pdurlej/platform

Fork 0

docs(prompts): codex cleanup prompt — #122 + #124 + #100 (combined) #136

Merged

pdurlej merged 1 commit from claude/orders/codex-cleanup-122-124 into main

2026-05-09 23:48:17 +02:00

claude commented

2026-05-09 23:44:14 +02:00

Collaborator

Canary status: missing — Medium PR class (multi-packet driver including class/security-sensitive #124). Fire canary 3+3 manually before merge OR operator_override per ADR 0001.

Purpose

Single Codex master prompt closing 3 remaining items per operator's chat decisions 2026-05-09:

Packet M: Issue #122 (token-budget cleanup) — operator chose (b) Codex makes cleanup PR
Packet N: Issue #124 (honcho-redis password-in-argv) — operator chose (a) hotfix-first; security-sensitive class
Packet O: Issue #100 (honcho-redis v2 cataloging) — depends on Packet N merge + operator redeploy on RS 2000; was originally Wave 2 deferred packet H

What this PR ships

prompts/codex-cleanup-122-124-2026-05-09.md (new, ~340 lines).

Three packets in agent-souls codex-handoff-packet-format:

evidence_known, files_to_read (whitelist), files_to_create/edit (with change_type), proposed_change_scope, non_goals, acceptance_criteria, stop_conditions, production_impact, rollback, smoke pre/post, piotr_must_approve_before, codex_must_ask_prof_before
Per-packet stop_conditions enforce: NO secret value in PR body/commit/log/transcript; Codex MUST NOT auto-deploy on RS 2000 (Packet N requires operator manual redeploy); 3-way disagreement triggers escalation

Why now

Last night's batch shipped 9/10 PRs (#119, #120, #121, #125-130 merged; #123 L4-Verify suite still open chained on #119)
Issue #122 (Codex's own L4-Verify findings: 12 token-budget overruns + missing cross-links) needs structural waiver mechanism so the suite can pass cleanly post-merge
Issue #124 (Codex correctly surfaced honcho-redis password leak via Config.Cmd; refused autonomous fix per coordination protocol) needs explicit operator-approved fix
Issue #100 (honcho-redis v2 cataloging) was deferred precisely because Codex hit the secret-in-argv stop condition; closes naturally after #124 fix + redeploy

Files touched

prompts/codex-cleanup-122-124-2026-05-09.md (new, ~340 lines)

No other files. Prompt does not touch modules, schema, control-plane, decisions, or AGENTS.md. It DRIVES Codex to do those (in 3 separate PRs).

Relevant context

prompts/codex-night-close-2026-05-09.md (PR #117 merged) — sibling Wave 1+3 prompt
prompts/codex-wave-2-v2-cataloging-2026-05-09.md (PR #118 merged) — sibling Wave 2 prompt
state/agent-execution-template.md — execution discipline reference
decisions/0001-canary-mandatory-pm-cadence.md + decisions/0002-ci-enforcement-canary.md
agent-souls/practices/agent-coordination-protocol.md (5-turn cap → Owner Checkpoint)
agent-souls/references/codex-handoff-packet-format.md
docs/forgejo-agent-operations.md (PR #111) — mandatory pre-read, referenced in every packet
Issues #122 + #124 + #100 (all open; Codex authored #122 + #124 himself when he hit findings during night-close)

Runtime evidence

N/A — pure docs/prompts change. Codex's resulting 3 PRs will have runtime evidence. Notably Packet N requires ssh rs2000 'docker inspect ...' BEFORE and AFTER (with secret values redacted to <REDACTED> in PR body — no raw password ever surfaces in agent-visible output).

Known constraints

Packet M depends on PR #123 (L4-Verify suite) being merged first (otherwise tests/test_l4_verify.py doesn't exist on main yet for waiver mechanism to extend). Operator merge order: #123 first, then this PR.
Packet N is production_impact: medium (Honcho redeploy required); operator must run ssh rs2000 'cd /opt/vps-home-platform-infra && docker compose up -d honcho-redis' post-N-merge. Codex must NOT auto-deploy.
Packet O depends on Packet N merge + redeploy. Codex sanity-checks Config.Cmd no longer shows password before cataloging; if still leaks, halts.

