Compare commits
2 Commits
df583bc183
..
master
| Author | SHA1 | Date | |
|---|---|---|---|
 Chris Farhood
|
613f570bdc | ||
|
Chris Farhood
|
12ccf82454 |
Vendored
+1
@@ -0,0 +1 @@
|
||||
ghs_n2DXnoj38RccFYNlzH18XQ739bhr8e2w4BZK
|
||||
Vendored
+17
@@ -0,0 +1,17 @@
|
||||
# The current version of the config schema
|
||||
version: 1
|
||||
# What protocol to use when performing git operations. Supported values: ssh, https
|
||||
git_protocol: https
|
||||
# What editor gh should run when creating issues, pull requests, etc. If blank, will refer to environment.
|
||||
editor:
|
||||
# When to interactively prompt. This is a global config that cannot be overridden by hostname. Supported values: enabled, disabled
|
||||
prompt: enabled
|
||||
# A pager program to send command output to, e.g. "less". If blank, will refer to environment. Set the value to "cat" to disable the pager.
|
||||
pager:
|
||||
# Aliases allow you to create nicknames for gh commands
|
||||
aliases:
|
||||
co: pr checkout
|
||||
# The path to a unix socket through which send HTTP connections. If blank, HTTP traffic will be handled by net/http.DefaultTransport.
|
||||
http_unix_socket:
|
||||
# What web browser gh should use when opening URLs. If blank, will refer to environment.
|
||||
browser:
|
||||
Vendored
+12
@@ -0,0 +1,12 @@
|
||||
github.com:
|
||||
users:
|
||||
privilegedescalation-engineer[bot]:
|
||||
oauth_token: ghs_n2DXnoj38RccFYNlzH18XQ739bhr8e2w4BZK
|
||||
privilegedescalation-ceo[bot]:
|
||||
oauth_token: ghs_K7fsAgb8nVATb7zFV5VoZLUaRExyOX3uPkn3
|
||||
privilegedescalation-cto[bot]:
|
||||
oauth_token: ghs_OK6yqSB45aMkas1g5zgJKEgh2CoVH42JLuwu
|
||||
privilegedescalation-qa[bot]:
|
||||
oauth_token: ghs_ppIO9dekMz5A5uAqCPERzj5bk9jBHU2Bf0sL
|
||||
user: privilegedescalation-engineer[bot]
|
||||
oauth_token: ghs_n2DXnoj38RccFYNlzH18XQ739bhr8e2w4BZK
|
||||
-501
@@ -1,501 +0,0 @@
|
||||
schema: "paperclip/v1"
|
||||
agents:
|
||||
barkley-trimsworth:
|
||||
role: "engineer"
|
||||
icon: "shield"
|
||||
capabilities: "Security engineer responsible for code security reviews in the SDLC pipeline (post-UAT gate) and scheduled penetration testing of production and demo environments. Board-authorized for offensive security analysis."
|
||||
adapter:
|
||||
config:
|
||||
timeoutSec: 3600
|
||||
type: "claude_k8s"
|
||||
runtime:
|
||||
heartbeat:
|
||||
intervalSec: 14400
|
||||
maxConcurrentRuns: 1
|
||||
inputs:
|
||||
env:
|
||||
AGENT_HOME:
|
||||
description: "Optional default for AGENT_HOME on agent barkley-trimsworth"
|
||||
kind: "plain"
|
||||
default: "/paperclip/instances/default/companies/d50d9792-5817-4ff5-9771-c3267ba12990/agents/fadbc601-1528-4368-9317-31b144ed1655/instructions"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_AUTH_TOKEN:
|
||||
description: "Provide ANTHROPIC_AUTH_TOKEN for agent barkley-trimsworth"
|
||||
kind: "secret"
|
||||
default: ""
|
||||
requirement: "optional"
|
||||
ANTHROPIC_BASE_URL:
|
||||
description: "Optional default for ANTHROPIC_BASE_URL on agent barkley-trimsworth"
|
||||
kind: "plain"
|
||||
default: "https://api.minimax.io/anthropic"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_DEFAULT_HAIKU_MODEL:
|
||||
description: "Optional default for ANTHROPIC_DEFAULT_HAIKU_MODEL on agent barkley-trimsworth"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_DEFAULT_OPUS_MODEL:
|
||||
description: "Optional default for ANTHROPIC_DEFAULT_OPUS_MODEL on agent barkley-trimsworth"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_DEFAULT_SONNET_MODEL:
|
||||
description: "Optional default for ANTHROPIC_DEFAULT_SONNET_MODEL on agent barkley-trimsworth"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_MODEL:
|
||||
description: "Optional default for ANTHROPIC_MODEL on agent barkley-trimsworth"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_SMALL_FAST_MODEL:
|
||||
description: "Optional default for ANTHROPIC_SMALL_FAST_MODEL on agent barkley-trimsworth"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
API_TIMEOUT_MS:
|
||||
description: "Optional default for API_TIMEOUT_MS on agent barkley-trimsworth"
|
||||
kind: "plain"
|
||||
default: "3000000"
|
||||
requirement: "optional"
|
||||
CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS:
|
||||
description: "Optional default for CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS on agent barkley-trimsworth"
|
||||
kind: "plain"
|
||||
default: "1"
|
||||
requirement: "optional"
|
||||
GH_CONFIG_DIR:
|
||||
description: "Optional default for GH_CONFIG_DIR on agent barkley-trimsworth"
|
||||
kind: "plain"
|
||||
default: "$AGENT_HOME/.config/gh"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_ID:
|
||||
description: "Optional default for GITHUB_APP_ID on agent barkley-trimsworth"
|
||||
kind: "plain"
|
||||
default: "3141748"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_INSTALLATION_ID:
|
||||
description: "Optional default for GITHUB_APP_INSTALLATION_ID on agent barkley-trimsworth"
|
||||
kind: "plain"
|
||||
default: "117793367"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_PEM_FILE:
|
||||
description: "Optional default for GITHUB_APP_PEM_FILE on agent barkley-trimsworth"
|
||||
kind: "plain"
|
||||
default: "/secrets/groombook/groombook-engineer.pem"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
flea-flicker:
|
||||
role: "engineer"
|
||||
icon: "code"
|
||||
capabilities: "Principal software engineer responsible for core platform architecture, implementation, and technical execution."
|
||||
adapter:
|
||||
config:
|
||||
timeoutSec: 3600
|
||||
type: "claude_k8s"
|
||||
runtime:
|
||||
heartbeat:
|
||||
enabled: true
|
||||
intervalSec: 14400
|
||||
maxConcurrentRuns: 1
|
||||
inputs:
|
||||
env:
|
||||
AGENT_HOME:
|
||||
description: "Optional default for AGENT_HOME on agent flea-flicker"
|
||||
kind: "plain"
|
||||
default: "/paperclip/instances/default/companies/d50d9792-5817-4ff5-9771-c3267ba12990/agents/515a927a-66b6-449b-aa03-653b697b30f7/instructions"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_AUTH_TOKEN:
|
||||
description: "Provide ANTHROPIC_AUTH_TOKEN for agent flea-flicker"
|
||||
kind: "secret"
|
||||
default: ""
|
||||
requirement: "optional"
|
||||
ANTHROPIC_BASE_URL:
|
||||
description: "Optional default for ANTHROPIC_BASE_URL on agent flea-flicker"
|
||||
kind: "plain"
|
||||
default: "https://api.minimax.io/anthropic"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_DEFAULT_HAIKU_MODEL:
|
||||
description: "Optional default for ANTHROPIC_DEFAULT_HAIKU_MODEL on agent flea-flicker"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_DEFAULT_OPUS_MODEL:
|
||||
description: "Optional default for ANTHROPIC_DEFAULT_OPUS_MODEL on agent flea-flicker"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_MODEL:
|
||||
description: "Optional default for ANTHROPIC_MODEL on agent flea-flicker"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_SMALL_FAST_MODEL:
|
||||
description: "Optional default for ANTHROPIC_SMALL_FAST_MODEL on agent flea-flicker"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHRPOIC_DEFAULT_SONNET_MODEL:
|
||||
description: "Optional default for ANTHRPOIC_DEFAULT_SONNET_MODEL on agent flea-flicker"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
API_TIMEOUT_MS:
|
||||
description: "Optional default for API_TIMEOUT_MS on agent flea-flicker"
|
||||
kind: "plain"
|
||||
default: "3000000"
|
||||
requirement: "optional"
|
||||
CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS:
|
||||
description: "Optional default for CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS on agent flea-flicker"
|
||||
kind: "plain"
|
||||
default: "1"
|
||||
requirement: "optional"
|
||||
GH_CONFIG_DIR:
|
||||
description: "Optional default for GH_CONFIG_DIR on agent flea-flicker"
|
||||
kind: "plain"
|
||||
default: "$AGENT_HOME/.config/gh"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_ID:
|
||||
description: "Optional default for GITHUB_APP_ID on agent flea-flicker"
|
||||
kind: "plain"
|
||||
default: "3141748"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_INSTALLATION_ID:
|
||||
description: "Optional default for GITHUB_APP_INSTALLATION_ID on agent flea-flicker"
|
||||
kind: "plain"
|
||||
default: "117793367"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_PEM_FILE:
|
||||
description: "Optional default for GITHUB_APP_PEM_FILE on agent flea-flicker"
|
||||
kind: "plain"
|
||||
default: "/secrets/groombook/groombook-engineer.pem"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
lint-roller:
|
||||
role: "qa"
|
||||
icon: "bug"
|
||||
capabilities: "Senior QA engineer responsible for test strategy, quality assurance, bug tracking, and release validation."
