OSVauco/.gemini/GEMINI.md

GEMINI.md — OSVauco / OPAX

Gemini 2.5 Pro · Nemotron session protocol · HITL-safe

---

Locked Definitions

MCP_NAME:       OPAX-MCP
MCP_PROTOCOL:   OPAX Protocol
ROOT_DOMAIN:    vauco.no
HUB_URL:        https://opax.vauco.no

These values are LOCKED. Do NOT change without explicit human instruction.

---

Session Protocol (Nemotron Loop)

BOOT

• Read docs/AGENT_RULEBOOK.md, docs/VAUCO_OS_ROADMAP.md, and docs/OSVAUCO_OPAX_SESSION_LOG.md.
• Print LOCKED DEFINITIONS (MCP_NAME, MCP_PROTOCOL, HUB_URL, ROOT_DOMAIN).
• Print the last ## NESTE OPPGAVE block found in the session log.
• If no NESTE OPPGAVE found → warn and read ROADMAP NOW section instead.

PLAN

• Before any code change, write a short PLAN block in Markdown:
  • Files to touch
  • Expected outcome
  • HITL gate required
• Do NOT proceed to EXECUTE without human confirmation.

EXECUTE

• Apply exactly the change described in the PLAN block — no more, no less.
• Always show a full diff before writing any file.
• Never batch unrelated edits in a single EXECUTE step.

VERIFY

• Run the relevant verification command (curl, gcloud, grep, git log).
• State result explicitly as PASS or FAIL.
• If FAIL → stop and report, do not proceed to LOG.

LOG

• Append to docs/OSVAUCO_OPAX_SESSION_LOG.md:

  ## SLUTTRAPPORT – <date> – <Phase>
  - Hva: <description of change>
  - Filer: <list of files changed>
  - Verifisering: <command + result>
  
  ## NESTE OPPGAVE
  <single next task, explicit>
  

NEXT

• At the next session start, read ## NESTE OPPGAVE before doing anything else.
• The boot script reads the last NESTE OPPGAVE automatically — keep it updated.

---

Hard Rules

1. Never change LOCK LIST values without explicit human instruction.
2. Always show diff before writing any file.
3. Never batch unrelated edits in a single EXECUTE step.
4. OPAX (opax.vauco.no) is management plane only — it never receives raw patient data.
5. Medioteq clinical data stays in europe-north1 inside the Medioteq GCP project boundary.
6. Deploy clinical-mcp and clinical-orchestrator to the Medioteq project (--project=<MEDIOTEQ_PROJECT_ID>), never the Vauco project.
7. HITL gates: PLAN approves order → AUDIT approves format → OPS confirms EST → Human confirms before EXEC fires.

---

Domain Convention

Subdomain	Type	Purpose
opax.vauco.no	Hub / MCP	OPAX-MCP operator hub — Vauco internal only
<client>-os.vauco.no	Prod OS	Client live production OS
<client>-oss.vauco.no	Stage OS	Client staging / demo OS

Auth: Google OAuth now. BankID on -os later (Medioteq first).

---

Standard Boot Prompt

Paste this at the start of every Gemini TUI session:

BOOT: Read docs/AGENT_RULEBOOK.md, docs/VAUCO_OS_ROADMAP.md, docs/OSVAUCO_OPAX_SESSION_LOG.md.
Print LOCKED DEFINITIONS. Print last NESTE OPPGAVE. Do not take any action until I give a PLAN prompt.