# Contract Registry — OpenProse Enforcement Index
#
# Maps every prose contract to its enforcement category, trigger mechanism,
# dependencies, postconditions, and escalation rules.
#
# Contracts are indexed by:
#   1. Enforcement category (compliance, monitoring, remediation, ...)
#   2. Domain (hermes-agent, zulip, infrastructure, gpu, proxmox, litellm, ...)
#   3. Owner (who runs it: abiba, mumuni, kwame, or none)
#   4. Trigger type (scheduled, event_driven, passive, on_demand)
#
# Use the top-level `index` map for quick lookups by any dimension:
#   - index.by_category: contract name → category
#   - index.by_domain: domain → [contract names]
#   - index.by_owner: owner → [contract names]
#   - index.by_trigger: trigger type → [contract names]
#   - index.by_sensitivity: sensitivity → [contract names]
#
# Schema reference: ~/.hermes/contract-registry.md
#
# Last updated: 2026-07-13

registry_version: "0.1.0"
last_updated: "2026-07-13T00:00:00Z"
updated_by: mumuni

categories:
  - compliance
  - monitoring
  - remediation
  - build_deploy
  - maintenance
  - reference

domains:
  - hermes-agent
  - zulip
  - infrastructure
  - gpu
  - proxmox
  - litellm
  - memory
  - relay
  - shared-patterns

owners:
  - abiba
  - mumuni
  - kwame

trigger_types:
  - scheduled
  - event_driven
  - passive
  - on_demand
  - none

sensitivity_levels:
  - critical
  - high
  - normal
  - retired

sensitivity_levels:
  - critical
  - high
  - normal
  - retired

# ─── Multi-Dimensional Index ──────────────────────────────────
# Quick lookups by any dimension. Generated from the contracts list.

index:

  # Contract name → category mapping
  by_category:
    compliance:
      - hermes-key-enforcement
      - hermes-config-template
      - hermes-agent-baseline
    monitoring:
      - proxmox-monitor
      - gpu-monitor
      - infrastructure-monitoring
      - zulip-health
      - litellm-health
    remediation:
      - litellm-self-heal
      - pm2-self-heal
      - disk-gc-threat-response
      - hermes-zulip-restore
    build_deploy:
      - hermes-zulip-plugin
      - build-zulip-plugin
      - stirling-pdf-agent-access
    maintenance:
      - memory-audit-maintenance
      - gpu-fleet
      - infrastructure-update
    reference:
      - infrastructure-control
      - ra-h-os-custodianship-contract
      - mumuni-delegation
      - zulip-approval-fix
      - zulip-oidc-redirect-fix
      - hello-world
      - zulip-adapter-lessons
      - pi-approval-architecture
    retired:
      - zulip-mention-reliability
      - zulip-self-heal

  # Domain → contract names (natural grouping by subsystem)
  by_domain:
    hermes-agent:
      - hermes-key-enforcement
      - hermes-config-template
      - hermes-agent-baseline
      - mumuni-delegation
    zulip:
      - zulip-health
      - hermes-zulip-restore
      - hermes-zulip-plugin
      - build-zulip-plugin
      - zulip-approval-fix
      - zulip-oidc-redirect-fix
      - zulip-adapter-lessons
      - zulip-mention-reliability
      - zulip-self-heal
    infrastructure:
      - infrastructure-control
      - infrastructure-monitoring
      - infrastructure-update
      - pm2-self-heal
      - disk-gc-threat-response
    gpu:
      - gpu-monitor
      - gpu-fleet
    proxmox:
      - proxmox-monitor
    litellm:
      - litellm-health
      - litellm-self-heal
    memory:
      - memory-audit-maintenance
    shared-patterns:
      - ra-h-os-custodianship-contract
      - pi-approval-architecture
      - stirling-pdf-agent-access
      - hello-world
    retired:
      - zulip-mention-reliability
      - zulip-self-heal
      - zulip-adapter-lessons
      - pi-approval-architecture

