pdurlej/platform

Fork 0

docs(prompts): codex master prompts — PR #53 rebase + workflows Infisical integration #72

Closed

claude wants to merge 1 commit from claude/orders/codex-prompts-canary-ops into main

claude commented

2026-05-05 02:00:45 +02:00

Collaborator

Canary status: missing — Medium PR class (governance + Codex master prompts driving CI changes); fire canary 3+3 manually before merge

Purpose

Two master prompts for Codex GPT-5.5 execution, operationalizing canary workflow per operator decisions 2026-05-05:

prompts/codex-pr-53-rebase.md — small operational fix. Codex rebases PR #53 on current main, resolves .forgejo/workflows/canary-required.yml conflict per #53 design, force-pushes with codex identity. Unblocks PR #53 merge.
prompts/workflows-infisical-integration.md — feature work. Codex replaces Forgejo repo secrets in canary workflow with Infisical service-token retrieval. Operator chose this over manual sync (option b over option a) because "Infisical jako single source of truth" matches charter §5 direction.

This PR does NOT do

Does NOT execute either prompt (Codex does that in master operator thread)
Does NOT change .forgejo/workflows/canary-required.yml directly (Codex changes it)
Does NOT amend Issue #49 (Codex's PR for Infisical integration will comment on #49)
Does NOT install or configure Infisical CLI on Forgejo runner (that's runtime, in Codex's PR)

Changed artifacts

prompts/codex-pr-53-rebase.md (new, ~150 lines) — rebase + conflict resolution policy, identity check, escape hatches, self-verification
prompts/workflows-infisical-integration.md (new, ~210 lines) — pre-work research (R1 inventory, R2 Infisical structure verify, R3 CLI vs SDK decision, R4 bootstrap-secret scope), implementation steps S1-S5, self-verification, PR opening conventions, escape hatches

Total: 2 files, +362 lines.

Why now

PR #53 has been blocked on conflict since 2026-05-04. Architecture is correct (verified via PR #69 workflow run: collect-diff GREEN, canary honest-red on missing secrets). Only rebase needed.
Forgejo Actions currently fail at "Validate secrets present" because operator stores secrets in Infisical (charter direction) but workflow expects Forgejo repo secrets. Two paths: (a) manual sync (5 min, ongoing chore) or (b) Infisical integration (one-time work, clean architecture). Operator chose (b).

Relevant context

PR #53 (codex/orders/canary-workflow-rewrite) — target of prompt 1
PR #54 (codex/ci/forgejo-actions-guardrails, merged) — source of conflict for #53
PR #69 (just merged) — provided live test of #53 workflow architecture (collect-diff GREEN + honest fail on missing secret)
Issue #49 — ADR 0002 setup tasks; will be amended by Codex's Infisical PR comment to swap ZAI_API_KEY/CANARY_FORGEJO_TOKEN entries for INFISICAL_SERVICE_TOKEN bootstrap entry
PLATFORM_CHARTER.md §5 — Infisical primary, Vault sunset; this work fulfills the principle in workflow domain
migrations/vault-to-infisical.md — Vault sunset migration plan; Infisical structure should already be set up per Phase 0
AGENTS.md §"Identity-isolation" + §"Joining as a new agent" — both prompts reference these for identity discipline
state/agent-execution-template.md (just landed in PR #69) — referenced by both prompts for execution protocol

Runtime evidence

N/A — pure docs/prompts change. No workflow modification in this PR. Codex's resulting PRs (one per prompt) will have runtime evidence.

Known constraints

Prompt 2 makes assumptions about Infisical structure (project name iskra-platform, env prod, path /forgejo-actions/canary). Codex's R2 step verifies these against actual Infisical config; if assumptions wrong, Codex stops and surfaces.
Prompt 2 pins Infisical CLI version 0.28.0 as a placeholder; Codex must verify current stable + SHA at execution time.
Prompt 1 assumes operator's worktree platform-wt-takeover-pr51 still exists with codex/orders/canary-workflow-rewrite branch; if not, Codex needs to recreate from origin.

