# Pre-Agent Deployment Sprint — Game Plan
Created: 2026-06-23
Window: 7:00 AM → 3:00 AM (20 hours max)

## Phase 1 — Core Infrastructure (~4-5 hrs)
Hard prerequisites everything else depends on.

1. **id=51 — Secrets Proxy sandbox precondition scaffolding**
   - Feature: before sandbox dry-run, proxy classifies what the command needs (file, service, iptables rule), checks if it exists in sandbox, creates/scaffolds it if missing, then re-runs
   - Examples: `rm /tmp/foo` → create /tmp/foo first; `systemctl stop nginx` → start nginx in sandbox first
   - Classification must handle: file existence, directory existence, running process/service, iptables rules, sysctl values
   - After scaffold → re-run command → result shown in NTFY approval body
   - Code lives in: /opt/appdata/docker/docker-compose/secrets-proxy/app.py

2. **Obsidian vault setup on server-01** (personal_projects id=136)
   - Location: server-01
   - AI-first, fully automated — user never has to touch it
   - PARA structure: Projects (active build sessions), Areas (ongoing systems), Resources (playbooks/decisions), Archives (completed)
   - Write paths: Claude Code directly, session end hooks, N8N workflows, Hermes task completions
   - Read path: ripgrep (exact) + semantic embed (fuzzy) — both
   - Migration: import existing ~/.claude/projects/*/memory/*.md files as seed; discard old postgres embed data
   - /recall redesign: ripgrep + semantic search against Obsidian vault markdown

3. **Playbook postgres DB schema + seed** (personal_projects id=139)
   - Machine-queryable for N8N workflows and scripts
   - Schema: playbooks(name, category, steps_json, last_updated, version)
   - Human-readable layer = Obsidian vault (companion system)
   - Seed with all existing playbooks from memory files

## Phase 2 — Security + Secrets Hardening (~2 hrs)

4. **bitwarden-bridge: POST /items create endpoint** (personal_projects id=142)
   - Add to /opt/appdata/docker/docker-compose/bitwarden-bridge/bridge.py
   - Pattern: bw create template item | bw encode | bw create item
   - Use bw-generate.sh for password generation

5. **secrets-proxy: bitwarden:// URI full support** (automation_ideas id=72)
   - Extend env_secrets resolver: field selection beyond password (username, notes)
   - Code in /opt/appdata/docker/docker-compose/secrets-proxy/app.py (partially exists)

6. **Zero-trust + security philosophy playbook** (personal_projects id=140)
   - Document: Vault-first env vars, Bitwarden/Vault separation, secrets-proxy discipline
   - NVIDIA NemoClaw blueprint: agent reads internal data, cannot write to external systems, API tokens not accessible to agent
   - All anti-patterns from June 22-23 sessions

## Phase 3 — CI/CD (~5 hrs)
Jenkins before Hermes so Hermes deploys through Jenkins from day one.

7. **Gitea source migration** — 10 services need repos
   - Services: sudo-bridge, secrets-proxy, bitwarden-bridge, media-api, nextcloud-business-watcher, whisper-transcriber, jellyfin-monitor, media-transcoder, filebot-monitor, media-downloader-local
   - Each repo: Dockerfile + Python source + requirements.txt only
   - docker-compose.yml stays on server; .env never in git

8. **Jenkins deployment + pipeline setup** (personal_projects id=141)
   - Deploy Jenkins on server-01 (28GB RAM available)
   - Configure Gitea webhooks
   - Infrastructure tier (sudo-bridge, secrets-proxy, bitwarden-bridge): sandbox-first + smoke tests gate promotion; NTFY alert on failure
   - Application tier (rest): health-check-only auto-promote
   - All Jenkins secrets in production Vault via AppRole
   - Smoke tests: sudo-bridge=GET /health + POST /exec safe cmd; secrets-proxy=GET /health + dry-run vault:// shell; bitwarden-bridge=GET /health + GET /secret test item

## Phase 4 — Hermes (~3-4 hrs)

9. **Hermes deployment on server-01** (personal_projects id=138)
   - llama3.1:8b primary + claude -p verification/guardrails only (budget gate)
   - Zero-trust: NVIDIA NemoClaw blueprint (OpenShell policies)
   - Connect to Obsidian vault (long-term memory)
   - Connect to playbook postgres DB
   - Web admin panel, TUI, Telegram integration
   - Hardware: 28GB RAM, RTX 2060 Super 7.9GB VRAM, llama3.1:8b already pulled

## Phase 5 — Agent Deployment (~2-3 hrs)

10. **Final readiness check**
    - id=51 live and tested
    - Sandbox mirrors production (id=57 already deployed)
    - Playbook DB seeded
    - secrets-proxy E2E verified
    - N8N sandbox healthy

11. **id=24 — Agent Builder Agent**
    - Builds claude_agent + script types
    - Ollama (llama3.1:8b) does the building, claude -p is overseer/validator
    - Deploy to sandbox → automated tests → NTFY approval → promote

12. **id=67 — N8N Builder Agent**
    - Builds n8n_automation types
    - Ollama generates workflow JSON using n8n_automations playbook as context
    - Import to sandbox N8N via API → assign credentials → automated tests → NTFY → promote

## Notes
- Hermes CAN slip without blocking agent deployment if time is short
- id=51, Obsidian, and playbook DB are the critical path — cannot skip
- Coolify is retired for automation — all deploys via Jenkins (direct docker compose on server until Jenkins is live)
- /recall redesign is part of the Obsidian setup task