  # Owner → contract names (who runs it)
  by_owner:
    abiba:
      - hermes-key-enforcement
      - hermes-config-template
      - hermes-agent-baseline
      - proxmox-monitor
      - gpu-monitor
      - infrastructure-monitoring
      - zulip-health
      - litellm-health
      - litellm-self-heal
      - pm2-self-heal
      - disk-gc-threat-response
      - hermes-zulip-restore
      - hermes-zulip-plugin
      - build-zulip-plugin
      - stirling-pdf-agent-access
      - gpu-fleet
      - infrastructure-update
      - infrastructure-control
      - zulip-adapter-lessons
      - pi-approval-architecture
      - zulip-approval-fix
      - zulip-oidc-redirect-fix
      - zulip-mention-reliability
      - zulip-self-heal
    mumuni:
      - memory-audit-maintenance
      - ra-h-os-custodianship-contract
      - mumuni-delegation
    kwame:
      - hello-world

  # Trigger type → contract names
  by_trigger:
    scheduled:
      - hermes-key-enforcement
      - hermes-config-template
      - hermes-agent-baseline
      - proxmox-monitor
      - gpu-monitor
      - infrastructure-monitoring
      - zulip-health
      - litellm-health
      - memory-audit-maintenance
      - infrastructure-update
    event_driven:
      - litellm-self-heal
      - pm2-self-heal
      - disk-gc-threat-response
      - hermes-zulip-restore
      - gpu-fleet
      - zulip-oidc-redirect-fix
    passive:
      - infrastructure-control
      - ra-h-os-custodianship-contract
      - mumuni-delegation
      - zulip-adapter-lessons
      - pi-approval-architecture
      - zulip-approval-fix
    on_demand:
      - hermes-zulip-plugin
      - build-zulip-plugin
      - stirling-pdf-agent-access
      - hello-world
    none:
      - zulip-mention-reliability
      - zulip-self-heal

  # Sensitivity → contract names
  by_sensitivity:
    critical:
      - hermes-key-enforcement
      - proxmox-monitor
      - gpu-monitor
      - litellm-health
      - litellm-self-heal
      - disk-gc-threat-response
      - gpu-fleet
      - infrastructure-control
    high:
      - hermes-config-template
      - infrastructure-monitoring
      - zulip-health
      - pm2-self-heal
      - hermes-zulip-restore
      - hermes-zulip-plugin
      - build-zulip-plugin
      - infrastructure-update
      - ra-h-os-custodianship-contract
      - mumuni-delegation
    normal:
      - hermes-agent-baseline
      - stirling-pdf-agent-access
      - memory-audit-maintenance
      - zulip-approval-fix
      - zulip-oidc-redirect-fix
      - hello-world
    retired:
      - zulip-adapter-lessons
      - pi-approval-architecture
      - zulip-mention-reliability
      - zulip-self-heal

contracts:

  # ─── COMPLIANCE ───────────────────────────────────────────────

  - name: hermes-key-enforcement
    file: hermes-key-enforcement.prose.md
    kind: enforcement
    category: compliance
    sensitivity: critical
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: scheduled
      cadence: "0 6 * * *"
      description: "Daily compliance scan at 6am ET"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 300
      requires: []
      protocol:
        - "Load contract from prose-contracts/main"
        - "Verify prerequisites: config.yaml readable, harness/litellm sections present"
        - "Execute enforcement: grep config for plaintext keys"
        - "On failure: stop, don't hallucinate forward"
        - "Log actions to ~/.hermes/runs/hermes-key-enforcement/"
    verification:
      postconditions:
        - check: "no plaintext API keys in config"
          verify: "grep -rc 'api_key: sk-' /root/.hermes/config.yaml"
          expect: "0 matches"
        - check: "api_key_env used for harness/litellm providers"
          verify: "grep -c 'api_key_env.*LITELLM_API_KEY' /root/.hermes/config.yaml"
          expect: "count > 0"
      artifact: "before/after verification report"
      verify_commands:
        - "grep -rc 'api_key: sk-' /root/.hermes/config.yaml"
        - "grep -c 'api_key_env.*LITELLM_API_KEY' /root/.hermes/config.yaml"
    receipt:
      format: json
      storage: "~/.hermes/runs/hermes-key-enforcement/"
      graph_node: true
      schema:
        contract: string
        run_id: string
        timestamp: ISO 8601
        agent: string
        status: pass|fail|escalated
        actions_taken: array
        postconditions: array
        drift_alerts: array
        evidence_path: string
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba"]
      critical:
        action: "relay_alert + pause"
        notify: ["abiba", "mumuni"]
      fatal:
        action: "relay_alert + pause + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: hermes-config-template
    file: hermes-config-template.prose.md
    kind: template
    category: compliance
    sensitivity: high
    status: active
    owner: abiba
    version: 2.1.0
    trigger:
      type: scheduled
      cadence: "0 4 * * 1"
      description: "Weekly config drift check Monday at 4am ET"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 300
      requires: []
    verification:
      postconditions:
        - check: "all agent configs match template version"
          verify: "diff <(grep template_version config.yaml) <(grep template_version /root/prose-contracts/hermes-config-template.prose.md)"
          expect: "no diff"
      artifact: "config drift report"
    receipt:
      format: json
      storage: "~/.hermes/runs/hermes-config-template/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba"]
      critical:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      fatal:
        action: "relay_alert + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: hermes-agent-baseline
    file: hermes-agent-baseline.prose.md
    kind: template
    category: compliance
    sensitivity: normal
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: scheduled
      cadence: "0 5 * * 1"
      description: "Weekly baseline verification Monday at 5am ET"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 300
      requires: []
    verification:
      postconditions: []
      artifact: "baseline drift report"
    receipt:
      format: json
      storage: "~/.hermes/runs/hermes-agent-baseline/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba"]
      critical:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      fatal:
        action: "relay_alert + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  # ─── MONITORING ──────────────────────────────────────────────