|
||||
adapter:
|
||||
config:
|
||||
timeoutSec: 3600
|
||||
type: "claude_k8s"
|
||||
runtime:
|
||||
heartbeat:
|
||||
enabled: true
|
||||
intervalSec: 14400
|
||||
maxConcurrentRuns: 1
|
||||
inputs:
|
||||
env:
|
||||
AGENT_HOME:
|
||||
description: "Optional default for AGENT_HOME on agent lint-roller"
|
||||
kind: "plain"
|
||||
default: "/paperclip/instances/default/companies/d50d9792-5817-4ff5-9771-c3267ba12990/agents/16fa774c-bbab-4647-9f8d-24807b83a24f/instructions"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_AUTH_TOKEN:
|
||||
description: "Provide ANTHROPIC_AUTH_TOKEN for agent lint-roller"
|
||||
kind: "secret"
|
||||
default: ""
|
||||
requirement: "optional"
|
||||
ANTHROPIC_BASE_URL:
|
||||
description: "Optional default for ANTHROPIC_BASE_URL on agent lint-roller"
|
||||
kind: "plain"
|
||||
default: "https://api.minimax.io/anthropic"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_DEFAULT_HAIKU_MODEL:
|
||||
description: "Optional default for ANTHROPIC_DEFAULT_HAIKU_MODEL on agent lint-roller"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_DEFAULT_OPUS_MODEL:
|
||||
description: "Optional default for ANTHROPIC_DEFAULT_OPUS_MODEL on agent lint-roller"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_DEFAULT_SONNET_MODEL:
|
||||
description: "Optional default for ANTHROPIC_DEFAULT_SONNET_MODEL on agent lint-roller"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_MODEL:
|
||||
description: "Optional default for ANTHROPIC_MODEL on agent lint-roller"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_SMALL_FAST_MODEL:
|
||||
description: "Optional default for ANTHROPIC_SMALL_FAST_MODEL on agent lint-roller"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
API_TIMEOUT_MS:
|
||||
description: "Optional default for API_TIMEOUT_MS on agent lint-roller"
|
||||
kind: "plain"
|
||||
default: "3000000"
|
||||
requirement: "optional"
|
||||
CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS:
|
||||
description: "Optional default for CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS on agent lint-roller"
|
||||
kind: "plain"
|
||||
default: "1"
|
||||
requirement: "optional"
|
||||
GH_CONFIG_DIR:
|
||||
description: "Optional default for GH_CONFIG_DIR on agent lint-roller"
|
||||
kind: "plain"
|
||||
default: "$AGENT_HOME/.config/gh"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_ID:
|
||||
description: "Optional default for GITHUB_APP_ID on agent lint-roller"
|
||||
kind: "plain"
|
||||
default: "3141835"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_INSTALLATION_ID:
|
||||
description: "Optional default for GITHUB_APP_INSTALLATION_ID on agent lint-roller"
|
||||
kind: "plain"
|
||||
default: "117794928"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_PEM_FILE:
|
||||
description: "Optional default for GITHUB_APP_PEM_FILE on agent lint-roller"
|
||||
kind: "plain"
|
||||
default: "/secrets/groombook/groombook-qa.pem"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
pawla-abdul:
|
||||
role: "cmo"
|
||||
icon: "target"
|
||||
capabilities: "Chief Marketing & Product Officer responsible for marketing strategy, market positioning, brand management, product strategy, feature intake and prioritization (PDLC gate), product research, and public-facing content. Primary reviewer of all feature requests — returns Accept, Backlog, or Deny decisions to the CEO before any engineering work begins."
|
||||
adapter:
|
||||
config:
|
||||
model: "claude-haiku-4-5-20251001"
|
||||
type: "claude_k8s"
|
||||
runtime:
|
||||
heartbeat:
|
||||
intervalSec: 14400
|
||||
inputs:
|
||||
env:
|
||||
AGENT_HOME:
|
||||
description: "Optional default for AGENT_HOME on agent pawla-abdul"
|
||||
kind: "plain"
|
||||
default: "/paperclip/instances/default/companies/d50d9792-5817-4ff5-9771-c3267ba12990/agents/7332abb9-4f85-4f87-ba13-aa7e0d5a2963/instructions"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
GH_CONFIG_DIR:
|
||||
description: "Optional default for GH_CONFIG_DIR on agent pawla-abdul"
|
||||
kind: "plain"
|
||||
default: "$AGENT_HOME/.config/gh"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_ID:
|
||||
description: "Optional default for GITHUB_APP_ID on agent pawla-abdul"
|
||||
kind: "plain"
|
||||
default: "3141748"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_INSTALLATION_ID:
|
||||
description: "Optional default for GITHUB_APP_INSTALLATION_ID on agent pawla-abdul"
|
||||
kind: "plain"
|
||||
default: "117793367"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_PEM_FILE:
|
||||
description: "Optional default for GITHUB_APP_PEM_FILE on agent pawla-abdul"
|
||||
kind: "plain"
|
||||
default: "/secrets/groombook/groombook-engineer.pem"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
MINIMAX_API_BASE_URL:
|
||||
description: "Optional default for MINIMAX_API_BASE_URL on agent pawla-abdul"
|
||||
kind: "plain"
|
||||
default: "https://api.minimax.io"
|
||||
requirement: "optional"
|
||||
MINIMAX_API_KEY:
|
||||
description: "Optional default for MINIMAX_API_KEY on agent pawla-abdul"
|
||||
kind: "secret"
|
||||
default: ""
|
||||
requirement: "optional"
|
||||
scrubs-mcbarkley:
|
||||
role: "ceo"
|
||||
icon: "crown"
|
||||
capabilities: "CEO responsible for company strategy, product roadmap, organizational coordination, hiring, and final production merge authority. Owns the PDLC gate: routes feature requests through CMPO review, approves or denies work, and is the sole agent authorized to merge to production."
|
||||
adapter:
|
||||
config:
|
||||
dangerouslySkipPermissions: true
|
||||
maxTurnsPerRun: 300
|
||||
model: "claude-sonnet-4-6"
|
||||
type: "claude_local"
|
||||
runtime:
|
||||
heartbeat:
|
||||
intervalSec: 28800
|
||||
maxConcurrentRuns: 1
|
||||
permissions:
|
||||
canCreateAgents: true
|
||||
inputs:
|
||||
env:
|
||||
AGENT_HOME:
|
||||
description: "Optional default for AGENT_HOME on agent scrubs-mcbarkley"
|
||||
kind: "plain"
|
||||
default: "/paperclip/instances/default/companies/d50d9792-5817-4ff5-9771-c3267ba12990/agents/1471aa94-e2b4-46b7-8fe7-084865d662fe/instructions"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
GH_CONFIG_DIR:
|
||||
description: "Optional default for GH_CONFIG_DIR on agent scrubs-mcbarkley"
|
||||
kind: "plain"
|
||||
default: "$AGENT_HOME/.config/gh"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_ID:
|
||||
description: "Optional default for GITHUB_APP_ID on agent scrubs-mcbarkley"
|
||||
kind: "plain"
|
||||
default: "3141498"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_INSTALLATION_ID:
|
||||
description: "Optional default for GITHUB_APP_INSTALLATION_ID on agent scrubs-mcbarkley"
|
||||
kind: "plain"
|
||||
default: "117787139"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_PEM_FILE:
|
||||
description: "Optional default for GITHUB_APP_PEM_FILE on agent scrubs-mcbarkley"
|
||||
kind: "plain"
|
||||
default: "/secrets/groombook/groombook-ceo.pem"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
shedward-scissorhands:
|
||||
role: "qa"
|
||||
icon: "microscope"
|
||||
capabilities: "User acceptance testing via Playwright MCP. Performs exhaustive pre-production browser evaluation — navigates every page, clicks every interactive element, walks all critical user flows, and blocks releases when defects are found."
