Promote OSVauco to main hub: richer README, agentic MCP contract doc, and session-aware OPAX boot logging
This commit is contained in:
parent
bcee0cbd30
commit
18a9f93c37
23
README.md
23
README.md
|
|
@ -1,9 +1,22 @@
|
|||
# OSVauco
|
||||
|
||||
Main operator workspace for OS-Vauco.
|
||||
Main operator workspace for OS-Vauco, focused on OPAX-MCP and Gemini TUI in GCP project `propane-will-491900-m5` (region `us-central1`).
|
||||
|
||||
- OPAX MCP boot script: `scripts/osvauco-opax-boot.sh`
|
||||
- Session log: `docs/OSVAUCO_OPAX_SESSION_LOG.md`
|
||||
- Governance docs: `docs/AGENT_RULEBOOK.md`, `docs/LEARNINGS.md`, `docs/ARCHITECTURE.md`, `docs/SECRETS-SETUP.md`, `docs/IAP-SETUP.md`
|
||||
## Repositories
|
||||
|
||||
This repo is intended to be checked out into `~/OSVauco` on Cloud Shell.
|
||||
- **OSVauco (this repo)** – operator hub: scripts, governance docs, session log.
|
||||
- **vauco-gemini-tui-bridge** – Textual TUI + FastAPI WebSocket bridge for Gemini LLM.
|
||||
- **vauco-bootstrap** – skill templates and higher-level automation flows.
|
||||
|
||||
## Daily flow
|
||||
|
||||
From Cloud Shell:
|
||||
|
||||
```bash
|
||||
cd ~/OSVauco
|
||||
./scripts/osvauco-startup.sh # auth + ADC + .env sync
|
||||
./scripts/osvauco-opax-boot.sh # OPAX-MCP ping + optional Gemini TUI entry
|
||||
./scripts/osvauco-health-check.sh # sanity-check git/disk/auth
|
||||
```
|
||||
|
||||
Session history is stored in `docs/OSVAUCO_OPAX_SESSION_LOG.md`. Governance rules live in `docs/AGENT_RULEBOOK.md`.
|
||||
|
|
|
|||
67
docs/AGENTIC_CONTRACT_MCP_PROVISIONING.md
Normal file
67
docs/AGENTIC_CONTRACT_MCP_PROVISIONING.md
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
---
|
||||
TITLE AGENTIC CONTRACT — Structured Prompt Provisioning via MCP (OSVauco Edition)
|
||||
---
|
||||
|
||||
> **Thread type:** PLAN / ARCH
|
||||
> **Version:** 1.0.1
|
||||
> **Date:** 2026-05-21
|
||||
> **Status:** IN PROGRESS
|
||||
> **Owner:** OSVauco Operator Hub
|
||||
|
||||
Denne versjonen er kopiert og lett tilpasset fra `vauco-os/docs/AGENTIC_CONTRACT_MCP_PROVISIONING.md`.
|
||||
|
||||
## 📌 Concept Note
|
||||
|
||||
Structured prompts provisioneres fra OSVauco som API-endepunkter.
|
||||
Hver modul/API er governet via en MCP-server under Vauco, og tilgang er gated av Google Login på `@vauco.no` eller godkjent alias.
|
||||
|
||||
## 🏛️ Architecture — 3 Layers
|
||||
|
||||
```
|
||||
┌──────────────────────────────────────────────────────────┐
|
||||
│ LAYER 3 — IDENTITY │
|
||||
│ Google OAuth → @vauco.no sub-mail or approved alias │
|
||||
│ Whitelisted in OSVauco Login Whitelist │
|
||||
└──────────────────────┬───────────────────────────────────┘
|
||||
│ authenticated identity
|
||||
┌──────────────────────▼───────────────────────────────────┐
|
||||
│ LAYER 2 — GOVERNANCE │
|
||||
│ MCP Server (OPAX-MCP) │
|
||||
│ Tool registry · Access policy · Routing rules │
|
||||
│ Minimum-privilege roles per module │
|
||||
└──────────────────────┬───────────────────────────────────┘
|
||||
│ governed tool call
|
||||
┌──────────────────────▼───────────────────────────────────┐
|
||||
│ LAYER 1 — PROVISIONING │
|
||||
│ OSVauco / Vauco OS API │
|
||||
│ Serves structured prompt payloads to agents/consumers │
|
||||
│ Each module = a callable API endpoint │
|
||||
└──────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
## 🔐 Identity & Access Control
|
||||
|
||||
- Primær identitet: `name@vauco.no`
|
||||
- Sub-mail alias: `role@vauco.no`
|
||||
- Ekstern alias: whitelist-only
|
||||
|
||||
Regler:
|
||||
- Hver identitet knyttes til en GCP IAM-rolle.