  - name: proxmox-monitor
    file: proxmox-monitor.prose.md
    kind: responsibility
    category: monitoring
    sensitivity: critical
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: scheduled
      cadence: "*/15 * * * *"
      description: "Every 15 minutes"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 120
      requires: []
      protocol:
        - "Load contract from prose-contracts/main"
        - "Verify connectivity to all Proxmox nodes"
        - "Execute monitoring checks per contract"
        - "Log intermediate state"
        - "On failure: stop, don't hallucinate"
    verification:
      postconditions:
        - check: "all Proxmox nodes reachable"
          verify: "curl -sf http://<pve-api>/status | jq '.status'"
          expect: "healthy"
        - check: "no VMs in crashed state"
          verify: "pvesh get /nodes -output-format=json | jq '.[] | select(.status==\"Crashed\")'"
          expect: "empty"
        - check: "backups running on schedule"
          verify: "pbs-info --check"
          expect: "last_backup < 24h ago"
      artifact: "cluster health snapshot"
      verify_commands:
        - "curl -sf http://<pve-api>/status | jq '.status'"
        - "pvesh get /nodes -output-format=json"
    receipt:
      format: json
      storage: "~/.hermes/runs/proxmox-monitor/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      critical:
        action: "relay_alert + trigger_remediation"
        notify: ["abiba", "mumuni"]
        triggers: ["disk-gc-threat-response"]
      fatal:
        action: "relay_alert + pause + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: gpu-monitor
    file: gpu-monitor.prose.md
    kind: responsibility
    category: monitoring
    sensitivity: critical
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: scheduled
      cadence: "*/15 * * * *"
      description: "Every 15 minutes — polls all GPU subsystems"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 120
      requires: []
    verification:
      postconditions:
        - check: "GPU metrics accessible"
          verify: "curl -sf http://localhost:9100/gpu-data"
          expect: "200 OK, populated data"
        - check: "dashboard serving"
          verify: "curl -sf http://localhost:9100/gpu-fleet.html"
          expect: "200 OK, HTML returned"
        - check: "health endpoint responsive"
          verify: "curl -sf http://localhost:9100/health"
          expect: "200 OK"
      artifact: "GPU fleet snapshot"
    receipt:
      format: json
      storage: "~/.hermes/runs/gpu-monitor/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      critical:
        action: "relay_alert + trigger_remediation"
        notify: ["abiba", "mumuni"]
        triggers: ["gpu-fleet"]
      fatal:
        action: "relay_alert + pause + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: infrastructure-monitoring
    file: infrastructure-monitoring.prose.md
    kind: function
    category: monitoring
    sensitivity: high
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: scheduled
      cadence: "*/30 * * * *"
      description: "Every 30 minutes"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 180
      requires: []
    verification:
      postconditions:
        - check: "all services reachable"
          verify: "curl -sf http://<service-endpoints>"
          expect: "200 OK for all"
      artifact: "infrastructure health report"
    receipt:
      format: json
      storage: "~/.hermes/runs/infrastructure-monitoring/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      critical:
        action: "relay_alert + trigger_remediation"
        notify: ["abiba", "mumuni"]
        triggers: ["litellm-health"]
      fatal:
        action: "relay_alert + pause + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: zulip-health
    file: zulip-health.prose.md
    kind: responsibility
    category: monitoring
    sensitivity: high
    status: active
    owner: abiba
    version: 3.0.0
    trigger:
      type: scheduled
      cadence: "*/15 * * * *"
      description: "Every 15 minutes — monitors all Zulip-connected agents"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 120
      requires:
        - "Zulip API key for abiba-bot@chat.sysloggh.net"
        - "SSH access to all Hermes agents"
    verification:
      postconditions:
        - check: "bot registration active"
          verify: "curl -sf https://chat.sysloggh.net/api/v1/me | jq '.user_id'"
          expect: "bot_id present"
        - check: "DM delivery working"
          verify: "send test DM to each agent"
          expect: "message delivered within 5s"
      artifact: "Zulip mesh health report"
    receipt:
      format: json
      storage: "~/.hermes/runs/zulip-health/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      critical:
        action: "relay_alert + trigger_remediation"
        notify: ["abiba", "mumuni"]
        triggers: ["hermes-zulip-restore"]
      fatal:
        action: "relay_alert + pause + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: litellm-health
    file: litellm-health.prose.md
    kind: function
    category: monitoring
    sensitivity: critical
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: scheduled
      cadence: "*/10 * * * *"
      description: "Every 10 minutes — LiteLLM proxy health"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 60
      requires: []
    verification:
      postconditions:
        - check: "LiteLLM proxy reachable"
          verify: "curl -sf http://192.168.68.116/litellm/v1/models"
          expect: "200 OK, models returned"
        - check: "router deprecated, nginx routes work"
          verify: "curl -sf https://litellm.sysloggh.net/v1/models"
          expect: "200 OK (via nginx)"
      artifact: "LiteLLM health snapshot"
    receipt:
      format: json
      storage: "~/.hermes/runs/litellm-health/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      critical:
        action: "relay_alert + trigger_remediation"
        notify: ["abiba", "mumuni"]
        triggers: ["litellm-self-heal"]
      fatal:
        action: "relay_alert + pause + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  # ─── REMEDIATION ────────────────────────────────────────────

