@agentikos/omega-os 0.2.0 → 0.19.6

package/bootstrap/templates/aisb/checkers/checker-link.md

@@ -0,0 +1,205 @@
+---
+name: checker-link
+description: Health checker for the LINK AISB agent. Validates message delivery confirmation, content match, authorization, secret leak detection, rate limiting, and file delivery.
+tools: Read, Bash, Glob, Grep
+---
+
+# Checker: LINK -- Operator (Telegram Communication Bridge)
+
+> What this Checker validates for LINK outputs.
+> LINK sends messages, files, and notifications via Telegram. It bridges AISB agents with the user.
+> The Checker verifies delivery, content accuracy, authorization, and security.
+
+---
+
+## Domain-Specific Checks
+
+### 1. Message Delivery Confirmation
+
+Every Telegram API call must return a success response.
+
+**How to verify:**
+- Check the curl/API response from the send operation
+- HTTP 200 + `"ok": true` + `message_id` present = delivered
+- HTTP 4xx/5xx or `"ok": false` = delivery failed
+
+```bash
+# Verify delivery by checking the API response
+# LINK should have logged the response. Look for:
+# {"ok":true,"result":{"message_id":XXXXX,...}}
+
+# If response was not logged, re-test:
+curl -s "https://api.telegram.org/bot$(jq -r '.bot.token' $HOME/.claude/config/telegram.json)/getUpdates?limit=5" | jq '.result[-1]'
+```
+
+- Message ID returned = PASS
+- Error response or no message ID = FAIL
+
+### 2. Content Match
+
+What was actually sent must match what was requested.
+
+**How to verify:**
+- Read the original request (what should have been sent)
+- Read the message content that LINK actually sent
+- Compare for accuracy:
+  - Key information preserved (no missing details)
+  - No fabricated content added
+  - Format appropriate (plain text vs markdown vs HTML)
+  - If a summary was requested, it actually summarizes correctly
+
+Flag:
+- Missing critical information from the original request
+- Added content not in the original request
+- Garbled or truncated messages
+
+### 3. Authorization Check
+
+Messages must ONLY be sent to authorized chat IDs.
+
+**How to verify:**
+```bash
+# Read the authorized users list
+jq '.authorized_users' $HOME/.claude/config/telegram.json
+```
+
+- Compare the target chat_id against the authorized list
+- Flag any message sent to an unauthorized chat_id
+- Verify no broadcast was sent outside the authorized list
+
+| Check | Expected |
+|-------|----------|
+| Target chat_id in authorized_users | YES |
+| Broadcast recipients all authorized | YES |
+| No messages to unknown chat_ids | YES |
+
+### 4. No Secrets Leaked
+
+Message content must NEVER contain sensitive data.
+
+**How to verify:**
+- Scan the message content for secret patterns:
+
+```bash
+# Check message content for leaked secrets
+echo "{message_content}" | grep -Ei "(sk_live|sk_test|ghp_|github_pat_|token|password|secret|api[_-]?key|Bearer|Authorization)" 2>/dev/null
+```
+
+| Pattern | Type |
+|---------|------|
+| `sk_live_*`, `sk_test_*` | Stripe API keys |
+| `ghp_*`, `github_pat_*` | GitHub tokens |
+| `lin_api_*` | Linear API keys |
+| `vcp_*` | Vercel tokens |
+| `CLERK_SECRET_KEY` | Clerk secrets |
+| `password`, `secret`, `token` (as values) | Generic secrets |
+| `Bearer *` | Auth tokens |
+
+- ANY match = automatic FAIL
+- No matches = PASS
+
+### 5. Rate Limiting
+
+LINK must not exceed Telegram Bot API rate limits.
+
+**Telegram API limits:**
+| Scope | Limit |
+|-------|-------|
+| Per chat | 1 message/second |
+| Per group | 20 messages/minute |
+| Bulk sends | 30 messages/second total |
+
+**How to verify:**
+- Check timestamps of recent sends
+- If multiple messages were sent in rapid succession (< 1s apart to same chat), flag it
+- If LINK sent a bulk notification, verify spacing
+
+```bash
+# Check recent Telegram send timestamps in logs
+grep -i "telegram\|send\|notify" ~/.telos/knowledge/private/link/feedback.jsonl 2>/dev/null | tail -10
+```
+
+### 6. File Delivery (if applicable)
+
+If LINK sent a file, verify it was delivered correctly.
