generated from mathias/template-go-web
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 mathias
|
710976ac93 | ||
|
mathias
|
bc33d44b43 | ||
 mathiasandClaude Opus 5
|
097d8747c6 |
@@ -1,2 +0,0 @@
|
||||
read: .aider.conventions.md
|
||||
auto-commits: false
|
||||
@@ -1,372 +0,0 @@
|
||||
# Agent context — Mathias workspace
|
||||
|
||||
<!-- Canonical root context for all AI coding agents.
|
||||
Lives at: ~/dev/.context/AGENT.md
|
||||
Applies to every project under ~/dev/ unless overridden.
|
||||
|
||||
Run `task context:sync` from ~/dev/ to regenerate harness-specific files.
|
||||
Project-level context in .context/PROJECT.md layers on top of this. -->
|
||||
|
||||
## Who I am
|
||||
|
||||
I'm Mathias, a digital product manager and technology consultant based in Sweden.
|
||||
I build software, research emerging tech, and deliver consulting engagements
|
||||
for clients under NDA. I work across AI/ML, financial automation, web applications,
|
||||
and climate/sustainability tech.
|
||||
|
||||
## How I work with agents
|
||||
|
||||
- I think like a product manager — I care about *why* before *how*
|
||||
- I want agents to be opinionated and push back, not just execute blindly
|
||||
- I prefer concise responses; skip ceremony and get to the point
|
||||
- When I say "build this", I mean production-quality with tests, not a demo
|
||||
- Ask me before making irreversible changes or adding heavy dependencies
|
||||
- I work with confidential client data — never send it to cloud APIs unless I explicitly say it's OK
|
||||
|
||||
## Behavior rules
|
||||
|
||||
These rules apply to every task across every project, regardless of harness.
|
||||
|
||||
0. **Pre-task ritual — before ANY implementation (non-negotiable).** Run this before writing a single line:
|
||||
- **Query the brain** (`brain_query`) for the domain + symptom. If the result changes your approach, surface it before acting. 5 seconds beats 5 hours.
|
||||
- **Load the relevant skill** — see trigger table in *Engineering Skills* below.
|
||||
- **Write the failing test first.** Name the test before the function. If the target is untestable (e.g. `main()` wiring), extract the logic into a testable function first. No implementation without a red test.
|
||||
- **State the observable success criterion** — what specific behavior, output, or passing test proves this is done?
|
||||
|
||||
**TDD is non-negotiable.** "Tests pass" is not proof of correctness — only proof the tests ran. Write tests that would catch the bug before writing code that fixes it.
|
||||
|
||||
1. **No assumptions.** Don't hide confusion — surface it. Surface tradeoffs explicitly.
|
||||
Think before coding; if the problem is unclear, ask or state assumptions before acting.
|
||||
2. **Minimum viable code.** Solve with the smallest change that works. Nothing
|
||||
speculative, no "while we're here" cleanups, no premature abstractions. Simplicity first.
|
||||
3. **Surgical changes.** Touch only what the task requires. Leave unrelated code,
|
||||
files, and formatting alone. Diffs should be small and reviewable.
|
||||
4. **Goal-driven execution.** Define clear success criteria up front for every task.
|
||||
Loop — implement, verify, refine — until those criteria are met. Don't claim
|
||||
completion without evidence (tests pass, command output, observed behavior).
|
||||
5. **Trunk-Based Development — commit directly to main.** Every commit is one
|
||||
logical change (one tool, one fix, one test) with passing tests. Main is always
|
||||
deployable. Never create long-lived feature branches.
|
||||
|
||||
**Exception — parallel agents on same repo:** If another agent is known to be
|
||||
actively working on the same repo simultaneously, create a short-lived branch
|
||||
(`agent/<description>`), finish the task, and merge to main within the same
|
||||
session. Do not leave agent branches open between sessions.
|
||||
|
||||
**Exception — external contributor or client four-eyes requirement:** Use
|
||||
PR flow only when a human reviewer outside the project is required. Document
|
||||
the reason in PROJECT.md.
|
||||
|
||||
6. **Close the loop — every substantive task ends with the same ritual.** Shipping
|
||||
the code is not the end of the task; capturing it is. Run this unprompted:
|
||||
- **Tag + bump SemVer** on the change (annotated tag; minor for a feature or
|
||||
new/changed ADR, patch for a fix; docs in the same commit). Check the repo's
|
||||
actual last tag — stated versions in docs drift stale.
|
||||
- **Push** main and the tag (CI is the gate).
|
||||
- **Persist generalizable learnings to the brain** (`brain_write`, wing/hall) —
|
||||
the reusable patterns and the footguns that would bite anyone again, never
|
||||
project status. See *Knowledge base — when to write* below.
|
||||
- **File discovered-but-deferred work as tracker issues** on the project's own
|
||||
repo — token-budget gaps, recorded ADR limitations, v2 follow-ups. Don't let
|
||||
"out of scope, recorded" rot in a commit message; make it a ticket with a
|
||||
source pointer.
|
||||
- Surface the brain entries and issue numbers in the closing summary so the
|
||||
trail is auditable.
|
||||
|
||||
## Default stack
|
||||
|
||||
| Layer | Default | Fallback | Last resort |
|
||||
|-------|---------|----------|-------------|
|
||||
| Language | Go | Python | TypeScript, Java, C |
|
||||
| UI | HTMX + Templ | Server-rendered HTML | React (only if SPA is justified) |
|
||||
| Build | Task (taskfile.dev) | Make | — |
|
||||
| Containers | Docker Compose (dev), k3s (prod) | — | — |
|
||||
| DB | PostgreSQL + sqlc | SQLite | — |
|
||||
| Search | pgvector (vector), BM25 | Qdrant (when >1M vectors or hybrid retrieval) | — |
|
||||
| Logging | slog (structured) | — | — |
|
||||
| Testing | Table-driven, testify | — | — |
|
||||
| Agents (Go) | google.golang.org/adk + pkg/litellm adapter | — | — |
|
||||
|
||||
Exploratory: Rust, Zig — I'll tell you when I want these.
|
||||
|
||||
## Code conventions
|
||||
|
||||
- **Go style**: golines, gofumpt, golangci-lint
|
||||
- **Errors**: `fmt.Errorf("operation: %w", err)` — never naked, never log-and-return
|
||||
- **Naming**: stdlib conventions, no stuttering
|
||||
- **Architecture**: prefer stdlib over frameworks, constructor injection, env-var config parsed into typed structs
|
||||
- **Git**: conventional commits (`feat:`, `fix:`, `chore:`), commit directly to main,
|
||||
one logical change per commit, CI is the quality gate
|
||||
- **Never**: long-lived feature branches, PRs for solo work, direct push without
|
||||
passing `task check` locally first
|
||||
- **Security**: no secrets in code, govulncheck before adding deps, SOPS for encrypted config
|
||||
- **Dependencies**: prefer stdlib. testify, slog, templ, sqlc, google.golang.org/adk (agent projects only) are pre-approved; anything else needs justification in the commit message
|
||||
|
||||
## Secret handling (every harness, every command)
|
||||
|
||||
Tool output is persisted: terminal → `~/.claude/projects` transcripts →
|
||||
claudewatcher → brain/wiki → gitea history. A secret printed once is
|
||||
searchable forever, and clearing it means rotating the key. So:
|
||||
|
||||
1. **Never print, echo, log, or transform a secret to inspect it.** No
|
||||
`base64`/`xxd`/`cat` of a key, and never pipe a secret through a transform
|
||||
to defeat `op run`'s output masking (it masks raw values; base64 hides them
|
||||
from the mask — that exact trick leaked a key on 2026-06-11).
|
||||
2. **Secrets stay in the subprocess.** Reference them only as env vars consumed
|
||||
*inside* `op run --env-file ~/.op-env -- <cmd>`. Never place a literal secret
|
||||
in a command's argv (it lands in the tool call and the transcript).
|
||||
3. **Existence check without revealing the value:** `[ -n "$X" ] && echo set` —
|
||||
never `${X:-...}` (returns the value when set) and never echo a substring of it.
|
||||
4. **Cross-host secrets:** run the secret-consuming command on the host that has
|
||||
the secret; do not forward a raw key over ssh argv/stdout.
|
||||
5. If a secret does leak into output, say so immediately and flag it for rotation —
|
||||
don't bury it.
|
||||
|
||||
## Infrastructure
|
||||
|
||||
Three machines on Tailscale:
|
||||
|
||||
| Machine | Role | Key specs |
|
||||
|---------|------|-----------|
|
||||
| koala | GPU inference, heavy compute | RTX 5070, runs k3s + llama-swap + shared postgres18/pgvector |
|
||||
| iguana | Services, builds | M2 Ultra Mac |
|
||||
| flamingo | Daily driver, edge | Mac mini, ~/dev is here |
|
||||
|
||||
- **Model routing**: LiteLLM in front of llama-swap (local) + cloud APIs (when permitted)
|
||||
- **Orchestration**: k3s cluster across all three machines
|
||||
- **Networking**: Tailscale mesh
|
||||
|
||||
## Project landscape
|
||||
|
||||
All development repos live at `~/dev/` (softlink from `~/Documents/local-dev/`).
|
||||
|
||||
Organized in thematic folders:
|
||||
|
||||
| Folder | Focus | Count |
|
||||
|--------|-------|-------|
|
||||
| `GO/` | Go web frameworks, API integrations, learning projects | ~10 |
|
||||
| `AI/` | ML research, AI frameworks (FinRL, DSPy, crawl4ai) | ~6 |
|
||||
| `AGENTS/` | Autonomous agents, coding agents, MCP servers, infra | ~15 |
|
||||
| `QKX/` | Invoice processing, financial automation, payment systems | ~13 |
|
||||
| `XT/` | Climate data, sustainability (Klimatkollen, Garbo) | ~2 |
|
||||
|
||||
See `~/dev/PROJECT_SUMMARY.md` for detailed descriptions of each project.
|
||||
|
||||
### Key active projects
|
||||
|
||||
- **super-koala** (`AGENTS/`) — multi-component agent stack with LangGraph, DSPy, MCP
|
||||
- **azure-tiger** (`QKX/`) — invoice extraction → ISO 20022 payment instructions
|
||||
- **gocrwl** (`AGENTS/`) — Go web crawler with containerized deployment
|
||||
- **koala-ai-stack** (`AGENTS/`) — local AI server infrastructure management
|
||||
- **klimatkollen** (`XT/`) — Swedish municipal climate data platform
|
||||
|
||||
## Knowledge base — actively use it
|
||||
|
||||
A persistent brain (BM25 search + LLM-synthesised Q&A) survives across sessions,
|
||||
hosts, and harnesses. It holds 100+ hard-won entries: infra incident postmortems,
|
||||
Go pitfalls, framework gotchas, design principles, ADRs. **It is not optional
|
||||
reference material — query it actively, not just when explicitly told.**
|
||||
|
||||
### When to query (treat as a reflex)
|
||||
|
||||
- **Before** starting a non-trivial task — search for prior art with the symptom
|
||||
AND the system component ("how did we solve X in Y?"). 5 seconds beats 5 hours.
|
||||
- **When debugging** — search for the error string, the stack frame, the affected
|
||||
service. Past you may have already paid this tax.
|
||||
- **Before adopting** a pattern, library, framework, or model name — check if it
|
||||
was tried and rejected, or what the integration footguns are.
|
||||
- **When making architectural decisions** — search for the domain + "ADR" or
|
||||
"decision" to find prior reasoning before re-deriving it.
|
||||
- **When a recommendation feels novel** — challenge yourself: "has this been
|
||||
documented?" The brain often has it.
|
||||
|
||||
### When to write
|
||||
|
||||
After you discover something that **future-you would forget** and that **isn't
|
||||
recoverable from the code, git log, or PR description alone**:
|
||||
|
||||
- Bugs whose root cause is non-obvious and generalisable beyond this project.
|
||||
- Framework / library / model-name quirks that bit you and would bite anyone.
|
||||
- Design principles validated under fire (e.g. "every `_get` needs a `_list`").
|
||||
- Postmortems for incidents: what broke, why, how diagnosed, what to do next time.
|
||||
|
||||
DON'T write project status, sprint progress, PR summaries, or "what I did this
|
||||
session" — those rot fast and the originals are in git/gitea anyway. Brain
|
||||
entries that age well are about *why*, *how to avoid*, and *what to do when*.
|
||||
|
||||
### How to access (per harness)
|
||||
|
||||
| Harness | Query | Write |
|
||||
|---------|-------|-------|
|
||||
| **Claude Code, Claude Desktop** | `brain_query` (BM25), `brain_answer` (LLM-synth + sources) MCP tools | `brain_write` MCP tool |
|
||||
| **Crush, Pi, Antigravity, other MCP-capable** | same MCP server: `ingestion-brain` (via the `mcp__*_brain__*` namespace once authenticated) | same |
|
||||
| **Anything HTTP-only (curl, scripts)** | `POST https://brain-mcp.d-ma.be/query` with `{"query":"..."}` (auth via `BRAIN_MCP_TOKEN`) | `POST .../write` with `{"content":"...","filename":"..."}` |
|
||||
| **Browser / human inspection** | `https://git.d-ma.be/mathias/hyperguild` → `knowledge/` and `wiki/` markdown files |
|
||||
|
||||
- **Scoping**: defaults to `public` collection; client projects filter to `{client}` + `public`.
|
||||
- **Routing**: brain_answer's LLM uses berget.ai as primary, iguana ollama as
|
||||
fallback. Both are configurable in the `supervisor/ingestion-deployment.yaml`
|
||||
on the koala k3s cluster; don't hardcode local-only model names into the
|
||||
berget URL (see knowledge entry on namespace mismatches).