Explicit out-of-scope

Cross-link findings from #122 (defer to separate issue if scope expands; this PR's Packet M only addresses token-budget waivers + archive)
Honcho-api / honcho-deriver argv check (separate finding if Codex notices)
Rotation of Honcho Redis password (this is delivery-mechanism change, not rotation)
Issue #103 traefik (still deferred from Wave 2; not in this batch)
ADR 0002 setup tasks (#49 — operator UI work)

Requested decision

approve_merge after canary 3+3 fires (Medium class) OR operator_override per Rule 2.

Merge blockers

Canary 3+3 not yet fired (manual)
PR #123 (L4-Verify suite) must be merged FIRST so Packet M has tests/test_l4_verify.py to extend

How operator triggers Codex (after #123 + this PR merge)

In master operator (Codex thread):

cd ~/Developer/iskra-platform-2026-04-30
git pull
codex exec < prompts/codex-cleanup-122-124-2026-05-09.md

Codex opens Packet M + Packet N PRs in parallel. Operator merges them. Operator runs redeploy. Codex opens Packet O PR. Operator merges.

Spec sources read

prompts/codex-night-close-2026-05-09.md + prompts/codex-wave-2-v2-cataloging-2026-05-09.md (sibling prompt structure for consistency)
agent-souls practices/agent-coordination-protocol.md
agent-souls references/codex-handoff-packet-format.md
Issues #122, #124, #100 (full bodies via Forgejo API)
docs/forgejo-agent-operations.md
state/agent-execution-template.md
tests/ directory listing (confirmed test_l4_verify.py NOT yet on main — depends on #123 merge)
control-plane/platformctl/manifest.py (confirmed TOKEN_BUDGET = 1500 for module.yaml; prompts have separate 2000 budget per #122 issue body)
Forgejo last 15 main commits (verified merge state post-night-close)
Operator chat 2026-05-09 (decisions A/B/C/D applied)

Test plan

Operator readback: 3 packets correctly scoped (no scope creep, no cross-contamination)
Operator readback: Packet N's no-auto-deploy + no-secret-in-output guards feel sufficient
PR #123 merges before this PR (operator click order)
After this PR merge: operator runs codex exec < prompts/codex-cleanup-122-124-2026-05-09.md
Packet M PR + Packet N PR open in parallel as codex identity
Operator merges Packet M (tests pass) + Packet N (compose change)
Operator runs honcho-redis redeploy on RS 2000
Codex opens Packet O PR with sanity-check post-redeploy state
Operator merges Packet O — Wave 2 cataloging complete (8/8)