  - name: litellm-self-heal
    file: litellm-self-heal.prose.md
    kind: responsibility
    category: remediation
    sensitivity: critical
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: event_driven
      description: "Triggered by relay message from litellm-health or infrastructure-monitoring"
      relay_message_type: "remediation:litellm-self-heal"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 600
      requires:
        - "Relay message with failure details from monitoring contract"
    verification:
      postconditions:
        - check: "LiteLLM proxy responding"
          verify: "curl -sf http://192.168.68.116/litellm/v1/models"
          expect: "200 OK"
      artifact: "self-heal run report"
    receipt:
      format: json
      storage: "~/.hermes/runs/litellm-self-heal/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      critical:
        action: "relay_alert + pause"
        notify: ["abiba", "mumuni"]
      fatal:
        action: "relay_alert + pause + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: pm2-self-heal
    file: pm2-self-heal.prose.md
    kind: responsibility
    category: remediation
    sensitivity: high
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: event_driven
      description: "Triggered by relay message when PM2 process crashes"
      relay_message_type: "remediation:pm2-self-heal"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 300
      requires:
        - "Relay message with process name and failure details"
    verification:
      postconditions:
        - check: "PM2 process running"
          verify: "pm2 list | grep <process_name>"
          expect: "online"
      artifact: "self-heal run report"
    receipt:
      format: json
      storage: "~/.hermes/runs/pm2-self-heal/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba"]
      critical:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      fatal:
        action: "relay_alert + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: disk-gc-threat-response
    file: disk-gc-threat-response.prose.md
    kind: responsibility
    category: remediation
    sensitivity: critical
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: event_driven
      description: "Triggered by relay message from proxmox-monitor when disk >80%"
      relay_message_type: "remediation:disk-gc-threat-response"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 900
      requires:
        - "Relay message with target CT/host and current disk usage"
      protocol:
        - "Load contract from prose-contracts/main"
        - "Verify target node reachable"
        - "Run garbage collection per contract SOP"
        - "Verify disk usage reduced"
    verification:
      postconditions:
        - check: "disk usage below 80%"
          verify: "df -h <target>"
          expect: "<80%"
        - check: "no critical services stopped"
          verify: "ps aux | grep <critical_services>"
          expect: "all running"
      artifact: "GC run report with reclaimed space"
    receipt:
      format: json
      storage: "~/.hermes/runs/disk-gc-threat-response/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      critical:
        action: "relay_alert + pause"
        notify: ["abiba", "mumuni"]
      fatal:
        action: "relay_alert + pause + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: hermes-zulip-restore
    file: hermes-zulip-restore.prose.md
    kind: function
    category: remediation
    sensitivity: high
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: event_driven
      description: "Triggered by relay message from zulip-health when bot registration fails"
      relay_message_type: "remediation:hermes-zulip-restore"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 600
      requires:
        - "Relay message with failure details"
    verification:
      postconditions:
        - check: "Zulip bot registration active"
          verify: "curl -sf https://chat.sysloggh.net/api/v1/me | jq '.user_id'"
          expect: "bot_id present"
        - check: "DM delivery working"
          verify: "send test DM"
          expect: "message delivered"
      artifact: "restore run report"
    receipt:
      format: json
      storage: "~/.hermes/runs/hermes-zulip-restore/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      critical:
        action: "relay_alert + pause"
        notify: ["abiba", "mumuni"]
      fatal:
        action: "relay_alert + pause + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  # ─── BUILD/DEPLOY ───────────────────────────────────────────

  - name: hermes-zulip-plugin
    file: hermes-zulip-plugin.prose.md
    kind: function
    category: build_deploy
    sensitivity: high
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: on_demand
      description: "Manual or change request to update Zulip plugin"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 1800
      requires: []
    verification:
      postconditions:
        - check: "3 adapter files present"
          verify: "ls -la /usr/local/lib/hermes-agent/plugins/platforms/zulip/"
          expect: "3 files"
        - check: "gateway connected"
          verify: "ps aux | grep hermes"
          expect: "zulip connected"
      artifact: "deploy verification report"
    receipt:
      format: json
      storage: "~/.hermes/runs/hermes-zulip-plugin/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba"]
      critical:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      fatal:
        action: "relay_alert + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 1
      window: 7200
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: build-zulip-plugin
    file: build-zulip-plugin.prose.md
    kind: responsibility
    category: build_deploy
    sensitivity: high
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: on_demand
      description: "Generate or improve Zulip plugin via iterative refinement"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 3600
      requires: []
    verification:
      postconditions:
        - check: "plugin builds without errors"
          verify: "npm install && npm run build"
          expect: "0 errors"
        - check: "connectivity tests pass"
          verify: "run plugin selftest"
          expect: "all checks green"
      artifact: "plugin version artifact"
    receipt:
      format: json
      storage: "~/.hermes/runs/build-zulip-plugin/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba"]
      critical:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      fatal:
        action: "relay_alert + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 1
      window: 7200
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: stirling-pdf-agent-access
    file: stirling-pdf-agent-access.prose.md
    kind: function
    category: build_deploy
    sensitivity: normal
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: on_demand
      description: "Grant agent access to Stirling PDF"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 300
      requires: []
    verification:
      postconditions:
        - check: "agent can access Stirling PDF"
          verify: "curl -sf https://stirling.sysloggh.net"
          expect: "200 OK"
      artifact: "access verification report"
    receipt:
      format: json
      storage: "~/.hermes/runs/stirling-pdf-agent-access/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba"]
      critical:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      fatal:
        action: "relay_alert + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 1
      window: 7200
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  # ─── MAINTENANCE ────────────────────────────────────────────