|
||||
|
||||
### Quick reflex checks
|
||||
|
||||
If you find yourself about to say any of these out loud, you owe yourself a brain query first:
|
||||
|
||||
- "I think the issue might be..."
|
||||
- "Let me try X and see..."
|
||||
- "I'll just write a script to..."
|
||||
- "This is probably a new bug..."
|
||||
- "Has anyone done this before?" — *yes, probably, go check.*
|
||||
|
||||
## Client work rules
|
||||
|
||||
When working on a project tagged with a client name:
|
||||
1. Never send code, data, or context to cloud APIs — use local models only
|
||||
2. Never reference other client projects or their data
|
||||
3. Keep all artifacts within the client's git org / directory
|
||||
4. Treat everything as confidential unless told otherwise
|
||||
|
||||
## Harness-agnostic principles
|
||||
|
||||
This context is designed to work with any AI coding tool:
|
||||
- Claude Code, Cursor, Aider, Open WebUI, Charmbracelet Mods/Crush
|
||||
- Pi Coding Agent, Mistral Vibe, Antigravity
|
||||
- Any tool that accepts a system prompt or reads a markdown context file
|
||||
|
||||
The canonical source is always `.context/AGENT.md` (root) and `.context/PROJECT.md` (per-project).
|
||||
Derived files are committed (see *How context propagates* below) so a `git pull` on any host yields full agent context with no setup.
|
||||
|
||||
## How context propagates
|
||||
|
||||
Canonical sources of truth:
|
||||
- Universal: `~/dev/.context/AGENT.md` (this file)
|
||||
- Project: `<repo>/.context/PROJECT.md` (per-repo)
|
||||
|
||||
Derived files (committed, regenerated by `task context:sync`):
|
||||
- `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `.aider.conventions.md`,
|
||||
`.context/system-prompt.txt`
|
||||
|
||||
Workflow:
|
||||
1. Edit a canonical file. Run `task context:sync`. Commit canonical and
|
||||
derived together. Push.
|
||||
2. On any other host, `git pull` brings both. Claude Code (tree-walking)
|
||||
uses `CLAUDE.md`; Crush / Pi / Antigravity (cwd-only) use `AGENTS.md`;
|
||||
Cursor uses `.cursorrules`; Aider uses `.aider.conventions.md`.
|
||||
3. `task check` runs `context:sync` then asserts `git status --porcelain`
|
||||
is empty over the derived files (catches both modified-tracked drift
|
||||
and missing-untracked adapters). A drift fails the check with a
|
||||
message telling you to stage the regenerated files.
|
||||
|
||||
Behavior rules in this file and per-project rules in `PROJECT.md` apply
|
||||
unconditionally on every host, every harness.
|
||||
|
||||
## Engineering Skills
|
||||
|
||||
Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Clone it to `~/dev/skills/` and run `SKILLS_CHECKOUT_DIR="$PWD" bash install.sh` there to wire every skill into your harnesses (Claude Code, Crush, Antigravity, Mistral Vibe) as native, on-demand skills. (Use `install.sh`, not `task install` — the latter is currently broken, skills#7.) Load at task start — not "on demand" but on schedule, before writing code. Browse `~/dev/skills/SKILLS_INDEX.md` for the full list.
|
||||
|
||||
**Skill trigger table — load before starting, not after getting stuck:**
|
||||
|
||||
| Task type | Load |
|
||||
|-----------|------|
|
||||
| Any feature or bug fix | `tdd` |
|
||||
| Refactor or design | `clean-code` or `solid` |
|
||||
| Debug | `problem-analysis` |
|
||||
| Review code or PRs | `code-review` |
|
||||
| Frame a problem before coding | `problem-analysis` |
|
||||
|
||||
---
|
||||
|
||||
# cad-atlas
|
||||
|
||||
## Identity
|
||||
|
||||
- **Name**: cad-atlas
|
||||
- **Owner**: Mathias
|
||||
- **Client**: personal
|
||||
- **Repo**: git.d-ma.be/mathias/cad-atlas
|
||||
- **Status**: active
|
||||
- **Stack**: Go + Templ + HTMX + CDN Tailwind (template-go-web). Cross-project conventions: `~/dev/.context/AGENT.md`.
|
||||
|
||||
## What this is
|
||||
|
||||
A visual **atlas of the Continuous Agentic Development (CAD) workflow** — the full path
|
||||
from a captured signal to a deployed k3s pod, one screen, reel-style ("From Signal to Pod").
|
||||
It exists to (a) make the homelab's agentic delivery pipeline legible to a human, and
|
||||
(b) render the CAD **audit chain** — which doubles as the regulated-industry audit artifact.
|
||||
|
||||
> **Core thesis:** the CAD audit chain *is* the visualization data.
|
||||
> `TELOS → goal → spec → issue → execution → attestation → deploy` is both the trace and
|
||||
> the audit package. Phase C renders it once and serves two masters (observability + compliance).
|
||||
|
||||
## Phases
|
||||
|
||||
- **Phase A — static hero viz** (current). Self-contained `internal/web/static/cad-atlas.html`,
|
||||
data-driven from a hand-authored `STAGES` array (ground-truth snapshot from brain, 2026-07-19).
|
||||
Served at `/` by `internal/web/handler.go` via `go:embed`. Reel-parity: SVG spine with
|
||||
arrowheads, animated pulse, dashed **feedback bus** (stage 08 → TELOS), replay + slow-mo.
|
||||
- **Phase B — generated-from-source**. Parse brain docs + `.gitea/workflows` + infra manifests
|
||||
→ render the graph so it can't drift from config.
|
||||
- **Phase C — live trace viewer**. Replace the static `STAGES` array with live reads of the
|
||||
`assessor-loop` attestation ledger + brain `session_log` + Gitea run API + Flux events.
|
||||
This is the prize: a real signal→pod trace viewer that is also the audit package.
|
||||
|
||||
## The workflow it visualizes (9 stages)
|
||||
|
||||
`00 Signals` (Applied AI Radar → mathias/signals) → `01 TELOS` (intention substrate) →
|
||||
`02 Strategic session` (claude.ai frontier + LLM Council + Autoresearch Council) →
|
||||
`03 Spec → Gitea issue` (agent-ready contract; Ed25519 admission #36; **var-go Oath**) →
|
||||
`04 Human dispatch gate` (the only checkpoint; session-dispatch bridge → cad-dispatch.yml) →
|
||||
`05 Execute · agentsquad` (serve/taskqueue, exec+review loop, risk LOW/MED/HIGH, dma-cli routing,
|
||||
assessor-loop ledger) → `06 PR → CI` (go test/vet/lint/govulncheck + **var-go/oath gate**) →
|
||||
`07 CD → pod` (Flux GitOps → k3s on koala) → `08 Loop back` (outcome scored vs TELOS goal).
|
||||
|
||||
### Three orthogonal governance gates
|
||||
|
||||
| Gate | Guards | Where |
|
||||
|---|---|---|
|
||||
| Ed25519 admission controller (#36) | spec **integrity** (issue untampered) | stage 03 |
|
||||
| dispatch-allow (`.dispatch-allow` + `mathias/dispatch` allowlist) | repo **eligibility** (may agents run here) | stage 04/05 |
|
||||
| **var-go Oath** (`cmd/vargo-gate`, commit status `var-go/oath`) | output **correctness** (PR satisfies the Oath; floor over reviewer, anti-rubber-stamp #55) | stage 06 |
|
||||
|
||||
## Dogfooding
|
||||
|
||||
This repo is built *through* the workflow it depicts. It is `dispatch-allow`-enabled, and its
|
||||
own build increments are governed by a **var-go Oath** embedded in their spec issues (see the
|
||||
Stage-03 tracking issue). Bootstrapping honesty (per swedsl honest-stub discipline): the Oath is
|
||||
**defined** but `cmd/vargo-gate` is **not yet wired** into this repo's CI — until it is, the Oath
|
||||
is advisory here. Wiring it is a first tracked task; disclosed in code, this doc, and CI config.
|
||||
|
||||
## Brain references (source of truth — `brain_get <path>`)
|
||||
|
||||
- `wiki/homelab/decisions/cad-atlas-audit-chain-is-viz-data.md` — **this project's genesis note**: the audit-chain-is-viz-data thesis, the three gates, template-go-web footguns
|
||||
- `wiki/homelab/decisions/inception-sprint-and-oath.md` — the Inception Sprint + Oath methodology (this repo's birth is the worked example); see [`docs/INCEPTION-OATH.md`](docs/INCEPTION-OATH.md) for the kept Oath
|
||||
- `knowledge/workflow-idea-to-running-service.md` — Double Diamond idea→service workflow
|
||||
- `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16.md` — CAD definition
|
||||
- `wiki/agentsquad/decisions/cad-dispatch-bridge.md` — claude.ai → agentsquad trigger path
|
||||
- `wiki/agentsquad/facts/llm-council-design-and-first-runs-2026-06-21.md` — LLM Council
|
||||
- `wiki/agentsquad/decisions/autoresearch-council-sibling-pipe.md` — Autoresearch Council
|
||||
- `wiki/agentsquad/decisions/serve-http-task-api.md` — agentsquad serve/taskqueue
|
||||
- `knowledge/var-go-anchor-to-span-spike-verdict.md` — var-go runner + CAD gate seam
|
||||
- `knowledge/swedsl-vargo-sprint1-enforcement-teeth-verdict.md` — vargo-gate enforcement teeth
|
||||
- `wiki/assessor-loop/decisions/assessor-loop-genesis.md` — attestation ledger (Phase C source)
|
||||
- `wiki/homelab/facts/homelab-network-topology-reference.md` — koala/iguana/flamingo/piguard
|
||||
|
||||
## External references
|
||||
|
||||
- Inspiration reel — "From Inbox to Shipped" pipeline viz: https://www.instagram.com/reel/DY92L7bu27j/
|
||||
- karpathy/llm-council — origin of the Council pattern
|
||||
- Double Diamond design process (Discover/Define/Develop/Deliver)
|
||||
|
||||
## Run
|
||||
|
||||
```bash
|
||||
task check # lint + vet + test (CI gate)
|
||||
task run # build + serve at http://localhost:8080 → the atlas
|
||||
```
|
||||
|
||||
## Deploy note
|
||||
|
||||
CD (`.gitea/workflows/cd.yml`) deploys to k3s namespace `cad-atlas` via Flux. Per the known
|
||||
template-go-agent CD gap: the `deploy` job stays RED until `mathias/infra` has
|
||||
`k3s/apps/cad-atlas/deployment.yaml`. `check` + `build` are the real bootstrap gate.
|
||||
+100
-24
@@ -53,14 +53,30 @@ These rules apply to every task across every project, regardless of harness.
|
||||
logical change (one tool, one fix, one test) with passing tests. Main is always
|
||||
deployable. Never create long-lived feature branches.
|
||||
|
||||
**Exception — parallel agents on same repo:** If another agent is known to be
|
||||
actively working on the same repo simultaneously, create a short-lived branch
|
||||
(`agent/<description>`), finish the task, and merge to main within the same
|
||||
session. Do not leave agent branches open between sessions.
|
||||
**The PR trigger is RISK, not concurrency.** `risk/low` work commits straight to
|
||||
main with CI as the gate — that is most work and is unchanged. `risk/medium` and
|
||||
above opens a PR, even solo, even with nobody waiting to review it. This mirrors
|
||||
the tiered merge model in `assessor-loop`
|
||||
`method/transfer-to-a-regulated-organisation.md` §4.1, so the estate practises
|
||||
what it sells instead of merging everything on green and claiming otherwise.
|
||||
|
||||
**Exception — external contributor or client four-eyes requirement:** Use
|
||||
PR flow only when a human reviewer outside the project is required. Document
|
||||
the reason in PROJECT.md.
|
||||
**Concurrency is NOT a reason to branch.** Measured 2026-08-29 across three real
|
||||
collisions between parallel sessions: two were not branching problems at all — a
|
||||
generated artifact written to the same path by both (branching turns that into a
|
||||
merge conflict on a 33k-line JSON), and uncommitted work in a shared checkout
|
||||
(a per-session worktree fixes it) — and the third was an ordinary non-fast-forward
|
||||
push resolved by rebase in seconds. Use a worktree per session on shared repos and
|
||||
timestamp generated artifacts. Do not reach for a branch.
|
||||
|
||||
Branch+PR flow carries documented costs on solo repos: merging auto-closes gated
|
||||
issues, review comments live on a thread separate from the issue's, and a
|
||||
merged-and-deleted branch cannot be amended (brain:
|
||||
`gitea-pr-merge-autoclose-and-review-comment-footguns`). Those are the price of
|
||||
the `risk/medium`+ lane — paid deliberately, not incurred by accident.
|
||||
|
||||
**Exception — external contributor or client four-eyes requirement:** Use PR flow
|
||||
when a human reviewer outside the project is required. Document the reason in
|
||||
PROJECT.md.
|
||||
|
||||
6. **Close the loop — every substantive task ends with the same ritual.** Shipping
|
||||
the code is not the end of the task; capturing it is. Run this unprompted:
|
||||
@@ -78,6 +94,26 @@ These rules apply to every task across every project, regardless of harness.
|
||||
- Surface the brain entries and issue numbers in the closing summary so the
|
||||
trail is auditable.
|
||||
|
||||
**Chat is not a durable store. Never rely on Mathias remembering anything.**
|
||||
Every gap, caveat, risk, open question and next step must land in one of four
|
||||
places before the turn ends: **the brain**, **a repo** (code, docs, ADR),
|
||||
**a tracker issue**, or **a plan file**. A finding stated only in conversation is
|
||||
lost the moment the session closes — and this estate has repeatedly proved that a
|
||||
remembered convention is an unreliable control.