|
||||
adapter:
|
||||
config:
|
||||
graceSec: 15
|
||||
timeoutSec: 3600
|
||||
type: "claude_k8s"
|
||||
runtime:
|
||||
heartbeat:
|
||||
enabled: true
|
||||
intervalSec: 14400
|
||||
maxConcurrentRuns: 1
|
||||
inputs:
|
||||
env:
|
||||
AGENT_HOME:
|
||||
description: "Optional default for AGENT_HOME on agent shedward-scissorhands"
|
||||
kind: "plain"
|
||||
default: "/paperclip/instances/default/companies/d50d9792-5817-4ff5-9771-c3267ba12990/agents/22f13aec-6df2-4d24-be70-66e0abad7e12/instructions"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_AUTH_TOKEN:
|
||||
description: "Provide ANTHROPIC_AUTH_TOKEN for agent shedward-scissorhands"
|
||||
kind: "secret"
|
||||
default: ""
|
||||
requirement: "optional"
|
||||
ANTHROPIC_BASE_URL:
|
||||
description: "Optional default for ANTHROPIC_BASE_URL on agent shedward-scissorhands"
|
||||
kind: "plain"
|
||||
default: "https://api.minimax.io/anthropic"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_DEFAULT_HAIKU_MODEL:
|
||||
description: "Optional default for ANTHROPIC_DEFAULT_HAIKU_MODEL on agent shedward-scissorhands"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_DEFAULT_OPUS_MODEL:
|
||||
description: "Optional default for ANTHROPIC_DEFAULT_OPUS_MODEL on agent shedward-scissorhands"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_DEFAULT_SONNET_MODEL:
|
||||
description: "Optional default for ANTHROPIC_DEFAULT_SONNET_MODEL on agent shedward-scissorhands"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHROPIC_MODEL:
|
||||
description: "Optional default for ANTHROPIC_MODEL on agent shedward-scissorhands"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
ANTHRPOIC_SMALL_FAST_MODEL:
|
||||
description: "Optional default for ANTHRPOIC_SMALL_FAST_MODEL on agent shedward-scissorhands"
|
||||
kind: "plain"
|
||||
default: "MiniMax-M2.7"
|
||||
requirement: "optional"
|
||||
API_TIMEOUT_MS:
|
||||
description: "Optional default for API_TIMEOUT_MS on agent shedward-scissorhands"
|
||||
kind: "plain"
|
||||
default: "3000000"
|
||||
requirement: "optional"
|
||||
CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS:
|
||||
description: "Optional default for CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS on agent shedward-scissorhands"
|
||||
kind: "plain"
|
||||
default: "1"
|
||||
requirement: "optional"
|
||||
GH_CONFIG_DIR:
|
||||
description: "Optional default for GH_CONFIG_DIR on agent shedward-scissorhands"
|
||||
kind: "plain"
|
||||
default: "$AGENT_HOME/.config/gh"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_ID:
|
||||
description: "Optional default for GITHUB_APP_ID on agent shedward-scissorhands"
|
||||
kind: "plain"
|
||||
default: "3141835"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_INSTALLATION_ID:
|
||||
description: "Optional default for GITHUB_APP_INSTALLATION_ID on agent shedward-scissorhands"
|
||||
kind: "plain"
|
||||
default: "117794928"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_PEM_FILE:
|
||||
description: "Optional default for GITHUB_APP_PEM_FILE on agent shedward-scissorhands"
|
||||
kind: "plain"
|
||||
default: "/secrets/groombook/groombook-qa.pem"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
the-dogfather:
|
||||
role: "cto"
|
||||
icon: "cpu"
|
||||
capabilities: "Owns technical roadmap, architecture, engineering hiring, and execution. First engineering leader for a pet grooming platform."
|
||||
adapter:
|
||||
config:
|
||||
effort: "high"
|
||||
graceSec: 15
|
||||
model: "claude-opus-4-6"
|
||||
timeoutSec: 0
|
||||
type: "claude_k8s"
|
||||
runtime:
|
||||
heartbeat:
|
||||
intervalSec: 14400
|
||||
maxConcurrentRuns: 1
|
||||
inputs:
|
||||
env:
|
||||
AGENT_HOME:
|
||||
description: "Optional default for AGENT_HOME on agent the-dogfather"
|
||||
kind: "plain"
|
||||
default: "/paperclip/instances/default/companies/d50d9792-5817-4ff5-9771-c3267ba12990/agents/2a556501-95e0-4e52-9cf1-e2034678285d/instructions"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
GH_CONFIG_DIR:
|
||||
description: "Optional default for GH_CONFIG_DIR on agent the-dogfather"
|
||||
kind: "plain"
|
||||
default: "$AGENT_HOME/.config/gh"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_ID:
|
||||
description: "Optional default for GITHUB_APP_ID on agent the-dogfather"
|
||||
kind: "plain"
|
||||
default: "3141591"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_INSTALLATION_ID:
|
||||
description: "Optional default for GITHUB_APP_INSTALLATION_ID on agent the-dogfather"
|
||||
kind: "plain"
|
||||
default: "117788845"
|
||||
requirement: "optional"
|
||||
GITHUB_APP_PEM_FILE:
|
||||
description: "Optional default for GITHUB_APP_PEM_FILE on agent the-dogfather"
|
||||
kind: "plain"
|
||||
default: "/secrets/groombook/groombook-cto.pem"
|
||||
portability: "system_dependent"
|
||||
requirement: "optional"
|
||||
company:
|
||||
brandColor: "#96d35f"
|
||||
logoPath: "images/company-logo.png"
|
||||
sidebar:
|
||||
agents:
|
||||
- "scrubs-mcbarkley"
|
||||
- "pawla-abdul"
|
||||
- "the-dogfather"
|
||||
- "barkley-trimsworth"
|
||||
- "flea-flicker"
|
||||
- "lint-roller"
|
||||
- "shedward-scissorhands"
|
||||
@@ -2,38 +2,33 @@
|
||||
|
||||
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
|
||||
|
||||
## What This Repo Is
|
||||
## Repository Purpose
|
||||
|
||||
This is the **GitHub org-level configuration repository** (`groombook/.github`) for GroomBook — an open-source, self-hostable pet grooming business management platform. It contains:
|
||||
This is the **Privileged Escalation org-level repository**. It contains company-wide skills (instruction bundles) consumed by AI agents that run inside Paperclip and develop Headlamp plugins. There is no application code, build system, or test suite — only Markdown skill definitions.
|
||||
|
||||
- `profile/` — GitHub organization profile README and logo
|
||||
- `company/` — Paperclip AI company configuration export (agent definitions, skills, projects)
|
||||
## Structure
|
||||
|
||||
There is no application code, build system, or test suite here. This repo is purely configuration and documentation.
|
||||
- `skills/` — Company skill definitions, each in its own directory with a `SKILL.md` file
|
||||
- `skills/safety/SKILL.md` — Non-negotiable safety rules (secret handling, destructive action restrictions, sealed-secrets workflow, escalation protocol)
|
||||
- `skills/sdlc/SKILL.md` — Software development lifecycle rules (GitHub auth, issue approval gates, branch strategy, PR review policy, handoff protocol, CI/CD)
|
||||
- `skills/coding-standards/SKILL.md` — Headlamp plugin development conventions (stack, commands, registration API, shared libraries)
|
||||
|
||||
## Related Repositories
|
||||
## Skill File Format
|
||||
|
||||
| Repo | Purpose |
|
||||
|------|---------|
|
||||
| `groombook/groombook` | Primary application (TypeScript, Node.js, React, PostgreSQL) |
|
||||
| `groombook/agents` | Canonical agent definitions — prompts, personas, heartbeats, adapter configs |
|
||||
| `groombook/infra` | Kubernetes manifests for Flux GitOps deployment |
|
||||
Each skill is a Markdown file with YAML frontmatter containing `name` and `description` fields:
|
||||
|
||||
## Company Directory (`company/`)
|
||||
```markdown
|
||||
---
|
||||
name: skill-name
|
||||
description: >
|
||||
One-line description of what the skill covers.
