skynet/claude-foundations
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: insights-driven guardrails — SSH pre-flight, bash safety, infra approval, dispatch pre-flight, session end, ask-minimax fallback

Browse Source
This commit is contained in:
Paul O'Reilly
2026-06-12 21:37:26 +12:00
parent f41c22d0ac
commit d13beca5d7
5 changed files with 79 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
claude/source-control.md
View File

@@ -15,10 +15,33 @@ Pattern: `gitea.oreillyit.nz-<username>`.
- `gitea.oreillyit.nz-homelab` → authenticates as `cluster-administrator` (key: `~/.ssh/gitea-cluster-admin`)
- `gitea.oreillyit.nz-ai-enablement` → authenticates as `ai_enablement` (key: `~/.ssh/gitea.ai-enablement`)
- `gitea.oreillyit.nz-accelerators` → (key: `~/.ssh/gitea.accelerators.2026`)
Git remote URL format: `git@gitea.oreillyit.nz-<user>:<org>/<repo>.git`
- Example: `git@gitea.oreillyit.nz-ai-enablement:skynet/custom-claude-skills.git`
## SSH agent pre-flight
Before the first push of a session:
1. Derive the alias: `git remote get-url origin` — the host segment is the SSH alias.
2. Confirm the key is loaded: `ssh-add -l` — the relevant key must appear.
3. Confirm auth: `ssh -T git@<alias>` — expect a Gitea welcome message.
Claude cannot answer a passphrase prompt. If the key isn't loaded, ask the user to `ssh-add ~/.ssh/<keyfile>` before proceeding.
In non-interactive contexts (CI, container agents, unattended loops), use `GIT_SSH_COMMAND='ssh -o BatchMode=yes' git push` so a missing credential fails fast instead of hanging on a passphrase prompt.
## Push failure recovery
| Symptom | Likely cause |
|---|---|
| `Permission denied (publickey)` | Key not loaded, or wrong alias in remote URL |
| Push hangs silently | Passphrase prompt in non-interactive context — use `BatchMode=yes` |
| 403 after API-created repo | SSH user not added as collaborator — add via Gitea UI or API |
Commit locally first, surface the failure explicitly, and never end a session with finished work unpushed and unmentioned. Record the recovery step in CONTEXT.md.
## Working rules
- **Always pull before planning work** — run `git pull --ff-only` when entering a project. Work may have been pushed from another machine or by container agents. If the pull fails (diverged history, uncommitted changes), warn the user before proceeding.