|
||||
|
||||
This applies hardest to what is tempting to leave as a closing remark: "worth
|
||||
knowing X isn't enforced yet", "this is a convention, not a gate", "we should
|
||||
revisit Y". Those are exactly the items that need a locator. If it is worth
|
||||
saying in a summary, it is worth writing where it can be found again without you.
|
||||
|
||||
## CAD sprint patterns
|
||||
|
||||
Two CAD sprint archetypes (defs: brain `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16`):
|
||||
- **Inception Sprint** — birth a new repo. Oath-gated close; tag only once every clause holds. Brain: `.../inception-sprint-and-oath`.
|
||||
- **Sweep Sprint** — clear an existing backlog. Parallel read-only research per issue → sequential one-issue-per-commit execution. Brain: `.../sweep-sprint-and-oath`.
|
||||
|
||||
Shared: decisions that are yours, not the agent's, surface as `DECISION NEEDED` (question/options/recommendation/blocks) — ask live if you're present, else comment and wait, never act past it. Live-breaking regressions get `git revert`, never forward-fixed; host-network work skips even read-only research (solo, synchronous, you present). Rule 6's closing ritual only fires once every Oath clause genuinely holds — blocked = descoped-and-tracked, never marked done.
|
||||
|
||||
## Default stack
|
||||
|
||||
| Layer | Default | Fallback | Last resort |
|
||||
@@ -88,7 +124,7 @@ These rules apply to every task across every project, regardless of harness.
|
||||
| Containers | Docker Compose (dev), k3s (prod) | — | — |
|
||||
| DB | PostgreSQL + sqlc | SQLite | — |
|
||||
| Search | pgvector (vector), BM25 | Qdrant (when >1M vectors or hybrid retrieval) | — |
|
||||
| Logging | slog (structured) | — | — |
|
||||
| Logging | slog (structured) | stdlib `logging` w/ structured `extra=` (or structlog) | — |
|
||||
| Testing | Table-driven, testify | — | — |
|
||||
| Agents (Go) | google.golang.org/adk + pkg/litellm adapter | — | — |
|
||||
|
||||
@@ -97,7 +133,12 @@ Exploratory: Rust, Zig — I'll tell you when I want these.
|
||||
## Code conventions
|
||||
|
||||
- **Go style**: golines, gofumpt, golangci-lint
|
||||
- **Errors**: `fmt.Errorf("operation: %w", err)` — never naked, never log-and-return
|
||||
- **Python style** (fallback language): ruff (format+lint, one tool), mypy --strict (non-negotiable,
|
||||
matches Go's static typing discipline), pytest + pytest-cov (table-driven via
|
||||
`@pytest.mark.parametrize`), uv (venv+deps+lock, one tool), pydantic-settings (typed env-var config
|
||||
— same principle as Go's typed structs), src-layout + `pyproject.toml` only (no `setup.py`)
|
||||
- **Errors**: `fmt.Errorf("operation: %w", err)` — never naked, never log-and-return.
|
||||
Python: `raise X from e` (exception chaining, same principle) — never bare `except`, never silent `pass`
|
||||
- **Naming**: stdlib conventions, no stuttering
|
||||
- **Architecture**: prefer stdlib over frameworks, constructor injection, env-var config parsed into typed structs
|
||||
- **Git**: conventional commits (`feat:`, `fix:`, `chore:`), commit directly to main,
|
||||
@@ -135,10 +176,10 @@ Three machines on Tailscale:
|
||||
|---------|------|-----------|
|
||||
| koala | GPU inference, heavy compute | RTX 5070, runs k3s + llama-swap + shared postgres18/pgvector |
|
||||
| iguana | Services, builds | M2 Ultra Mac |
|
||||
| flamingo | Daily driver, edge | Mac mini, ~/dev is here |
|
||||
| flamingo | Daily driver, edge | Apple Silicon Mac, ~/dev is here |
|
||||
|
||||
- **Model routing**: LiteLLM in front of llama-swap (local) + cloud APIs (when permitted)
|
||||
- **Orchestration**: k3s cluster across all three machines
|
||||
- **Orchestration**: k3s on koala only — single control-plane node, no workers (verified 2026-08-30). iguana and flamingo are on the tailnet but are not cluster members
|
||||
- **Networking**: Tailscale mesh
|
||||
|
||||
## Project landscape
|
||||
@@ -234,10 +275,11 @@ When working on a project tagged with a client name:
|
||||
|
||||
## Harness-agnostic principles
|
||||
|
||||
This context is designed to work with any AI coding tool:
|
||||
- Claude Code, Cursor, Aider, Open WebUI, Charmbracelet Mods/Crush
|
||||
- Pi Coding Agent, Mistral Vibe, Antigravity
|
||||
- Any tool that accepts a system prompt or reads a markdown context file
|
||||
Supported harnesses (2026-09-01) — Cursor and Aider were dropped; do not
|
||||
re-add adapters for them:
|
||||
- Claude Code, Antigravity, OpenCode, Mistral Vibe, Crush, Pi Coding Agent
|
||||
- Open WebUI, Charmbracelet Mods, or any tool that takes a system prompt string
|
||||
- Any other tool that reads `AGENTS.md`, which is the de facto convention
|
||||
|
||||
The canonical source is always `.context/AGENT.md` (root) and `.context/PROJECT.md` (per-project).
|
||||
Derived files are committed (see *How context propagates* below) so a `git pull` on any host yields full agent context with no setup.
|
||||
@@ -249,15 +291,29 @@ Canonical sources of truth:
|
||||
- Project: `<repo>/.context/PROJECT.md` (per-repo)
|
||||
|
||||
Derived files (committed, regenerated by `task context:sync`):
|
||||
- `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `.aider.conventions.md`,
|
||||
`.context/system-prompt.txt`
|
||||
- `CLAUDE.md`, `AGENTS.md`, `.context/system-prompt.txt`
|
||||
|
||||
Repos still carrying `.cursorrules`, `.aider.conventions.md` or
|
||||
`.aider.conf.yml` are stale: nothing regenerates them. Delete them the next time
|
||||
you touch the repo, along with their entries in that repo's `task check`
|
||||
assertion.
|
||||
|
||||
Workflow:
|
||||
1. Edit a canonical file. Run `task context:sync`. Commit canonical and
|
||||
derived together. Push.
|
||||
2. On any other host, `git pull` brings both. Claude Code (tree-walking)
|
||||
uses `CLAUDE.md`; Crush / Pi / Antigravity (cwd-only) use `AGENTS.md`;
|
||||
Cursor uses `.cursorrules`; Aider uses `.aider.conventions.md`.
|
||||
2. On any other host, `git pull` brings both. Which file a harness reads does
|
||||
NOT split cleanly by lookup strategy, so do not reason from the strategy:
|
||||
- `CLAUDE.md` — Claude Code (walks up the tree)
|
||||
- `AGENTS.md` — Crush, Pi, Antigravity (cwd-only), OpenCode (project root,
|
||||
global at `~/.config/opencode/AGENTS.md`), and Mistral Vibe, which **walks
|
||||
up** from cwd and takes the first `AGENTS.md` it finds
|
||||
(user-level `~/.vibe/AGENTS.md`)
|
||||
- `.context/system-prompt.txt` — Open WebUI, Mods, raw API calls; not read by
|
||||
any harness, it is for pasting
|
||||
|
||||
Vibe tree-walks for `AGENTS.md`, so "tree-walkers use CLAUDE.md" is false.
|
||||
Each repo's `AGENTS.md` embeds the canonical and is the first one found from
|
||||
inside that repo, so this works — but by construction, not by luck.
|
||||
3. `task check` runs `context:sync` then asserts `git status --porcelain`
|
||||
is empty over the derived files (catches both modified-tracked drift
|
||||
and missing-untracked adapters). A drift fails the check with a
|
||||
@@ -268,7 +324,20 @@ unconditionally on every host, every harness.
|
||||
|
||||
## Engineering Skills
|
||||
|
||||
Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Clone it to `~/dev/skills/` and run `SKILLS_CHECKOUT_DIR="$PWD" bash install.sh` there to wire every skill into your harnesses (Claude Code, Crush, Antigravity, Mistral Vibe) as native, on-demand skills. (Use `install.sh`, not `task install` — the latter is currently broken, skills#7.) Load at task start — not "on demand" but on schedule, before writing code. Browse `~/dev/skills/SKILLS_INDEX.md` for the full list.
|
||||
Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Load at task start — not "on demand" but on schedule, before writing code. Browse `SKILLS_INDEX.md` for the full list.
|
||||
|
||||
**Claude Code** installs the repo as a plugin from the marketplace the same repo hosts. That path also carries the `secret-guard` and `pre-task-ritual` hooks and the brain/gitea/infra MCP servers, which symlinks cannot:
|
||||
|
||||
```
|
||||
/plugin marketplace add https://git.d-ma.be/mathias/skills.git
|
||||
/plugin install skills@mathias
|
||||
```
|
||||
|
||||
Skills are **namespaced** under Claude Code: load `tdd` as `skills:tdd`. The trigger table below uses bare names — prefix them.
|
||||
|
||||
**Crush, Pi and OpenCode** have no plugin system and are wired by `install.sh` as one directory symlink per harness via `~/.agents/skills`. Do not clone the checkout into `~/dev`: that folder is iCloud-shared between the Macs and spans two path roots (`/Users/mathias` vs `/home/mathias` on koala), so a checkout there is a git working tree with two concurrent writers, and any absolute symlink stored in it is broken on one side by construction (skills#23). Leave `SKILLS_CHECKOUT_DIR` at its host-local default.
|
||||
|
||||
Check a host with `task doctor` in the skills repo; it also runs automatically at session start via the plugin.
|
||||
|
||||
**Skill trigger table — load before starting, not after getting stuck:**
|
||||
|
||||
@@ -338,9 +407,16 @@ assessor-loop ledger) → `06 PR → CI` (go test/vet/lint/govulncheck + **var-g
|
||||
|
||||
This repo is built *through* the workflow it depicts. It is `dispatch-allow`-enabled, and its
|
||||
own build increments are governed by a **var-go Oath** embedded in their spec issues (see the
|
||||
Stage-03 tracking issue). Bootstrapping honesty (per swedsl honest-stub discipline): the Oath is
|
||||
**defined** but `cmd/vargo-gate` is **not yet wired** into this repo's CI — until it is, the Oath
|
||||
is advisory here. Wiring it is a first tracked task; disclosed in code, this doc, and CI config.
|
||||
Stage-03 tracking issue). `cmd/vargo-gate` is wired into `.gitea/workflows/cd.yml`'s `oath` job —
|
||||
on every pull_request it fetches the linked issue's oath and gates cad-atlas's **own real
|
||||
candidate** (`oathcandidate/`, #8): it parses the committed `.gitea/workflows/cd.yml` and checks
|
||||
the `oath` job actually exists and invokes `cmd/vargo-gate`, then posts the `var-go/oath` commit
|
||||
status. This is a real check (TDD'd: passes on the real file, fails closed on a fixture missing
|
||||
the job), not swedsl's toy self-test stub — swedsl#35 (import path) and swedsl#38 (real-candidate
|
||||
subprocess gating) unblocked it. **Required by branch protection on `main`** (#8, closed
|
||||
2026-07-20), confirmed holding on a real PR. Direct pushes remain allowlisted for `mathias` per
|
||||
this repo's TBD convention. Disclosed in the CI config comment, this doc, and
|
||||
`docs/INCEPTION-OATH.md`.
|
||||
|
||||
## Brain references (source of truth — `brain_get <path>`)
|
||||
|
||||
|
||||
-375
@@ -1,375 +0,0 @@
|
||||
# Cursor rules — auto-generated
|
||||
# Do not edit. Run: task context:sync
|
||||
|
||||
# Agent context — Mathias workspace
|
||||
|
||||
<!-- Canonical root context for all AI coding agents.
|
||||
Lives at: ~/dev/.context/AGENT.md
|
||||
Applies to every project under ~/dev/ unless overridden.
|
||||
|
||||
Run `task context:sync` from ~/dev/ to regenerate harness-specific files.
|
||||
Project-level context in .context/PROJECT.md layers on top of this. -->
|
||||
|
||||
## Who I am
|
||||
|
||||
I'm Mathias, a digital product manager and technology consultant based in Sweden.
|
||||
I build software, research emerging tech, and deliver consulting engagements
|
||||
for clients under NDA. I work across AI/ML, financial automation, web applications,
|
||||
and climate/sustainability tech.
|
||||
|
||||
## How I work with agents
|
||||
|
||||
- I think like a product manager — I care about *why* before *how*
|
||||
- I want agents to be opinionated and push back, not just execute blindly
|
||||
- I prefer concise responses; skip ceremony and get to the point
|
||||
- When I say "build this", I mean production-quality with tests, not a demo
|
||||
- Ask me before making irreversible changes or adding heavy dependencies
|
||||
- I work with confidential client data — never send it to cloud APIs unless I explicitly say it's OK
|
||||
|
||||
## Behavior rules
|
||||
|
||||
These rules apply to every task across every project, regardless of harness.
|
||||
|
||||
0. **Pre-task ritual — before ANY implementation (non-negotiable).** Run this before writing a single line:
|
||||
- **Query the brain** (`brain_query`) for the domain + symptom. If the result changes your approach, surface it before acting. 5 seconds beats 5 hours.
|
||||
- **Load the relevant skill** — see trigger table in *Engineering Skills* below.
|
||||
- **Write the failing test first.** Name the test before the function. If the target is untestable (e.g. `main()` wiring), extract the logic into a testable function first. No implementation without a red test.
|
||||
- **State the observable success criterion** — what specific behavior, output, or passing test proves this is done?
|
||||
|
||||
**TDD is non-negotiable.** "Tests pass" is not proof of correctness — only proof the tests ran. Write tests that would catch the bug before writing code that fixes it.