|
||||
---
|
||||
|
||||
This is an export from [Paperclip](https://paperclip.ing) and contains a snapshot of the agent company configuration:
|
||||
# Skill Title
|
||||
|
||||
- `.paperclip.yaml` — Full agent configuration (adapters, heartbeats, env vars, permissions)
|
||||
- `agents/` — Per-agent directories with prompt files (AGENTS.md, SOUL.md, HEARTBEAT.md, etc.)
|
||||
- `skills/` — Shared skill definitions sourced from external repos (cpfarhood, fluxcd, paperclipai)
|
||||
- `projects/` — Project definitions (groombook-app, groombook-infra, groombook-org, groombook-site, onboarding)
|
||||
- `COMPANY.md` — Company metadata frontmatter
|
||||
Content...
|
||||
```
|
||||
|
||||
The canonical source for agent configurations is the `groombook/agents` repo. The `company/` directory here is a synced export — do not treat it as the source of truth for agent prompts or configs.
|
||||
## Skill Loading Order
|
||||
|
||||
## Key Policies
|
||||
|
||||
- **Container images**: `ghcr.io` only — no Docker Hub, no mirrors
|
||||
- **Dependency updates**: Mend Renovate only — never use Dependabot
|
||||
- **Versioning**: CalVer format `YYYY.MDD.PATCH` (e.g., `2026.318.0`), not SemVer
|
||||
- **All PRs**: Include `cc @cpfarhood` at the bottom of the PR body
|
||||
Skills are loaded by Paperclip in this order: `safety` → `sdlc` → `coding-standards`. Later skills can assume earlier ones are already loaded and should not duplicate their content.
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
name: "GroomBook"
|
||||
description: "An open source business management solution for pet groomers."
|
||||
schema: "agentcompanies/v1"
|
||||
slug: "groombook"
|
||||
---
|
||||
|
||||
@@ -1,62 +0,0 @@
|
||||
# GroomBook
|
||||
|
||||
> An open source business management solution for pet groomers.
|
||||
|
||||
|
||||
|
||||
## What's Inside
|
||||
|
||||
> This is an [Agent Company](https://agentcompanies.io) package from [Paperclip](https://paperclip.ing)
|
||||
|
||||
| Content | Count |
|
||||
|---------|-------|
|
||||
| Agents | 7 |
|
||||
| Skills | 20 |
|
||||
|
||||
### Agents
|
||||
|
||||
| Agent | Role | Reports To |
|
||||
|-------|------|------------|
|
||||
| Barkley Trimsworth | Engineer | the-dogfather |
|
||||
| Flea Flicker | Engineer | the-dogfather |
|
||||
| Lint Roller | qa | the-dogfather |
|
||||
| Pawla Abdul | CMO | scrubs-mcbarkley |
|
||||
| Scrubs McBarkley | CEO | — |
|
||||
| Shedward Scissorhands | qa | the-dogfather |
|
||||
| The Dogfather | CTO | scrubs-mcbarkley |
|
||||
|
||||
### Skills
|
||||
|
||||
| Skill | Description | Source |
|
||||
|-------|-------------|--------|
|
||||
| better-auth-best-practices | Configure Better Auth server and client, set up database adapters, manage sessions, add plugins, and handle environment variables. Use when users mention Better Auth, betterauth, auth.ts, or need to set up TypeScript authentication with email/password, OAuth, or plugin configuration. | [github](https://github.com/better-auth/skills) |
|
||||
| better-auth-security-best-practices | Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment. | [github](https://github.com/better-auth/skills) |
|
||||
| create-auth-skill | Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth. | [github](https://github.com/better-auth/skills) |
|
||||
| email-and-password-best-practices | Configure email verification, implement password reset flows, set password policies, and customise hashing algorithms for Better Auth email/password authentication. Use when users need to set up login, sign-in, sign-up, credential authentication, or password security with Better Auth. | [github](https://github.com/better-auth/skills) |
|
||||
| organization-best-practices | Configure multi-tenant organizations, manage members and invitations, define custom roles and permissions, set up teams, and implement RBAC using Better Auth's organization plugin. Use when users need org setup, team management, member roles, access control, or the Better Auth organization plugin. | [github](https://github.com/better-auth/skills) |
|
||||
| two-factor-authentication-best-practices | Configure TOTP authenticator apps, send OTP codes via email/SMS, manage backup codes, handle trusted devices, and implement 2FA sign-in flows using Better Auth's twoFactor plugin. Use when users need MFA, multi-factor authentication, authenticator setup, or login security with Better Auth. | [github](https://github.com/better-auth/skills) |
|
||||
| github-app-token | Generate a GitHub installation access token from a GitHub App PEM key, App ID, and Installation ID, write it to a per-agent file, then authenticate the gh CLI with it. | [github](https://github.com/farhoodliquor/skills) |
|
||||
| minimax-image-generation | — | [github](https://github.com/farhoodliquor/skills) |
|
||||
| shannon | Autonomous AI pentester for web apps and APIs. Run white-box security assessments with Shannon — analyzes source code, identifies attack vectors, and executes real exploits to prove vulnerabilities. Triggered by 'shannon', 'pentest', 'security audit', 'vuln scan'. | [github](https://github.com/farhoodliquor/skills) |
|
||||
| commit-assisted-by | > | [github](https://github.com/fluxcd/agent-skills) |
|
||||
| flux-controller-patch-releases | > | [github](https://github.com/fluxcd/agent-skills) |
|
||||
| gitops-cluster-debug | > | [github](https://github.com/fluxcd/agent-skills) |
|
||||
| gitops-knowledge | > | [github](https://github.com/fluxcd/agent-skills) |
|
||||
| gitops-repo-audit | > | [github](https://github.com/fluxcd/agent-skills) |
|
||||
| check-pr | > | [github](https://github.com/greptileai/skills) |
|
||||
| greploop | > | [github](https://github.com/greptileai/skills) |
|
||||
| paperclip-create-agent | > | [github](https://github.com/paperclipai/paperclip/tree/master/skills/paperclip-create-agent) |
|
||||
| paperclip-create-plugin | > | [github](https://github.com/paperclipai/paperclip/tree/master/skills/paperclip-create-plugin) |
|
||||
| paperclip | > | [github](https://github.com/paperclipai/paperclip/tree/master/skills/paperclip) |
|
||||
| para-memory-files | > | [github](https://github.com/paperclipai/paperclip/tree/master/skills/para-memory-files) |
|
||||
|
||||
## Getting Started
|
||||
|
||||
```bash
|
||||
pnpm paperclipai company import this-github-url-or-folder
|
||||
```
|
||||
|
||||
See [Paperclip](https://paperclip.ing) for more information.
|
||||
|
||||
---
|
||||
Exported from [Paperclip](https://paperclip.ing) on 2026-04-16
|
||||
Submodule
+1
Submodule headlamp-rook-plugin added at 79eaa6910d
Submodule
+1
Submodule headlamp-sealed-secrets-plugin added at 143b2c36e0
Binary file not shown.
|
Before Width: | Height: | Size: 51 KiB |
@@ -0,0 +1 @@
|
||||
test
|
||||
Submodule
+1
Submodule org added at c420e1543f
Binary file not shown.
|
Before Width: | Height: | Size: 1.2 MiB |
@@ -1,6 +0,0 @@
|
||||
---
|
||||
name: "GroomBook App"
|
||||
description: "This git repository is the primary GroomBook Application source code and associated build artifacts."
|
||||
---
|
||||
|
||||
This git repository is the primary GroomBook Application source code and associated build artifacts.
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
name: "GroomBook Infra"
|
||||
description: "This repository is the infrastructure associated with the development and production/demo instances of GroomBook. It is a target gitrepository of a 2 step Flux GitOps process that is triggered from an external kubernetes cluster management repository."
|
||||
---
|
||||
|
||||
This repository is the infrastructure associated with the development and production/demo instances of GroomBook. It is a target gitrepository of a 2 step Flux GitOps process that is triggered from an external kubernetes cluster management repository.
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
name: "GroomBook Org"
|
||||
description: "This repository houses the organization level GitHub Pages as well as shared GitHub Actions."
|
||||
---
|
||||
|
||||
This repository houses the organization level GitHub Pages as well as shared GitHub Actions.
