52b0f2b5c6
Session log for 2026-03-29 covering API/LLM security research, agent-runtimes audit, and review skill creation. Reflected into: - decisions.md: best-practices topic split, review skills read-only design - process-lessons.md: background agents for research, Edit context disambiguation, best-practices repo location Pruned 2 old reflected logs (2026-03-17, 2026-03-18). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
28 lines
3.2 KiB
Markdown
28 lines
3.2 KiB
Markdown
# Session Log — 2026-03-29
|
|
|
|
## Summary
|
|
Researched API design best practices and LLM code security, created two new best-practice files in the dedicated skynet/best-practices repo, audited agent-runtimes against the new practices (found critical auth gap + 5 unplanned medium-severity gaps), added F37-F41 to agent-runtimes FUTURE.md, and created two new skills (/review-plan, /review-spec) that review plans and specs against these best practices.
|
|
|
|
## Decisions
|
|
- Decision: Create two separate best-practice files (api-design.md and llm-code-security.md) rather than one combined security file — Rationale: Keeps topics self-contained and independently referenceable; API design covers more than just security (versioning, pagination, idempotency)
|
|
- Decision: Best practices repo (skynet/best-practices) is the target, not claude-foundations — Rationale: Best practices were migrated to a dedicated repo; BESTPRACTICES.md in claude-foundations now redirects there
|
|
- Decision: Mark F27 (deep health checks) as DONE in agent-runtimes FUTURE.md — Rationale: /health/ready already exists on both CP and dispatcher with dependency checks
|
|
- Decision: Create /review-plan and /review-spec as read-only skills — Rationale: Review output should inform the human, not auto-edit plans/specs. Read-only also reduces permission prompts.
|
|
- Decision: Both review skills load all 5 security/design best practice files upfront — Rationale: Better to over-load context than miss a relevant check; the files are not excessively large
|
|
|
|
## Gotchas Discovered
|
|
- **[best-practices]** Symptom: best-practices directory didn't exist under claude-foundations (got `No such file or directory`) — Fix: BESTPRACTICES.md redirects to skynet/best-practices repo; local clone already existed at ~/dev/claude/projects/best-practices/ but wasn't in the directory tree shown by context-load
|
|
- **[agent-runtimes]** Symptom: FUTURE.md had 3 instances of "Depends on: M9 (complete — K8s deployment exists)" making unique string replacement fail — Fix: Included more surrounding context to uniquely identify the F36 instance
|
|
|
|
## Key Context
|
|
- The best-practices repo is at ~/dev/claude/projects/best-practices/ with remote skynet/best-practices on Gitea
|
|
- ~/dev/claude/BESTPRACTICES.md is a symlink to the best-practices repo's index
|
|
- agent-runtimes spec/authentication.md has a comprehensive OIDC + mTLS + bootstrap token design (AU-1..AU-30) but zero implementation — the entire API is currently unauthenticated except for poll and heartbeat
|
|
- Research agents (background subagents) were effective for parallel web research — both completed in ~5 minutes and produced well-structured output with citations
|
|
- api-design.md references RFC 9700 (OAuth 2.0 Security BCP, January 2025) which deprecates implicit flow and password grant
|
|
|
|
## Process Notes
|
|
- Parallel background agents worked well for independent research tasks — launched both simultaneously and reviewed results as they completed
|
|
- The audit agent (foreground) was thorough — checked actual implementation files and line numbers rather than just reading specs
|
|
- Four repos touched in one session (best-practices, agent-runtimes, custom-claude-skills, claude-foundations) — each committed and pushed independently with focused commit messages
|