|
||||
|
||||
1. **No assumptions.** Don't hide confusion — surface it. Surface tradeoffs explicitly.
|
||||
Think before coding; if the problem is unclear, ask or state assumptions before acting.
|
||||
2. **Minimum viable code.** Solve with the smallest change that works. Nothing
|
||||
speculative, no "while we're here" cleanups, no premature abstractions. Simplicity first.
|
||||
3. **Surgical changes.** Touch only what the task requires. Leave unrelated code,
|
||||
files, and formatting alone. Diffs should be small and reviewable.
|
||||
4. **Goal-driven execution.** Define clear success criteria up front for every task.
|
||||
Loop — implement, verify, refine — until those criteria are met. Don't claim
|
||||
completion without evidence (tests pass, command output, observed behavior).
|
||||
5. **Trunk-Based Development — commit directly to main.** Every commit is one
|
||||
logical change (one tool, one fix, one test) with passing tests. Main is always
|
||||
deployable. Never create long-lived feature branches.
|
||||
|
||||
**Exception — parallel agents on same repo:** If another agent is known to be
|
||||
actively working on the same repo simultaneously, create a short-lived branch
|
||||
(`agent/<description>`), finish the task, and merge to main within the same
|
||||
session. Do not leave agent branches open between sessions.
|
||||
|
||||
**Exception — external contributor or client four-eyes requirement:** Use
|
||||
PR flow only when a human reviewer outside the project is required. Document
|
||||
the reason in PROJECT.md.
|
||||
|
||||
6. **Close the loop — every substantive task ends with the same ritual.** Shipping
|
||||
the code is not the end of the task; capturing it is. Run this unprompted:
|
||||
- **Tag + bump SemVer** on the change (annotated tag; minor for a feature or
|
||||
new/changed ADR, patch for a fix; docs in the same commit). Check the repo's
|
||||
actual last tag — stated versions in docs drift stale.
|
||||
- **Push** main and the tag (CI is the gate).
|
||||
- **Persist generalizable learnings to the brain** (`brain_write`, wing/hall) —
|
||||
the reusable patterns and the footguns that would bite anyone again, never
|
||||
project status. See *Knowledge base — when to write* below.
|
||||
- **File discovered-but-deferred work as tracker issues** on the project's own
|
||||
repo — token-budget gaps, recorded ADR limitations, v2 follow-ups. Don't let
|
||||
"out of scope, recorded" rot in a commit message; make it a ticket with a
|
||||
source pointer.
|
||||
- Surface the brain entries and issue numbers in the closing summary so the
|
||||
trail is auditable.
|
||||
|
||||
## Default stack
|
||||
|
||||
| Layer | Default | Fallback | Last resort |
|
||||
|-------|---------|----------|-------------|
|
||||
| Language | Go | Python | TypeScript, Java, C |
|
||||
| UI | HTMX + Templ | Server-rendered HTML | React (only if SPA is justified) |
|
||||
| Build | Task (taskfile.dev) | Make | — |
|
||||
| Containers | Docker Compose (dev), k3s (prod) | — | — |
|
||||
| DB | PostgreSQL + sqlc | SQLite | — |
|
||||
| Search | pgvector (vector), BM25 | Qdrant (when >1M vectors or hybrid retrieval) | — |
|
||||
| Logging | slog (structured) | — | — |
|
||||
| Testing | Table-driven, testify | — | — |
|
||||
| Agents (Go) | google.golang.org/adk + pkg/litellm adapter | — | — |
|
||||
|
||||
Exploratory: Rust, Zig — I'll tell you when I want these.
|
||||
|
||||
## Code conventions
|
||||
|
||||
- **Go style**: golines, gofumpt, golangci-lint
|
||||
- **Errors**: `fmt.Errorf("operation: %w", err)` — never naked, never log-and-return
|
||||
- **Naming**: stdlib conventions, no stuttering
|
||||
- **Architecture**: prefer stdlib over frameworks, constructor injection, env-var config parsed into typed structs
|
||||
- **Git**: conventional commits (`feat:`, `fix:`, `chore:`), commit directly to main,
|
||||
one logical change per commit, CI is the quality gate
|
||||
- **Never**: long-lived feature branches, PRs for solo work, direct push without
|
||||
passing `task check` locally first
|
||||
- **Security**: no secrets in code, govulncheck before adding deps, SOPS for encrypted config
|
||||
- **Dependencies**: prefer stdlib. testify, slog, templ, sqlc, google.golang.org/adk (agent projects only) are pre-approved; anything else needs justification in the commit message
|
||||
|
||||
## Secret handling (every harness, every command)
|
||||
|
||||
Tool output is persisted: terminal → `~/.claude/projects` transcripts →
|
||||
claudewatcher → brain/wiki → gitea history. A secret printed once is
|
||||
searchable forever, and clearing it means rotating the key. So:
|
||||
|
||||
1. **Never print, echo, log, or transform a secret to inspect it.** No
|
||||
`base64`/`xxd`/`cat` of a key, and never pipe a secret through a transform
|
||||
to defeat `op run`'s output masking (it masks raw values; base64 hides them
|
||||
from the mask — that exact trick leaked a key on 2026-06-11).
|
||||
2. **Secrets stay in the subprocess.** Reference them only as env vars consumed
|
||||
*inside* `op run --env-file ~/.op-env -- <cmd>`. Never place a literal secret
|
||||
in a command's argv (it lands in the tool call and the transcript).
|
||||
3. **Existence check without revealing the value:** `[ -n "$X" ] && echo set` —
|
||||
never `${X:-...}` (returns the value when set) and never echo a substring of it.
|
||||
4. **Cross-host secrets:** run the secret-consuming command on the host that has
|
||||
the secret; do not forward a raw key over ssh argv/stdout.
|
||||
5. If a secret does leak into output, say so immediately and flag it for rotation —
|
||||
don't bury it.
|
||||
|
||||
## Infrastructure
|
||||
|
||||
Three machines on Tailscale:
|
||||
|
||||
| Machine | Role | Key specs |
|
||||
|---------|------|-----------|
|
||||
| koala | GPU inference, heavy compute | RTX 5070, runs k3s + llama-swap + shared postgres18/pgvector |
|
||||
| iguana | Services, builds | M2 Ultra Mac |
|
||||
| flamingo | Daily driver, edge | Mac mini, ~/dev is here |
|
||||
|
||||
- **Model routing**: LiteLLM in front of llama-swap (local) + cloud APIs (when permitted)
|
||||
- **Orchestration**: k3s cluster across all three machines
|
||||
- **Networking**: Tailscale mesh
|
||||
|
||||
## Project landscape
|
||||
|
||||
All development repos live at `~/dev/` (softlink from `~/Documents/local-dev/`).
|
||||
|
||||
Organized in thematic folders:
|
||||
|
||||
| Folder | Focus | Count |
|
||||
|--------|-------|-------|
|
||||
| `GO/` | Go web frameworks, API integrations, learning projects | ~10 |
|
||||
| `AI/` | ML research, AI frameworks (FinRL, DSPy, crawl4ai) | ~6 |
|
||||
| `AGENTS/` | Autonomous agents, coding agents, MCP servers, infra | ~15 |
|
||||
| `QKX/` | Invoice processing, financial automation, payment systems | ~13 |
|
||||
| `XT/` | Climate data, sustainability (Klimatkollen, Garbo) | ~2 |
|
||||
|
||||
See `~/dev/PROJECT_SUMMARY.md` for detailed descriptions of each project.
|
||||
|
||||
### Key active projects
|
||||
|
||||
- **super-koala** (`AGENTS/`) — multi-component agent stack with LangGraph, DSPy, MCP
|
||||
- **azure-tiger** (`QKX/`) — invoice extraction → ISO 20022 payment instructions
|
||||
- **gocrwl** (`AGENTS/`) — Go web crawler with containerized deployment
|
||||
- **koala-ai-stack** (`AGENTS/`) — local AI server infrastructure management
|
||||
- **klimatkollen** (`XT/`) — Swedish municipal climate data platform
|
||||
|
||||
## Knowledge base — actively use it
|
||||
|
||||
A persistent brain (BM25 search + LLM-synthesised Q&A) survives across sessions,
|
||||
hosts, and harnesses. It holds 100+ hard-won entries: infra incident postmortems,
|
||||
Go pitfalls, framework gotchas, design principles, ADRs. **It is not optional
|
||||
reference material — query it actively, not just when explicitly told.**
|
||||
|
||||
### When to query (treat as a reflex)
|
||||
|
||||
- **Before** starting a non-trivial task — search for prior art with the symptom
|
||||
AND the system component ("how did we solve X in Y?"). 5 seconds beats 5 hours.
|
||||
- **When debugging** — search for the error string, the stack frame, the affected
|
||||
service. Past you may have already paid this tax.
|
||||
- **Before adopting** a pattern, library, framework, or model name — check if it
|
||||
was tried and rejected, or what the integration footguns are.
|
||||
- **When making architectural decisions** — search for the domain + "ADR" or
|
||||
"decision" to find prior reasoning before re-deriving it.
|
||||
- **When a recommendation feels novel** — challenge yourself: "has this been
|
||||
documented?" The brain often has it.
|
||||
|
||||
### When to write
|
||||
|
||||
After you discover something that **future-you would forget** and that **isn't
|
||||
recoverable from the code, git log, or PR description alone**:
|
||||
|
||||
- Bugs whose root cause is non-obvious and generalisable beyond this project.
|
||||
- Framework / library / model-name quirks that bit you and would bite anyone.
|
||||
- Design principles validated under fire (e.g. "every `_get` needs a `_list`").
|
||||
- Postmortems for incidents: what broke, why, how diagnosed, what to do next time.
|
||||
|
||||
DON'T write project status, sprint progress, PR summaries, or "what I did this
|
||||
session" — those rot fast and the originals are in git/gitea anyway. Brain
|
||||
entries that age well are about *why*, *how to avoid*, and *what to do when*.
|
||||
|
||||
### How to access (per harness)
|
||||
|
||||
| Harness | Query | Write |
|
||||
|---------|-------|-------|
|
||||
| **Claude Code, Claude Desktop** | `brain_query` (BM25), `brain_answer` (LLM-synth + sources) MCP tools | `brain_write` MCP tool |
|
||||
| **Crush, Pi, Antigravity, other MCP-capable** | same MCP server: `ingestion-brain` (via the `mcp__*_brain__*` namespace once authenticated) | same |
|
||||
| **Anything HTTP-only (curl, scripts)** | `POST https://brain-mcp.d-ma.be/query` with `{"query":"..."}` (auth via `BRAIN_MCP_TOKEN`) | `POST .../write` with `{"content":"...","filename":"..."}` |
|
||||
| **Browser / human inspection** | `https://git.d-ma.be/mathias/hyperguild` → `knowledge/` and `wiki/` markdown files |
|
||||
|
||||
- **Scoping**: defaults to `public` collection; client projects filter to `{client}` + `public`.
|
||||
- **Routing**: brain_answer's LLM uses berget.ai as primary, iguana ollama as
|
||||
fallback. Both are configurable in the `supervisor/ingestion-deployment.yaml`
|
||||
on the koala k3s cluster; don't hardcode local-only model names into the
|
||||
berget URL (see knowledge entry on namespace mismatches).
|
||||
|
||||
### Quick reflex checks
|
||||
|
||||
If you find yourself about to say any of these out loud, you owe yourself a brain query first:
|
||||
|
||||
- "I think the issue might be..."
|
||||
- "Let me try X and see..."
|
||||
- "I'll just write a script to..."
|
||||
- "This is probably a new bug..."
|
||||
- "Has anyone done this before?" — *yes, probably, go check.*
|
||||
|
||||
## Client work rules
|
||||
|
||||
When working on a project tagged with a client name:
|
||||
1. Never send code, data, or context to cloud APIs — use local models only
|
||||
2. Never reference other client projects or their data
|
||||
3. Keep all artifacts within the client's git org / directory
|
||||
4. Treat everything as confidential unless told otherwise
|
||||
|
||||
## Harness-agnostic principles
|
||||
|
||||
This context is designed to work with any AI coding tool:
|
||||
- Claude Code, Cursor, Aider, Open WebUI, Charmbracelet Mods/Crush
|
||||
- Pi Coding Agent, Mistral Vibe, Antigravity
|
||||
- Any tool that accepts a system prompt or reads a markdown context file
|
||||
|
||||
The canonical source is always `.context/AGENT.md` (root) and `.context/PROJECT.md` (per-project).
|
||||
Derived files are committed (see *How context propagates* below) so a `git pull` on any host yields full agent context with no setup.
|
||||
|
||||
## How context propagates
|
||||
|
||||
Canonical sources of truth:
|
||||
- Universal: `~/dev/.context/AGENT.md` (this file)
|
||||
- Project: `<repo>/.context/PROJECT.md` (per-repo)
|
||||
|
||||
Derived files (committed, regenerated by `task context:sync`):
|
||||
- `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `.aider.conventions.md`,
|
||||
`.context/system-prompt.txt`
|
||||
|
||||
Workflow:
|
||||
1. Edit a canonical file. Run `task context:sync`. Commit canonical and
|
||||
derived together. Push.
|
||||
2. On any other host, `git pull` brings both. Claude Code (tree-walking)
|
||||
uses `CLAUDE.md`; Crush / Pi / Antigravity (cwd-only) use `AGENTS.md`;
|
||||
Cursor uses `.cursorrules`; Aider uses `.aider.conventions.md`.
|
||||
3. `task check` runs `context:sync` then asserts `git status --porcelain`
|
||||
is empty over the derived files (catches both modified-tracked drift
|
||||
and missing-untracked adapters). A drift fails the check with a
|
||||
message telling you to stage the regenerated files.