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
name: "GroomBook Site"
|
||||
description: "This repository houses the primary GitHub Pages based site for the GroomBook Platform."
|
||||
---
|
||||
|
||||
This repository houses the primary GitHub Pages based site for the GroomBook Platform.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
name: "Onboarding"
|
||||
---
|
||||
|
||||
@@ -1,62 +1,54 @@
|
||||
---
|
||||
name: coding-standards
|
||||
description: >
|
||||
Engineering quality bar for GroomBook code: priority ordering of correctness
|
||||
vs. clarity vs. maintainability vs. performance vs. elegance, PR and test
|
||||
requirements, no-hardcoded-values rules, branch discipline, and the no-self-
|
||||
merge contract.
|
||||
Coding standards for Privileged Escalation. Covers Headlamp plugin
|
||||
development workflow, registration API, and shared libraries.
|
||||
---
|
||||
|
||||
# Coding Standards
|
||||
|
||||
These rules apply to any GroomBook agent that writes, reviews, or merges code.
|
||||
## Headlamp Plugins
|
||||
|
||||
## Priority ordering
|
||||
All plugins extend [Headlamp](https://headlamp.dev/docs/latest/development/plugins/getting-started), a Kubernetes dashboard with a plugin system.
|
||||
|
||||
When making technical decisions, prioritize in this order:
|
||||
- **Language:** TypeScript + React 18, MUI v5
|
||||
- **Scaffolding:** `npx --yes @kinvolk/headlamp-plugin create <plugin-name>`
|
||||
- **Entry point:** `src/index.tsx`
|
||||
- **Linting:** ESLint via `@headlamp-k8s/eslint-config` + Prettier
|
||||
- **Testing:** Vitest + React Testing Library
|
||||
|
||||
1. **Correctness** — does it work? Does it handle edge cases? Have you proven it, not assumed it?
|
||||
2. **Clarity** — will another engineer understand this without context in 6 months?
|
||||
3. **Maintainability** — will it be safe to change?
|
||||
4. **Performance** — fast enough for the use case? Profile before optimizing.
|
||||
5. **Elegance** — nice if free; never trade any of the above for it.
|
||||
### Plugin Commands
|
||||
|
||||
## Pull request discipline
|
||||
Run from the plugin directory:
|
||||
|
||||
* All changes go through a PR. **Never push directly to `dev`, `uat`, or `main`.**
|
||||
* No agent merges their own PR.
|
||||
* Always include `cc @cpfarhood` at the bottom of the PR body for visibility (not as a reviewer).
|
||||
| Command | Purpose |
|
||||
|---|---|
|
||||
| `npm run start` | Dev mode with hot reload |
|
||||
| `npm run build` | Production build (`dist/main.js`) |
|
||||
| `npm run format` | Prettier format |
|
||||
| `npm run lint` | ESLint check |
|
||||
| `npm run lint-fix` | ESLint auto-fix |
|
||||
| `npm run tsc` | Typecheck |
|
||||
| `npm run test` | Vitest tests |
|
||||
|
||||
## Test requirements
|
||||
### Registration API
|
||||
|
||||
* **Every PR must include tests** for new code paths. No exceptions for "small" changes.
|
||||
* Run unit tests, type check, and lint locally (or rely on CI) **before** requesting review.
|
||||
* A PR without passing tests does not get approval.
|
||||
* New code paths require coverage. No coverage = no approval.
|
||||
Import from `@kinvolk/headlamp-plugin/lib`:
|
||||
|
||||
## Code review tone
|
||||
- `registerAppBarAction()` — add components to the nav bar
|
||||
- `registerRoute()` — create new pages
|
||||
- `registerSidebarEntry()` — add sidebar items
|
||||
- `registerDetailsViewSection()` — extend resource detail views
|
||||
- `registerPluginSettings()` — add plugin configuration UI
|
||||
|
||||
Hold a high bar. PRs with obvious mistakes, missing tests, hardcoded values, or policy violations get firm, specific review comments citing what's wrong and what the fix is. Cite the file and line. Suggest the fix when you know it. Don't sugarcoat — but be professional and constructive. "This looks wrong" is not a review comment.
|
||||
### K8s API Access
|
||||
|
||||
## Hardcoded values
|
||||
```typescript
|
||||
import { K8s } from '@kinvolk/headlamp-plugin/lib';
|
||||
const [pods, error] = K8s.ResourceClasses.Pod.useList();
|
||||
```
|
||||
|
||||
* **Colors** use CSS variables / theme tokens. Never raw hex in components.
|
||||
* **Strings** use constants or i18n. No magic strings.
|
||||
* **Numbers** that aren't trivially obvious go in named constants.
|
||||
* **No magic numbers** in business logic.
|
||||
### Shared Libraries
|
||||
|
||||
## Secrets in code
|
||||
|
||||
Secrets never touch source. See the `safety` skill for the SealedSecrets workflow. If your implementation requires a Kubernetes secret you cannot create, file an issue for the agent who owns the SealedSecrets workflow rather than committing a plaintext value.
|
||||
|
||||
## Releases and versioning
|
||||
|
||||
All releases use CalVer (`YYYY.MMDD.PATCH`, e.g. `2026.0504.0`). No SemVer, no custom schemes.
|
||||
|
||||
## Container images
|
||||
|
||||
Push to `ghcr.io` only. Never Docker Hub for first-party images.
|
||||
|
||||
## When uncertain
|
||||
|
||||
If a code-quality call isn't covered above and you can't decide cleanly, escalate to the CTO via comment rather than guessing.
|
||||
These are provided by Headlamp at runtime — **do not bundle them**:
|
||||
React, React Router, Redux, MUI, Lodash, Monaco Editor, Notistack, Iconify.
|
||||
|
||||
+12
-17
@@ -1,31 +1,26 @@
|
||||
---
|
||||
name: safety
|
||||
description: >
|
||||
Non-negotiable safety rules for all GroomBook agents. Covers secret handling,
|
||||
destructive-action gating, the SealedSecrets workflow, kubectl scope limits,
|
||||
and the escalation protocol when an action's safety is uncertain.
|
||||
Non-negotiable safety rules for all agents at Privileged Escalation. Covers
|
||||
secret handling, destructive command restrictions, sealed-secrets workflow, and
|
||||
escalation protocol when uncertain.
|
||||
---
|
||||
|
||||
# Safety
|
||||
# Safety Considerations
|
||||
|
||||
The following rules apply to every GroomBook agent without exception.
|
||||
The following rules apply to all agents at Privileged Escalation without exception.
|
||||
|
||||
## Non-negotiable rules
|
||||
## Non-Negotiable Rules
|
||||
|
||||
* **Never exfiltrate secrets or private data.** This includes API keys, tokens, PEM files, database credentials, kubeconfig contents, and any value sourced from a secret reference in your adapter config. Never log, comment, or return these values in any output — including PR descriptions, issue comments, and chat responses.
|
||||
* **Never exfiltrate secrets or private data.** This includes API keys, tokens, PEM files, database credentials, kubeconfig contents, and any value sourced from a secret reference in your adapter config. Do not log, comment, or return these values in any output.
|
||||
|
||||
* **Seek board approval before destructive actions.** "Destructive" means: deleting resources, dropping tables, wiping namespaces, force-pushing branches, resetting git history, removing secrets, or any operation that cannot be undone without restoring from backup. Use `request_board_approval` and set the source issue to `blocked` until approved.
|
||||
* **Seek Board Approval for Destructive Actions.** Destructive means: deleting resources, dropping tables, wiping namespaces, force-pushing branches, resetting git history, removing secrets, or any operation that cannot be undone without restoring from backup.
|
||||
|
||||
* **Never commit plaintext secrets.** Kubernetes secrets go through Bitnami Sealed Secrets (`kubeseal`). Application credentials go in environment variables injected at runtime — never hardcoded in source.
|
||||
* **No plaintext secrets in any repository.** Kubernetes secrets go through Bitnami Sealed Secrets (`kubeseal`). Application credentials go in environment variables injected at runtime — never hardcoded.
|
||||
|
||||
* **Never `kubectl apply` against production (`groombook`).** The production namespace is Flux-managed. Manifest changes go through a PR to `groombook/infra` and are reconciled by Flux. The `groombook-dev` and `groombook-uat` namespaces permit direct kubectl use for iteration; secrets at every environment still follow the SealedSecrets pattern.
|
||||
|
||||
* **Never `kubectl create secret` in production.** All secrets — at every environment — go through SealedSecrets, encrypted with `kubeseal`, committed as `SealedSecret` resources to `groombook/infra`.
|
||||
|
||||
* **Never bypass the merge gate.** No self-merging PRs. No pushing directly to `dev`, `uat`, or `main`. Every change goes through a PR with the reviews required by the `sdlc` skill.
|
||||
|
||||
* **Never run `tofu` directly.** Terraform / OpenTofu goes through the Flux OpenTofu Controller via a PR to `groombook/infra`.
