From 924e7d5e8b827604045bc9f78e2c385b1f2f3610 Mon Sep 17 00:00:00 2001 From: Backtalk6858 Date: Wed, 24 Jun 2026 23:52:57 -0500 Subject: [PATCH] docs: add sprint gameplan + Hermes grill-me decisions logged --- .../.claude/pre-agent-sprint-gameplan.md | 95 +++++++++++++++++++ 1 file changed, 95 insertions(+) create mode 100644 agent-builder/.claude/pre-agent-sprint-gameplan.md diff --git a/agent-builder/.claude/pre-agent-sprint-gameplan.md b/agent-builder/.claude/pre-agent-sprint-gameplan.md new file mode 100644 index 0000000..0b30957 --- /dev/null +++ b/agent-builder/.claude/pre-agent-sprint-gameplan.md @@ -0,0 +1,95 @@ +# Pre-Agent Deployment Sprint — Game Plan +Created: 2026-06-23 +Window: 7:00 AM → 3:00 AM (20 hours max) + +## Phase 1 — Core Infrastructure (~4-5 hrs) +Hard prerequisites everything else depends on. + +1. **id=51 — Secrets Proxy sandbox precondition scaffolding** + - Feature: before sandbox dry-run, proxy classifies what the command needs (file, service, iptables rule), checks if it exists in sandbox, creates/scaffolds it if missing, then re-runs + - Examples: `rm /tmp/foo` → create /tmp/foo first; `systemctl stop nginx` → start nginx in sandbox first + - Classification must handle: file existence, directory existence, running process/service, iptables rules, sysctl values + - After scaffold → re-run command → result shown in NTFY approval body + - Code lives in: /opt/appdata/docker/docker-compose/secrets-proxy/app.py + +2. **Obsidian vault setup on server-01** (personal_projects id=136) + - Location: server-01 + - AI-first, fully automated — user never has to touch it + - PARA structure: Projects (active build sessions), Areas (ongoing systems), Resources (playbooks/decisions), Archives (completed) + - Write paths: Claude Code directly, session end hooks, N8N workflows, Hermes task completions + - Read path: ripgrep (exact) + semantic embed (fuzzy) — both + - Migration: import existing ~/.claude/projects/*/memory/*.md files as seed; discard old postgres embed data + - /recall redesign: ripgrep + semantic search against Obsidian vault markdown + +3. **Playbook postgres DB schema + seed** (personal_projects id=139) + - Machine-queryable for N8N workflows and scripts + - Schema: playbooks(name, category, steps_json, last_updated, version) + - Human-readable layer = Obsidian vault (companion system) + - Seed with all existing playbooks from memory files + +## Phase 2 — Security + Secrets Hardening (~2 hrs) + +4. **bitwarden-bridge: POST /items create endpoint** (personal_projects id=142) + - Add to /opt/appdata/docker/docker-compose/bitwarden-bridge/bridge.py + - Pattern: bw create template item | bw encode | bw create item + - Use bw-generate.sh for password generation + +5. **secrets-proxy: bitwarden:// URI full support** (automation_ideas id=72) + - Extend env_secrets resolver: field selection beyond password (username, notes) + - Code in /opt/appdata/docker/docker-compose/secrets-proxy/app.py (partially exists) + +6. **Zero-trust + security philosophy playbook** (personal_projects id=140) + - Document: Vault-first env vars, Bitwarden/Vault separation, secrets-proxy discipline + - NVIDIA NemoClaw blueprint: agent reads internal data, cannot write to external systems, API tokens not accessible to agent + - All anti-patterns from June 22-23 sessions + +## Phase 3 — CI/CD (~5 hrs) +Jenkins before Hermes so Hermes deploys through Jenkins from day one. + +7. **Gitea source migration** — 10 services need repos + - Services: sudo-bridge, secrets-proxy, bitwarden-bridge, media-api, nextcloud-business-watcher, whisper-transcriber, jellyfin-monitor, media-transcoder, filebot-monitor, media-downloader-local + - Each repo: Dockerfile + Python source + requirements.txt only + - docker-compose.yml stays on server; .env never in git + +8. **Jenkins deployment + pipeline setup** (personal_projects id=141) + - Deploy Jenkins on server-01 (28GB RAM available) + - Configure Gitea webhooks + - Infrastructure tier (sudo-bridge, secrets-proxy, bitwarden-bridge): sandbox-first + smoke tests gate promotion; NTFY alert on failure + - Application tier (rest): health-check-only auto-promote + - All Jenkins secrets in production Vault via AppRole + - Smoke tests: sudo-bridge=GET /health + POST /exec safe cmd; secrets-proxy=GET /health + dry-run vault:// shell; bitwarden-bridge=GET /health + GET /secret test item + +## Phase 4 — Hermes (~3-4 hrs) + +9. **Hermes deployment on server-01** (personal_projects id=138) + - llama3.1:8b primary + claude -p verification/guardrails only (budget gate) + - Zero-trust: NVIDIA NemoClaw blueprint (OpenShell policies) + - Connect to Obsidian vault (long-term memory) + - Connect to playbook postgres DB + - Web admin panel, TUI, Telegram integration + - Hardware: 28GB RAM, RTX 2060 Super 7.9GB VRAM, llama3.1:8b already pulled + +## Phase 5 — Agent Deployment (~2-3 hrs) + +10. **Final readiness check** + - id=51 live and tested + - Sandbox mirrors production (id=57 already deployed) + - Playbook DB seeded + - secrets-proxy E2E verified + - N8N sandbox healthy + +11. **id=24 — Agent Builder Agent** + - Builds claude_agent + script types + - Ollama (llama3.1:8b) does the building, claude -p is overseer/validator + - Deploy to sandbox → automated tests → NTFY approval → promote + +12. **id=67 — N8N Builder Agent** + - Builds n8n_automation types + - Ollama generates workflow JSON using n8n_automations playbook as context + - Import to sandbox N8N via API → assign credentials → automated tests → NTFY → promote + +## Notes +- Hermes CAN slip without blocking agent deployment if time is short +- id=51, Obsidian, and playbook DB are the critical path — cannot skip +- Coolify is retired for automation — all deploys via Jenkins (direct docker compose on server until Jenkins is live) +- /recall redesign is part of the Obsidian setup task