Canary status: missing — Medium PR class (multi-packet driver including class/security-sensitive #124). Fire canary 3+3 manually before merge OR operator_override per ADR 0001. ## Purpose Single Codex master prompt closing 3 remaining items per operator's chat decisions 2026-05-09: - **Packet M**: Issue #122 (token-budget cleanup) — operator chose `(b) Codex makes cleanup PR` - **Packet N**: Issue #124 (honcho-redis password-in-argv) — operator chose `(a) hotfix-first`; security-sensitive class - **Packet O**: Issue #100 (honcho-redis v2 cataloging) — depends on Packet N merge + operator redeploy on RS 2000; was originally Wave 2 deferred packet H ## What this PR ships `prompts/codex-cleanup-122-124-2026-05-09.md` (new, ~340 lines). Three packets in agent-souls `codex-handoff-packet-format`: - evidence_known, files_to_read (whitelist), files_to_create/edit (with change_type), proposed_change_scope, non_goals, acceptance_criteria, stop_conditions, production_impact, rollback, smoke pre/post, piotr_must_approve_before, codex_must_ask_prof_before - Per-packet stop_conditions enforce: NO secret value in PR body/commit/log/transcript; Codex MUST NOT auto-deploy on RS 2000 (Packet N requires operator manual redeploy); 3-way disagreement triggers escalation ## Why now - Last night's batch shipped 9/10 PRs (#119, #120, #121, #125-130 merged; #123 L4-Verify suite still open chained on #119) - Issue #122 (Codex's own L4-Verify findings: 12 token-budget overruns + missing cross-links) needs structural waiver mechanism so the suite can pass cleanly post-merge - Issue #124 (Codex correctly surfaced honcho-redis password leak via Config.Cmd; refused autonomous fix per coordination protocol) needs explicit operator-approved fix - Issue #100 (honcho-redis v2 cataloging) was deferred precisely because Codex hit the secret-in-argv stop condition; closes naturally after #124 fix + redeploy ## Files touched - `prompts/codex-cleanup-122-124-2026-05-09.md` (new, ~340 lines) No other files. Prompt does not touch modules, schema, control-plane, decisions, or AGENTS.md. It DRIVES Codex to do those (in 3 separate PRs). ## Relevant context - `prompts/codex-night-close-2026-05-09.md` (PR #117 merged) — sibling Wave 1+3 prompt - `prompts/codex-wave-2-v2-cataloging-2026-05-09.md` (PR #118 merged) — sibling Wave 2 prompt - `state/agent-execution-template.md` — execution discipline reference - `decisions/0001-canary-mandatory-pm-cadence.md` + `decisions/0002-ci-enforcement-canary.md` - `agent-souls/practices/agent-coordination-protocol.md` (5-turn cap → Owner Checkpoint) - `agent-souls/references/codex-handoff-packet-format.md` - `docs/forgejo-agent-operations.md` (PR #111) — mandatory pre-read, referenced in every packet - Issues #122 + #124 + #100 (all open; Codex authored #122 + #124 himself when he hit findings during night-close) ## Runtime evidence N/A — pure docs/prompts change. Codex's resulting 3 PRs will have runtime evidence. Notably Packet N requires `ssh rs2000 'docker inspect ...'` BEFORE and AFTER (with secret values redacted to `<REDACTED>` in PR body — no raw password ever surfaces in agent-visible output). ## Known constraints - Packet M depends on PR #123 (L4-Verify suite) being merged first (otherwise tests/test_l4_verify.py doesn't exist on main yet for waiver mechanism to extend). Operator merge order: **#123 first, then this PR**. - Packet N is `production_impact: medium` (Honcho redeploy required); operator must run `ssh rs2000 'cd /opt/vps-home-platform-infra && docker compose up -d honcho-redis'` post-N-merge. Codex must NOT auto-deploy. - Packet O depends on Packet N merge + redeploy. Codex sanity-checks Config.Cmd no longer shows password before cataloging; if still leaks, halts. ## Explicit out-of-scope - Cross-link findings from #122 (defer to separate issue if scope expands; this PR's Packet M only addresses token-budget waivers + archive) - Honcho-api / honcho-deriver argv check (separate finding if Codex notices) - Rotation of Honcho Redis password (this is delivery-mechanism change, not rotation) - Issue #103 traefik (still deferred from Wave 2; not in this batch) - ADR 0002 setup tasks (#49 — operator UI work) ## Requested decision `approve_merge` after canary 3+3 fires (Medium class) OR `operator_override` per Rule 2. ## Merge blockers - Canary 3+3 not yet fired (manual) - PR #123 (L4-Verify suite) must be merged FIRST so Packet M has tests/test_l4_verify.py to extend ## How operator triggers Codex (after #123 + this PR merge) In master operator (Codex thread): ```bash cd ~/Developer/iskra-platform-2026-04-30 git pull codex exec < prompts/codex-cleanup-122-124-2026-05-09.md ``` Codex opens Packet M + Packet N PRs in parallel. Operator merges them. Operator runs redeploy. Codex opens Packet O PR. Operator merges. ## Spec sources read - `prompts/codex-night-close-2026-05-09.md` + `prompts/codex-wave-2-v2-cataloging-2026-05-09.md` (sibling prompt structure for consistency) - agent-souls `practices/agent-coordination-protocol.md` - agent-souls `references/codex-handoff-packet-format.md` - Issues #122, #124, #100 (full bodies via Forgejo API) - `docs/forgejo-agent-operations.md` - `state/agent-execution-template.md` - `tests/` directory listing (confirmed test_l4_verify.py NOT yet on main — depends on #123 merge) - `control-plane/platformctl/manifest.py` (confirmed TOKEN_BUDGET = 1500 for module.yaml; prompts have separate 2000 budget per #122 issue body) - Forgejo last 15 main commits (verified merge state post-night-close) - Operator chat 2026-05-09 (decisions A/B/C/D applied) ## Test plan - [ ] Operator readback: 3 packets correctly scoped (no scope creep, no cross-contamination) - [ ] Operator readback: Packet N's no-auto-deploy + no-secret-in-output guards feel sufficient - [ ] PR #123 merges before this PR (operator click order) - [ ] After this PR merge: operator runs `codex exec < prompts/codex-cleanup-122-124-2026-05-09.md` - [ ] Packet M PR + Packet N PR open in parallel as `codex` identity - [ ] Operator merges Packet M (tests pass) + Packet N (compose change) - [ ] Operator runs honcho-redis redeploy on RS 2000 - [ ] Codex opens Packet O PR with sanity-check post-redeploy state - [ ] Operator merges Packet O — Wave 2 cataloging complete (8/8)

