pack: apply All

.coagent/guardrails/redirects.jsonl

@@ -0,0 +1,2 @@
+{"ts":"2025-10-02T12:24:45","type":"at-risk-clear"}
+{"ts":"2025-10-02T12:29:58","type":"at-risk-hit","note":"heuristic"}

.coagent/sandbox.config.json

@@ -0,0 +1,7 @@
+{
+  "notes": "CoCivium sandbox preset. Tools should avoid outbound network.",
+  "net": {
+    "egress": false
+  },
+  "updated": "2025-10-02T20:53:48"
+}

.github/branch-protection.backup.json

@@ -0,0 +1 @@
+{"url":"https://api.github.com/repos/rickballard/CoAgent/branches/main/protection","required_status_checks":{"url":"https://api.github.com/repos/rickballard/CoAgent/branches/main/protection/required_status_checks","strict":true,"contexts":[],"contexts_url":"https://api.github.com/repos/rickballard/CoAgent/branches/main/protection/required_status_checks/contexts","checks":[]},"required_pull_request_reviews":{"url":"https://api.github.com/repos/rickballard/CoAgent/branches/main/protection/required_pull_request_reviews","dismiss_stale_reviews":false,"require_code_owner_reviews":false,"require_last_push_approval":false,"required_approving_review_count":1},"required_signatures":{"url":"https://api.github.com/repos/rickballard/CoAgent/branches/main/protection/required_signatures","enabled":false},"enforce_admins":{"url":"https://api.github.com/repos/rickballard/CoAgent/branches/main/protection/enforce_admins","enabled":true},"required_linear_history":{"enabled":true},"allow_force_pushes":{"enabled":false},"allow_deletions":{"enabled":false},"block_creations":{"enabled":false},"required_conversation_resolution":{"enabled":false},"lock_branch":{"enabled":false},"allow_fork_syncing":{"enabled":false}}

.github/workflows/status-bot.yml

@@ -0,0 +1,22 @@
+name: status-bot
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "*/30 * * * *"
+permissions:
+  contents: write
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Refresh status.json
+        shell: pwsh
+        run: |
+          pwsh -File tools/Write-Status.ps1
+          git config user.name "status-bot"
+          git config user.email "status-bot@users.noreply.github.com"
+          git add docs/status.json
+          if (git diff --cached --quiet) { echo "No changes"; exit 0 }
+          git commit -m "bot: refresh status.json"
+          git push

docs/BPOE.md

@@ -0,0 +1,18 @@
+# CoAgent — BPOE (Best Practices of Execution)
+
+## Principles
+- File-first, PR-driven changes
+- Minimal external dependencies
+- Local JSONL instrumentation (no external telemetry)
+
+## Where logs live
+- `.coagent/logs/*.jsonl`
+
+## What to track (MVP)
+- `status`: ok | fail | redirected
+- `duration_ms`: per-operation latency
+- `guardrail`: redirect | none
+- `op`: which tool or task
+
+## Analyze
+Run: `pwsh -File tools\Analyze-BPOE.ps1`

docs/HELP.md

@@ -0,0 +1,21 @@
+# CoAgent — HELP (User Guide, MVP)
+
+## What this is
+A minimal public MVP with a live UI mock, status panel, and guardrails smoke tests.
+
+## Quick start
+1. Visit: `/` → `index.html`
+2. UI Mock: `/ui-mock/quad.html`
+3. Status Panel: `/status.html` (reads `status.json`)
+4. Smoke locally: `pwsh -File tools\Test-MVP.ps1`
+
+## Guardrails (at-risk user redirect)
+- Heuristic scanner: `tools/Scan-AtRisk.ps1`
+- CI smoke: `.github/workflows/guardrail-smoke.yml`
+
+## Release
+- Tag with `tools/CoAgent_Release_MVP.ps1` (on main, clean tree).
+- Creates a GitHub Release with version + notes.
+
+## Support & Security
+- See `SUPPORT.md` and `SECURITY.md`.

