Where work runs
Use native Codex SSH projects. The execution host owns task state, tools and authentication. Phone access and ChatGPT authentication are deferred; Bedrock does not enable desktop-only integrations on Linux.
Daily use
- Run the existing work-laptop
acommand and complete local/cloud security-key prompts. It delivers short-lived Caminus credentials to the Mac and Cecelia credentials to Bifrost. - Open DevEnv for work or Homelab on
macfor personal tasks. Reconnect to the existing task when changing clients. - Use the same SSH aliases outside the LAN: Cloudflare Access for
mac, WSSH for work. Each client needs its normal authorization. - Check git, CI and Flux after changes; a completed agent turn does not prove deployment success.
Tools and documentation
Keep work tools in the private work plugin repository. Create one personal plugin inside this repository, avoiding another repository initially. Personal skills currently remain incluster/apps/agent/opencode/skills, exposed through .agents/skills, until OpenCode migration. A plugin does not make cluster endpoints reachable or Mac integrations available on Linux.
Use this existing Mintlify source for human guidance; buy a paid plan only for a needed publishing feature. Keep AGENTS.md short, configuration authoritative, and work/customer data out of personal docs. Avoid duplicate inventories and execution journals.
Symphony evaluation
Official v0.0.2 runs on the home Mac. Sources arescripts/mac/symphony/WORKFLOW.md and scripts/mac/symphony/ai.augustin.symphony.plist; reinstall their copies after updating. The binary SHA-256 is 902fb351aa2a4305887a1d8d10d47977100fe1398676e8d50e5baa3eb20db52c (11,127,016 bytes).
Application Support avoids an observed launchd stall reading Documents; no privacy settings were changed. RunAtLoad and KeepAlive are false. The worker is stopped after acceptance; continuous service startup, restart and token renewal are not established.
Scope: personal Agent Control Plane (
95c74cd16203), label symphony-pilot, state Up Next, concurrency 1. Before starting, check exactly one intended issue and no competing delegate or unresolved blocker. Upstream’s automatic blocker guard recognizes literal Todo; the workflow additionally checks blockers. Codex uses Runtime, codex-asbx, us-east-2, a read-only repository sandbox and on-request approval (this build rejects upstream’s object-form default).
The only allowed write is moving the current issue to Done after checks, or Paused on a blocker. max_turns: 1 does not prevent redelivery; the state transition must succeed before returning. A failed transition requires stopping the worker. No repository edits, deployments, comments or external operations are authorized by this pilot.
The dedicated Linear viewer is Symphony (bd37c531-dc84-4546-a8d0-c8373d321fd2), personal ATM team only at verification. Client credentials are enabled; public distribution/webhooks are off. Routing uses project/label, not assignment; AgentSession delegation/replies are unsupported. The required registration redirect http://localhost:3000/callback is unused by this grant and needs no server.
Follow Linear’s client-credentials flow: request a fresh read,write token at each run, verify viewer identity, and keep the token in memory. Do not persist it in a plist, environment file or long-lived key. Maximum validity is 30 days; on 401 stop and obtain a new token. No extra remote client-secret copy is needed.
The acceptance launcher passed a fresh token over SSH stdin into a detached child environment using one-time Python Popen with start_new_session=True, DEVNULL stdin and existing logs; no helper file was installed. It survived SSH disconnect. Native launchd credential delivery remains unresolved: SSH setenv targeted Background rather than gui/501, argument-based delivery exposes the token, and plist delivery persists it. Do not install a custom renewal bridge.
ATM-272 passed September 9: own identity, Runtime inference, repository/Git reads, own-issue Done update, and no redelivery through later polling. The corrected run took 35 seconds with 86,689 input / 1,192 output tokens. The first attempt repeated five completed invocations plus one interrupted; terminal transition fixed it. Worker stopped, temporary clone cleaned by upstream. These counters are not billing.
Symphony spawns its own stdio Codex app-server; it cannot attach to the existing daemon or promise live client handoff. Personal/bundled skills were discovered; cluster tools/write workflows still need acceptance. Dashboard UI remains untested. See upstream setup.