|
||||
|
||||
Behavior rules in this file and per-project rules in `PROJECT.md` apply
|
||||
unconditionally on every host, every harness.
|
||||
|
||||
## Engineering Skills
|
||||
|
||||
Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Clone it to `~/dev/skills/` and run `SKILLS_CHECKOUT_DIR="$PWD" bash install.sh` there to wire every skill into your harnesses (Claude Code, Crush, Antigravity, Mistral Vibe) as native, on-demand skills. (Use `install.sh`, not `task install` — the latter is currently broken, skills#7.) Load at task start — not "on demand" but on schedule, before writing code. Browse `~/dev/skills/SKILLS_INDEX.md` for the full list.
|
||||
|
||||
**Skill trigger table — load before starting, not after getting stuck:**
|
||||
|
||||
| Task type | Load |
|
||||
|-----------|------|
|
||||
| Any feature or bug fix | `tdd` |
|
||||
| Refactor or design | `clean-code` or `solid` |
|
||||
| Debug | `problem-analysis` |
|
||||
| Review code or PRs | `code-review` |
|
||||
| Frame a problem before coding | `problem-analysis` |
|
||||
|
||||
---
|
||||
|
||||
# cad-atlas
|
||||
|
||||
## Identity
|
||||
|
||||
- **Name**: cad-atlas
|
||||
- **Owner**: Mathias
|
||||
- **Client**: personal
|
||||
- **Repo**: git.d-ma.be/mathias/cad-atlas
|
||||
- **Status**: active
|
||||
- **Stack**: Go + Templ + HTMX + CDN Tailwind (template-go-web). Cross-project conventions: `~/dev/.context/AGENT.md`.
|
||||
|
||||
## What this is
|
||||
|
||||
A visual **atlas of the Continuous Agentic Development (CAD) workflow** — the full path
|
||||
from a captured signal to a deployed k3s pod, one screen, reel-style ("From Signal to Pod").
|
||||
It exists to (a) make the homelab's agentic delivery pipeline legible to a human, and
|
||||
(b) render the CAD **audit chain** — which doubles as the regulated-industry audit artifact.
|
||||
|
||||
> **Core thesis:** the CAD audit chain *is* the visualization data.
|
||||
> `TELOS → goal → spec → issue → execution → attestation → deploy` is both the trace and
|
||||
> the audit package. Phase C renders it once and serves two masters (observability + compliance).
|
||||
|
||||
## Phases
|
||||
|
||||
- **Phase A — static hero viz** (current). Self-contained `internal/web/static/cad-atlas.html`,
|
||||
data-driven from a hand-authored `STAGES` array (ground-truth snapshot from brain, 2026-07-19).
|
||||
Served at `/` by `internal/web/handler.go` via `go:embed`. Reel-parity: SVG spine with
|
||||
arrowheads, animated pulse, dashed **feedback bus** (stage 08 → TELOS), replay + slow-mo.
|
||||
- **Phase B — generated-from-source**. Parse brain docs + `.gitea/workflows` + infra manifests
|
||||
→ render the graph so it can't drift from config.
|
||||
- **Phase C — live trace viewer**. Replace the static `STAGES` array with live reads of the
|
||||
`assessor-loop` attestation ledger + brain `session_log` + Gitea run API + Flux events.
|
||||
This is the prize: a real signal→pod trace viewer that is also the audit package.
|
||||
|
||||
## The workflow it visualizes (9 stages)
|
||||
|
||||
`00 Signals` (Applied AI Radar → mathias/signals) → `01 TELOS` (intention substrate) →
|
||||
`02 Strategic session` (claude.ai frontier + LLM Council + Autoresearch Council) →
|
||||
`03 Spec → Gitea issue` (agent-ready contract; Ed25519 admission #36; **var-go Oath**) →
|
||||
`04 Human dispatch gate` (the only checkpoint; session-dispatch bridge → cad-dispatch.yml) →
|
||||
`05 Execute · agentsquad` (serve/taskqueue, exec+review loop, risk LOW/MED/HIGH, dma-cli routing,
|
||||
assessor-loop ledger) → `06 PR → CI` (go test/vet/lint/govulncheck + **var-go/oath gate**) →
|
||||
`07 CD → pod` (Flux GitOps → k3s on koala) → `08 Loop back` (outcome scored vs TELOS goal).
|
||||
|
||||
### Three orthogonal governance gates
|
||||
|
||||
| Gate | Guards | Where |
|
||||
|---|---|---|
|
||||
| Ed25519 admission controller (#36) | spec **integrity** (issue untampered) | stage 03 |
|
||||
| dispatch-allow (`.dispatch-allow` + `mathias/dispatch` allowlist) | repo **eligibility** (may agents run here) | stage 04/05 |
|
||||
| **var-go Oath** (`cmd/vargo-gate`, commit status `var-go/oath`) | output **correctness** (PR satisfies the Oath; floor over reviewer, anti-rubber-stamp #55) | stage 06 |
|
||||
|
||||
## Dogfooding
|
||||
|
||||
This repo is built *through* the workflow it depicts. It is `dispatch-allow`-enabled, and its
|
||||
own build increments are governed by a **var-go Oath** embedded in their spec issues (see the
|
||||
Stage-03 tracking issue). Bootstrapping honesty (per swedsl honest-stub discipline): the Oath is
|
||||
**defined** but `cmd/vargo-gate` is **not yet wired** into this repo's CI — until it is, the Oath
|
||||
is advisory here. Wiring it is a first tracked task; disclosed in code, this doc, and CI config.
|
||||
|
||||
## Brain references (source of truth — `brain_get <path>`)
|
||||
|
||||
- `wiki/homelab/decisions/cad-atlas-audit-chain-is-viz-data.md` — **this project's genesis note**: the audit-chain-is-viz-data thesis, the three gates, template-go-web footguns
|
||||
- `wiki/homelab/decisions/inception-sprint-and-oath.md` — the Inception Sprint + Oath methodology (this repo's birth is the worked example); see [`docs/INCEPTION-OATH.md`](docs/INCEPTION-OATH.md) for the kept Oath
|
||||
- `knowledge/workflow-idea-to-running-service.md` — Double Diamond idea→service workflow
|
||||
- `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16.md` — CAD definition
|
||||
- `wiki/agentsquad/decisions/cad-dispatch-bridge.md` — claude.ai → agentsquad trigger path
|
||||
- `wiki/agentsquad/facts/llm-council-design-and-first-runs-2026-06-21.md` — LLM Council
|
||||
- `wiki/agentsquad/decisions/autoresearch-council-sibling-pipe.md` — Autoresearch Council
|
||||
- `wiki/agentsquad/decisions/serve-http-task-api.md` — agentsquad serve/taskqueue
|
||||
- `knowledge/var-go-anchor-to-span-spike-verdict.md` — var-go runner + CAD gate seam
|
||||
- `knowledge/swedsl-vargo-sprint1-enforcement-teeth-verdict.md` — vargo-gate enforcement teeth
|
||||
- `wiki/assessor-loop/decisions/assessor-loop-genesis.md` — attestation ledger (Phase C source)
|
||||
- `wiki/homelab/facts/homelab-network-topology-reference.md` — koala/iguana/flamingo/piguard
|
||||
|
||||
## External references
|
||||
|
||||
- Inspiration reel — "From Inbox to Shipped" pipeline viz: https://www.instagram.com/reel/DY92L7bu27j/
|
||||
- karpathy/llm-council — origin of the Council pattern
|
||||
- Double Diamond design process (Discover/Define/Develop/Deliver)
|
||||
|
||||
## Run
|
||||
|
||||
```bash
|
||||
task check # lint + vet + test (CI gate)
|
||||
task run # build + serve at http://localhost:8080 → the atlas
|
||||
```
|
||||
|
||||
## Deploy note
|
||||
|
||||
CD (`.gitea/workflows/cd.yml`) deploys to k3s namespace `cad-atlas` via Flux. Per the known
|
||||
template-go-agent CD gap: the `deploy` job stays RED until `mathias/infra` has
|
||||
`k3s/apps/cad-atlas/deployment.yaml`. `check` + `build` are the real bootstrap gate.
|
||||
@@ -0,0 +1,52 @@
|
||||
# Canonical golangci-lint configuration for the estate's Go repos (infra#309
|
||||
# pattern: one canonical file here, a byte-identical copy in each adopter,
|
||||
# and the drift gate in THIS repo comparing sha256).
|
||||
#
|
||||
# Why this exists: 26 Go repos, 3 had a lint config, and all three were
|
||||
# different. The 23 without one ran golangci-lint's v2 default set, which
|
||||
# does NOT include a formatter -- so gofmt/gofumpt drift went uncaught until
|
||||
# it was found by hand (dma-cli#12: two files drifted, nothing flagged them).
|
||||
#
|
||||
# The two configs this replaces (cobalt-dingo, coo-agent) were near-identical
|
||||
# copies of each other AND both invalid under v2: they carried v1-style
|
||||
# `linters-settings` and `issues.exclude-rules` keys, which `golangci-lint
|
||||
# config verify` rejects outright. Their revive settings and test exclusions
|
||||
# were therefore not in effect. Consolidating fixes that too.
|
||||
#
|
||||
# Per-repo variation does NOT belong here -- this file must stay byte-identical
|
||||
# across adopters so the gate is a checksum, not a diff a human has to judge.
|
||||
# A repo with a genuine exception (agentsquad excludes its seeded-bug fixture
|
||||
# tree, which exists precisely to contain broken code) keeps its own config and
|
||||
# is not listed as an adopter.
|
||||
|
||||
version: "2"
|
||||
|
||||
linters:
|
||||
default: none
|
||||
enable:
|
||||
- errcheck # unchecked errors
|
||||
- govet # suspicious constructs
|
||||
- staticcheck # broad static analysis
|
||||
- unused # unused code
|
||||
- misspell # spelling
|
||||
- revive # idiomatic Go
|
||||
- exhaustive # exhaustive switch on enums
|
||||
|
||||
settings:
|
||||
revive:
|
||||
rules:
|
||||
- name: var-naming
|
||||
severity: warning
|
||||
|
||||
exclusions:
|
||||
rules:
|
||||
# Test files: table-driven cases legitimately carry unused struct fields
|
||||
# and long functions.
|
||||
- path: _test\.go
|
||||
linters:
|
||||
- revive
|
||||
- unused
|
||||
|
||||
formatters:
|
||||
enable:
|
||||
- gofumpt
|
||||
@@ -48,14 +48,30 @@ These rules apply to every task across every project, regardless of harness.
|
||||
logical change (one tool, one fix, one test) with passing tests. Main is always
|
||||
deployable. Never create long-lived feature branches.
|
||||
|
||||
**Exception — parallel agents on same repo:** If another agent is known to be
|
||||
actively working on the same repo simultaneously, create a short-lived branch
|
||||
(`agent/<description>`), finish the task, and merge to main within the same
|
||||
session. Do not leave agent branches open between sessions.
|
||||
**The PR trigger is RISK, not concurrency.** `risk/low` work commits straight to
|
||||
main with CI as the gate — that is most work and is unchanged. `risk/medium` and
|
||||
above opens a PR, even solo, even with nobody waiting to review it. This mirrors
|
||||
the tiered merge model in `assessor-loop`
|
||||
`method/transfer-to-a-regulated-organisation.md` §4.1, so the estate practises
|
||||
what it sells instead of merging everything on green and claiming otherwise.
|
||||
|
||||
**Exception — external contributor or client four-eyes requirement:** Use
|
||||
PR flow only when a human reviewer outside the project is required. Document
|
||||
the reason in PROJECT.md.
|
||||
**Concurrency is NOT a reason to branch.** Measured 2026-08-29 across three real
|
||||
collisions between parallel sessions: two were not branching problems at all — a
|
||||
generated artifact written to the same path by both (branching turns that into a
|
||||
merge conflict on a 33k-line JSON), and uncommitted work in a shared checkout
|
||||
(a per-session worktree fixes it) — and the third was an ordinary non-fast-forward
|
||||
push resolved by rebase in seconds. Use a worktree per session on shared repos and
|
||||
timestamp generated artifacts. Do not reach for a branch.
|
||||
|
||||
Branch+PR flow carries documented costs on solo repos: merging auto-closes gated
|
||||
issues, review comments live on a thread separate from the issue's, and a
|
||||
merged-and-deleted branch cannot be amended (brain:
|
||||
`gitea-pr-merge-autoclose-and-review-comment-footguns`). Those are the price of
|
||||
the `risk/medium`+ lane — paid deliberately, not incurred by accident.
|
||||
|
||||
**Exception — external contributor or client four-eyes requirement:** Use PR flow
|
||||
when a human reviewer outside the project is required. Document the reason in
|
||||
PROJECT.md.
|
||||
|
||||
6. **Close the loop — every substantive task ends with the same ritual.** Shipping
|
||||
the code is not the end of the task; capturing it is. Run this unprompted:
|
||||
@@ -73,6 +89,26 @@ These rules apply to every task across every project, regardless of harness.
|
||||
- Surface the brain entries and issue numbers in the closing summary so the
|
||||
trail is auditable.
|
||||
|
||||
**Chat is not a durable store. Never rely on Mathias remembering anything.**
|
||||
Every gap, caveat, risk, open question and next step must land in one of four
|
||||
places before the turn ends: **the brain**, **a repo** (code, docs, ADR),
|
||||
**a tracker issue**, or **a plan file**. A finding stated only in conversation is
|
||||
lost the moment the session closes — and this estate has repeatedly proved that a
|
||||
remembered convention is an unreliable control.
|
||||
|
||||
This applies hardest to what is tempting to leave as a closing remark: "worth
|
||||
knowing X isn't enforced yet", "this is a convention, not a gate", "we should
|
||||
revisit Y". Those are exactly the items that need a locator. If it is worth
|
||||
saying in a summary, it is worth writing where it can be found again without you.