Explicit out-of-scope

Vault sunset itself (separate; Issue #48 + migrations/)
Other workflows besides canary-required.yml
Infisical organization/structure changes (operator pre-work if needed)
Branch protection on main (Issue #49 setup task #3, operator UI)
ADR 0002 status flip from "Accepted design, NOT operational" to "Operational" (depends on Codex's PRs landing + Issue #49 setup complete + first real test PR)

Requested decision

approve_merge after canary 3+3 fires (manual; workflow this PR depends on for auto-fire is not yet operational).

Merge blockers

Canary 3+3 not yet fired (manual)
If reviewer cites scope creep — iterate within cap

How operator triggers Codex

After this PR merges, in master operator (Codex thread):

cd ~/Developer/iskra-platform-2026-04-30   # or appropriate worktree
git pull

# Prompt 1 (smaller, can run first):
codex exec < prompts/codex-pr-53-rebase.md
# Codex rebases + force-pushes; PR #53 conflict gone

# Prompt 2 (feature work; can run in parallel after operator confirms Infisical structure):
codex exec < prompts/workflows-infisical-integration.md
# Codex opens new PR for Infisical integration

Orchestrator (claude) reports back when both PRs land.

Spec sources read

PR #53 body + comments — to understand current state and blocker
PR #54 (chore(ci): add Forgejo Actions guardrails) — to understand what conflicts with #53
PR #69 workflow run (commit 70cde4579) — to verify #53 architecture works (collect-diff GREEN + canary honest-red)
PLATFORM_CHARTER.md §5 — operator's Infisical primary stance
decisions/0002-ci-enforcement-canary.md — for trust boundary requirements that prompt 2 must preserve
Issue #49 — for setup task list amendment scope
AGENTS.md §"Identity-isolation" + §"Joining as a new agent" — referenced by both prompts
state/agent-execution-template.md — referenced for execution protocol

Test plan

Operator readback: prompt 1 rebase policy (keep #53's design, layer #54 additions only where compatible) feels right
Operator readback: prompt 2 Infisical CLI approach (vs SDK) and bootstrap-secret scope feel right
Operator confirms: Infisical actually has ZAI_API_KEY + CANARY_FORGEJO_TOKEN at predictable path (or names where they live)
Manual canary 3+3 fires + passes (or operator_override per Rule 2)
After merge: operator runs codex exec < prompts/codex-pr-53-rebase.md first; PR #53 conflict resolved
After merge: operator runs codex exec < prompts/workflows-infisical-integration.md; new PR opens with Infisical integration
Both Codex PRs authored by codex (NOT pdurlej; verified via user.login)
After both PRs merged: operator adds INFISICAL_SERVICE_TOKEN to Forgejo repo secrets (Issue #49 amended setup task)
Next PR's canary 3+3 fires successfully via Infisical secret retrieval

