158 lines
4.7 KiB
Markdown
158 lines
4.7 KiB
Markdown
# GEMINI.md — OSVauco / OPAX
|
||
|
||
> Gemini 2.5 Pro · Nemotron session protocol · HITL-safe
|
||
|
||
---
|
||
|
||
## Locked Definitions
|
||
|
||
```
|
||
MCP_NAME: OPAX-MCP
|
||
MCP_PROTOCOL: OPAX Protocol
|
||
ROOT_DOMAIN: vauco.no
|
||
HUB_URL: https://opax.vauco.no
|
||
```
|
||
|
||
> These values are LOCKED. Do NOT change without explicit human instruction.
|
||
|
||
---
|
||
|
||
## Session Protocol (Nemotron Loop)
|
||
|
||
### BOOT
|
||
- Read `docs/AGENT_RULEBOOK.md`, `docs/VAUCO_OS_ROADMAP.md`, and `docs/OSVAUCO_OPAX_SESSION_LOG.md`.
|
||
- Print LOCKED DEFINITIONS (`MCP_NAME`, `MCP_PROTOCOL`, `HUB_URL`, `ROOT_DOMAIN`).
|
||
- Print the last `## NESTE OPPGAVE` block found in the session log.
|
||
- If no NESTE OPPGAVE found → warn and read ROADMAP NOW section instead.
|
||
|
||
### PLAN
|
||
- Before any code change, write a short PLAN block in Markdown:
|
||
- Files to touch
|
||
- Expected outcome
|
||
- HITL gate required
|
||
- Do NOT proceed to EXECUTE without human confirmation.
|
||
|
||
### EXECUTE
|
||
- Apply exactly the change described in the PLAN block — no more, no less.
|
||
- Always show a full diff before writing any file.
|
||
- Never batch unrelated edits in a single EXECUTE step.
|
||
|
||
### VERIFY
|
||
- Run the relevant verification command (`curl`, `gcloud`, `grep`, `git log`).
|
||
- State result explicitly as `PASS` or `FAIL`.
|
||
- If FAIL → stop and report, do not proceed to LOG.
|
||
|
||
### LOG
|
||
- Append to `docs/OSVAUCO_OPAX_SESSION_LOG.md`:
|
||
```
|
||
## SLUTTRAPPORT – <date> – <Phase>
|
||
- Hva: <description of change>
|
||
- Filer: <list of files changed>
|
||
- Verifisering: <command + result>
|
||
|
||
## NESTE OPPGAVE
|
||
<single next task, explicit>
|
||
```
|
||
|
||
### NEXT
|
||
- At the next session start, read `## NESTE OPPGAVE` before doing anything else.
|
||
- The boot script reads the last NESTE OPPGAVE automatically — keep it updated.
|
||
|
||
---
|
||
|
||
## Hard Rules
|
||
|
||
1. **Never change LOCK LIST values** without explicit human instruction.
|
||
2. **Always show diff before writing** any file.
|
||
3. **Never batch unrelated edits** in a single EXECUTE step.
|
||
4. **OPAX (`opax.vauco.no`) is management plane only** — it never receives raw patient data.
|
||
5. **Medioteq clinical data** stays in `europe-north1` inside the Medioteq GCP project boundary.
|
||
6. **Deploy `clinical-mcp` and `clinical-orchestrator`** to the Medioteq project (`--project=<MEDIOTEQ_PROJECT_ID>`), never the Vauco project.
|
||
7. **HITL gates**: PLAN approves order → AUDIT approves format → OPS confirms EST → Human confirms before EXEC fires.
|
||
|
||
---
|
||
|
||
## Diagnostics Rules (CRITICAL)
|
||
|
||
> **Regel: Aldri gjett. Alltid hent faktisk data før du konkluderer.**
|
||
|
||
### Ved build-feil (Cloud Build)
|
||
|
||
NÅR `gcloud builds submit` feiler → kjør ALLTID dette FØR du gjør noe annet:
|
||
|
||
```bash
|
||
# Hent siste build-ID og vis logg direkte
|
||
BUILD_ID=$(gcloud builds list \
|
||
--project=propane-will-491900-m5 \
|
||
--limit=1 \
|
||
--format="value(id)")
|
||
|
||
gcloud builds log $BUILD_ID \
|
||
--project=propane-will-491900-m5 2>&1 | tail -80
|
||
```
|
||
|
||
- IKKE søk på nett før du har lest loggene.
|
||
- IKKE gjett på årsak basert på exit code alene.
|
||
- Exit code 125 = Docker-feil → les logg for å se hvilken linje som feilet.
|
||
|
||
### Ved deploy-feil (Cloud Run)
|
||
|
||
```bash
|
||
# Hent Cloud Run-logger
|
||
gcloud logging read \
|
||
'resource.type=cloud_run_revision AND resource.labels.service_name=osvauco-agent' \
|
||
--project=propane-will-491900-m5 \
|
||
--limit=50 \
|
||
--format="value(textPayload)"
|
||
```
|
||
|
||
### Ved HTTP-feil (4xx/5xx fra tjeneste)
|
||
|
||
```bash
|
||
# Test direkte mot Cloud Run URL (bypasser IAP)
|
||
curl -s -o /dev/null -w "%{http_code}" \
|
||
-H "Authorization: Bearer $(gcloud auth print-identity-token)" \
|
||
https://osvauco-agent-357036551735.us-central1.run.app/ENDPOINT
|
||
```
|
||
|
||
### Ved sertifikat/DNS-feil
|
||
|
||
```bash
|
||
# Sjekk SSL-sertifikat status
|
||
gcloud compute ssl-certificates list \
|
||
--project=propane-will-491900-m5 \
|
||
--format="table(name,managed.status,managed.domainStatus)"
|
||
```
|
||
|
||
### Generell regel
|
||
|
||
| Situasjon | Gjør DETTE | IKKE dette |
|
||
|-----------|-----------|------------|
|
||
| Build feiler | Les build-logg via `gcloud builds log` | Søk på nett |
|
||
| Runtime-feil | Les Cloud Run-logger | Gjett på koden |
|
||
| HTTP 404 | `curl` tjenesten direkte | Endre kode uten å bekrefte |
|
||
| Auth-feil | `gcloud auth list` + `gcloud auth print-identity-token` | Anta token er ugyldig |
|
||
|
||
---
|
||
|
||
## Domain Convention
|
||
|
||
| Subdomain | Type | Purpose |
|
||
|-----------|------|---------|
|
||
| `opax.vauco.no` | Hub / MCP | OPAX-MCP operator hub — Vauco internal only |
|
||
| `<client>-os.vauco.no` | Prod OS | Client live production OS |
|
||
| `<client>-oss.vauco.no` | Stage OS | Client staging / demo OS |
|
||
|
||
Auth: Google OAuth now. BankID on `-os` later (Medioteq first).
|
||
|
||
---
|
||
|
||
## Standard Boot Prompt
|
||
|
||
Paste this at the start of every Gemini TUI session:
|
||
|
||
```
|
||
BOOT: Read docs/AGENT_RULEBOOK.md, docs/VAUCO_OS_ROADMAP.md, docs/OSVAUCO_OPAX_SESSION_LOG.md.
|
||
Print LOCKED DEFINITIONS. Print last NESTE OPPGAVE. Do not take any action until I give a PLAN prompt.
|
||
```
|