Where work runs
Use native Codex SSH projects. The execution host owns task state, tools and authentication. Phone access and ChatGPT authentication are deferred; Bedrock does not enable desktop-only integrations on Linux.
Daily use
- Run the existing work-laptop
acommand and complete local/cloud security-key prompts. It delivers short-lived Caminus credentials to the Mac and Cecelia credentials to Bifrost. - Open DevEnv for work or Homelab on
macfor personal tasks. Reconnect to the existing task when changing clients. - Use the same SSH aliases outside the LAN: Cloudflare Access for
mac, WSSH for work. Each client needs its normal authorization. - Check git, CI and Flux after changes; a completed agent turn does not prove deployment success.
amazon-bedrock bearer authentication and current model. Bifrost’s bearer removal is complete; do not revoke the upstream bearer while the laptop needs it.
Tools and documentation
Keep work tools in the private work plugin repository. The personalhomelab plugin lives in plugins/homelab, with its marketplace in .agents/plugins/marketplace.json. Install through codex plugin marketplace add amarcin/homelab --ref main, then codex plugin add homelab@personal. The three existing skills have one source and load through the installed plugin; OpenCode receives the same ConfigMap content until retirement. Update older checkouts to remove their obsolete .agents/skills link and avoid duplicate discovery. Host setup, credentials and task state remain outside the plugin; installation does not provide network access or make Mac integrations work on Linux.
Use this existing Mintlify source for human guidance; buy a paid plan only for a needed publishing feature. Keep AGENTS.md short, configuration authoritative, and work/customer data out of personal docs. Avoid duplicate inventories and execution journals.
Symphony evaluation
Official v0.0.2 runs on the home Mac. Sources arescripts/mac/symphony/WORKFLOW.md and scripts/mac/symphony/ai.augustin.symphony.plist; reinstall their copies after updating. The binary SHA-256 is 902fb351aa2a4305887a1d8d10d47977100fe1398676e8d50e5baa3eb20db52c (11,127,016 bytes).
Application Support avoids an observed launchd stall reading Documents; no privacy settings were changed. RunAtLoad and KeepAlive are false. The worker is stopped after acceptance; continuous service startup, restart and token renewal are not established.
Scope: personal Agent Control Plane (
95c74cd16203), label symphony-pilot, state Up Next, concurrency 1. Before starting, check exactly one intended issue and no competing delegate or unresolved blocker. Upstream’s automatic blocker guard recognizes literal Todo; the workflow additionally checks blockers. Codex uses Runtime, codex-asbx, us-east-2, a read-only repository sandbox and on-request approval (this build rejects upstream’s object-form default).
The only allowed write is moving the current issue to Done after checks, or Paused on a blocker. max_turns: 1 does not prevent redelivery; the state transition must succeed before returning. A failed transition requires stopping the worker. No repository edits, deployments, comments or external operations are authorized by this pilot.
The dedicated Linear viewer is Symphony (bd37c531-dc84-4546-a8d0-c8373d321fd2), personal ATM team only at verification. Client credentials are enabled; public distribution/webhooks are off. Routing uses project/label, not assignment; AgentSession delegation/replies are unsupported. The required registration redirect http://localhost:3000/callback is unused by this grant and needs no server.
Follow Linear’s client-credentials flow: request a fresh read,write token at each run, verify viewer identity, and keep the token in memory. Do not persist it in a plist, environment file or long-lived key. Maximum validity is 30 days; on 401 stop and obtain a new token. No extra remote client-secret copy is needed.
The acceptance launcher passed a fresh token over SSH stdin into a detached child environment using one-time Python Popen with start_new_session=True, DEVNULL stdin and existing logs; no helper file was installed. It survived SSH disconnect. Native launchd credential delivery remains unresolved: SSH setenv targeted Background rather than gui/501, argument-based delivery exposes the token, and plist delivery persists it. Do not install a custom renewal bridge.
ATM-272 passed September 9: own identity, Runtime inference, repository/Git reads, own-issue Done update, and no redelivery through later polling. The corrected run took 35 seconds with 86,689 input / 1,192 output tokens. The first attempt repeated five completed invocations plus one interrupted; terminal transition fixed it. Worker stopped, temporary clone cleaned by upstream. These counters are not billing.
Symphony spawns its own stdio Codex app-server; it cannot attach to the existing daemon or promise live client handoff. Personal/bundled skills were discovered; cluster tools/write workflows still need acceptance. Dashboard UI remains untested. See upstream setup.