  - name: memory-audit-maintenance
    file: memory-audit-maintenance.prose.md
    kind: responsibility
    category: maintenance
    sensitivity: normal
    status: active
    owner: mumuni
    version: 1.0.0
    trigger:
      type: scheduled
      cadence: "0 3 * * *"
      description: "Daily at 3am ET"
      cron_job_id: null
    execution:
      agent: mumuni
      timeout: 600
      requires: []
      protocol:
        - "Load contract from prose-contracts/main"
        - "Verify prerequisites: memory files accessible"
        - "Execute memory audit per contract SOP"
        - "Log actions to ~/.hermes/runs/memory-audit-maintenance/"
    verification:
      postconditions:
        - check: "memory files below 80% capacity"
          verify: "wc -l ~/.hermes/memories/*.md"
          expect: "total lines < threshold"
        - check: "no stale entries"
          verify: "grep -r 'STALE' ~/.hermes/memories/"
          expect: "0 matches"
      artifact: "memory audit report"
    receipt:
      format: json
      storage: "~/.hermes/runs/memory-audit-maintenance/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["mumuni"]
      critical:
        action: "relay_alert"
        notify: ["mumuni", "abiba"]
      fatal:
        action: "relay_alert + human_required"
        notify: ["mumuni", "abiba", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: gpu-fleet
    file: gpu-fleet.prose.md
    kind: responsibility
    category: maintenance
    sensitivity: critical
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: event_driven
      description: "Triggered on model add/remove, GPU health degradation, agent key rotation"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 1800
      requires: []
    verification:
      postconditions:
        - check: "all GPUs reported to LiteLLM"
          verify: "curl -sf http://192.168.68.116/litellm/v1/models | jq '.data | length'"
          expect: "count matches expected"
        - check: "router deprecated"
          verify: "check nginx routes"
          expect: "no /v1/ prefix routes"
      artifact: "GPU fleet status report"
    receipt:
      format: json
      storage: "~/.hermes/runs/gpu-fleet/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      critical:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      fatal:
        action: "relay_alert + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: infrastructure-update
    file: infrastructure-update.prose.md
    kind: responsibility
    category: maintenance
    sensitivity: high
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: scheduled
      cadence: "0 2 * * 0"
      description: "Weekly system updates Sunday at 2am ET"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 3600
      requires: []
    verification:
      postconditions:
        - check: "all services running after update"
          verify: "systemctl list-units --state=running"
          expect: "all critical services"
      artifact: "update report with changelog"
    receipt:
      format: json
      storage: "~/.hermes/runs/infrastructure-update/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba"]
      critical:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      fatal:
        action: "relay_alert + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 1
      window: 7200
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  # ─── REFERENCE / PATTERN ────────────────────────────────────

