OSVauco/.gemini/GEMINI.md

GEMINI.md — OSVauco / OPAX

Gemini 2.5 Pro · Nemotron session protocol · HITL-safe

---

Locked Definitions

MCP_NAME:       OPAX-MCP
MCP_PROTOCOL:   OPAX Protocol
ROOT_DOMAIN:    vauco.no
HUB_URL:        https://opax.vauco.no

These values are LOCKED. Do NOT change without explicit human instruction.

---

Session Protocol (Nemotron Loop)

BOOT

• Read docs/AGENT_RULEBOOK.md, docs/VAUCO_OS_ROADMAP.md, and docs/OSVAUCO_OPAX_SESSION_LOG.md.
• Print LOCKED DEFINITIONS (MCP_NAME, MCP_PROTOCOL, HUB_URL, ROOT_DOMAIN).
• Print the last ## NESTE OPPGAVE block found in the session log.
• If no NESTE OPPGAVE found → warn and read ROADMAP NOW section instead.

PLAN

• Before any code change, write a short PLAN block in Markdown:
  • Files to touch
  • Expected outcome
  • HITL gate required
• Do NOT proceed to EXECUTE without human confirmation.

EXECUTE

• Apply exactly the change described in the PLAN block — no more, no less.
• Always show a full diff before writing any file.
• Never batch unrelated edits in a single EXECUTE step.

VERIFY

• Run the relevant verification command (curl, gcloud, grep, git log).
• State result explicitly as PASS or FAIL.
• If FAIL → stop and report, do not proceed to LOG.

LOG

• Append to docs/OSVAUCO_OPAX_SESSION_LOG.md:

  ## SLUTTRAPPORT – <date> – <Phase>
  - Hva: <description of change>
  - Filer: <list of files changed>
  - Verifisering: <command + result>
  
  ## NESTE OPPGAVE
  <single next task, explicit>
  

NEXT

• At the next session start, read ## NESTE OPPGAVE before doing anything else.
• The boot script reads the last NESTE OPPGAVE automatically — keep it updated.

---

Hard Rules

1. Never change LOCK LIST values without explicit human instruction.
2. Always show diff before writing any file.
3. Never batch unrelated edits in a single EXECUTE step.
4. OPAX (opax.vauco.no) is management plane only — it never receives raw patient data.
5. Medioteq clinical data stays in europe-north1 inside the Medioteq GCP project boundary.
6. Deploy clinical-mcp and clinical-orchestrator to the Medioteq project (--project=<MEDIOTEQ_PROJECT_ID>), never the Vauco project.
7. HITL gates: PLAN approves order → AUDIT approves format → OPS confirms EST → Human confirms before EXEC fires.

---

Diagnostics Rules (CRITICAL)

Regel: Aldri gjett. Alltid hent faktisk data før du konkluderer.

Ved build-feil (Cloud Build)

NÅR gcloud builds submit feiler → kjør ALLTID dette FØR du gjør noe annet:

# Hent siste build-ID og vis logg direkte
BUILD_ID=$(gcloud builds list \
  --project=propane-will-491900-m5 \
  --limit=1 \
  --format="value(id)")

gcloud builds log $BUILD_ID \
  --project=propane-will-491900-m5 2>&1 | tail -80

• IKKE søk på nett før du har lest loggene.
• IKKE gjett på årsak basert på exit code alene.
• Exit code 125 = Docker-feil → les logg for å se hvilken linje som feilet.

Ved deploy-feil (Cloud Run)

# Hent Cloud Run-logger
gcloud logging read \
  'resource.type=cloud_run_revision AND resource.labels.service_name=osvauco-agent' \
  --project=propane-will-491900-m5 \
  --limit=50 \
  --format="value(textPayload)"

Ved HTTP-feil (4xx/5xx fra tjeneste)

# Test direkte mot Cloud Run URL (bypasser IAP)
curl -s -o /dev/null -w "%{http_code}" \
  -H "Authorization: Bearer $(gcloud auth print-identity-token)" \
  https://osvauco-agent-357036551735.us-central1.run.app/ENDPOINT

Ved sertifikat/DNS-feil

# Sjekk SSL-sertifikat status
gcloud compute ssl-certificates list \
  --project=propane-will-491900-m5 \
  --format="table(name,managed.status,managed.domainStatus)"

Generell regel

Situasjon	Gjør DETTE	IKKE dette
Build feiler	Les build-logg via gcloud builds log	Søk på nett
Runtime-feil	Les Cloud Run-logger	Gjett på koden
HTTP 404	curl tjenesten direkte	Endre kode uten å bekrefte
Auth-feil	gcloud auth list + gcloud auth print-identity-token	Anta token er ugyldig

---

Domain Convention

Subdomain	Type	Purpose
opax.vauco.no	Hub / MCP	OPAX-MCP operator hub — Vauco internal only
<client>-os.vauco.no	Prod OS	Client live production OS
<client>-oss.vauco.no	Stage OS	Client staging / demo OS

Auth: Google OAuth now. BankID on -os later (Medioteq first).

---

Standard Boot Prompt

Paste this at the start of every Gemini TUI session:

BOOT: Read docs/AGENT_RULEBOOK.md, docs/VAUCO_OS_ROADMAP.md, docs/OSVAUCO_OPAX_SESSION_LOG.md.
Print LOCKED DEFINITIONS. Print last NESTE OPPGAVE. Do not take any action until I give a PLAN prompt.