Promote OSVauco to main hub: richer README, agentic MCP contract doc, and session-aware OPAX boot logging

README.md

@@ -1,9 +1,22 @@
 # OSVauco
 
-Main operator workspace for OS-Vauco.
+Main operator workspace for OS-Vauco, focused on OPAX-MCP and Gemini TUI in GCP project `propane-will-491900-m5` (region `us-central1`).
 
-- OPAX MCP boot script: `scripts/osvauco-opax-boot.sh`
+## Repositories
-- Session log: `docs/OSVAUCO_OPAX_SESSION_LOG.md`
-- Governance docs: `docs/AGENT_RULEBOOK.md`, `docs/LEARNINGS.md`, `docs/ARCHITECTURE.md`, `docs/SECRETS-SETUP.md`, `docs/IAP-SETUP.md`
 
-This repo is intended to be checked out into `~/OSVauco` on Cloud Shell.
+- **OSVauco (this repo)** – operator hub: scripts, governance docs, session log.
+- **vauco-gemini-tui-bridge** – Textual TUI + FastAPI WebSocket bridge for Gemini LLM.
+- **vauco-bootstrap** – skill templates and higher-level automation flows.
+
+## Daily flow
+
+From Cloud Shell:
+
+```bash
+cd ~/OSVauco
+./scripts/osvauco-startup.sh     # auth + ADC + .env sync
+./scripts/osvauco-opax-boot.sh   # OPAX-MCP ping + optional Gemini TUI entry
+./scripts/osvauco-health-check.sh # sanity-check git/disk/auth
+```
+
+Session history is stored in `docs/OSVAUCO_OPAX_SESSION_LOG.md`. Governance rules live in `docs/AGENT_RULEBOOK.md`.

docs/AGENTIC_CONTRACT_MCP_PROVISIONING.md

@@ -0,0 +1,67 @@
+---
+TITLE AGENTIC CONTRACT — Structured Prompt Provisioning via MCP (OSVauco Edition)
+---
+
+> **Thread type:** PLAN / ARCH  
+> **Version:** 1.0.1  
+> **Date:** 2026-05-21  
+> **Status:** IN PROGRESS  
+> **Owner:** OSVauco Operator Hub
+
+Denne versjonen er kopiert og lett tilpasset fra `vauco-os/docs/AGENTIC_CONTRACT_MCP_PROVISIONING.md`.
+
+## 📌 Concept Note
+
+Structured prompts provisioneres fra OSVauco som API-endepunkter.  
+Hver modul/API er governet via en MCP-server under Vauco, og tilgang er gated av Google Login på `@vauco.no` eller godkjent alias.
+
+## 🏛️ Architecture — 3 Layers
+
+```
+┌──────────────────────────────────────────────────────────┐
+│  LAYER 3 — IDENTITY                                      │
+│  Google OAuth → @vauco.no sub-mail or approved alias     │
+│  Whitelisted in OSVauco Login Whitelist                  │
+└──────────────────────┬───────────────────────────────────┘
+                       │ authenticated identity
+┌──────────────────────▼───────────────────────────────────┐
+│  LAYER 2 — GOVERNANCE                                    │
+│  MCP Server (OPAX-MCP)                                   │
+│  Tool registry · Access policy · Routing rules           │
+│  Minimum-privilege roles per module                      │
+└──────────────────────┬───────────────────────────────────┘
+                       │ governed tool call
+┌──────────────────────▼───────────────────────────────────┐
+│  LAYER 1 — PROVISIONING                                  │
+│  OSVauco / Vauco OS API                                  │
+│  Serves structured prompt payloads to agents/consumers   │
+│  Each module = a callable API endpoint                   │
+└──────────────────────────────────────────────────────────┘
+```
+
+## 🔐 Identity & Access Control
+
+- Primær identitet: `name@vauco.no`  
+- Sub-mail alias: `role@vauco.no`  
+- Ekstern alias: whitelist-only  
+
+Regler:
+- Hver identitet knyttes til en GCP IAM-rolle.
+- Hver MCP-modul har minimum-privilege-scope.
+- Login whitelist vedlikeholdes i OSVauco/Command Hub.
+- Ingen blanket API-tilgang — scope per modul.
+
+## 🗺️ Implementation Roadmap (kort)
+
+1. Forankre arkitektur i OSVauco (denne fila + `docs/AGENT_RULEBOOK.md`).
+2. Definér IAM-roller og modul-scope i GCP.
+3. Etabler MCP-server som permission broker foran OPAX-MCP.
+4. Logg alle MCP-kall til Firestore med identity + modul.
+5. Prototype med én modul, deretter tre.
+
+## ✅ Done When
+
+- 3+ moduler callable via MCP-endepunktet.  
+- Alle moduler gated av Google OAuth.  
+- Firestore logger alle kall med identity + modul + resultat.  
+- DEPLOY GODKJENT mottatt før produksjonsregistrering.

scripts/osvauco-opax-boot.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+# OSVauco OPAX boot — nå med enkel session-logg
+
 set -euo pipefail
 
 PROJECT_ID="propane-will-491900-m5"
@@ -14,6 +16,15 @@ GREEN="$(tput setaf 2 || true)"
 RED="$(tput setaf 1 || true)"
 RESET="$(tput sgr0 || true)"
 
+SESSION_ID="$(date '+%Y%m%d-%H%M%S')"
+
+# Vis siste linje fra session-logg hvis den finnes
+if [ -f "$LOG_FILE" ]; then
+  LAST_LINE=$(tail -n 1 "$LOG_FILE" || true)
+else
+  LAST_LINE="(ingen tidligere sesjoner logget ennå)"
+fi
+
 echo "============================================================"
 echo " O S V A U C O  ·  O P A X"
 echo "============================================================"
@@ -26,6 +37,10 @@ echo " Project : $PROJECT_ID"
 echo " Region  : $REGION"
 echo " Account : $ACCOUNT"
 echo " Repo    : $REPO ($BRANCH)"
+echo " Session : $SESSION_ID"
+echo
+
+echo " Forrige: $LAST_LINE"
 echo
 
 echo " Tester OPAX-MCP på: $PING_URL"
@@ -38,8 +53,11 @@ fi
 echo
 
 mkdir -p "$(dirname "$LOG_FILE")"
+
+read -r -p "[OSVauco/OPAX] Kort beskrivelse av denne sesjonen: " SESSION_DESC || SESSION_DESC="(ingen beskrivelse)"
+
+echo "$SESSION_ID | $PROJECT_ID | $REGION | $ACCOUNT | $SESSION_DESC" >> "$LOG_FILE"
 echo " Logg oppdatert: $LOG_FILE"
-touch "$LOG_FILE"
 echo
 
 read -r -p "[OSVauco/OPAX] Starte Gemini-CLI i ~/OSVauco nå? (y/N): " ANSWER