|
||||
|
||||
## CAD sprint patterns
|
||||
|
||||
Two CAD sprint archetypes (defs: brain `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16`):
|
||||
- **Inception Sprint** — birth a new repo. Oath-gated close; tag only once every clause holds. Brain: `.../inception-sprint-and-oath`.
|
||||
- **Sweep Sprint** — clear an existing backlog. Parallel read-only research per issue → sequential one-issue-per-commit execution. Brain: `.../sweep-sprint-and-oath`.
|
||||
|
||||
Shared: decisions that are yours, not the agent's, surface as `DECISION NEEDED` (question/options/recommendation/blocks) — ask live if you're present, else comment and wait, never act past it. Live-breaking regressions get `git revert`, never forward-fixed; host-network work skips even read-only research (solo, synchronous, you present). Rule 6's closing ritual only fires once every Oath clause genuinely holds — blocked = descoped-and-tracked, never marked done.
|
||||
|
||||
## Default stack
|
||||
|
||||
| Layer | Default | Fallback | Last resort |
|
||||
@@ -83,7 +119,7 @@ These rules apply to every task across every project, regardless of harness.
|
||||
| Containers | Docker Compose (dev), k3s (prod) | — | — |
|
||||
| DB | PostgreSQL + sqlc | SQLite | — |
|
||||
| Search | pgvector (vector), BM25 | Qdrant (when >1M vectors or hybrid retrieval) | — |
|
||||
| Logging | slog (structured) | — | — |
|
||||
| Logging | slog (structured) | stdlib `logging` w/ structured `extra=` (or structlog) | — |
|
||||
| Testing | Table-driven, testify | — | — |
|
||||
| Agents (Go) | google.golang.org/adk + pkg/litellm adapter | — | — |
|
||||
|
||||
@@ -92,7 +128,12 @@ Exploratory: Rust, Zig — I'll tell you when I want these.
|
||||
## Code conventions
|
||||
|
||||
- **Go style**: golines, gofumpt, golangci-lint
|
||||
- **Errors**: `fmt.Errorf("operation: %w", err)` — never naked, never log-and-return
|
||||
- **Python style** (fallback language): ruff (format+lint, one tool), mypy --strict (non-negotiable,
|
||||
matches Go's static typing discipline), pytest + pytest-cov (table-driven via
|
||||
`@pytest.mark.parametrize`), uv (venv+deps+lock, one tool), pydantic-settings (typed env-var config
|
||||
— same principle as Go's typed structs), src-layout + `pyproject.toml` only (no `setup.py`)
|
||||
- **Errors**: `fmt.Errorf("operation: %w", err)` — never naked, never log-and-return.
|
||||
Python: `raise X from e` (exception chaining, same principle) — never bare `except`, never silent `pass`
|
||||
- **Naming**: stdlib conventions, no stuttering
|
||||
- **Architecture**: prefer stdlib over frameworks, constructor injection, env-var config parsed into typed structs
|
||||
- **Git**: conventional commits (`feat:`, `fix:`, `chore:`), commit directly to main,
|
||||
@@ -130,10 +171,10 @@ Three machines on Tailscale:
|
||||
|---------|------|-----------|
|
||||
| koala | GPU inference, heavy compute | RTX 5070, runs k3s + llama-swap + shared postgres18/pgvector |
|
||||
| iguana | Services, builds | M2 Ultra Mac |
|
||||
| flamingo | Daily driver, edge | Mac mini, ~/dev is here |
|
||||
| flamingo | Daily driver, edge | Apple Silicon Mac, ~/dev is here |
|
||||
|
||||
- **Model routing**: LiteLLM in front of llama-swap (local) + cloud APIs (when permitted)
|
||||
- **Orchestration**: k3s cluster across all three machines
|
||||
- **Orchestration**: k3s on koala only — single control-plane node, no workers (verified 2026-08-30). iguana and flamingo are on the tailnet but are not cluster members
|
||||
- **Networking**: Tailscale mesh
|
||||
|
||||
## Project landscape
|
||||
@@ -229,10 +270,11 @@ When working on a project tagged with a client name:
|
||||
|
||||
## Harness-agnostic principles
|
||||
|
||||
This context is designed to work with any AI coding tool:
|
||||
- Claude Code, Cursor, Aider, Open WebUI, Charmbracelet Mods/Crush
|
||||
- Pi Coding Agent, Mistral Vibe, Antigravity
|
||||
- Any tool that accepts a system prompt or reads a markdown context file
|
||||
Supported harnesses (2026-09-01) — Cursor and Aider were dropped; do not
|
||||
re-add adapters for them:
|
||||
- Claude Code, Antigravity, OpenCode, Mistral Vibe, Crush, Pi Coding Agent
|
||||
- Open WebUI, Charmbracelet Mods, or any tool that takes a system prompt string
|
||||
- Any other tool that reads `AGENTS.md`, which is the de facto convention
|
||||
|
||||
The canonical source is always `.context/AGENT.md` (root) and `.context/PROJECT.md` (per-project).
|
||||
Derived files are committed (see *How context propagates* below) so a `git pull` on any host yields full agent context with no setup.
|
||||
@@ -244,15 +286,29 @@ Canonical sources of truth:
|
||||
- Project: `<repo>/.context/PROJECT.md` (per-repo)
|
||||
|
||||
Derived files (committed, regenerated by `task context:sync`):
|
||||
- `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `.aider.conventions.md`,
|
||||
`.context/system-prompt.txt`
|
||||
- `CLAUDE.md`, `AGENTS.md`, `.context/system-prompt.txt`
|
||||
|
||||
Repos still carrying `.cursorrules`, `.aider.conventions.md` or
|
||||
`.aider.conf.yml` are stale: nothing regenerates them. Delete them the next time
|
||||
you touch the repo, along with their entries in that repo's `task check`
|
||||
assertion.
|
||||
|
||||
Workflow:
|
||||
1. Edit a canonical file. Run `task context:sync`. Commit canonical and
|
||||
derived together. Push.
|
||||
2. On any other host, `git pull` brings both. Claude Code (tree-walking)
|
||||
uses `CLAUDE.md`; Crush / Pi / Antigravity (cwd-only) use `AGENTS.md`;
|
||||
Cursor uses `.cursorrules`; Aider uses `.aider.conventions.md`.
|
||||
2. On any other host, `git pull` brings both. Which file a harness reads does
|
||||
NOT split cleanly by lookup strategy, so do not reason from the strategy:
|
||||
- `CLAUDE.md` — Claude Code (walks up the tree)
|
||||
- `AGENTS.md` — Crush, Pi, Antigravity (cwd-only), OpenCode (project root,
|
||||
global at `~/.config/opencode/AGENTS.md`), and Mistral Vibe, which **walks
|
||||
up** from cwd and takes the first `AGENTS.md` it finds
|
||||
(user-level `~/.vibe/AGENTS.md`)
|
||||
- `.context/system-prompt.txt` — Open WebUI, Mods, raw API calls; not read by
|
||||
any harness, it is for pasting
|
||||
|
||||
Vibe tree-walks for `AGENTS.md`, so "tree-walkers use CLAUDE.md" is false.
|
||||
Each repo's `AGENTS.md` embeds the canonical and is the first one found from
|
||||
inside that repo, so this works — but by construction, not by luck.
|
||||
3. `task check` runs `context:sync` then asserts `git status --porcelain`
|
||||
is empty over the derived files (catches both modified-tracked drift
|
||||
and missing-untracked adapters). A drift fails the check with a
|
||||
@@ -263,7 +319,20 @@ unconditionally on every host, every harness.
|
||||
|
||||
## Engineering Skills
|
||||
|
||||
Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Clone it to `~/dev/skills/` and run `SKILLS_CHECKOUT_DIR="$PWD" bash install.sh` there to wire every skill into your harnesses (Claude Code, Crush, Antigravity, Mistral Vibe) as native, on-demand skills. (Use `install.sh`, not `task install` — the latter is currently broken, skills#7.) Load at task start — not "on demand" but on schedule, before writing code. Browse `~/dev/skills/SKILLS_INDEX.md` for the full list.
|
||||
Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Load at task start — not "on demand" but on schedule, before writing code. Browse `SKILLS_INDEX.md` for the full list.
|
||||
|
||||
**Claude Code** installs the repo as a plugin from the marketplace the same repo hosts. That path also carries the `secret-guard` and `pre-task-ritual` hooks and the brain/gitea/infra MCP servers, which symlinks cannot:
|
||||
|
||||
```
|
||||
/plugin marketplace add https://git.d-ma.be/mathias/skills.git
|
||||
/plugin install skills@mathias
|
||||
```
|
||||
|
||||
Skills are **namespaced** under Claude Code: load `tdd` as `skills:tdd`. The trigger table below uses bare names — prefix them.
|
||||
|
||||
**Crush, Pi and OpenCode** have no plugin system and are wired by `install.sh` as one directory symlink per harness via `~/.agents/skills`. Do not clone the checkout into `~/dev`: that folder is iCloud-shared between the Macs and spans two path roots (`/Users/mathias` vs `/home/mathias` on koala), so a checkout there is a git working tree with two concurrent writers, and any absolute symlink stored in it is broken on one side by construction (skills#23). Leave `SKILLS_CHECKOUT_DIR` at its host-local default.
|
||||
|
||||
Check a host with `task doctor` in the skills repo; it also runs automatically at session start via the plugin.
|
||||
|
||||
**Skill trigger table — load before starting, not after getting stuck:**
|
||||
|
||||
@@ -333,9 +402,16 @@ assessor-loop ledger) → `06 PR → CI` (go test/vet/lint/govulncheck + **var-g
|
||||
|
||||
This repo is built *through* the workflow it depicts. It is `dispatch-allow`-enabled, and its
|
||||
own build increments are governed by a **var-go Oath** embedded in their spec issues (see the
|
||||
Stage-03 tracking issue). Bootstrapping honesty (per swedsl honest-stub discipline): the Oath is
|
||||
**defined** but `cmd/vargo-gate` is **not yet wired** into this repo's CI — until it is, the Oath
|
||||
is advisory here. Wiring it is a first tracked task; disclosed in code, this doc, and CI config.
|
||||
Stage-03 tracking issue). `cmd/vargo-gate` is wired into `.gitea/workflows/cd.yml`'s `oath` job —
|
||||
on every pull_request it fetches the linked issue's oath and gates cad-atlas's **own real
|
||||
candidate** (`oathcandidate/`, #8): it parses the committed `.gitea/workflows/cd.yml` and checks
|
||||
the `oath` job actually exists and invokes `cmd/vargo-gate`, then posts the `var-go/oath` commit
|
||||
status. This is a real check (TDD'd: passes on the real file, fails closed on a fixture missing
|
||||
the job), not swedsl's toy self-test stub — swedsl#35 (import path) and swedsl#38 (real-candidate
|
||||
subprocess gating) unblocked it. **Required by branch protection on `main`** (#8, closed
|
||||
2026-07-20), confirmed holding on a real PR. Direct pushes remain allowlisted for `mathias` per
|
||||
this repo's TBD convention. Disclosed in the CI config comment, this doc, and
|
||||
`docs/INCEPTION-OATH.md`.
|
||||
|
||||
## Brain references (source of truth — `brain_get <path>`)
|
||||
|
||||
|
||||
@@ -54,9 +54,16 @@ assessor-loop ledger) → `06 PR → CI` (go test/vet/lint/govulncheck + **var-g
|
||||
|
||||
This repo is built *through* the workflow it depicts. It is `dispatch-allow`-enabled, and its
|
||||
own build increments are governed by a **var-go Oath** embedded in their spec issues (see the
|
||||
Stage-03 tracking issue). Bootstrapping honesty (per swedsl honest-stub discipline): the Oath is
|
||||
**defined** but `cmd/vargo-gate` is **not yet wired** into this repo's CI — until it is, the Oath
|
||||
is advisory here. Wiring it is a first tracked task; disclosed in code, this doc, and CI config.
|
||||
Stage-03 tracking issue). `cmd/vargo-gate` is wired into `.gitea/workflows/cd.yml`'s `oath` job —
|
||||
on every pull_request it fetches the linked issue's oath and gates cad-atlas's **own real
|
||||
candidate** (`oathcandidate/`, #8): it parses the committed `.gitea/workflows/cd.yml` and checks
|
||||
the `oath` job actually exists and invokes `cmd/vargo-gate`, then posts the `var-go/oath` commit
|
||||
status. This is a real check (TDD'd: passes on the real file, fails closed on a fixture missing
|
||||
the job), not swedsl's toy self-test stub — swedsl#35 (import path) and swedsl#38 (real-candidate
|
||||
subprocess gating) unblocked it. **Required by branch protection on `main`** (#8, closed
|
||||
2026-07-20), confirmed holding on a real PR. Direct pushes remain allowlisted for `mathias` per
|
||||
this repo's TBD convention. Disclosed in the CI config comment, this doc, and
|
||||
`docs/INCEPTION-OATH.md`.