Canary status: missing — Medium PR class (governance + Codex master prompts driving CI changes); fire canary 3+3 manually before merge ## Purpose Two master prompts for Codex GPT-5.5 execution, operationalizing canary workflow per operator decisions 2026-05-05: 1. **`prompts/codex-pr-53-rebase.md`** — small operational fix. Codex rebases PR #53 on current main, resolves `.forgejo/workflows/canary-required.yml` conflict per #53 design, force-pushes with `codex` identity. Unblocks PR #53 merge. 2. **`prompts/workflows-infisical-integration.md`** — feature work. Codex replaces Forgejo repo secrets in canary workflow with Infisical service-token retrieval. Operator chose this over manual sync (option b over option a) because "Infisical jako single source of truth" matches charter §5 direction. ## This PR does NOT do - Does NOT execute either prompt (Codex does that in master operator thread) - Does NOT change `.forgejo/workflows/canary-required.yml` directly (Codex changes it) - Does NOT amend Issue #49 (Codex's PR for Infisical integration will comment on #49) - Does NOT install or configure Infisical CLI on Forgejo runner (that's runtime, in Codex's PR) ## Changed artifacts - `prompts/codex-pr-53-rebase.md` (new, ~150 lines) — rebase + conflict resolution policy, identity check, escape hatches, self-verification - `prompts/workflows-infisical-integration.md` (new, ~210 lines) — pre-work research (R1 inventory, R2 Infisical structure verify, R3 CLI vs SDK decision, R4 bootstrap-secret scope), implementation steps S1-S5, self-verification, PR opening conventions, escape hatches Total: 2 files, +362 lines. ## Why now - PR #53 has been blocked on conflict since 2026-05-04. Architecture is correct (verified via PR #69 workflow run: collect-diff GREEN, canary honest-red on missing secrets). Only rebase needed. - Forgejo Actions currently fail at "Validate secrets present" because operator stores secrets in Infisical (charter direction) but workflow expects Forgejo repo secrets. Two paths: (a) manual sync (5 min, ongoing chore) or (b) Infisical integration (one-time work, clean architecture). Operator chose (b). ## Relevant context - PR #53 (codex/orders/canary-workflow-rewrite) — target of prompt 1 - PR #54 (codex/ci/forgejo-actions-guardrails, merged) — source of conflict for #53 - PR #69 (just merged) — provided live test of #53 workflow architecture (collect-diff GREEN + honest fail on missing secret) - Issue #49 — ADR 0002 setup tasks; will be amended by Codex's Infisical PR comment to swap ZAI_API_KEY/CANARY_FORGEJO_TOKEN entries for INFISICAL_SERVICE_TOKEN bootstrap entry - `PLATFORM_CHARTER.md` §5 — Infisical primary, Vault sunset; this work fulfills the principle in workflow domain - `migrations/vault-to-infisical.md` — Vault sunset migration plan; Infisical structure should already be set up per Phase 0 - `AGENTS.md` §"Identity-isolation" + §"Joining as a new agent" — both prompts reference these for identity discipline - `state/agent-execution-template.md` (just landed in PR #69) — referenced by both prompts for execution protocol ## Runtime evidence N/A — pure docs/prompts change. No workflow modification in this PR. Codex's resulting PRs (one per prompt) will have runtime evidence. ## Known constraints - Prompt 2 makes assumptions about Infisical structure (project name `iskra-platform`, env `prod`, path `/forgejo-actions/canary`). Codex's R2 step verifies these against actual Infisical config; if assumptions wrong, Codex stops and surfaces. - Prompt 2 pins Infisical CLI version 0.28.0 as a placeholder; Codex must verify current stable + SHA at execution time. - Prompt 1 assumes operator's worktree `platform-wt-takeover-pr51` still exists with codex/orders/canary-workflow-rewrite branch; if not, Codex needs to recreate from origin. ## Explicit out-of-scope - Vault sunset itself (separate; Issue #48 + migrations/) - Other workflows besides canary-required.yml - Infisical organization/structure changes (operator pre-work if needed) - Branch protection on main (Issue #49 setup task #3, operator UI) - ADR 0002 status flip from "Accepted design, NOT operational" to "Operational" (depends on Codex's PRs landing + Issue #49 setup complete + first real test PR) ## Requested decision `approve_merge` after canary 3+3 fires (manual; workflow this PR depends on for auto-fire is not yet operational). ## Merge blockers - Canary 3+3 not yet fired (manual) - If reviewer cites scope creep — iterate within cap ## How operator triggers Codex After this PR merges, in master operator (Codex thread): ```bash cd ~/Developer/iskra-platform-2026-04-30 # or appropriate worktree git pull # Prompt 1 (smaller, can run first): codex exec < prompts/codex-pr-53-rebase.md # Codex rebases + force-pushes; PR #53 conflict gone # Prompt 2 (feature work; can run in parallel after operator confirms Infisical structure): codex exec < prompts/workflows-infisical-integration.md # Codex opens new PR for Infisical integration ``` Orchestrator (claude) reports back when both PRs land. ## Spec sources read - PR #53 body + comments — to understand current state and blocker - PR #54 (chore(ci): add Forgejo Actions guardrails) — to understand what conflicts with #53 - PR #69 workflow run (commit `70cde4579`) — to verify #53 architecture works (collect-diff GREEN + canary honest-red) - `PLATFORM_CHARTER.md` §5 — operator's Infisical primary stance - `decisions/0002-ci-enforcement-canary.md` — for trust boundary requirements that prompt 2 must preserve - Issue #49 — for setup task list amendment scope - `AGENTS.md` §"Identity-isolation" + §"Joining as a new agent" — referenced by both prompts - `state/agent-execution-template.md` — referenced for execution protocol ## Test plan - [ ] Operator readback: prompt 1 rebase policy (keep #53's design, layer #54 additions only where compatible) feels right - [ ] Operator readback: prompt 2 Infisical CLI approach (vs SDK) and bootstrap-secret scope feel right - [ ] Operator confirms: Infisical actually has `ZAI_API_KEY` + `CANARY_FORGEJO_TOKEN` at predictable path (or names where they live) - [ ] Manual canary 3+3 fires + passes (or operator_override per Rule 2) - [ ] After merge: operator runs `codex exec < prompts/codex-pr-53-rebase.md` first; PR #53 conflict resolved - [ ] After merge: operator runs `codex exec < prompts/workflows-infisical-integration.md`; new PR opens with Infisical integration - [ ] Both Codex PRs authored by `codex` (NOT pdurlej; verified via `user.login`) - [ ] After both PRs merged: operator adds `INFISICAL_SERVICE_TOKEN` to Forgejo repo secrets (Issue #49 amended setup task) - [ ] Next PR's canary 3+3 fires successfully via Infisical secret retrieval