docs/TRAINING.md

@@ -0,0 +1,31 @@
+# CoAgent — TRAINING (Guided walkthrough)
+
+## Goal
+Practice the full flow as a brand-new user and verify your environment.
+
+### Part 1: Orientation (5 min)
+- Open `/` → click UI Mock → browse quadrants (Model, Guardrails, Status, Logs).
+- Open `/status.html` → confirm it loads `status.json`.
+
+### Part 2: Smoke test (2 min)
+```pwsh
+pwsh -File tools\Test-MVP.ps1
+```
+
+Expected: 4/4 pages OK, `status.json: ✓ present`, CI guardrail smoke triggered.
+
+### Part 3: Sandbox mode (2 min)
+```pwsh
+pwsh -File tools\Enter-Sandbox.ps1
+pwsh -File tools\Test-MVP.ps1   # should still pass; no outbound required
+```
+
+### Part 4: Status refresh (1 min)
+```pwsh
+pwsh -File tools\Write-Status.ps1
+```
+
+### Part 5: BPOE metrics (2 min)
+```pwsh
+pwsh -File tools\Analyze-BPOE.ps1
+```

docs/status.json

@@ -2,6 +2,6 @@
   "auth": "linked",
   "safeguards": "PR-first",
   "undo_hint": "gh pr revert <#>",
-  "index": "updated @2025-10-02T16:07:12",
+  "index": "updated @2025-10-02T20:53:46",
   "deliverable": "ok"
 }

tools/Analyze-BPOE.ps1

@@ -0,0 +1,38 @@
+Set-StrictMode -Version Latest; $ErrorActionPreference='Stop'
+# Analyze-BPOE.ps1 — quick summary of local JSONL logs under .coagent/logs/*.jsonl
+$root = (Get-Location).Path
+$logDir = Join-Path $root ".coagent\logs"
+if (!(Test-Path $logDir)) { Write-Host "ℹ️ No logs at $logDir"; exit 0 }
+
+$files = Get-ChildItem $logDir -Filter *.jsonl -File -Recurse
+if (!$files) { Write-Host "ℹ️ No *.jsonl logs found in $logDir"; exit 0 }
+
+$counts = @{
+  total = 0; ok = 0; fail = 0; guardrail = 0; duration_ms = 0
+}
+
+foreach($f in $files){
+  Get-Content $f | ForEach-Object {
+    if([string]::IsNullOrWhiteSpace($_)) { return }
+    try {
+      $j = $_ | ConvertFrom-Json
+      $counts.total++
+      if($j.status -eq 'ok'){ $counts.ok++ }
+      if($j.status -eq 'fail'){ $counts.fail++ }
+      if($j.guardrail -eq 'redirect'){ $counts.guardrail++ }
+      if($j.duration_ms){ $counts.duration_ms += [int]$j.duration_ms }
+    } catch { }
+  }
+}
+
+$avg = 0
+if($counts.total -gt 0 -and $counts.duration_ms -gt 0){
+  $avg = [math]::Round($counts.duration_ms / $counts.total, 1)
+}
+
+"---- BPOE Summary ----"
+"events: {0}" -f $counts.total
+"ok/fail: {0}/{1}" -f $counts.ok, $counts.fail
+"guardrail redirects: {0}" -f $counts.guardrail
+"avg latency (ms): {0}" -f $avg
+"----------------------"

