From 2fb223b99339671612d85dc4cce943ead74269fb Mon Sep 17 00:00:00 2001 From: Sam Rolfe Date: Thu, 15 Oct 2026 13:13:04 +1100 Subject: [PATCH] =?UTF-8?q?docs:=20add=20=C2=A72a=20Prerequisites=20to=20A?= =?UTF-8?q?GENTS.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Record the verified Phase 1-2 prerequisites from AUD-102: Go toolchain (missing), Docker + compose, port 8792, the Caddy route mechanism, pi-browser-harness, Compass URL and reachability, the credential/2FA state, and Apprise. Mark the unverified items. Co-Authored-By: Paperclip --- AGENTS.md | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 72cf774..aef8b3b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -35,6 +35,34 @@ Assistant calendar, and send the morning briefs. - The **React calendar** — that is a separate project. Do not build a calendar UI here. - The school's own systems. Read-only. +## 2a. Prerequisites (verify before Phase 1) + +Check these first. The values come from the prerequisite check on `.13` (AUD-102). +Items marked **not verified** need a decision or a test. + +| Need | Status / note | +|---|---| +| **Go toolchain** | **MISSING on `.13`** — `go` is not in the PATH, not in `nix-env`, and not in `/etc/nixos/configuration.nix`. Sam must add `go` to `environment.systemPackages` and run `nixos-rebuild switch`. Phase 1 can build in the `golang` Docker image instead. | +| **Docker + compose** | Present on `.13`. Docker client and server 29.6.2, Compose 5.3.1. Run as user `sam` (in the `docker` group, no sudo). | +| **Port 8792** | Free on `.13`. No listener and no container maps this port. Ports 8790 and 8791 are in use by other services. | +| **Caddy route on `.35`** | Caddy runs as the Docker container `caddy` (v2.8.4) on `sam-Ubuntu1` (`.35`). Routes are site blocks in `/Docker/Containers/caddy/Caddyfile`, bind-mounted to `/etc/caddy/Caddyfile`. Use `school.lab.audasmedia.com.au { import basic-auth; reverse_proxy 192.168.20.13:8792 }`. **No `school.*` block exists yet** — Phase 1 must add one. Reload with `docker exec caddy caddy reload --config /etc/caddy/Caddyfile`. DNS for the name resolves (wildcard) to `144.6.86.11`. | +| **pi-browser-harness** | Present on `.13` at `/home/sam/.agents/extensions/pi-browser-harness`, version 0.11.0. It is a **pi extension**, not a CLI. Load it as a package extension, then use the commands `/browser-setup` and `/browser-profile`. It exposes `browser_*` tools and drives a long-lived headless Chrome over CDP (`--user-data-dir=/home/sam/.chrome-pi`, debug port 9222). Session reuse works. **The extension is not enabled in this repo's `.pi/settings.json`** — Phase 2 must enable it before the login proof. | +| **Compass URL + reachability** | **`https://nhs-vic.compass.education/login.aspx`** (Northcote High School). DNS goes to Cloudflare. TCP and TLS reach the edge, but the page returns `HTTP/2 403` with `cf-mitigated: challenge` (Cloudflare bot challenge). A real browser session is necessary. This is the Phase 2 risk. | +| **Compass credentials + 2FA** | **NOT AVAILABLE** — no Compass, school, or child key exists in `~/.config/environment.d/10-secrets.conf` or its backups, and no school-named secret is in the instance config. Sam must supply the account name, the username, and the password as a **Paperclip secret** (or in `10-secrets.conf`). Never write them in this file. **2FA is not verified** — no login was attempted. Confirm whether Compass enforces 2FA or new-device email verification, and define the manual step. | +| **Apprise** | Running on `.35:8210` (container `apprise`, host 8210 to container 8000). `GET /` and `GET /status` return 200. The Caddy route `apprise.lab.audasmedia.com.au` has basic auth. | + +**Gating read-out** + +- **Phase 1** is unblocked except for Go. Build in the `golang` Docker image, or ask Sam to install Go on the host. +- **Phase 2** is blocked until Sam supplies a Compass credential and confirms the 2FA step. Phase 2 must also enable the `pi-browser-harness` extension in this repo. +- The Cloudflare challenge is the main technical risk. Prove it first. + +**Not verified** + +- Whether Compass enforces 2FA. +- The exact per-child account model. +- Whether the headless Chrome profile clears the Cloudflare challenge (no login was attempted). + ## 3. Users and roles | User | Can do |