|
||||
* **Do not use `kubectl create` in production.**
|
||||
The `privilegedescalation` namespace is Flux-managed. Secret changes go through the SealedSecrets workflow, committed to `privilegedescalation/infra`.
|
||||
|
||||
## If you are unsure
|
||||
|
||||
If you are unsure whether an action is safe, **stop**. Post a comment on the Paperclip issue explaining what you are about to do and why you are uncertain, set the issue to `blocked`, and escalate to your manager. Do not guess.
|
||||
If you are unsure whether an action is safe, stop. Post a comment on the Paperclip issue explaining what you are about to do and why you are uncertain, set the issue to `blocked`, and escalate to your manager. Do not guess.
|
||||
|
||||
+162
-138
@@ -1,32 +1,30 @@
|
||||
---
|
||||
name: sdlc
|
||||
description: >
|
||||
Software development lifecycle for GroomBook. Covers GitHub authentication,
|
||||
branch strategy across Dev/UAT/Prod, the four-phase SDLC pipeline with
|
||||
product analysis intake, PR review and merge policy, the handoff protocol,
|
||||
status semantics, infrastructure layout, the canonical tools list, the
|
||||
GitHub-origin issue board-approval gate, the cc-cpfarhood visibility rule,
|
||||
the scheduled penetration testing program, and delegation model tier policy.
|
||||
Software development lifecycle rules for Privileged Escalation. Covers GitHub
|
||||
issue approval gates, authentication, branch strategy, PR review policy,
|
||||
pipeline stages, agent roster, handoff protocol, status semantics, CI/CD,
|
||||
security review, and work distribution.
|
||||
---
|
||||
|
||||
# Software Development Lifecycle
|
||||
|
||||
## GitHub authentication
|
||||
## GitHub Authentication
|
||||
|
||||
**Invoke the `github-app-token` skill** before any GitHub operation. It generates a short-lived installation token and sets `GH_TOKEN`. **Never** run `gh auth login` — it hangs headless agents. Token expires after ~1 hour; re-invoke to regenerate.
|
||||
**Invoke the `github-app-token` skill** before any GitHub operation. It generates a short-lived installation token and sets `GH_TOKEN`. **Never** run `gh auth login` directly — it hangs headless agents.
|
||||
|
||||
GitHub is the **primary source of truth**. Every Paperclip issue should have a corresponding GitHub issue (create one if missing). Both stay open until the work is completed, reviewed, approved, merged, and QA-verified.
|
||||
Token expires after ~1 hour. Re-invoke the skill to regenerate if needed.
|
||||
|
||||
## GitHub-origin issue policy — board approval required
|
||||
## GitHub Issues — Board Approval Required
|
||||
|
||||
If a task originated from GitHub (`originKind: "github"`), **do not begin work**. Immediately create a board approval:
|
||||
**If a task originated from GitHub (`originKind: "github"` in the issue data), do not begin any work.** Immediately create a `request_board_approval`:
|
||||
|
||||
```
|
||||
POST /api/companies/{companyId}/approvals
|
||||
{
|
||||
"type": "request_board_approval",
|
||||
"requestedByAgentId": "{your-agent-id}",
|
||||
"issueIds": ["{issueId}"],
|
||||
"issueIds": ["{issue-id}"],
|
||||
"payload": {
|
||||
"title": "Board approval required: GitHub issue",
|
||||
"summary": "Summarize what the GitHub issue requests.",
|
||||
@@ -36,190 +34,216 @@ POST /api/companies/{companyId}/approvals
|
||||
}
|
||||
```
|
||||
|
||||
Set the issue to `blocked` with a comment linking to the approval. Only proceed once `PAPERCLIP_APPROVAL_ID` is set and `PAPERCLIP_APPROVAL_STATUS` indicates approval.
|
||||
Set the issue to `blocked` until `PAPERCLIP_APPROVAL_STATUS` confirms approval. Only proceed once approved.
|
||||
|
||||
## Branch strategy
|
||||
## Branch Strategy
|
||||
|
||||
Three long-lived branches map to the three deployment environments:
|
||||
All plugin repositories use a single long-lived branch:
|
||||
|
||||
| Branch | Environment | Who merges |
|
||||
|--------|-------------|-----------|
|
||||
| `dev` | Dev | CTO (after QA approval) |
|
||||
| `uat` | UAT | CTO (promotes `dev` → `uat`) |
|
||||
| `main` | Production | CEO (promotes `uat` → `main`) |
|
||||
|--------|-------------|------------|
|
||||
| `main` | Production | CEO (Countess von Containerheim) after triple approval |
|
||||
|
||||
**Engineers always target `dev`** — never `uat` or `main` directly. Feature branches: `<agent-name>/<short-description>`.
|
||||
**Engineers always target `main` via feature branches** — never push directly.
|
||||
|
||||
## Pull requests
|
||||
Feature branches follow the convention: `<agent-name>/<short-description>` (e.g., `gandalf/add-sealed-secrets-list`).
|
||||
|
||||
All changes happen via pull request. Always include `cc @cpfarhood` at the bottom of the PR body for visibility — never as a reviewer.
|
||||
## Pull Requests
|
||||
|
||||
All changes must happen via pull request. Always include `cc @cpfarhood` at the bottom of the PR body for visibility — not as a reviewer.
|
||||
|
||||
```bash
|
||||
gh pr create --base dev --title "..." --body "... cc @cpfarhood"
|
||||
gh pr create --title "..." --body "... cc @cpfarhood"
|
||||
```
|
||||
|
||||
## PR review & merge policy
|
||||
## PR Review & Merge Policy
|
||||
|
||||
### Dev branch (`dev`)
|
||||
**Do not approve a PR with failing tests, type errors, or no coverage for new code.**
|
||||
|
||||
- **QA** (Lint Roller) reviews the PR. Approve → hand to CTO. Fail → back to engineer directly with exact details.
|
||||
- **CTO** (The Dogfather) reviews. Approve → CTO merges the `dev` PR. Fail → back to engineer.
|
||||
Requires **3 approving GitHub reviews** before the CEO merges:
|
||||
|
||||
### UAT branch (`uat`)
|
||||
1. **UAT (Pixel Patty)** — E2E browser testing against `headlamp-dev`
|
||||
2. **QA (Regression Regina)** — code-level review: test coverage, regressions, edge cases
|
||||
3. **CTO (Null Pointer Nancy)** — architecture alignment, code quality, security
|
||||
|
||||
- **CTO** opens and merges a `dev` → `uat` PR.
|
||||
**Review order is mandatory: CI → UAT → QA → CTO → CEO merge.** Each stage gates the next. No agent merges their own PRs.
|
||||
|
||||
### Main branch (`main`)
|
||||
## 48-Hour PR Review SLA (Binding)
|
||||
|
||||
- **CEO** (Scrubs McBarkley) reviews and merges the `uat` → `main` PR.
|
||||
**MANDATORY: Every open PR must receive its first review within 48 hours of submission. No exceptions.**
|
||||
|
||||
`@cpfarhood` is cc'd for visibility on all PRs — never as a reviewer.
|
||||
### SLA Assignments & Responsibility
|
||||
- **0-24 hours:** Assigned reviewer must begin review (or explicitly hand off)
|
||||
- **24-48 hours:** Assigned reviewer must complete review or be flagged for SLA violation
|
||||
- **48+ hours:** SLA violation is documented and escalated
|
||||
|
||||
## SDLC pipeline
|
||||
### Assigned Reviewers & Accountability
|
||||
1. **UAT (Pixel Patty)** — responsible for all PRs needing E2E testing
|
||||
- SLA: Initial E2E test within 48 hours of open
|
||||
2. **QA (Regression Regina)** — responsible for code review after UAT pass
|
||||
- SLA: Code review within 48 hours of UAT approval
|
||||
3. **CTO (Null Pointer Nancy)** — responsible for architecture/security review after QA pass
|
||||
- SLA: Architecture review within 48 hours of QA approval
|
||||
4. **CEO (Countess von Containerheim)** — responsible for SLA enforcement
|
||||
- Enforces SLA via daily audit and escalation
|
||||
|
||||
### Phase 0 — Product analysis (feature intake)
|
||||
### Escalation Protocol (CEO Responsibility)
|
||||
- **At 24 hours:** CEO tags reviewer with automated comment and surfaces PR in daily status
|
||||
- **At 48 hours:** CEO blocks PR from merge queue; escalates to reviewer's manager (CTO for most)
|
||||
- **At 72+ hours:** If critical-path, PR blocks next release until review completes or reviewer hands off
|
||||
|
||||
* Feature requests arrive at the CEO via Paperclip or GitHub Issues.
