentage. Distinguish
  source/fixture proof, actual operational proof and owner acceptance.
- Record new risks and out-of-scope findings as explicit disposition/handoff
  tasks or linked live work records; do not silently expand authorization.

Make these changes in the repository source, commit/push, run the repository's
required projection sync, and verify the actual projected task counts, statuses
and dependencies. Progress events supplement the task structure; they do not
replace it. A checkpoint report must show both substantive outcomes and newly
refined remaining work when this rule is triggered.

**File location:** `workplans/{WP_PREFIX}-NNNN-<slug>.md`

**Archived location:** finished workplans may move to
`workplans/archived/YYMMDD-{WP_PREFIX}-NNNN-<slug>.md`. The `YYMMDD` prefix is
the completion/archive date; the frontmatter `id` does not change.

**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use
`workplans/ADHOC-YYYY-MM-DD.md`, workplan id
`{WP_PREFIX}-ADHOC-YYYY-MM-DD`, and task ids
`{WP_PREFIX}-ADHOC-YYYY-MM-DD-T01`, etc. `{WP_PREFIX}` includes its final `-WP`
token. Unqualified historic `ADHOC-*` ids are grandfathered and must not be
copied into new records. Use this only for low-risk work completed directly;
create a normal workplan for anything needing analysis, design, approval,
dependencies, or multiple phases.

**Frontmatter:**

```yaml
---
id: {WP_PREFIX}-NNNN
type: workplan
title: "..."
domain: {DOMAIN}
repo: {REPO_SLUG}
status: proposed | ready | active | blocked | backlog | finished | archived
owner: codex
topic_slug: ...
created: "YYYY-MM-DD"
updated: "YYYY-MM-DD"
state_hub_workstream_id: "<uuid>"   # deterministic UUIDv5; managed by Repo Manager
---
```

Use `proposed` for a new draft, `ready` after review against current repo
state, and `finished` after implementation. `stalled` and `needs_review` are
derived health labels, not frontmatter statuses.

**Terminology:** workplan is the fleet term; `workstream` appears only in legacy
API/MCP/frontmatter bridges until `STATE-WP-0069` retires them — see
`the-custodian/canon/standards/workplan-terminology-fleet_v0.1.md`.

**Task block format** (one per `##` section):

```
## Task Title

` ` `task
id: {WP_PREFIX}-NNNN-T01
status: wait | todo | progress | done | cancel
priority: high | medium | low
state_hub_task_id: "<uuid>"         # deterministic UUIDv5; managed by Repo Manager
` ` `

Task description text.
```

Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blocked work and `cancel` for stopped work.

**Residuals when finishing:** actionable leftovers become live work records
before `status: finished` — usually an intake (`origin: residual`,
`origin_ref: {WP_PREFIX}-NNNN`) or a spawned workplan. Residual is a *role*,
not a kind. Fleet list lives on State Hub, not in `SCOPE.md`.

To create a new workplan:
1. Write the file following the format above
2. Run `uv run --project ~/repo-manager rmgr sync --path . --push`.
3. Run `statehub fix-consistency` only when a separate deep audit is needed.