Skip to main content

Where work runs

Use native Codex SSH projects. The execution host owns task state, tools and authentication. Phone access and ChatGPT authentication are deferred; Bedrock does not enable desktop-only integrations on Linux.

Daily use

  1. Run the existing work-laptop a command and complete local/cloud security-key prompts. It delivers short-lived Caminus credentials to the Mac and Cecelia credentials to Bifrost.
  2. Open DevEnv for work or Homelab on mac for personal tasks. Reconnect to the existing task when changing clients.
  3. Use the same SSH aliases outside the LAN: Cloudflare Access for mac, WSSH for work. Each client needs its normal authorization.
  4. Check git, CI and Flux after changes; a completed agent turn does not prove deployment success.
Closing the laptop does not stop remote execution. Home-Mac AWS renewal still depends on the laptop; already-issued credentials work until expiry. Laptop Runtime now uses Caminus; restarting its running app and revoking the old bearer remain separate final steps.

Tools and documentation

Keep work tools in the private work plugin repository. Create one personal plugin inside this repository, avoiding another repository initially. Personal skills currently remain in cluster/apps/agent/opencode/skills, exposed through .agents/skills, until OpenCode migration. A plugin does not make cluster endpoints reachable or Mac integrations available on Linux. Use this existing Mintlify source for human guidance; buy a paid plan only for a needed publishing feature. Keep AGENTS.md short, configuration authoritative, and work/customer data out of personal docs. Avoid duplicate inventories and execution journals.

Symphony evaluation

Official v0.0.2 runs on the home Mac. Sources are scripts/mac/symphony/WORKFLOW.md and scripts/mac/symphony/ai.augustin.symphony.plist; reinstall their copies after updating. The binary SHA-256 is 902fb351aa2a4305887a1d8d10d47977100fe1398676e8d50e5baa3eb20db52c (11,127,016 bytes). Application Support avoids an observed launchd stall reading Documents; no privacy settings were changed. RunAtLoad and KeepAlive are false. The worker is stopped after acceptance; continuous service startup, restart and token renewal are not established. Scope: personal Agent Control Plane (95c74cd16203), label symphony-pilot, state Up Next, concurrency 1. Before starting, check exactly one intended issue and no competing delegate or unresolved blocker. Upstream’s automatic blocker guard recognizes literal Todo; the workflow additionally checks blockers. Codex uses Runtime, codex-asbx, us-east-2, a read-only repository sandbox and on-request approval (this build rejects upstream’s object-form default). The only allowed write is moving the current issue to Done after checks, or Paused on a blocker. max_turns: 1 does not prevent redelivery; the state transition must succeed before returning. A failed transition requires stopping the worker. No repository edits, deployments, comments or external operations are authorized by this pilot. The dedicated Linear viewer is Symphony (bd37c531-dc84-4546-a8d0-c8373d321fd2), personal ATM team only at verification. Client credentials are enabled; public distribution/webhooks are off. Routing uses project/label, not assignment; AgentSession delegation/replies are unsupported. The required registration redirect http://localhost:3000/callback is unused by this grant and needs no server. Follow Linear’s client-credentials flow: request a fresh read,write token at each run, verify viewer identity, and keep the token in memory. Do not persist it in a plist, environment file or long-lived key. Maximum validity is 30 days; on 401 stop and obtain a new token. No extra remote client-secret copy is needed. The acceptance launcher passed a fresh token over SSH stdin into a detached child environment using one-time Python Popen with start_new_session=True, DEVNULL stdin and existing logs; no helper file was installed. It survived SSH disconnect. Native launchd credential delivery remains unresolved: SSH setenv targeted Background rather than gui/501, argument-based delivery exposes the token, and plist delivery persists it. Do not install a custom renewal bridge. ATM-272 passed September 9: own identity, Runtime inference, repository/Git reads, own-issue Done update, and no redelivery through later polling. The corrected run took 35 seconds with 86,689 input / 1,192 output tokens. The first attempt repeated five completed invocations plus one interrupted; terminal transition fixed it. Worker stopped, temporary clone cleaned by upstream. These counters are not billing. Symphony spawns its own stdio Codex app-server; it cannot attach to the existing daemon or promise live client handoff. Personal/bundled skills were discovered; cluster tools/write workflows still need acceptance. Dashboard UI remains untested. See upstream setup.

Observability and remaining migration

Prefer native Codex token/tool events and OpenTelemetry. Work already has managed collection; dashboard access remains a work-side permission issue. Keep work telemetry there. Existing Grafana/Loki/Alloy collect cluster pod logs, not a complete Codex cost dashboard; see Monitoring. Bifrost retains Cecelia STS and active Kiro/OpenCode traffic; Isengard/Mantle routes and AWS bearer credentials are retired from configuration, Secrets and the running pod. Do not add agentgateway now: shared MCP policy could justify it later, but it does not resolve browser support, credential expiry or task handoff. General AEA browser access on Linux remains unresolved. MCS authentication alone is insufficient; both an official browser/AEA installation and an accepted control method must pass. No alternative browser method has been approved. T3, Paseo, CC Pocket and voice are retired with history/data retained. Keep OpenCode, its old Linear bridge, Renovate wake job and custom image/skill dependencies until their replacements pass. Temporal had no schedules or running/retained workflows on September 9, but custom agents still reference it; retire only after resolving that dependency.