  - name: infrastructure-control
    file: infrastructure-control.prose.md
    kind: pattern
    category: reference
    sensitivity: critical
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: passive
      description: "Loaded on-demand by executing agents as source of truth"
      cron_job_id: null
    execution:
      agent: none
      timeout: 0
      requires: []
    verification:
      postconditions: []
      artifact: none
    receipt:
      format: none
      storage: none
      graph_node: false
    escalation:
      info:
        action: "none"
        notify: []
      warning:
        action: "none"
        notify: []
      critical:
        action: "none"
        notify: []
      fatal:
        action: "none"
        notify: []
    circuit_breaker:
      max_retries: 0
      window: 0
      trip_action: none
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: ra-h-os-custodianship-contract
    file: ra-h-os-custodianship-contract.prose.md
    kind: pattern
    category: reference
    sensitivity: high
    status: active
    owner: mumuni
    version: 1.0.0
    trigger:
      type: passive
      description: "Loaded on-demand by agents needing RA-H OS guidance"
      cron_job_id: null
    execution:
      agent: none
      timeout: 0
      requires: []
    verification:
      postconditions: []
      artifact: none
    receipt:
      format: none
      storage: none
      graph_node: false
    escalation:
      info:
        action: "none"
        notify: []
      warning:
        action: "none"
        notify: []
      critical:
        action: "none"
        notify: []
      fatal:
        action: "none"
        notify: []
    circuit_breaker:
      max_retries: 0
      window: 0
      trip_action: none
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: mumuni-delegation
    file: mumuni-delegation-prose-contract.prose.md
    kind: pattern
    category: reference
    sensitivity: high
    status: active
    owner: mumuni
    version: 1.0.0
    trigger:
      type: passive
      description: "Loaded by Mumuni when delegating tasks"
      cron_job_id: null
    execution:
      agent: none
      timeout: 0
      requires: []
    verification:
      postconditions: []
      artifact: none
    receipt:
      format: none
      storage: none
      graph_node: false
    escalation:
      info:
        action: "none"
        notify: []
      warning:
        action: "none"
        notify: []
      critical:
        action: "none"
        notify: []
      fatal:
        action: "none"
        notify: []
    circuit_breaker:
      max_retries: 0
      window: 0
      trip_action: none
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: zulip-adapter-lessons
    file: zulip-adapter-lessons.prose.md
    kind: pattern
    category: reference
    sensitivity: retired
    status: historical
    owner: abiba
    version: 1.0.0
    trigger:
      type: passive
      description: "Historical reference — pi Zulip extension retired 2026-07-04"
      cron_job_id: null
    execution:
      agent: none
      timeout: 0
      requires: []
    verification:
      postconditions: []
      artifact: none
    receipt:
      format: none
      storage: none
      graph_node: false
    escalation:
      info:
        action: "none"
        notify: []
      warning:
        action: "none"
        notify: []
      critical:
        action: "none"
        notify: []
      fatal:
        action: "none"
        notify: []
    circuit_breaker:
      max_retries: 0
      window: 0
      trip_action: none
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: pi-approval-architecture
    file: pi-approval-architecture.prose.md
    kind: architecture
    category: reference
    sensitivity: retired
    status: historical
    owner: abiba
    version: 1.0.0
    trigger:
      type: passive
      description: "Historical reference — pi Zulip extension retired"
      cron_job_id: null
    execution:
      agent: none
      timeout: 0
      requires: []
    verification:
      postconditions: []
      artifact: none
    receipt:
      format: none
      storage: none
      graph_node: false
    escalation:
      info:
        action: "none"
        notify: []
      warning:
        action: "none"
        notify: []
      critical:
        action: "none"
        notify: []
      fatal:
        action: "none"
        notify: []
    circuit_breaker:
      max_retries: 0
      window: 0
      trip_action: none
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: zulip-approval-fix
    file: zulip-approval-fix.prose.md
    kind: responsibility
    category: reference
    sensitivity: normal
    status: active
    owner: abiba
    version: 2.0.0
    trigger:
      type: passive
      description: "Loaded on-demand when /approve or /deny commands fail"
      cron_job_id: null
    execution:
      agent: none
      timeout: 0
      requires: []
    verification:
      postconditions: []
      artifact: none
    receipt:
      format: none
      storage: none
      graph_node: false
    escalation:
      info:
        action: "none"
        notify: []
      warning:
        action: "none"
        notify: []
      critical:
        action: "none"
        notify: []
      fatal:
        action: "none"
        notify: []
    circuit_breaker:
      max_retries: 0
      window: 0
      trip_action: none
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: zulip-oidc-redirect-fix
    file: zulip-oidc-redirect-fix.prose.md
    kind: responsibility
    category: reference
    sensitivity: normal
    status: active
    owner: abiba
    version: 1.0.0
    trigger:
      type: event_driven
      description: "Triggered when Zulip OIDC login returns redirect URI error"
      cron_job_id: null
    execution:
      agent: abiba
      timeout: 300
      requires: []
    verification:
      postconditions:
        - check: "OIDC redirect uses public domain"
          verify: "grep redirect_uri /opt/zulip/zulip_env.py"
          expect: "chat.sysloggh.net"
      artifact: "fix verification report"
    receipt:
      format: json
      storage: "~/.hermes/runs/zulip-oidc-redirect-fix/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: ["abiba"]
      critical:
        action: "relay_alert"
        notify: ["abiba", "mumuni"]
      fatal:
        action: "relay_alert + human_required"
        notify: ["abiba", "mumuni", "kwame"]
    circuit_breaker:
      max_retries: 1
      window: 7200
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  # ─── RETIRED ────────────────────────────────────────────────

