claude-projects/agent-builder/.claude/pre-agent-sprint-gameplan.md

Pre-Agent Deployment Sprint — Game Plan

Created: 2026-06-23 Window: 7:00 AM → 3:00 AM (20 hours max)

Phase 1 — Core Infrastructure (~4-5 hrs)

Hard prerequisites everything else depends on.

1. id=51 — Secrets Proxy sandbox precondition scaffolding

   • Feature: before sandbox dry-run, proxy classifies what the command needs (file, service, iptables rule), checks if it exists in sandbox, creates/scaffolds it if missing, then re-runs
   • Examples: rm /tmp/foo → create /tmp/foo first; systemctl stop nginx → start nginx in sandbox first
   • Classification must handle: file existence, directory existence, running process/service, iptables rules, sysctl values
   • After scaffold → re-run command → result shown in NTFY approval body
   • Code lives in: /opt/appdata/docker/docker-compose/secrets-proxy/app.py

2. Obsidian vault setup on server-01 (personal_projects id=136)

   • Location: server-01
   • AI-first, fully automated — user never has to touch it
   • PARA structure: Projects (active build sessions), Areas (ongoing systems), Resources (playbooks/decisions), Archives (completed)
   • Write paths: Claude Code directly, session end hooks, N8N workflows, Hermes task completions
   • Read path: ripgrep (exact) + semantic embed (fuzzy) — both
   • Migration: import existing ~/.claude/projects//memory/.md files as seed; discard old postgres embed data
   • /recall redesign: ripgrep + semantic search against Obsidian vault markdown

3. Playbook postgres DB schema + seed (personal_projects id=139)

   • Machine-queryable for N8N workflows and scripts
   • Schema: playbooks(name, category, steps_json, last_updated, version)
   • Human-readable layer = Obsidian vault (companion system)
   • Seed with all existing playbooks from memory files

Phase 2 — Security + Secrets Hardening (~2 hrs)

4. bitwarden-bridge: POST /items create endpoint (personal_projects id=142)

   • Add to /opt/appdata/docker/docker-compose/bitwarden-bridge/bridge.py
   • Pattern: bw create template item | bw encode | bw create item
   • Use bw-generate.sh for password generation

5. secrets-proxy: bitwarden:// URI full support (automation_ideas id=72)

   • Extend env_secrets resolver: field selection beyond password (username, notes)
   • Code in /opt/appdata/docker/docker-compose/secrets-proxy/app.py (partially exists)

6. Zero-trust + security philosophy playbook (personal_projects id=140)

   • Document: Vault-first env vars, Bitwarden/Vault separation, secrets-proxy discipline
   • NVIDIA NemoClaw blueprint: agent reads internal data, cannot write to external systems, API tokens not accessible to agent
   • All anti-patterns from June 22-23 sessions

Phase 3 — CI/CD (~5 hrs)

Jenkins before Hermes so Hermes deploys through Jenkins from day one.

7. Gitea source migration — 10 services need repos

   • Services: sudo-bridge, secrets-proxy, bitwarden-bridge, media-api, nextcloud-business-watcher, whisper-transcriber, jellyfin-monitor, media-transcoder, filebot-monitor, media-downloader-local
   • Each repo: Dockerfile + Python source + requirements.txt only
   • docker-compose.yml stays on server; .env never in git

8. Jenkins deployment + pipeline setup (personal_projects id=141)

   • Deploy Jenkins on server-01 (28GB RAM available)
   • Configure Gitea webhooks
   • Infrastructure tier (sudo-bridge, secrets-proxy, bitwarden-bridge): sandbox-first + smoke tests gate promotion; NTFY alert on failure
   • Application tier (rest): health-check-only auto-promote
   • All Jenkins secrets in production Vault via AppRole
   • Smoke tests: sudo-bridge=GET /health + POST /exec safe cmd; secrets-proxy=GET /health + dry-run vault:// shell; bitwarden-bridge=GET /health + GET /secret test item

Phase 4 — Hermes (~3-4 hrs)

9. Hermes deployment on server-01 (personal_projects id=138)
   • llama3.1:8b primary + claude -p verification/guardrails only (budget gate)
   • Zero-trust: NVIDIA NemoClaw blueprint (OpenShell policies)
   • Connect to Obsidian vault (long-term memory)
   • Connect to playbook postgres DB
   • Web admin panel, TUI, Telegram integration
   • Hardware: 28GB RAM, RTX 2060 Super 7.9GB VRAM, llama3.1:8b already pulled

Phase 5 — Agent Deployment (~2-3 hrs)

10. Final readiness check

    • id=51 live and tested
    • Sandbox mirrors production (id=57 already deployed)
    • Playbook DB seeded
    • secrets-proxy E2E verified
    • N8N sandbox healthy

11. id=24 — Agent Builder Agent

    • Builds claude_agent + script types
    • Ollama (llama3.1:8b) does the building, claude -p is overseer/validator
    • Deploy to sandbox → automated tests → NTFY approval → promote

12. id=67 — N8N Builder Agent

    • Builds n8n_automation types
    • Ollama generates workflow JSON using n8n_automations playbook as context
    • Import to sandbox N8N via API → assign credentials → automated tests → NTFY → promote

Notes

• Hermes CAN slip without blocking agent deployment if time is short
• id=51, Obsidian, and playbook DB are the critical path — cannot skip
• Coolify is retired for automation — all deploys via Jenkins (direct docker compose on server until Jenkins is live)
• /recall redesign is part of the Obsidian setup task