claude added 1 commit

2026-05-09 23:44:14 +02:00

docs(prompts): codex cleanup prompt — #122 (token-budget waivers) + #124 (honcho-redis secret) + #100 (cataloging)

canary-required / collect-diff (pull_request) Failing after 3s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 17s

Details

python-ci / Python 3.11 (pull_request) Successful in 32s

Details

python-ci / Python 3.12 (pull_request) Successful in 32s

Details

python-ci / Python 3.13 (pull_request) Successful in 32s

Details

canary-required / canary (pull_request) Has been skipped

Details

8005836318

Per operator decisions chat 2026-05-09:
- #122 → option (b): Codex makes cleanup PR (waiver mechanism + archive
  historical executed prompts)
- #124 → option (a): hotfix-first (security-sensitive: honcho-redis
  password in container argv visible via /proc/<pid>/cmdline)

Three packets in one combined prompt per agent-souls handoff format:

Packet M — issue/122 token-budget cleanup:
- New tests/l4-verify-waivers.yaml mechanism with reason+date per waiver
- Move 9 historical executed prompts to prompts/archive/<date>/ via git mv
- Add 4 active-prompt waivers (canonical schema RFC + 3 active master prompts)
- Update test_l4_verify.py to load waivers + skip with reason

Packet N — issue/124 honcho-redis secret delivery:
- Refactor compose to deliver Redis password via env var, not argv
- production_impact: medium (honcho service redeploy required)
- Operator must redeploy on RS 2000 post-merge (Codex MUST NOT auto-deploy)
- Critical: no secret value in PR body / commit / log / transcript

Packet O — issue/100 honcho-redis v2 cataloging:
- Depends on Packet N merged AND operator's redeploy complete
- Sanity-check that Config.Cmd no longer shows password before cataloging
- Originally Wave 2 deferred packet H

Coordination per agent-coordination-protocol.md (5-turn cap → Owner
Checkpoint). Forgejo agent contract pre-read mandatory per docs/forgejo-agent-operations.md.

After this PR merges + operator dispatches Codex + operator redeploys
honcho-redis post-N: Wave 2 cataloging fully complete (8/8 v2), token-
budget hygiene structurally enforceable, one CVE-grade leak closed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>