docs: agent-sudo grill-me complete — D1-D10, P0-P5 build prompts, comparison

- Close Agent-Sudo (infra id=176) design grill-me; gap #5 cross-cutting locked
- Add P0-P5 phased background-agent build prompts (Opus 4.8 upgrades applied)
- Add agent_sudo_vs_sudo_bridge.md comparison doc
- Update context.md: sprint day 11 session 4, Coolify/N8N/port-8084 corrections

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent-builder/.claude/context.md

@@ -549,5 +549,20 @@ Key finding this session: secrets-proxy /shell only accepts target=sandbox or ta
 3. Launch Phase 2 (5 parallel agents): id=161, id=154, content repurposing, id=135, id=112
 4. After Phase 2 id=154 completes: launch Phase 3 (id=155)
 
+### 2026-07-08 Sprint Day 11 session 4 (evening) — Agent-Sudo grill-me COMPLETE + build prompts
+- **Agent-Sudo (id=176) grill-me DONE** — D1–D10 + gap-#5 cross-cutting all locked. Design: `agent_sudo_design_decisions.md`. Phased build prompts **P0–P5 written to `agent_prompts.md`** (Opus 4.8 upgrades: locked-design guardrail, contract-not-brittle-script, right-sized turns, 4-level gate + agent_test_results logging, per-phase abort/rollback + idempotent pre-flight). **NOT dispatched — pending user review.**
+- **Comparison doc written:** `agent_sudo_vs_sudo_bridge.md` (Agent-Sudo vs old bridge, side-by-side).
+- **Live-verified corrections:** Agent-Sudo parallel port = **8084** (8083 is bitwarden-bridge; design-doc D8 was wrong); `agent_test_results` EXISTS in api_business (was unverified); `automation_ideas`/`behavior_changes` live in api_business (not the empty `automation_ideas` DB); postgres peer-auth works (no secret needed for psql).
+- **Coolify reality-check:** Coolify is genuinely RETIRED (control plane `Exited` since 2026-06-25). `coolify.managed=true` labels on ~31 containers are VESTIGIAL static metadata, NOT active management. `coolify-proxy` = standalone `traefik:v3.6` (name kept for cloudflared tunnels → `http://coolify-proxy:80`). Stale memory `project_coolify_traefik_retirement.md` REWRITTEN to reflect executed retirement.
+- **N8N caller audit:** all 12 production workflows checked — **ZERO call sudo-bridge**. They use the now-DEAD Coolify API (`172.16.16.1:8000/api/v1/deploy|services/.../envs`) + Vault + bitwarden-bridge. So Agent-Sudo cutover has zero N8N surface.
+
+#### ⚠️ REDUNDANCY FINDING (today's decisions vs remaining sprint-day-11 work)
+Remaining sprint-day-11 priorities were: (1) fix secrets-proxy Dockerfile compose-plugin, (2) trigger sudo-bridge Jenkins jobs to deploy the **urgent-NTFY-priority** change to both bridges, (3) fix Jenkinsfile compound-command bug (behavior_changes id=1), (4) re-run jellyfin E2E.
+- **#2 is now REDUNDANT** — its only purpose was making the tier-2 NTFY **approval** notifications reliable. **D4 ELIMINATES the tier-2 approval gate entirely** (broken + theatrical). The old bridges are being replaced by Agent-Sudo (which has no such gate) and decommissioned in P5. Rebuilding them just to ship urgent-NTFY-priority is wasted work → **DROP it.** (The high→urgent app.py change stays uncommitted/undeployed; harmless.)
+- **#1, #3, #4 remain NECESSARY** — they're secrets-proxy / Jenkins-pipeline infra, orthogonal to Agent-Sudo (Agent-Sudo replaces sudo-bridge, not secrets-proxy; the Jenkinsfile compound-command bug is a secrets-proxy `/shell` shlex issue, unaffected).
+- **New separate debt logged (not Agent-Sudo):** the ~7 N8N workflows calling the dead Coolify API are silently broken → need Jenkins migration (per project_cicd_jenkins). Candidate automation_ideas / cleanup pass.
+
+**NEXT SESSION (Agent-Sudo):** user reviews P0–P5 prompts → dispatch P0 (zero-risk, standalone) first, then P1→P5 in order. Switch back to Sonnet+medium (Opus 4.8/high was today-only).
+
 ## Update instructions
 Update at the end of every agent-builder session. Keep agent status, key decisions, and prereq checklist current.