# GEMINI.md — OSVauco / OPAX

> Gemini 2.5 Pro · Nemotron session protocol · HITL-safe

---

## Locked Definitions

```
MCP_NAME:       OPAX-MCP
MCP_PROTOCOL:   OPAX Protocol
ROOT_DOMAIN:    vauco.no
HUB_URL:        https://opax.vauco.no
```

> These values are LOCKED. Do NOT change without explicit human instruction.

---

## Session Protocol (Nemotron Loop)

### BOOT
- Read `docs/AGENT_RULEBOOK.md`, `docs/VAUCO_OS_ROADMAP.md`, and `docs/OSVAUCO_OPAX_SESSION_LOG.md`.
- Print LOCKED DEFINITIONS (`MCP_NAME`, `MCP_PROTOCOL`, `HUB_URL`, `ROOT_DOMAIN`).
- Print the last `## NESTE OPPGAVE` block found in the session log.
- If no NESTE OPPGAVE found → warn and read ROADMAP NOW section instead.

### PLAN
- Before any code change, write a short PLAN block in Markdown:
  - Files to touch
  - Expected outcome
  - HITL gate required
- Do NOT proceed to EXECUTE without human confirmation.

### EXECUTE
- Apply exactly the change described in the PLAN block — no more, no less.
- Always show a full diff before writing any file.
- Never batch unrelated edits in a single EXECUTE step.

### VERIFY
- Run the relevant verification command (`curl`, `gcloud`, `grep`, `git log`).
- State result explicitly as `PASS` or `FAIL`.
- If FAIL → stop and report, do not proceed to LOG.

### LOG
- Append to `docs/OSVAUCO_OPAX_SESSION_LOG.md`:
  ```
  ## SLUTTRAPPORT – <date> – <Phase>
  - Hva: <description of change>
  - Filer: <list of files changed>
  - Verifisering: <command + result>

  ## NESTE OPPGAVE
  <single next task, explicit>
  ```

### NEXT
- At the next session start, read `## NESTE OPPGAVE` before doing anything else.
- The boot script reads the last NESTE OPPGAVE automatically — keep it updated.

---

## Hard Rules

1. **Never change LOCK LIST values** without explicit human instruction.
2. **Always show diff before writing** any file.
3. **Never batch unrelated edits** in a single EXECUTE step.
4. **OPAX (`opax.vauco.no`) is management plane only** — it never receives raw patient data.
5. **Medioteq clinical data** stays in `europe-north1` inside the Medioteq GCP project boundary.
6. **Deploy `clinical-mcp` and `clinical-orchestrator`** to the Medioteq project (`--project=<MEDIOTEQ_PROJECT_ID>`), never the Vauco project.
7. **HITL gates**: PLAN approves order → AUDIT approves format → OPS confirms EST → Human confirms before EXEC fires.

---

## Diagnostics Rules (CRITICAL)

> **Regel: Aldri gjett. Alltid hent faktisk data før du konkluderer.**

### Ved build-feil (Cloud Build)

NÅR `gcloud builds submit` feiler → kjør ALLTID dette FØR du gjør noe annet:

```bash
# Hent siste build-ID og vis logg direkte
BUILD_ID=$(gcloud builds list \
  --project=propane-will-491900-m5 \
  --limit=1 \
  --format="value(id)")

gcloud builds log $BUILD_ID \
  --project=propane-will-491900-m5 2>&1 | tail -80
```

- IKKE søk på nett før du har lest loggene.
- IKKE gjett på årsak basert på exit code alene.
- Exit code 125 = Docker-feil → les logg for å se hvilken linje som feilet.

### Ved deploy-feil (Cloud Run)

```bash
# Hent Cloud Run-logger
gcloud logging read \
  'resource.type=cloud_run_revision AND resource.labels.service_name=osvauco-agent' \
  --project=propane-will-491900-m5 \
  --limit=50 \
  --format="value(textPayload)"
```

### Ved HTTP-feil (4xx/5xx fra tjeneste)

```bash
# Test direkte mot Cloud Run URL (bypasser IAP)
curl -s -o /dev/null -w "%{http_code}" \
  -H "Authorization: Bearer $(gcloud auth print-identity-token)" \
  https://osvauco-agent-357036551735.us-central1.run.app/ENDPOINT
```

### Ved sertifikat/DNS-feil

```bash
# Sjekk SSL-sertifikat status
gcloud compute ssl-certificates list \
  --project=propane-will-491900-m5 \
  --format="table(name,managed.status,managed.domainStatus)"
```

### Generell regel

| Situasjon | Gjør DETTE | IKKE dette |
|-----------|-----------|------------|
| Build feiler | Les build-logg via `gcloud builds log` | Søk på nett |
| Runtime-feil | Les Cloud Run-logger | Gjett på koden |
| HTTP 404 | `curl` tjenesten direkte | Endre kode uten å bekrefte |
| Auth-feil | `gcloud auth list` + `gcloud auth print-identity-token` | Anta token er ugyldig |

---

## Domain Convention

| Subdomain | Type | Purpose |
|-----------|------|---------|
| `opax.vauco.no` | Hub / MCP | OPAX-MCP operator hub — Vauco internal only |
| `<client>-os.vauco.no` | Prod OS | Client live production OS |
| `<client>-oss.vauco.no` | Stage OS | Client staging / demo OS |

Auth: Google OAuth now. BankID on `-os` later (Medioteq first).

---

## Standard Boot Prompt

Paste this at the start of every Gemini TUI session:

```
BOOT: Read docs/AGENT_RULEBOOK.md, docs/VAUCO_OS_ROADMAP.md, docs/OSVAUCO_OPAX_SESSION_LOG.md.
Print LOCKED DEFINITIONS. Print last NESTE OPPGAVE. Do not take any action until I give a PLAN prompt.
```