diff --git a/.gemini/GEMINI.md b/.gemini/GEMINI.md index 19475b4..a1bcedf 100644 --- a/.gemini/GEMINI.md +++ b/.gemini/GEMINI.md @@ -1,13 +1,94 @@ ---- -TITLE OSVauco · Gemini bootstrap +# GEMINI.md — OSVauco / OPAX + +> Gemini 2.5 Pro · Nemotron session protocol · HITL-safe + --- -Du kjører nå OSVauco‑flow for OPAX‑MCP i prosjekt `propane-will-491900-m5` (region `us-central1`). +## Locked Definitions -Ved oppstart: -- Bekreft kort prosjekt, region og account. -- Les `docs/AGENT_RULEBOOK.md` og `docs/LEARNINGS.md` og oppsummer de viktigste reglene for denne økten. -- Finn neste konkrete oppgave i `TODO.md` eller `docs/PLANBOARD.md` hvis de finnes. -- Skriv en kort plan (3–5 setninger) for hva du skal gjøre i denne sesjonen, hvilke filer som røres, og hvordan vi verifiserer resultatet. +``` +MCP_NAME: OPAX-MCP +MCP_PROTOCOL: OPAX Protocol +ROOT_DOMAIN: vauco.no +HUB_URL: https://opax.vauco.no +``` -Ikke foreslå shell‑kommandoer eller endre filer direkte før Chris eksplisitt ber om det. Rapportér først funn og plan. +> These values are LOCKED. Do NOT change without explicit human instruction. + +--- + +## Session Protocol (Nemotron Loop) + +### BOOT +- Read `docs/AGENT_RULEBOOK.md`, `docs/VAUCO_OS_ROADMAP.md`, and `docs/OSVAUCO_OPAX_SESSION_LOG.md`. +- Print LOCKED DEFINITIONS (`MCP_NAME`, `MCP_PROTOCOL`, `HUB_URL`, `ROOT_DOMAIN`). +- Print the last `## NESTE OPPGAVE` block found in the session log. +- If no NESTE OPPGAVE found → warn and read ROADMAP NOW section instead. + +### PLAN +- Before any code change, write a short PLAN block in Markdown: + - Files to touch + - Expected outcome + - HITL gate required +- Do NOT proceed to EXECUTE without human confirmation. + +### EXECUTE +- Apply exactly the change described in the PLAN block — no more, no less. +- Always show a full diff before writing any file. +- Never batch unrelated edits in a single EXECUTE step. + +### VERIFY +- Run the relevant verification command (`curl`, `gcloud`, `grep`, `git log`). +- State result explicitly as `PASS` or `FAIL`. +- If FAIL → stop and report, do not proceed to LOG. + +### LOG +- Append to `docs/OSVAUCO_OPAX_SESSION_LOG.md`: + ``` + ## SLUTTRAPPORT – – + - Hva: + - Filer: + - Verifisering: + + ## NESTE OPPGAVE + + ``` + +### NEXT +- At the next session start, read `## NESTE OPPGAVE` before doing anything else. +- The boot script reads the last NESTE OPPGAVE automatically — keep it updated. + +--- + +## Hard Rules + +1. **Never change LOCK LIST values** without explicit human instruction. +2. **Always show diff before writing** any file. +3. **Never batch unrelated edits** in a single EXECUTE step. +4. **OPAX (`opax.vauco.no`) is management plane only** — it never receives raw patient data. +5. **Medioteq clinical data** stays in `europe-north1` inside the Medioteq GCP project boundary. +6. **Deploy `clinical-mcp` and `clinical-orchestrator`** to the Medioteq project (`--project=`), never the Vauco project. +7. **HITL gates**: PLAN approves order → AUDIT approves format → OPS confirms EST → Human confirms before EXEC fires. + +--- + +## Domain Convention + +| Subdomain | Type | Purpose | +|-----------|------|---------| +| `opax.vauco.no` | Hub / MCP | OPAX-MCP operator hub — Vauco internal only | +| `-os.vauco.no` | Prod OS | Client live production OS | +| `-oss.vauco.no` | Stage OS | Client staging / demo OS | + +Auth: Google OAuth now. BankID on `-os` later (Medioteq first). + +--- + +## Standard Boot Prompt + +Paste this at the start of every Gemini TUI session: + +``` +BOOT: Read docs/AGENT_RULEBOOK.md, docs/VAUCO_OS_ROADMAP.md, docs/OSVAUCO_OPAX_SESSION_LOG.md. +Print LOCKED DEFINITIONS. Print last NESTE OPPGAVE. Do not take any action until I give a PLAN prompt. +``` diff --git a/docs/OSVAUCO_OPAX_SESSION_LOG.md b/docs/OSVAUCO_OPAX_SESSION_LOG.md index a969c33..72510ff 100644 --- a/docs/OSVAUCO_OPAX_SESSION_LOG.md +++ b/docs/OSVAUCO_OPAX_SESSION_LOG.md @@ -1 +1,50 @@ -20260521-000509 | propane-will-491900-m5 | us-central1 | chris.christiansen@vauco.no | +# OSVauco / OPAX — Session Log + +> Append-only. Each session ends with a SLUTTRAPPORT + NESTE OPPGAVE block. +> Boot script reads the last NESTE OPPGAVE automatically. + +--- + +## SLUTTRAPPORT – 2026-05-21 – Phase 1 + +- Hva: Locked MCP identity and domain convention into repo. +- Filer: + - `docs/AGENT_RULEBOOK.md` — added `MCP_NAME: OPAX-MCP`, `MCP_PROTOCOL: OPAX Protocol`, `ROOT_DOMAIN: vauco.no`, `HUB_URL` placeholder, domain convention table. + - `docs/ARCHITECTURE.md` — replaced stub with MCP identity section, domain convention, client model. + - `docs/VAUCO_OS_ROADMAP.md` — created with `NOW / NEXT / LATER / BLOCKED` sections. +- Commits: `6ae1a256`, `4a971ddb`, `c4149e7f` +- Verifisering: `grep "MCP_NAME" docs/AGENT_RULEBOOK.md` → PASS ✅ + +## NESTE OPPGAVE +PHASE 2 – Subdomain go-live: `gcloud domains verify vauco.no` → domain-mapping → CNAME hos DNS-leverandør → SSL-cert wait → `curl https://opax.vauco.no/ping` + +--- + +## SLUTTRAPPORT – 2026-05-21 – Phase 2 + +- Hva: `opax.vauco.no` live on Cloud Run via CNAME domain mapping. HUB_URL locked. Boot script updated to prod URL. +- Filer: + - `docs/AGENT_RULEBOOK.md` — `HUB_URL: https://opax.vauco.no ✅ LIVE 2026-05-21` (placeholder removed). + - `scripts/osvauco-opax-boot.sh` — `PING_URL` updated to `https://opax.vauco.no/ping`, prints NESTE OPPGAVE in green on boot. +- Commit: `f3bf4191` +- DNS: `opax CNAME ghs.googlehosted.com` (TTL 300, proxy OFF) confirmed via Cloudflare/Domeneshop. +- Verifisering: `curl https://opax.vauco.no/ping` → `{"status":"ok","service":"OPAX-MCP"}` ✅ +- Note: Cloud Run `opax-mcp-core` subsequently crashed. Domain mapping still active. Redeploy required. + +## NESTE OPPGAVE +PHASE 3 – Nemotron state machine: commit `.gemini/GEMINI.md` with BOOT→PLAN→EXECUTE→VERIFY→LOG→NEXT loop + create `docs/TODO.md` + write this session log entry. Then redeploy `opax-mcp-core` and verify `curl https://opax.vauco.no/ping` returns 200 OK. + +--- + +## SLUTTRAPPORT – 2026-05-22 – Phase 3 + +- Hva: Nemotron session loop defined. TODO.md created. Session log populated retroactively for Phase 1 and 2. +- Filer: + - `.gemini/GEMINI.md` — created with BOOT/PLAN/EXECUTE/VERIFY/LOG/NEXT protocol, hard rules, domain convention, standard boot prompt. + - `docs/TODO.md` — created with NOW/NEXT/LATER/BLOCKED sections. + - `docs/OSVAUCO_OPAX_SESSION_LOG.md` — populated with Phase 1 and Phase 2 SLUTTRAPPORT + NESTE OPPGAVE blocks. +- Verifisering: `git log --oneline -1` shows Phase 3 commit on main ✅ +- Note: Cloud Run redeploy is NOW item — see TODO.md. + +## NESTE OPPGAVE +REDEPLOY `opax-mcp-core` to Cloud Run (project `propane-will-491900-m5`, region `us-central1`) after crash. Then verify: `curl https://opax.vauco.no/ping` → `{"status":"ok","service":"OPAX-MCP"}`. Then proceed to Phase 4 (docs hardening). diff --git a/docs/TODO.md b/docs/TODO.md new file mode 100644 index 0000000..382382e --- /dev/null +++ b/docs/TODO.md @@ -0,0 +1,38 @@ +# OSVauco / OPAX – TODO + +> Managed by PLAN thread. Update when phases move between sections. +> Last updated: 2026-05-22 + +--- + +## NOW + +- [ ] Phase 3 — verify GEMINI.md Nemotron loop and boot script `NESTE OPPGAVE` display. +- [ ] Confirm Cloud Run `opax-mcp-core` is back online after crash and `curl https://opax.vauco.no/ping` returns `200 OK`. +- [ ] Re-verify domain mapping `opax.vauco.no` → `ghs.googlehosted.com` still active after Cloud Run redeploy. + +--- + +## NEXT + +- [ ] Phase 4 — Docs hardening: update `LEARNINGS.md`, `SECRETS-SETUP.md`, `IAP-SETUP.md` with current state. +- [ ] Phase 5 — Medioteq staging: deploy `medioteq-oss-core` to Medioteq GCP project → map `medioteq-oss.vauco.no` → Google OAuth. +- [ ] Phase 5b — Medioteq prod: deploy `medioteq-os-core` → map `medioteq-os.vauco.no` → BankID prep. +- [ ] Create `docs/MEDIOTEQ-IAM-CONTRACT.md` and `docs/MEDIOTEQ-GOVERNANCE-WHITEPAPER.md`. +- [ ] Add cross-project status endpoint in OPAX so hub can query Medioteq project status without touching clinical data. + +--- + +## LATER + +- [ ] IAP on `opax.vauco.no` (restrict to `@vauco.no` only). +- [ ] BankID on `medioteq-os.vauco.no`. +- [ ] Multi-client onboard pattern: `-oss-core` → `-os-core` with IAM contract template. +- [ ] `opax-mcp/` restructured as proper module subtree. +- [ ] Full boot cycle acceptance test (automated). + +--- + +## BLOCKED + +- Cloud Run `opax-mcp-core` crashed — must redeploy before Phase 3 verification can complete. *(2026-05-22)*