|
||||
|
||||
## Brain references (source of truth — `brain_get <path>`)
|
||||
|
||||
|
||||
@@ -33,5 +33,3 @@ tasks:
|
||||
cmds: [bash scripts/context-sync.sh claude]
|
||||
context:sync:agents:
|
||||
cmds: [bash scripts/context-sync.sh agents]
|
||||
context:sync:cursor:
|
||||
cmds: [bash scripts/context-sync.sh cursor]
|
||||
|
||||
@@ -34,7 +34,7 @@
|
||||
{"t":"Human triggers execution","plain_t":"The go button","plain":"A person confirms the plan and its risk level, then releases the work — nothing runs until they do.","cls":"gateway","pill":"var(--amber)","d":"Ratify proposed-plan + risk tier, then dispatch.","gate":true},
|
||||
{"t":"Session-Dispatch bridge","plain_t":"Hand-off to agents","plain":"The approval flips a switch that hands the signed work order over to the agents to start execution.","cls":"bridge","pill":"var(--blue)","d":"claude.ai MCP → gitea:workflow_run_trigger → cad-dispatch.yml → agentsquad. The final design→execution bridge.","tags":["workflow_dispatch"]}
|
||||
]},
|
||||
{"no":"STAGE 05","short":"Build","cls":"exec","title":"Execute · agentsquad + dispatch","plain_title":"Agents do the work","plain":"AI agents actually build the thing — one writes, a second independent one reviews it to avoid marking its own homework — and every step is logged for the audit trail. Two execution paths run today: agentsquad for orchestrated multi-agent jobs, and dispatch for headless single-issue work.","path":"koala · agentsquad-serve + dispatch CronJob","generate":"stuck-badges",
|
||||
{"no":"STAGE 05","short":"Build","cls":"exec","title":"Execute · agentsquad + dispatch","plain_title":"Agents do the work","plain":"AI agents actually build the thing — one writes, a second independent one reviews it to avoid marking its own homework — and every step is logged for the audit trail. Two execution paths run today: agentsquad for orchestrated multi-agent jobs, and dispatch for headless single-issue work.","path":"koala · agentsquad-serve + dispatch CronJob","generate":["stuck-badges","gitea-repos"],
|
||||
"trans_label":"Change proposed","trans":"Advances when the agents finish and open a proposed change (a PR) with its audit log attached. Until there's a concrete change to test, nothing moves.","nodes":[
|
||||
{"t":"Task API","plain_t":"Start a job","plain":"A request kicks off a job and hands back an id you can poll for progress.","pill":"var(--coral)","d":"POST /tasks → job id · GET /tasks/{id}. taskqueue + serve (v0.12+).","tags":["single agentsquad.yaml"]},
|
||||
{"t":"Executor + reviewer loop","plain_t":"Build + independent review","plain":"One agent does the work; a second, independent agent on a different model reviews it — so nothing marks its own homework.","cls":"win","pill":"var(--coral)","d":"ADK Go + LiteLLM. Frontier models (local qwen spirals). Reviewer on distinct tier — echo-chamber prevention.","risk":true},
|
||||
|
||||
@@ -53,7 +53,7 @@ func TestDefault_HasPlainLayerAndTransitions(t *testing.T) {
|
||||
if s.TransLabel == "" {
|
||||
t.Fatalf("stage %s missing trans_label", s.No)
|
||||
}
|
||||
if s.Generate == "ci-jobs" {
|
||||
if s.Generate.Has("ci-jobs") {
|
||||
continue // nodes are generated live, no authored plain
|
||||
}
|
||||
for _, n := range s.Nodes {
|
||||
|
||||
@@ -0,0 +1,63 @@
|
||||
package atlas
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
)
|
||||
|
||||
// GenerateKeys names the live sources a stage draws nodes from. A stage grew
|
||||
// past one source once stuck-badges landed alongside the existing overlays, so
|
||||
// this accepts either spelling in atlas.json:
|
||||
//
|
||||
// "generate": "ci-jobs"
|
||||
// "generate": ["stuck-badges", "gitea-repos"]
|
||||
//
|
||||
// The bare string is kept rather than migrated: most stages have exactly one
|
||||
// source, and a one-element list reads worse for no benefit.
|
||||
type GenerateKeys []string
|
||||
|
||||
// Has reports whether the stage draws from the named source. The empty key
|
||||
// never matches, so a stage with no `generate` is inert.
|
||||
func (g GenerateKeys) Has(key string) bool {
|
||||
if key == "" {
|
||||
return false
|
||||
}
|
||||
for _, k := range g {
|
||||
if k == key {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func (g *GenerateKeys) UnmarshalJSON(b []byte) error {
|
||||
b = bytes.TrimSpace(b)
|
||||
if len(b) == 0 || string(b) == "null" {
|
||||
*g = nil
|
||||
return nil
|
||||
}
|
||||
if b[0] == '"' {
|
||||
var one string
|
||||
if err := json.Unmarshal(b, &one); err != nil {
|
||||
return fmt.Errorf("parse generate: %w", err)
|
||||
}
|
||||
*g = GenerateKeys{one}
|
||||
return nil
|
||||
}
|
||||
var many []string
|
||||
if err := json.Unmarshal(b, &many); err != nil {
|
||||
return fmt.Errorf("parse generate: %w", err)
|
||||
}
|
||||
*g = many
|
||||
return nil
|
||||
}
|
||||
|
||||
// MarshalJSON writes a lone key back as a bare string, so a round-trip through
|
||||
// the API does not rewrite every authored stage into list form.
|
||||
func (g GenerateKeys) MarshalJSON() ([]byte, error) {
|
||||
if len(g) == 1 {
|
||||
return json.Marshal(g[0])
|
||||
}
|
||||
return json.Marshal([]string(g))
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
package atlas_test
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"testing"
|
||||
|
||||
"git.d-ma.be/mathias/cad-atlas/internal/atlas"
|
||||
)
|
||||
|
||||
// Every stage authored before this type existed spells `generate` as a bare
|
||||
// string. That spelling stays valid — this is additive, not a migration.
|
||||
func TestGenerateKeys_UnmarshalsBareString(t *testing.T) {
|
||||
var s atlas.Stage
|
||||
if err := json.Unmarshal([]byte(`{"no":"06","generate":"ci-jobs"}`), &s); err != nil {
|
||||
t.Fatalf("unmarshal: %v", err)
|
||||
}
|
||||
if !s.Generate.Has("ci-jobs") {
|
||||
t.Fatalf("Has(ci-jobs) false for %+v", s.Generate)
|
||||
}
|
||||
if s.Generate.Has("gitea-repos") {
|
||||
t.Fatal("Has matched a key that is not present")
|
||||
}
|
||||
}
|
||||
|
||||
func TestGenerateKeys_UnmarshalsList(t *testing.T) {
|
||||
var s atlas.Stage
|
||||
if err := json.Unmarshal([]byte(`{"no":"05","generate":["stuck-badges","gitea-repos"]}`), &s); err != nil {
|
||||
t.Fatalf("unmarshal: %v", err)
|
||||
}
|
||||
if !s.Generate.Has("stuck-badges") || !s.Generate.Has("gitea-repos") {
|
||||
t.Fatalf("both keys should match, got %+v", s.Generate)
|
||||
}
|
||||
}
|
||||
|
||||
func TestGenerateKeys_AbsentMatchesNothing(t *testing.T) {
|
||||
var s atlas.Stage
|
||||
if err := json.Unmarshal([]byte(`{"no":"00"}`), &s); err != nil {
|
||||
t.Fatalf("unmarshal: %v", err)
|
||||
}
|
||||
if s.Generate.Has("") || s.Generate.Has("ci-jobs") {
|
||||
t.Fatalf("absent generate matched something: %+v", s.Generate)
|
||||
}
|
||||
}
|
||||
|
||||
// The frontend reads this JSON, so the round-trip must stay stable.
|
||||
func TestGenerateKeys_RoundTrips(t *testing.T) {
|
||||
for _, raw := range []string{`{"generate":"ci-jobs"}`, `{"generate":["a","b"]}`} {
|
||||
var s atlas.Stage
|
||||
if err := json.Unmarshal([]byte(raw), &s); err != nil {
|
||||
t.Fatalf("unmarshal %s: %v", raw, err)
|
||||
}
|
||||
out, err := json.Marshal(s)
|
||||
if err != nil {
|
||||
t.Fatalf("marshal: %v", err)
|
||||
}
|
||||
var back atlas.Stage
|
||||
if err := json.Unmarshal(out, &back); err != nil {
|
||||
t.Fatalf("re-unmarshal %s: %v", out, err)
|
||||
}
|
||||
for _, k := range []string{"ci-jobs", "a", "b"} {
|
||||
if s.Generate.Has(k) != back.Generate.Has(k) {
|
||||
t.Fatalf("round-trip lost %q: %s -> %s", k, raw, out)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -39,7 +39,7 @@ type Stage struct {
|
||||
Plain string `json:"plain,omitempty"`
|
||||
Path string `json:"path,omitempty"`
|
||||
Cls string `json:"cls,omitempty"`
|
||||
Generate string `json:"generate,omitempty"`
|
||||
Generate GenerateKeys `json:"generate,omitempty"`
|
||||
TransLabel string `json:"trans_label,omitempty"`
|
||||
Trans string `json:"trans,omitempty"`
|
||||
// StuckCount/AwaitingCount are set by ApplyStuckOverlay (cad-atlas#11) on
|
||||
@@ -71,7 +71,7 @@ func Build(atlasJSON, workflow []byte) (Atlas, error) {
|
||||
return Atlas{}, fmt.Errorf("parse atlas data: %w", err)
|
||||
}
|
||||
for i := range a.Stages {
|
||||
if a.Stages[i].Generate != "ci-jobs" {
|
||||
if !a.Stages[i].Generate.Has("ci-jobs") {
|
||||
continue
|
||||
}
|
||||
jobs, err := JobsFromWorkflow(workflow)
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
package atlas
|
||||
|
||||
// PrependGenerated puts live nodes ahead of the authored ones on every stage
|
||||
// carrying the given `generate` key. Authored nodes are kept, never replaced:
|
||||
// they are the graceful-degradation path, and a live source that is
|
||||
// unavailable (no token, no network) must leave the atlas rendering exactly as
|
||||
// authored. Passing no nodes is therefore a no-op, not an erasure.
|
||||
func PrependGenerated(a *Atlas, generate string, nodes []Node) {
|
||||
if a == nil || len(nodes) == 0 {
|
||||
return
|
||||
}
|
||||
for i := range a.Stages {
|
||||
if a.Stages[i].Generate.Has(generate) {
|
||||
a.Stages[i].Nodes = append(append([]Node{}, nodes...), a.Stages[i].Nodes...)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
package atlas_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"git.d-ma.be/mathias/cad-atlas/internal/atlas"
|
||||
)
|
||||
|
||||
func stagedAtlas() *atlas.Atlas {
|
||||
return &atlas.Atlas{Stages: []atlas.Stage{
|
||||
{No: "STAGE 03", Generate: atlas.GenerateKeys{"gitea-issues"}, Nodes: []atlas.Node{{Title: "authored issue node"}}},
|
||||
{No: "STAGE 05", Generate: atlas.GenerateKeys{"gitea-repos"}, Nodes: []atlas.Node{{Title: "authored repo node"}}},
|
||||
{No: "STAGE 08", Nodes: []atlas.Node{{Title: "untouched"}}},
|
||||
}}
|
||||
}
|
||||
|
||||
func TestPrependGenerated_LiveNodesComeFirstAndAuthoredSurvive(t *testing.T) {
|
||||
a := stagedAtlas()
|
||||
|
||||
atlas.PrependGenerated(a, "gitea-repos", []atlas.Node{{Title: "live repo"}})
|
||||
|
||||
got := a.Stages[1].Nodes
|
||||
if len(got) != 2 {
|
||||
t.Fatalf("want 2 nodes, got %d: %+v", len(got), got)
|
||||
}
|
||||
if got[0].Title != "live repo" || got[1].Title != "authored repo node" {
|
||||
t.Fatalf("order wrong: %+v", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestPrependGenerated_OnlyTouchesMatchingStage(t *testing.T) {
|
||||
a := stagedAtlas()
|
||||
|
||||
atlas.PrependGenerated(a, "gitea-repos", []atlas.Node{{Title: "live repo"}})
|
||||
|
||||
if len(a.Stages[0].Nodes) != 1 || a.Stages[0].Nodes[0].Title != "authored issue node" {
|
||||
t.Fatalf("stage 03 disturbed: %+v", a.Stages[0].Nodes)
|
||||
}
|
||||
if len(a.Stages[2].Nodes) != 1 || a.Stages[2].Nodes[0].Title != "untouched" {
|
||||
t.Fatalf("stage 08 disturbed: %+v", a.Stages[2].Nodes)
|
||||
}
|
||||
}
|
||||
|
||||
// The graceful-skip contract: with GITEA_TOKEN unset the overlay yields no
|
||||
// nodes, and the atlas must still render its authored placeholders unchanged.
|
||||
func TestPrependGenerated_NoLiveNodesLeavesAuthoredIntact(t *testing.T) {
|
||||
a := stagedAtlas()
|
||||
|
||||
atlas.PrependGenerated(a, "gitea-repos", nil)
|
||||
|
||||
if len(a.Stages[1].Nodes) != 1 || a.Stages[1].Nodes[0].Title != "authored repo node" {
|
||||
t.Fatalf("authored nodes lost on empty overlay: %+v", a.Stages[1].Nodes)
|
||||
}
|
||||
}
|
||||
|
||||
func TestPrependGenerated_UnknownKeyIsANoop(t *testing.T) {
|
||||
a := stagedAtlas()
|
||||
|
||||
atlas.PrependGenerated(a, "no-such-key", []atlas.Node{{Title: "live"}})
|
||||
|
||||
for i, s := range a.Stages {
|
||||
if len(s.Nodes) != 1 {
|
||||
t.Fatalf("stage %d changed: %+v", i, s.Nodes)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
package atlas
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
)
|
||||
|
||||
// RepoNodes parses a Gitea `/user/repos` response (the token owner's own
|
||||
// repositories) into one node per repo, linking out to the repo. Archived
|
||||
// repos are dropped: the atlas shows where work happens, and an archived repo
|
||||
// is by definition somewhere it does not.
