docs: add sprint gameplan + Hermes grill-me decisions logged

agent-builder/.claude/pre-agent-sprint-gameplan.md

@@ -0,0 +1,95 @@
+# Pre-Agent Deployment Sprint — Game Plan
+Created: 2026-06-23
+Window: 7:00 AM → 3:00 AM (20 hours max)
+
+## Phase 1 — Core Infrastructure (~4-5 hrs)
+Hard prerequisites everything else depends on.
+
+1. **id=51 — Secrets Proxy sandbox precondition scaffolding**
+   - Feature: before sandbox dry-run, proxy classifies what the command needs (file, service, iptables rule), checks if it exists in sandbox, creates/scaffolds it if missing, then re-runs
+   - Examples: `rm /tmp/foo` → create /tmp/foo first; `systemctl stop nginx` → start nginx in sandbox first
+   - Classification must handle: file existence, directory existence, running process/service, iptables rules, sysctl values
+   - After scaffold → re-run command → result shown in NTFY approval body
+   - Code lives in: /opt/appdata/docker/docker-compose/secrets-proxy/app.py
+
+2. **Obsidian vault setup on server-01** (personal_projects id=136)
+   - Location: server-01
+   - AI-first, fully automated — user never has to touch it
+   - PARA structure: Projects (active build sessions), Areas (ongoing systems), Resources (playbooks/decisions), Archives (completed)
+   - Write paths: Claude Code directly, session end hooks, N8N workflows, Hermes task completions
+   - Read path: ripgrep (exact) + semantic embed (fuzzy) — both
+   - Migration: import existing ~/.claude/projects/*/memory/*.md files as seed; discard old postgres embed data
+   - /recall redesign: ripgrep + semantic search against Obsidian vault markdown
+
+3. **Playbook postgres DB schema + seed** (personal_projects id=139)
+   - Machine-queryable for N8N workflows and scripts
+   - Schema: playbooks(name, category, steps_json, last_updated, version)
+   - Human-readable layer = Obsidian vault (companion system)
+   - Seed with all existing playbooks from memory files
+
+## Phase 2 — Security + Secrets Hardening (~2 hrs)
+
+4. **bitwarden-bridge: POST /items create endpoint** (personal_projects id=142)
+   - Add to /opt/appdata/docker/docker-compose/bitwarden-bridge/bridge.py
+   - Pattern: bw create template item | bw encode | bw create item
+   - Use bw-generate.sh for password generation
+
+5. **secrets-proxy: bitwarden:// URI full support** (automation_ideas id=72)
+   - Extend env_secrets resolver: field selection beyond password (username, notes)
+   - Code in /opt/appdata/docker/docker-compose/secrets-proxy/app.py (partially exists)
+
+6. **Zero-trust + security philosophy playbook** (personal_projects id=140)
+   - Document: Vault-first env vars, Bitwarden/Vault separation, secrets-proxy discipline
+   - NVIDIA NemoClaw blueprint: agent reads internal data, cannot write to external systems, API tokens not accessible to agent
+   - All anti-patterns from June 22-23 sessions
+
+## Phase 3 — CI/CD (~5 hrs)
+Jenkins before Hermes so Hermes deploys through Jenkins from day one.
+
+7. **Gitea source migration** — 10 services need repos
+   - Services: sudo-bridge, secrets-proxy, bitwarden-bridge, media-api, nextcloud-business-watcher, whisper-transcriber, jellyfin-monitor, media-transcoder, filebot-monitor, media-downloader-local
+   - Each repo: Dockerfile + Python source + requirements.txt only
+   - docker-compose.yml stays on server; .env never in git
+
+8. **Jenkins deployment + pipeline setup** (personal_projects id=141)
+   - Deploy Jenkins on server-01 (28GB RAM available)
+   - Configure Gitea webhooks
+   - Infrastructure tier (sudo-bridge, secrets-proxy, bitwarden-bridge): sandbox-first + smoke tests gate promotion; NTFY alert on failure
+   - Application tier (rest): health-check-only auto-promote
+   - All Jenkins secrets in production Vault via AppRole
+   - Smoke tests: sudo-bridge=GET /health + POST /exec safe cmd; secrets-proxy=GET /health + dry-run vault:// shell; bitwarden-bridge=GET /health + GET /secret test item
+
+## Phase 4 — Hermes (~3-4 hrs)
+
+9. **Hermes deployment on server-01** (personal_projects id=138)
+   - llama3.1:8b primary + claude -p verification/guardrails only (budget gate)
+   - Zero-trust: NVIDIA NemoClaw blueprint (OpenShell policies)
+   - Connect to Obsidian vault (long-term memory)
+   - Connect to playbook postgres DB
+   - Web admin panel, TUI, Telegram integration
+   - Hardware: 28GB RAM, RTX 2060 Super 7.9GB VRAM, llama3.1:8b already pulled
+
+## Phase 5 — Agent Deployment (~2-3 hrs)
+
+10. **Final readiness check**
+    - id=51 live and tested
+    - Sandbox mirrors production (id=57 already deployed)
+    - Playbook DB seeded
+    - secrets-proxy E2E verified
+    - N8N sandbox healthy
+
+11. **id=24 — Agent Builder Agent**
+    - Builds claude_agent + script types
+    - Ollama (llama3.1:8b) does the building, claude -p is overseer/validator
+    - Deploy to sandbox → automated tests → NTFY approval → promote
+
+12. **id=67 — N8N Builder Agent**
+    - Builds n8n_automation types
+    - Ollama generates workflow JSON using n8n_automations playbook as context
+    - Import to sandbox N8N via API → assign credentials → automated tests → NTFY → promote
+
+## Notes
+- Hermes CAN slip without blocking agent deployment if time is short
+- id=51, Obsidian, and playbook DB are the critical path — cannot skip
+- Coolify is retired for automation — all deploys via Jenkins (direct docker compose on server until Jenkins is live)
+- /recall redesign is part of the Obsidian setup task