tools/CoWrap.ps1

@@ -0,0 +1,38 @@
+param(
+  [ValidateSet('All','Docs','UI','Guardrails','Metrics','Sandbox')]
+  [string]$Pack = 'All'
+)
+Set-StrictMode -Version Latest; $ErrorActionPreference='Stop'
+
+function Exec($cmd, $err="Command failed"){
+  $p = Start-Process pwsh -ArgumentList "-NoLogo -NoProfile -Command $cmd" -NoNewWindow -PassThru -Wait
+  if($p.ExitCode -ne 0){ throw "$err : $cmd" }
+}
+
+# Ensure git and gh available
+if(-not (Get-Command git -ErrorAction SilentlyContinue)){ throw "git not found" }
+if(-not (Get-Command gh  -ErrorAction SilentlyContinue)){ throw "gh not found" }
+
+$stamp = Get-Date -Format yyyyMMdd-HHmmss
+$branch = "pack/$($Pack.ToLower())-$stamp"
+
+# Detect change set (simple: everything changed)
+git status --porcelain
+$dirty = $LASTEXITCODE -eq 0 -and ((git status --porcelain) -ne $null) -and ((git status --porcelain) -ne "")
+
+git checkout -B $branch origin/main | Out-Null
+
+# Optionally filter files by pack (no-op for now; keep simple & explicit)
+# You can manually curate staged paths before commit if desired.
+
+git add .
+if(git diff --cached --quiet){ Write-Host "ℹ️ No changes to commit for $Pack"; exit 0 }
+
+$msg = "pack: apply $Pack"
+git commit -m $msg | Out-Null
+git push -u origin $branch | Out-Null
+
+$body = "Automated $Pack pack via CoWrap."
+$pr = gh pr create --head $branch --base main -t $msg -b $body --draft
+Write-Host $pr
+Write-Host "✓ Opened draft PR for $Pack → $branch"

tools/Enter-Sandbox.ps1

@@ -0,0 +1,18 @@
+Set-StrictMode -Version Latest; $ErrorActionPreference='Stop'
+# Enter-Sandbox.ps1 — writes a local sandbox config and prints guidance
+$root = (Get-Location).Path
+$cfgDir = Join-Path $root ".coagent"
+$cfg = Join-Path $cfgDir "sandbox.config.json"
+New-Item -ItemType Directory -Force $cfgDir | Out-Null
+
+$payload = @{
+  net = @{ egress = $false }
+  notes = "CoCivium sandbox preset. Tools should avoid outbound network."
+  updated = (Get-Date).ToString("s")
+}
+
+$payload | ConvertTo-Json -Depth 5 | Set-Content -Encoding UTF8 $cfg
+Write-Host "✅ Sandbox ON — wrote $cfg"
+Write-Host "   Conventions: respect NO_NETWORK=1 and ./tools/* should short-circuit egress."
+$env:NO_NETWORK = "1"
+Write-Host "   Session env set: NO_NETWORK=1 (effective for this shell)"

tools/Release-MVP.ps1

@@ -0,0 +1,7 @@
+$ver="v0.4.0-mvp-public"
+$today=(Get-Date -Format "yyyy-MM-dd")
+Add-Content -Path CHANGELOG.md -Value "`n## $ver ($today)`n- MVP4 public: pages, plan, status, guardrails."
+git add CHANGELOG.md ; git commit -m "chore: changelog for $ver"
+git tag -a $ver -m "$ver"
+git push --follow-tags
+gh release create $ver -t "$ver" -n "Public MVP with live docs and guardrails. See README for Pages link."

tools/Write-Status.ps1

@@ -0,0 +1,14 @@
+Param(
+  [string]$Auth="linked",
+  [string]$Safeguards="PR-first",
+  [string]$UndoHint="gh pr revert <#>",
+  [string]$Deliverable="ok"
+)
+$stamp=(Get-Date).ToString('s')
+$payload = [pscustomobject]@{
+  auth=$Auth; safeguards=$Safeguards; undo_hint=$UndoHint;
+  index="updated @$stamp"; deliverable=$Deliverable
+} | ConvertTo-Json
+New-Item -ItemType Directory -Force .\docs | Out-Null
+$payload | Set-Content -Encoding UTF8 .\docs\status.json
+Write-Host "wrote docs/status.json @ $stamp"