|
||||
* CEO delegates to CMPO (Pawla Abdul) for review.
|
||||
* CMPO returns one of three decisions:
|
||||
* **Accepted** → CEO routes to CTO for work breakdown.
|
||||
* **Backlogged** → CEO handles prioritization.
|
||||
* **Denied** → CEO closes as unplanned.
|
||||
* CTO breaks accepted work into atomic tasks and assigns to Engineering.
|
||||
### Exception Policy
|
||||
If a reviewer cannot meet SLA:
|
||||
- They must explicitly hand off to another reviewer within the 48-hour window
|
||||
- If hand-off doesn't happen, the SLA breach is documented and escalated
|
||||
- Rare exceptions require board approval (documented in PR)
|
||||
|
||||
### Phase 1 — Dev
|
||||
### Enforcement Mechanism
|
||||
CEO creates daily automated report of SLA status and escalates immediately when thresholds breach. This is non-negotiable work.
|
||||
|
||||
1. **Engineer** (Flea Flicker) branches from `dev`, writes code. GitOps deploys to dev on demand.
|
||||
2. **Engineer** opens a PR against `dev`. CI must pass.
|
||||
3. **QA (Lint Roller)** reviews the PR. Fail → back to engineer.
|
||||
4. QA approves and hands off to CTO.
|
||||
5. **CTO (The Dogfather)** reviews the PR. Fail → back to engineer.
|
||||
6. **CTO** merges the dev PR.
|
||||
7. **CI** builds and deploys automatically to Dev (`https://dev.groombook.dev`).
|
||||
## Pipeline
|
||||
|
||||
### Phase 2 — UAT promotion
|
||||
**Two pipelines based on change type:**
|
||||
|
||||
8. **CTO** opens and merges a PR from `dev` to `uat`.
|
||||
9. **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`).
|
||||
10. **CTO** creates a UAT regression task for **Shedward Scissorhands** immediately after promoting.
|
||||
### Pipeline A: Plugin/Feature Changes (User-Facing Code)
|
||||
```
|
||||
CI: Engineer opens PR → CI runs (lint, types, unit tests)
|
||||
UAT: Pixel Patty validates E2E in headlamp-dev
|
||||
QA: Regression Regina reviews code quality and test coverage
|
||||
CTO: Null Pointer Nancy reviews architecture and security
|
||||
Merge: Countess von Containerheim merges after all approvals
|
||||
```
|
||||
|
||||
### Phase 3 — UAT testing & security
|
||||
**Applies to:** Changes in `headlamp-*-plugin/` repos (plugin code, features, bug fixes)
|
||||
|
||||
11. **UAT (Shedward Scissorhands)** runs full regression against UAT — every feature, no exceptions.
|
||||
12. UAT fail → CTO redistributes to engineer (return to Phase 1).
|
||||
13. UAT pass → **Security Engineer (Barkley Trimsworth)** performs a security code review of the changes.
|
||||
14. Security fail → CTO redistributes to engineer (return to Phase 1).
|
||||
### Pipeline B: Infrastructure Changes (No UI Impact)
|
||||
```
|
||||
CI: Engineer opens PR → CI runs (lint, types, unit tests)
|
||||
QA: Regression Regina reviews code and correctness (no E2E needed)
|
||||
CTO: Null Pointer Nancy reviews architecture and security
|
||||
Merge: Countess von Containerheim merges after all approvals
|
||||
```
|
||||
|
||||
### Phase 4 — Production
|
||||
**Applies to:** Changes in `.github/workflows/`, `infra/`, `org/` repos, and template repos (CI workflows, kustomize configs, RBAC manifests, deployment scripts)
|
||||
|
||||
15. Security pass → **CEO (Scrubs McBarkley)** reviews and merges the production PR (`uat → main`). Fail → back to CTO.
|
||||
16. **CI** deploys automatically to Production (`https://demo.groombook.dev`).
|
||||
**Rule:** If the PR contains ONLY infrastructure changes (no plugin code changes), use Pipeline B and skip UAT. Patty's time is reserved for user-facing feature testing.
|
||||
|
||||
### Hierarchy rules
|
||||
**Detection:** If `git diff` shows changes only in `.github/`, `infra/`, `org/`, or deployment files → Pipeline B. If any `headlamp-*-plugin/` code changed → Pipeline A.
|
||||
|
||||
* CTO rejections at Dev go directly to the engineer (not back through QA).
|
||||
* UAT failures (Shedward) go to CTO — CTO cascades to engineer.
|
||||
* Security failures (Barkley) go to CTO — CTO cascades to engineer.
|
||||
* CEO rejections at Prod go to CTO.
|
||||
### Stage 1 — Engineer Opens PR
|
||||
|
||||
> **Penetration testing.** Barkley performs scheduled penetration testing against Production (`demo.groombook.dev`) and Demo independently of the PR workflow. Board-authorized; not triggered per-PR. Findings get filed as Paperclip issues with severity (`CRITICAL` / `HIGH` / `MEDIUM` / `LOW`) and routed to CTO for engineer redistribution.
|
||||
1. Engineer (Gandalf the Greybeard) creates a feature branch and opens a PR targeting `main`.
|
||||
2. CI runs automatically: lint, type checks, unit tests.
|
||||
3. CI must pass before any reviewer spends tokens. If CI fails, the engineer fixes it.
|
||||
|
||||
## Delegation model tier
|
||||
### Stage 2 — UAT Review (Pipeline A Only)
|
||||
|
||||
When creating subtasks for other agents, set `modelProfile: "cheap"` only for:
|
||||
- Mechanical refactors or repetitive operations
|
||||
- Basic information lookups
|
||||
- Well-specified, bounded updates
|
||||
4. **Pipeline A only (user-facing changes):** Pixel Patty picks up PRs with passing CI.
|
||||
5. **Pipeline B skips this:** Infrastructure PRs bypass UAT and go directly to QA.
|
||||
6. Patty runs E2E browser testing against the deployed build in `headlamp-dev`.
|
||||
7. Pass → hands off to QA. Fail → goes directly to engineer.
|
||||
|
||||
Leave `modelProfile` unset for anything requiring judgment, reasoning, or QA review.
|
||||
### Stage 3 — QA Review
|
||||
|
||||
When in doubt, leave it unset.
|
||||
7. Regression Regina picks up PRs that have passed both CI and UAT.
|
||||
8. Regina reviews: test coverage, regressions, edge cases, code quality.
|
||||
9. Pass → hands off to CTO. Fail → goes directly to engineer.
|
||||
|
||||
## Handoff protocol — mandatory
|
||||
### Stage 4 — CTO Review
|
||||
|
||||
10. Null Pointer Nancy picks up PRs that have passed CI, UAT, and QA.
|
||||
11. Nancy reviews: architecture alignment, code quality, security.
|
||||
12. Approve → PR is ready for merge. Request changes → goes directly to engineer.
|
||||
|
||||
### Stage 5 — CEO Merge
|
||||
|
||||
13. Countess von Containerheim merges the PR after all three approvals (UAT + QA + CTO) and CI passing.
|
||||
14. Reject → returns to CTO → engineer.
|
||||
|
||||
### Hierarchy Rules
|
||||
|
||||
- CTO rejections go directly to engineer (not through QA or UAT).
|
||||
- UAT failures go directly to engineer (not through QA or UAT).
|
||||
- QA failures go directly to engineer (not through QA or UAT).
|
||||
- CEO rejections go to CTO, who cascades to engineer.
|
||||
- The CTO is the single routing point for all failures and rejections to and from the CEO.
|
||||
|
||||
## Agent Roster
|
||||
|
||||
| Role | Agent | Paperclip UUID |
|
||||
|------|-------|----------------|
|
||||
| CEO | Countess von Containerheim | `498f4d36-8e5b-4114-8514-d0698a091bd5` |
|
||||
| CTO | Null Pointer Nancy | `ed1eec37-f868-41b6-bc72-a3493bbce090` |
|
||||
| Staff Engineer | Gandalf the Greybeard | `fc07dd00-c4c2-4fa0-9a18-dd6fbb1d1eb4` |
|
||||
| QA Engineer | Regression Regina | `fd5dbec8-ddbb-4b57-9703-624e0ed90053` |
|
||||
| UAT Engineer | Pixel Patty | `01ec02f7-70c2-4fa1-ac3f-2545f1237ac3` |
|
||||
| VP Engineering Ops | Hugh Hackman | `2c97cff6-0f0b-4cff-967f-ca244eb2ef9b` |
|
||||
| CMO | Kubectl Karen | `95314e13-bea7-459d-a637-92381dede759` |
|
||||
|
||||
## Handoff Protocol — Mandatory
|
||||
|
||||
Every handoff to another agent requires ALL THREE steps:
|
||||
|
||||
### 1. Explicit assignment
|
||||
### Step 1 — Explicit Assignment
|
||||
|
||||
`PATCH /api/issues/{id}` with `assigneeAgentId: "<target-agent-uuid>"`. Mentioning is NOT a handoff — the agent won't wake without explicit assignment.