  - name: zulip-mention-reliability
    file: zulip-mention-reliability.prose.md
    kind: responsibility
    category: retired
    sensitivity: retired
    status: retired
    owner: abiba
    version: 1.0.0
    trigger:
      type: none
      description: "Retired 2026-07-04 — pi Zulip extension decommissioned"
      cron_job_id: null
    execution:
      agent: none
      timeout: 0
      requires: []
    verification:
      postconditions: []
      artifact: none
    receipt:
      format: none
      storage: none
      graph_node: false
    escalation:
      info:
        action: "none"
        notify: []
      warning:
        action: "none"
        notify: []
      critical:
        action: "none"
        notify: []
      fatal:
        action: "none"
        notify: []
    circuit_breaker:
      max_retries: 0
      window: 0
      trip_action: none
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  - name: zulip-self-heal
    file: zulip-self-heal.prose.md
    kind: responsibility
    category: retired
    sensitivity: retired
    status: retired
    owner: abiba
    version: 1.0.0
    trigger:
      type: none
      description: "Retired 2026-07-04 — pi Zulip extension decommissioned"
      cron_job_id: null
    execution:
      agent: none
      timeout: 0
      requires: []
    verification:
      postconditions: []
      artifact: none
    receipt:
      format: none
      storage: none
      graph_node: false
    escalation:
      info:
        action: "none"
        notify: []
      warning:
        action: "none"
        notify: []
      critical:
        action: "none"
        notify: []
      fatal:
        action: "none"
        notify: []
    circuit_breaker:
      max_retries: 0
      window: 0
      trip_action: none
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []

  # ─── HELPER / TEST ──────────────────────────────────────────

  - name: hello-world
    file: hello-world.prose.md
    kind: function
    category: reference
    sensitivity: normal
    status: active
    owner: kwame
    version: 1.0.0
    trigger:
      type: on_demand
      description: "Test contract for OpenProse on pi"
      cron_job_id: null
    execution:
      agent: kwame
      timeout: 60
      requires: []
    verification:
      postconditions:
        - check: "greeting returned"
          verify: "contract output contains 'Hello'"
          expect: "pass"
      artifact: "greeting output"
    receipt:
      format: json
      storage: "~/.hermes/runs/hello-world/"
      graph_node: true
    escalation:
      info:
        action: "log_to_receipt"
        notify: []
      warning:
        action: "relay_alert"
        notify: []
      critical:
        action: "relay_alert"
        notify: ["mumuni"]
      fatal:
        action: "relay_alert + human_required"
        notify: ["mumuni", "kwame"]
    circuit_breaker:
      max_retries: 3
      window: 3600
      trip_action: escalate_to_fatal
    depends_on: []
    last_run: null
    last_status: null
    drift_alerts: []