|
||||
- Hver MCP-modul har minimum-privilege-scope.
|
||||
- Login whitelist vedlikeholdes i OSVauco/Command Hub.
|
||||
- Ingen blanket API-tilgang — scope per modul.
|
||||
|
||||
## 🗺️ Implementation Roadmap (kort)
|
||||
|
||||
1. Forankre arkitektur i OSVauco (denne fila + `docs/AGENT_RULEBOOK.md`).
|
||||
2. Definér IAM-roller og modul-scope i GCP.
|
||||
3. Etabler MCP-server som permission broker foran OPAX-MCP.
|
||||
4. Logg alle MCP-kall til Firestore med identity + modul.
|
||||
5. Prototype med én modul, deretter tre.
|
||||
|
||||
## ✅ Done When
|
||||
|
||||
- 3+ moduler callable via MCP-endepunktet.
|
||||
- Alle moduler gated av Google OAuth.
|
||||
- Firestore logger alle kall med identity + modul + resultat.
|
||||
- DEPLOY GODKJENT mottatt før produksjonsregistrering.
|
||||
|
|
@ -1,4 +1,6 @@
|
|||
#!/usr/bin/env bash
|
||||
# OSVauco OPAX boot — nå med enkel session-logg
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
PROJECT_ID="propane-will-491900-m5"
|
||||
|
|
@ -14,6 +16,15 @@ GREEN="$(tput setaf 2 || true)"
|
|||
RED="$(tput setaf 1 || true)"
|
||||
RESET="$(tput sgr0 || true)"
|
||||
|
||||
SESSION_ID="$(date '+%Y%m%d-%H%M%S')"
|
||||
|
||||
# Vis siste linje fra session-logg hvis den finnes
|
||||
if [ -f "$LOG_FILE" ]; then
|
||||
LAST_LINE=$(tail -n 1 "$LOG_FILE" || true)
|
||||
else
|
||||
LAST_LINE="(ingen tidligere sesjoner logget ennå)"
|
||||
fi
|
||||
|
||||
echo "============================================================"
|
||||
echo " O S V A U C O · O P A X"
|
||||
echo "============================================================"
|
||||
|
|
@ -26,6 +37,10 @@ echo " Project : $PROJECT_ID"
|
|||
echo " Region : $REGION"
|
||||
echo " Account : $ACCOUNT"
|
||||
echo " Repo : $REPO ($BRANCH)"
|
||||
echo " Session : $SESSION_ID"
|
||||
echo
|
||||
|
||||
echo " Forrige: $LAST_LINE"
|
||||
echo
|
||||
|
||||
echo " Tester OPAX-MCP på: $PING_URL"
|
||||
|
|
@ -38,8 +53,11 @@ fi
|
|||
echo
|
||||
|
||||
mkdir -p "$(dirname "$LOG_FILE")"
|
||||
|
||||
read -r -p "[OSVauco/OPAX] Kort beskrivelse av denne sesjonen: " SESSION_DESC || SESSION_DESC="(ingen beskrivelse)"
|
||||
|
||||
echo "$SESSION_ID | $PROJECT_ID | $REGION | $ACCOUNT | $SESSION_DESC" >> "$LOG_FILE"
|
||||
echo " Logg oppdatert: $LOG_FILE"
|
||||
touch "$LOG_FILE"
|
||||
echo
|
||||
|
||||
read -r -p "[OSVauco/OPAX] Starte Gemini-CLI i ~/OSVauco nå? (y/N): " ANSWER
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user