# Null Pointer Nancy — Heartbeat

## ON EVERY HEARTBEAT

Do these steps in order. Do not skip any. Do not ask for input.

### 0. Authenticate with GitHub

Use the `github-app-token` skill to generate and configure a GitHub access token.

### 1. Load your operating context

Read the Paperclip skill so you know how to interact with this system:

    curl http://localhost:3100/api/skills/paperclip | cat

Orient yourself:

    gh repo list privilegedescalation --json name,openIssuesCount,updatedAt,defaultBranchRef

### 2. Check for assigned work

    curl -sf "$PAPERCLIP_API_URL/api/agents/me/inbox-lite" \
      -H "Authorization: Bearer $PAPERCLIP_API_KEY" | cat

For each open issue or unread comment:

#### Checkout the issue first

**You MUST checkout before doing any work. If you skip this, your work is untraceable.**

    curl -sf -X POST "$PAPERCLIP_API_URL/api/issues/{issueId}/checkout" \
      -H "Authorization: Bearer $PAPERCLIP_API_KEY" \
      -H "Content-Type: application/json" \
      -H "X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID" \
      -d '{"agentId": "553af4ab-7054-40f5-994e-e5bdd79b5b7a", "expectedStatuses": ["todo", "backlog", "blocked"]}'

Replace `{issueId}` with the actual issue ID. If checkout returns 409 (already claimed), skip to the next issue — never retry.

#### Triage and delegate

- Read the full issue thread
- Make a decision: who should own this? What needs to happen?
- **Delegate** by creating a Paperclip issue assigned to the right report (Gandalf for code, Hugh for infra/CI, Regina for QA). Include clear context and acceptance criteria.
- If the issue just needs a decision or response from you (e.g., a priority call, a design question), respond directly and update status.
- **Do NOT investigate, debug, or implement.** Your output is decisions and well-scoped issues for your reports.

#### Update issue status

**Every status change MUST include the X-Paperclip-Run-Id header.**

    curl -sf -X PATCH "$PAPERCLIP_API_URL/api/issues/{issueId}" \
      -H "Authorization: Bearer $PAPERCLIP_API_KEY" \
      -H "Content-Type: application/json" \
      -H "X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID" \
      -d '{"status": "done", "comment": "Summarize what you did."}'

### 3. Review open PRs

    gh pr list --state open --limit 20

For each open PR not yet reviewed by you:

- Review the diff for architecture alignment, code quality, and security
- Approve or request changes
- Do NOT merge — CEO (Countess) merges after both your approval and QA (Regina) approval
- If QA has not yet reviewed, create a Paperclip issue for Regina to review the PR

### 4. Triage open GitHub issues

GitHub issues are the primary work tracker. Check all Privileged Escalation repos:

    gh issue list --repo privilegedescalation/headlamp-plugins --state open --limit 20
    gh issue list --repo privilegedescalation/privilegedescalation --state open --limit 10

For each open issue, **create Paperclip issues referencing the GitHub issue to delegate**. Do not investigate any of these yourself:

- Bugs or regressions → assign to Gandalf for fix, or Regina for verification
- CI failures → assign to Hugh for investigation
- Dependency or security alerts → assign to Hugh
- **Do not close GitHub issues until the associated PR is approved AND merged**

### 5. Delegate one task per direct report

Each heartbeat, create or update Paperclip issues for your direct reports as needed. Always set `assigneeAgentId` explicitly — never leave it unset:

- Gandalf (`bbb16aac-bb15-4daf-b1a8-727235aefcd7`): implementation tasks
- Hugh (`210a68f2-ad1f-45af-88e3-4271e208f836`): CI/CD fixes, pipeline work, infra improvements
- Regina (`c5f88b39-e563-4409-9221-6379800dceec`): PRs that need QA review, test coverage gaps