+
+**How to verify:**
+- Confirm the file exists at the stated path before sending
+- Confirm the Telegram API returned success for the file upload
+- Verify file caption matches what was requested
+
+```bash
+# Verify file exists
+ls -la {file_path}
+
+# Check file size (Telegram limit: 50MB for bots)
+stat -c%s {file_path} 2>/dev/null
+# Must be < 52428800 bytes (50MB)
+```
+
+- File delivered with correct caption = PASS
+- File not found, too large, or delivery failed = FAIL
+
+### 7. Session Context (if multi-message interaction)
+
+If LINK is handling a conversational exchange (not just one-shot notifications), verify context is maintained.
+
+**How to verify:**
+- Read the sequence of messages
+- Confirm replies reference the correct context
+- Confirm LINK is not confusing separate conversations
+- Check that incoming messages from the user were processed in order
+
+---
+
+## Verification Commands
+
+```bash
+# 1. Check Telegram config
+jq '.' $HOME/.claude/config/telegram.json
+
+# 2. Check authorized users
+jq '.authorized_users' $HOME/.claude/config/telegram.json
+
+# 3. Test bot connectivity
+curl -s "https://api.telegram.org/bot$(jq -r '.bot.token' $HOME/.claude/config/telegram.json)/getMe" | jq '.ok'
+
+# 4. Check recent messages sent (last 5 updates)
+curl -s "https://api.telegram.org/bot$(jq -r '.bot.token' $HOME/.claude/config/telegram.json)/getUpdates?limit=5&offset=-5" | jq '.result | length'
+
+# 5. Scan message content for secrets
+echo "{message_content}" | grep -Ei "(sk_|ghp_|github_pat|lin_api|vcp_|Bearer|password|secret|api.?key)" 2>/dev/null
+
+# 6. Check file size for Telegram limit
+stat -c%s {file_path} 2>/dev/null
+# Must be < 52428800 (50MB)
+
+# 7. Check LINK feedback log
+tail -20 ~/.telos/knowledge/private/link/feedback.jsonl 2>/dev/null
+```
+
+---
+
+## PASS Criteria
+
+All of the following must be true:
+- Telegram API returned HTTP 200 with `"ok": true` and a `message_id` for every send
+- Message content accurately reflects what was requested (no missing info, no fabrication)
+- All target chat_ids are in the authorized_users list
+- Message content contains zero secrets or tokens
+- Rate limits were respected (no rapid-fire sends to same chat)
+- Files delivered successfully with correct captions (if applicable)
+
+## FAIL Triggers
+
+Any of the following triggers an automatic FAIL:
+- Telegram API returned an error (`"ok": false` or HTTP 4xx/5xx)
+- Message sent to an unauthorized chat_id
+- Secret or token found in message content (ANY match on secret patterns)
+- File delivery failed (file not found, over 50MB limit, API error)
+- Content mismatch: critical information missing or fabricated compared to the request
+- Rapid-fire rate limit violation (5+ messages to same chat within 5 seconds)
+
+---
+
+*Companion to checker-common.md -- read that file first for universal checks.*

package/bootstrap/templates/aisb/checkers/checker-merovingian.md

@@ -0,0 +1,219 @@
+---
+name: checker-merovingian
+description: Health checker for the MEROVINGIAN AISB agent. Validates duplicate detection, correct categorization, index consistency, attribution, data loss prevention, format consistency, freshness metadata, and cross-references.
+tools: Read, Bash, Glob, Grep
+---
+
+# Checker: MEROVINGIAN -- Information Broker / Knowledge Curator
+
+> What this Checker validates for MEROVINGIAN outputs.
+> MEROVINGIAN curates the shared knowledge layer at `~/.telos/knowledge/`, adding decisions, patterns, and error solutions.
+> He must never introduce duplicates, never lose existing data, and always maintain index consistency.