|
||||
func RepoNodes(listJSON []byte) ([]Node, error) {
|
||||
var repos []struct {
|
||||
Name string `json:"name"`
|
||||
Description string `json:"description"`
|
||||
HTMLURL string `json:"html_url"`
|
||||
Archived bool `json:"archived"`
|
||||
Language string `json:"language"`
|
||||
}
|
||||
if err := json.Unmarshal(listJSON, &repos); err != nil {
|
||||
return nil, fmt.Errorf("parse repos: %w", err)
|
||||
}
|
||||
nodes := make([]Node, 0, len(repos))
|
||||
for _, r := range repos {
|
||||
if r.Archived {
|
||||
continue
|
||||
}
|
||||
tags := []string{"live · Gitea"}
|
||||
if r.Language != "" {
|
||||
tags = append(tags, r.Language)
|
||||
}
|
||||
nodes = append(nodes, Node{
|
||||
Title: r.Name,
|
||||
Desc: r.Description,
|
||||
Tags: tags,
|
||||
URL: r.HTMLURL,
|
||||
})
|
||||
}
|
||||
return nodes, nil
|
||||
}
|
||||
@@ -0,0 +1,80 @@
|
||||
package atlas_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"git.d-ma.be/mathias/cad-atlas/internal/atlas"
|
||||
)
|
||||
|
||||
// A Gitea /user/repos response, trimmed to the fields RepoNodes reads.
|
||||
const repoList = `[
|
||||
{"name":"cad-atlas","full_name":"mathias/cad-atlas","description":"Visualising the CAD workflow","html_url":"https://git.d-ma.be/mathias/cad-atlas","archived":false,"language":"Go"},
|
||||
{"name":"dispatch","full_name":"mathias/dispatch","description":"","html_url":"https://git.d-ma.be/mathias/dispatch","archived":false,"language":""},
|
||||
{"name":"old-thing","full_name":"mathias/old-thing","description":"retired","html_url":"https://git.d-ma.be/mathias/old-thing","archived":true,"language":"Go"}
|
||||
]`
|
||||
|
||||
func TestRepoNodes_OneNodePerRepoWithDescriptionAndURL(t *testing.T) {
|
||||
nodes, err := atlas.RepoNodes([]byte(repoList))
|
||||
if err != nil {
|
||||
t.Fatalf("RepoNodes: %v", err)
|
||||
}
|
||||
if len(nodes) != 2 {
|
||||
t.Fatalf("want 2 nodes (archived excluded), got %d", len(nodes))
|
||||
}
|
||||
if nodes[0].Title != "cad-atlas" {
|
||||
t.Fatalf("title = %q, want %q", nodes[0].Title, "cad-atlas")
|
||||
}
|
||||
if nodes[0].URL != "https://git.d-ma.be/mathias/cad-atlas" {
|
||||
t.Fatalf("url = %q", nodes[0].URL)
|
||||
}
|
||||
if nodes[0].Desc != "Visualising the CAD workflow" {
|
||||
t.Fatalf("desc = %q", nodes[0].Desc)
|
||||
}
|
||||
}
|
||||
|
||||
// Mirrors IssueNodes' tagging so the two live slices read identically on stage.
|
||||
func TestRepoNodes_TagsCarryLiveMarkerAndLanguage(t *testing.T) {
|
||||
nodes, err := atlas.RepoNodes([]byte(repoList))
|
||||
if err != nil {
|
||||
t.Fatalf("RepoNodes: %v", err)
|
||||
}
|
||||
if len(nodes) < 2 {
|
||||
t.Fatalf("want at least 2 nodes, got %d", len(nodes))
|
||||
}
|
||||
if len(nodes[0].Tags) != 2 || nodes[0].Tags[0] != "live · Gitea" || nodes[0].Tags[1] != "Go" {
|
||||
t.Fatalf("tags = %v, want [live · Gitea Go]", nodes[0].Tags)
|
||||
}
|
||||
// A repo with no language must not emit an empty tag pill.
|
||||
if len(nodes[1].Tags) != 1 || nodes[1].Tags[0] != "live · Gitea" {
|
||||
t.Fatalf("tags = %v, want [live · Gitea]", nodes[1].Tags)
|
||||
}
|
||||
}
|
||||
|
||||
// Load-bearing: archived repos are explicitly out of scope per the issue.
|
||||
func TestRepoNodes_ExcludesArchived(t *testing.T) {
|
||||
nodes, err := atlas.RepoNodes([]byte(repoList))
|
||||
if err != nil {
|
||||
t.Fatalf("RepoNodes: %v", err)
|
||||
}
|
||||
for _, n := range nodes {
|
||||
if n.Title == "old-thing" {
|
||||
t.Fatalf("archived repo surfaced: %+v", n)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestRepoNodes_EmptyListReturnsEmptyNotNil(t *testing.T) {
|
||||
nodes, err := atlas.RepoNodes([]byte(`[]`))
|
||||
if err != nil {
|
||||
t.Fatalf("RepoNodes: %v", err)
|
||||
}
|
||||
if nodes == nil || len(nodes) != 0 {
|
||||
t.Fatalf("nodes = %+v, want empty non-nil slice", nodes)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRepoNodes_MalformedJSONErrors(t *testing.T) {
|
||||
if _, err := atlas.RepoNodes([]byte(`{`)); err == nil {
|
||||
t.Fatal("want an error for malformed JSON, got nil")
|
||||
}
|
||||
}
|
||||
@@ -66,7 +66,7 @@ func ApplyStuckOverlay(stages []Stage, findings []caddomain.StuckFinding) []Stag
|
||||
out := make([]Stage, len(stages))
|
||||
copy(out, stages)
|
||||
for i := range out {
|
||||
if out[i].Generate != "stuck-badges" {
|
||||
if !out[i].Generate.Has("stuck-badges") {
|
||||
continue
|
||||
}
|
||||
assigned := byStage[out[i].No]
|
||||
|
||||
@@ -8,7 +8,11 @@ import (
|
||||
)
|
||||
|
||||
func stage(no, generate string) atlas.Stage {
|
||||
return atlas.Stage{No: no, Title: "example", Generate: generate}
|
||||
s := atlas.Stage{No: no, Title: "example"}
|
||||
if generate != "" {
|
||||
s.Generate = atlas.GenerateKeys{generate}
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
func finding(repo string, issue int, cat caddomain.StuckCategory, class caddomain.StuckClass) caddomain.StuckFinding {
|
||||
|
||||
@@ -40,6 +40,20 @@ func MyIssues() ([]byte, error) {
|
||||
return get(url, token)
|
||||
}
|
||||
|
||||
// MyRepos returns the raw /user/repos JSON for the token owner's own
|
||||
// repositories. Same PAT and same contract as MyIssues: returns an error if
|
||||
// GITEA_TOKEN is unset so callers can skip the overlay gracefully rather than
|
||||
// issue an unauthenticated request. Gitea's own visibility rules scope the
|
||||
// result, so no additional filtering is applied here.
|
||||
func MyRepos() ([]byte, error) {
|
||||
token := os.Getenv("GITEA_TOKEN")
|
||||
if token == "" {
|
||||
return nil, fmt.Errorf("GITEA_TOKEN not set")
|
||||
}
|
||||
url := base() + "/api/v1/user/repos?limit=8"
|
||||
return get(url, token)
|
||||
}
|
||||
|
||||
// get performs a short-lived GET, optionally with a bearer token, and returns
|
||||
// the response body.
|
||||
func get(url, token string) ([]byte, error) {
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
package gitea_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"git.d-ma.be/mathias/cad-atlas/internal/gitea"
|
||||
)
|
||||
|
||||
// The unset path is the one that runs live right now: GITEA_TOKEN is still not
|
||||
// provisioned in prod (#4), so MyRepos must fail cleanly rather than issue an
|
||||
// unauthenticated request, letting liveOverlay skip and keep the authored
|
||||
// placeholder nodes.
|
||||
func TestMyRepos_ErrorsWhenTokenUnset(t *testing.T) {
|
||||
t.Setenv("GITEA_TOKEN", "")
|
||||
|
||||
body, err := gitea.MyRepos()
|
||||
if err == nil {
|
||||
t.Fatal("want an error when GITEA_TOKEN is unset, got nil")
|
||||
}
|
||||
if body != nil {
|
||||
t.Fatalf("want nil body on error, got %d bytes", len(body))
|
||||
}
|
||||
}
|
||||
+10
-9
@@ -58,19 +58,14 @@ func NewHandler() http.Handler {
|
||||
if ld.run != nil {
|
||||
nodes := atlas.RunNodes(*ld.run)
|
||||
for i := range a.Stages {
|
||||
if a.Stages[i].Generate == "ci-jobs" {
|
||||
if a.Stages[i].Generate.Has("ci-jobs") {
|
||||
a.Stages[i].Nodes = nodes
|
||||
}
|
||||
}
|
||||
a.CIDurationS, a.CDDurationS = atlas.StageSeconds(*ld.run)
|
||||
}
|
||||
if ld.issues != nil {
|
||||
for i := range a.Stages {
|
||||
if a.Stages[i].Generate == "gitea-issues" {
|
||||
a.Stages[i].Nodes = append(ld.issues, a.Stages[i].Nodes...)
|
||||
}
|
||||
}
|
||||
}
|
||||
atlas.PrependGenerated(&a, "gitea-issues", ld.issues)
|
||||
atlas.PrependGenerated(&a, "gitea-repos", ld.repos)
|
||||
// cad-atlas#11: overlay mathias/cad#14's cad-stuck findings as
|
||||
// per-stage badges. Read-only — ApplyStuckOverlay only adds Nodes
|
||||
// with a link out; it never writes anything back to Gitea.
|
||||
@@ -84,7 +79,7 @@ func NewHandler() http.Handler {
|
||||
live = append(live, atlas.FluxNode(*ld.flux))
|
||||
}
|
||||
for i := range a.Stages {
|
||||
if a.Stages[i].Generate == "deploy-state" {
|
||||
if a.Stages[i].Generate.Has("deploy-state") {
|
||||
a.Stages[i].Nodes = append(live, a.Stages[i].Nodes...)
|
||||
}
|
||||
}
|
||||
@@ -104,6 +99,7 @@ type liveOverlayData struct {
|
||||
flux *atlas.Flux
|
||||
timeline []atlas.RunDot
|
||||
issues []atlas.Node
|
||||
repos []atlas.Node
|
||||
stuck []caddomain.StuckFinding
|
||||
}
|
||||
|
||||
@@ -172,6 +168,11 @@ func liveOverlay() liveOverlayData {
|
||||
d.issues = nodes
|
||||
}
|
||||
}
|
||||
if raw, err := gitea.MyRepos(); err == nil {
|
||||
if nodes, err := atlas.RepoNodes(raw); err == nil {
|
||||
d.repos = nodes
|
||||
}
|
||||
}
|
||||
if raw, err := cluster.Deployment(); err == nil {
|
||||
if dep, err := atlas.DeployState(raw); err == nil {
|
||||
d.deploy = &dep
|
||||
|
||||
+5
-28
@@ -5,6 +5,11 @@
|
||||
# For Claude Code: generates project-only CLAUDE.md (it inherits root via tree walk)
|
||||
# For everything else: concatenates root AGENT.md + project PROJECT.md
|
||||
#
|
||||
# Cursor and Aider adapters removed 2026-09-01 — neither is a supported harness
|
||||
# any more. Supported: Claude Code, Antigravity, OpenCode, Mistral Vibe, Crush,
|
||||
# Pi. All read CLAUDE.md or AGENTS.md; system-prompt.txt remains for Open WebUI,
|
||||
# Mods and raw API use.
|
||||
#
|
||||
# Usage: ./scripts/context-sync.sh [--force] [adapter...]
|
||||
# Task: task context:sync
|
||||
#
|
||||
@@ -95,30 +100,6 @@ generate_agents() {
|
||||
echo " → AGENTS.md (root + project; Crush, Pi, Antigravity)"
|
||||
}
|
||||
|
||||
# ── Cursor ───────────────────────────────────────────────────
|
||||
generate_cursor() {
|
||||
{
|
||||
echo "# Cursor rules — auto-generated"
|
||||
echo "# Do not edit. Run: task context:sync"
|
||||
echo ""
|
||||
root_block
|
||||
cat "$PROJECT_FILE"
|
||||
} > .cursorrules
|
||||
echo " → .cursorrules (root + project)"
|
||||
}
|
||||
|
||||
# ── Aider ────────────────────────────────────────────────────
|
||||
generate_aider() {
|
||||
{ root_block; cat "$PROJECT_FILE"; } > .aider.conventions.md
|
||||
if [ ! -f .aider.conf.yml ]; then
|
||||
cat > .aider.conf.yml << 'YAML'
|
||||
read: .aider.conventions.md
|
||||
auto-commits: false
|
||||
YAML
|
||||
fi
|
||||
echo " → .aider.conventions.md (root + project)"
|
||||
}
|
||||
|
||||
# ── Generic system prompt (Open WebUI, Mods, etc.) ──────────
|
||||
generate_system_prompt() {
|
||||
{
|
||||
@@ -180,8 +161,6 @@ echo "Syncing project context from $PROJECT_FILE..."
|
||||
if [ ${#ADAPTERS[@]} -eq 0 ]; then
|
||||
generate_claude
|
||||
generate_agents
|
||||
generate_cursor
|
||||
generate_aider
|
||||
generate_system_prompt
|
||||
generate_mcp
|
||||
else
|
||||
@@ -189,8 +168,6 @@ else
|
||||
case "$adapter" in
|
||||
claude) generate_claude ;;
|
||||
agents) generate_agents ;;
|
||||
cursor) generate_cursor ;;
|
||||
aider) generate_aider ;;
|
||||
prompt|system|openwebui|owui|generic) generate_system_prompt ;;
|
||||
mcp) generate_mcp ;;
|
||||
*) echo "Unknown adapter: $adapter" >&2; exit 1 ;;
|
||||
|
||||
Reference in New Issue
Block a user