|
||||
PATCH the issue with `assigneeAgentId: "<target-agent-uuid>"`.
|
||||
@mentioning is NOT a handoff — the agent won't wake without explicit assignment.
|
||||
|
||||
### 2. Status = `todo`
|
||||
### Step 2 — Status = `todo`
|
||||
|
||||
Every handoff sets `status: "todo"`. Never `in_review`, never `backlog` — both are invisible in inbox-lite and the receiver won't wake.
|
||||
Every handoff sets `status: "todo"`. Never `in_review` — it doesn't appear in inbox-lite and the target agent won't wake.
|
||||
|
||||
### 3. Release checkout
|
||||
### Step 3 — Release Checkout
|
||||
|
||||
```
|
||||
POST /api/issues/{issueId}/release
|
||||
Headers: Authorization: Bearer $PAPERCLIP_API_KEY, X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID
|
||||
```
|
||||
|
||||
Without this release, the receiving agent cannot check out the issue.
|
||||
Without this release, the receiving agent cannot checkout the issue.
|
||||
|
||||
**Saying you are reassigning a task is NOT the same as reassigning it.** Verify the PATCH succeeded (200) before posting a comment claiming the handoff is done.
|
||||
## Status Semantics
|
||||
|
||||
## Infrastructure
|
||||
| Status | Meaning |
|
||||
|--------|---------|
|
||||
| `backlog` | Not ready; parked or unscheduled |
|
||||
| `todo` | Ready and actionable; not checked out |
|
||||
| `in_progress` | Actively owned; enter by checkout only |
|
||||
| `in_review` | Self-held only; awaiting external feedback |
|
||||
| `blocked` | Cannot proceed; state blocker and who must act |
|
||||
| `done` | Complete, no follow-up remains |
|
||||
| `cancelled` | Intentionally abandoned |
|
||||
|
||||
* **Production / Demo:** namespace `groombook`, FQDN `demo.groombook.dev`
|
||||
* **UAT:** namespace `groombook-uat`, FQDN `uat.groombook.dev`
|
||||
* **Dev:** namespace `groombook-dev`, FQDN `dev.groombook.dev`
|
||||
* **Cluster:** Kubernetes — cluster-wide read; read/write on `groombook-dev` and `groombook-uat`; read-only on `groombook` (production).
|
||||
* **Gateways:** `istio-external` (publicly accessible) and `istio-internal` (internal only) in `gateway-system`.
|
||||
* **Container registry:** `ghcr.io/groombook/<service>` only.
|
||||
**Never use `in_review` for handoffs.** It does not trigger inbox-lite and the receiving agent will not wake.
|
||||
|
||||
## Authentication
|
||||
## Status Transition Rules
|
||||
|
||||
* **Framework:** Better-Auth.
|
||||
* **Social login:** Google and Apple OAuth.
|
||||
* **SSO:** Authentik OIDC at `https://auth.farh.net` (credentials in `authentik-credentials` secret).
|
||||
* **Never build custom authentication.**
|
||||
| Handoff | Correct Status |
|
||||
|---------|----------------|
|
||||
| Engineer → UAT (Patty) | `todo` |
|
||||
| UAT (Patty) → QA (Regina) | `todo` |
|
||||
| QA (Regina) → CTO (Nancy) | `todo` |
|
||||
| CTO (Nancy) → CEO (Countess) | `todo` |
|
||||
| Any failure → Engineer | `todo` |
|
||||
| CEO rejection → CTO (Nancy) | `todo` |
|
||||
| CTO (Nancy) → Engineer (fix) | `todo` |
|
||||
|
||||
## Deployment — 2-stage Flux GitOps
|
||||
## CI/CD
|
||||
|
||||
**Stage 1 — CI (GitHub Actions, runs in each application repo):**
|
||||
- Triggered automatically on every merge to `main`
|
||||
- Builds and tags the Docker image
|
||||
- Pushes tagged images to `ghcr.io/groombook/<service>`
|
||||
- CI runs on self-hosted ARC runners: `runs-on: runners-privilegedescalation`
|
||||
- Only Hugh Hackman has write access to `.github/workflows/` files
|
||||
- All CI/CD workflow changes must be delegated to Hugh
|
||||
- Runners scale to zero when idle and start automatically when a workflow triggers
|
||||
|
||||
**Stage 2 — GitOps (Flux, managed externally):**
|
||||
- Flux watches `groombook/infra` as the **target** GitRepository — it is **not** a Flux bootstrap/cluster repo.
|
||||
- Reconciles Kustomize overlays: `apps/overlays/dev` → `groombook-dev`, `apps/overlays/uat` → `groombook-uat`, `apps/overlays/prod` → `groombook`.
|
||||
## Security Review
|
||||
|
||||
**Policy — Flux Image Tag Automation is DENIED.** Do NOT use `ImageRepository`, `ImagePolicy`, or `ImageUpdateAutomation` Flux resources. Image tag updates must be made intentionally via a PR to `groombook/infra`.
|
||||
Security review is handled as part of the CTO review stage. Null Pointer Nancy evaluates security concerns during her architecture and code quality review. There is no separate dedicated security review agent.
|
||||
|
||||
**To deploy a change:**
|
||||
1. Merge code to `main` in the app repo — CI builds and pushes a new image automatically.
|
||||
2. Open a PR against `groombook/infra` to update the relevant overlay; merge after kustomize CI passes.
|
||||
3. Flux reconciles `groombook/infra` on merge and rolls out the updated pods.
|
||||
## Work Distribution
|
||||
|
||||
**To force a rollout** (pick up new `:latest` on stuck pods):
|
||||
```bash
|
||||
kubectl rollout restart deployment/<name> -n <namespace>
|
||||
```
|
||||
|
||||
## Infrastructure as Code
|
||||
|
||||
Terraform / OpenTofu is deployed via the **Flux OpenTofu Controller** in a GitOps fashion. Submit configurations via a PR to `groombook/infra` — the tofu controller reconciles them on merge.
|
||||
|
||||
**Never run `tofu` directly.** Never `kubectl apply` against production. Production changes go through Flux only.
|
||||
|
||||
## Tools (canonical, not alternatives)
|
||||
|
||||
These are the only acceptable choices — alternatives are policy violations:
|
||||
|
||||
* **Secret management:** Bitnami Sealed Secrets Controller — no plain Kubernetes secrets.
|
||||
* **Database:** CloudNativePG Operator (Postgres) — no SQLite, MariaDB, or MySQL.
|
||||
* **Cache / pub-sub:** DragonflyDB Operator — no Redis.
|
||||
* **Authentication:** Better-Auth + Google + Apple + Authentik (see Authentication section). Never build custom auth.
|
||||
* **Dependency updates:** Mend Renovate. **Dependabot is not used and will not be used.**
|
||||
* **Container registry:** `ghcr.io/groombook/<service>` — no Docker Hub for first-party images.
|
||||
|
||||
If a task requires deviating from any of the above, treat it as a destructive action: stop, file an issue with rationale, request board approval.
|
||||
|
||||
## External communication
|
||||
|
||||
When communicating in any context visible outside the GroomBook agent team (external users, human reviewers, non-agent entities), include `cc @cpfarhood` for visibility — never as a reviewer.
|
||||
|
||||
## No self-merge
|
||||
|
||||
No agent merges their own PR. The merger is always the next role up the SDLC ladder (CTO for `dev` and `uat`, CEO for `main`).
|
||||
- All engineering and devops work is broken down and distributed by the CTO (Nancy).
|
||||
- Engineers do not self-assign — the CTO triages, scopes, and assigns all implementation tasks.
|
||||
- Hugh Hackman owns CI/CD, infrastructure, and pipeline work.
|
||||
- Gandalf the Greybeard owns plugin implementation.
|
||||
- Regression Regina owns QA review and test coverage.
|
||||
- Pixel Patty owns UAT/E2E browser testing.
|
||||
|
||||
Reference in New Issue
Block a user