claude added 1 commit

2026-05-05 02:00:45 +02:00

docs(prompts): codex master prompts — PR #53 rebase + Infisical integration

canary-required / collect-diff (pull_request) Successful in 3s

Details

canary-required / canary (pull_request) Failing after 1s

Details

cf6349d22e

Two master prompts for Codex GPT-5.5 execution. Operator chose path (b)
2026-05-05: Infisical as single source of truth instead of manual Forgejo
repo secrets sync.

prompts/codex-pr-53-rebase.md (small operational fix):
- Rebase codex/orders/canary-workflow-rewrite on current main
- Resolve conflict in .forgejo/workflows/canary-required.yml per #53
  design (2-job trust boundary, concurrency, marker, digest pinning,
  honest-red on missing secrets); layer in #54 additions only where they
  don't conflict
- Force-push --force-with-lease as codex identity
- Comment on PR #53 documenting kept/dropped from #54

prompts/workflows-infisical-integration.md (feature work):
- Pre-work: inventory current secret needs, verify Infisical structure,
  pick CLI vs SDK, determine bootstrap-secret scope
- Implementation: replace Forgejo repo secrets with Infisical CLI
  (`infisical export --token=$INFISICAL_SERVICE_TOKEN --env=prod
  --path=/forgejo-actions/canary --format=dotenv`)
- Preserves trust boundary: only privileged canary job touches Infisical;
  collect-diff (unprivileged) never does
- Pin Infisical CLI version + SHA-verify
- No runtime fallback (silent degradation defeats single-source-of-truth)
- Update Issue #49 setup tasks: drop ZAI_API_KEY/CANARY_FORGEJO_TOKEN
  Forgejo-secrets entries, add INFISICAL_SERVICE_TOKEN bootstrap entry

Both prompts include identity check, escape hatches, self-verification,
PR-opening conventions per AGENTS.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

codex referenced this pull request

2026-05-05 03:17:40 +02:00

arch(agent-access): Agent Access Plane — session-scoped AI credential delivery #76

codex referenced this pull request

2026-05-05 03:18:25 +02:00

feat(agent-access): add codex OpenClaw ssh-agent TTL wrapper #77

codex referenced this pull request

2026-05-05 03:21:33 +02:00

docs(decisions): define Agent Access Plane #78

codex referenced this pull request

2026-05-05 07:37:42 +02:00

fix(agent-access): harden ssh-agent session lifecycle #80

pdurlej approved these changes

2026-05-05 15:48:52 +02:00

Dismissed

pdurlej approved these changes

2026-05-05 15:49:38 +02:00

codex commented

2026-05-05 23:40:51 +02:00

Collaborator

Superseded by #89 and the post-#89 operating model.

The prompts here were useful as planning artifacts, but they now encode stale instructions around #53, force-push/rebase flow, and direct workflow secret assumptions. Merging them as agent-facing docs would make future agents more likely to choose the wrong path.

The live follow-up is a new implementation plan/PR for a runner-local Infisical bridge plus canary evidence, not these historical prompts. Closing as superseded.

Superseded by #89 and the post-#89 operating model. The prompts here were useful as planning artifacts, but they now encode stale instructions around #53, force-push/rebase flow, and direct workflow secret assumptions. Merging them as agent-facing docs would make future agents more likely to choose the wrong path. The live follow-up is a new implementation plan/PR for a runner-local Infisical bridge plus canary evidence, not these historical prompts. Closing as superseded.

codex closed this pull request

2026-05-05 23:40:51 +02:00