3a3503aa2e
AGENT.md: REQUIRED T2 frontmatter per §2.1. manifest.yaml: REQUIRED governance: block per §2.2. Register new toolkit skills. install.sh: chmod +x. skills/cto-python-toolkit/SKILL.md (v0.1): closes Python stack gap inline. References real workspace projects as exemplars: scripts/sot-precommit.py (single-file CLI), bte-mcp/server.py + bte_core.py (FastMCP server), svrnty-hermes-webui-plugin (PEP 621 + pytest.ini_options), curator/sweep.py (mode flags + dry-run + stdlib-heavy). Sandcastle prompt template + post- run quality-gate routing via PG-svrnty.lib-quality-gates. skills/cto-angular-toolkit/SKILL.md (v0.1): closes Angular stack gap inline. Anchored to adwright/adwright-console as canonical Plan B Angular reference (Angular 21.2 + signals + standalone components + inject() + gRPC-web via @protobuf-ts/grpcweb-transport + L6-svrnty.lib-cqrs-datasource). Sandcastle prompt template + DESIGN.md compliance check for UI work. CONTRACT.md §6: Python+Angular promoted from ⚪ generic → 🟡 skill-only (no more "gap" marker). Documents path to ✅ deep when cortex/ libs extract. skills/cto-agent/SKILL.md: routing table updated — Python/Angular rows now route to the toolkit skills instead of falling through to generic. CLAUDE.md: site-map footer. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
5.0 KiB
5.0 KiB
cto (repo) · cto-planb (Hermes profile)
Hermes classification: profile distribution (C-suite, instance #3, Plan B-scoped)
Inherits Karpathy 4 rules from ~/.claude/CLAUDE.md — read them before coding.
What this is
CTO agent for Plan B — thin orchestrator. Decomposes JP/CEO tech goals, invokes sandcastle to run code-modifying agents in isolated sandboxes, judges resulting diffs, opens PRs, requests JP approval for any deploy. Never deploys directly. Instance #3 of the C-suite profile distribution family.
Naming: the repo dir is cto/ (generic). The deployed Hermes profile is cto-planb (Plan B-scoped, driven by distribution.yaml → name). Future orgs would clone this repo and set name: cto-<org> in their distribution.yaml.
Status: v0.1 — scaffold only. Orchestrator skill stub exists but is not executable. v1.0 milestone = wire sandcastle.run() into skills/cto-agent/.
Hard rules
- CTO NEVER edits host repo code directly — always via sandcastle in an isolated sandbox
- CTO NEVER merges to main without JP
approve(definition of "deploy" per CONTRACT.md §3) - CTO NEVER touches infrastructure (DNS, certs, secrets, cron, cloud) — escalate always
- CTO NEVER edits
../sandcastle/— read-only workspace hard rule (mattpocock/sandcastle pinned v0.5.11) cto.dbnever committed — created byinstall.sh, managed at runtime- The CTO's "skill" is judgment + sandcastle invocation, not execution — do NOT add large skill libraries here (CEO precedent)
- Structural changes follow
../sot/03-PROTOCOLS/PROFILE-DISTRIBUTION-PROTOCOL.md
Structure
cto/
├── manifest.yaml # profile: cto-planb, kind: profile-distribution
├── distribution.yaml # Hermes native install contract
├── AGENT.md # CTO identity (role, mission, boundaries)
├── CONTRACT.md # CTO behavior contract — tier T1 (this file wins)
├── install.sh # idempotent installer → ~/.hermes/cto-planb symlink (skeleton)
├── credbridge.sh # secrets bridge (skeleton — github-pat only in v1)
├── schema.sql # cto.db schema (work_queue, agent_runtime, invocations)
├── skills/
│ └── cto-agent/ # orchestrator skill (SKILL.md = stub until v1.0)
└── cron/ # empty for v1 (CEO precedent — on-demand only)
Gotchas
- Sandcastle is at
../sandcastle/(sibling). Read itsCONTEXT.mdbefore writing any sandcastle.run() invocation — the terminology (sandbox provider, branch strategy, agent provider) matters cto/does NOT inheritcmo/'s 40-skill complexity — keep it thin likeceo/(1 skill: cto-agent)- v0.1 has NO executable orchestrator — running
hermes -p cto-planb skills listwill show cto-agent but invocations will no-op gracefully - credbridge in v1 resolves only
github-pat; other creds (deploy, cloud) deferred to v2 per CONTRACT.md §4 - When v1.0 work starts: write
skills/cto-agent/SKILL.mdbody (currently stub), test sandcastle.run() against a throwaway repo, then wire kanban dispatch
When to update this CLAUDE.md vs other docs
- This file: gotchas, hard rules, structure overview — what a Claude session needs to navigate the repo
AGENT.md: identity (role, mission, principal) — what CTO ISCONTRACT.md: behavior contract — what CTO DOES and does NOT do, decisions, anti-patterns (tier T1)manifest.yaml: machine-readable identity + install hooksdistribution.yaml: Hermes native install contract (separate from manifest by design)README.md: human-facing intro + install instructions
Site map — where to find anything in cortex-os
Read these in order to ground any session:
| What | Where |
|---|---|
| Karpathy 4 rules | ~/.claude/CLAUDE.md (auto-inherited every session) |
| Workspace contract + repo map | ~/workspaces/hermes/CLAUDE.md |
| SOT library orientation | ~/workspaces/hermes/sot/README.md |
| Curator-generated SOT index | ~/workspaces/hermes/sot/INDEX.md |
| Profile catalog (5 profiles + tool disclosure + governance) | ~/workspaces/hermes/sot/06-REGISTRY/PROFILE-CATALOG.md |
| Profile distribution protocol (T1) | ~/workspaces/hermes/sot/03-PROTOCOLS/PROFILE-DISTRIBUTION-PROTOCOL.md |
| Frontmatter spec (T1) | ~/workspaces/hermes/sot/04-STANDARDS/FRONTMATTER-SPEC.md |
| SOT enforcement (pre-commit + curator + pre-push) | ~/workspaces/hermes/sot/04-STANDARDS/SOT-ENFORCEMENT.md |
| Living graph artifact | ~/workspaces/hermes/graph/umbrella.json (curator-maintained) |
| Living graph UI panel (planned) | /umbrella route in hermes-webui per sot/03-PROTOCOLS/CORTEX-OS-UMBRELLA-VIZ-PRD.md |
| This repo's CONTRACT.md | ./CONTRACT.md if present (T1 — wins over everything in this repo) |
If you're new to a session: read the workspace contract first, then this file, then the SOT orientation. Don't guess about cortex-os structure — anchor to these.