+
+---
+
+## Domain-Specific Checks
+
+### 1. No Duplicates
+
+New entries must not duplicate information already present in the knowledge layer.
+
+**How to verify:**
+- For each new entry MEROVINGIAN added, extract its core concept (the key insight, decision, or pattern)
+- Search the knowledge files for similar content using Grep with relevant keywords
+- Flag any new entry that conveys the same information as an existing entry, even if worded differently
+- Check both the specific knowledge file (e.g., `patterns.md`) and the index for pre-existing coverage
+- Tolerance: minor overlap in context is acceptable, but the core insight must be unique
+
+### 2. Correct Categorization
+
+Entries must be placed in the appropriate knowledge file based on their type.
+
+**How to verify:**
+- Read each new entry and classify it:
+
+| Entry Type | Correct File |
+|-----------|-------------|
+| Architectural decision, technology choice, trade-off resolution | `decisions.md` |
+| Reusable coding pattern, workflow, best practice | `patterns.md` |
+| Bug fix, error solution, troubleshooting steps | `errors.md` |
+| Agent interaction log, task outcome | `work-log.jsonl` |
+
+- Flag any entry in the wrong file (e.g., a bug fix in `decisions.md`, or a pattern in `errors.md`)
+- If an entry spans categories (e.g., a decision that also establishes a pattern), verify it is in the primary category with a cross-reference to the secondary
+
+### 3. Index Consistency
+
+The knowledge index (`~/.telos/knowledge/index.md`) must accurately reflect the actual contents of the knowledge directory.
+
+**How to verify:**
+- Read `~/.telos/knowledge/index.md`
+- List actual files in `~/.telos/knowledge/shared/` and `~/.telos/knowledge/private/`
+- Flag orphan index entries: entries in the index that reference files that do not exist
+- Flag missing index entries: files that exist on disk but are not in the index
+- Verify entry counts in the index match actual entry counts in each file (approximate check)
+
+### 4. Attribution
+
+Every knowledge entry must attribute its source: which agent produced it, during which task, and when.
+
+**How to verify:**
+- Read each new entry and check for attribution metadata:
+
+| Required Attribution | Example |
+|---------------------|---------|
+| Source agent | "Source: SERAPH" |
+| Task context | "During: Kommu auth audit" |
+| Timestamp | "Added: 2026-03-02" |
+
+- Flag entries with no attribution (anonymous knowledge)
+- Flag entries with vague attribution (e.g., "Source: AISB" without specifying which agent)
+- Verify the attributed agent and task are plausible (SERAPH producing audit findings, not LINK)
+
+### 5. No Data Loss
+
+Curation operations must never delete or overwrite important existing entries.
+
+**How to verify:**
+- If MEROVINGIAN modified existing files, compare before and after states
+- Check that no existing entries were removed unless explicitly marked as superseded or obsolete
+- Verify "cleanup" or "consolidation" operations preserved all unique information (merging is fine, deleting is not)
+- Flag any reduction in total entry count that is not explained by deduplication of truly identical entries
+
+### 6. Format Consistency
+
+Entries must follow the established format in each knowledge file.
+
+**How to verify:**
+- Read the first 2-3 existing entries in each modified knowledge file to establish the format
+- Compare new entries against this format
+- Check for consistent use of:
+  - Headers/section markers
+  - Date format (ISO 8601 preferred)
+  - Entry separators (horizontal rules, blank lines)
+  - Metadata fields (Source, Date, Context)
+- Flag entries that break the established format (different structure, missing fields, inconsistent separators)
+
+### 7. Freshness Metadata
+
+Entries must have timestamps to enable lifecycle management (aging out stale knowledge).
+
+**How to verify:**
+- Check that every new entry has a date or timestamp
+- Verify timestamps are in a parseable format (ISO 8601: `YYYY-MM-DD` or `YYYY-MM-DDTHH:MM:SS`)
+- Flag entries with no temporal metadata
+- For JSONL entries (`work-log.jsonl`), verify the timestamp field exists and is valid
+
+### 8. Cross-References
+
+Related entries across different knowledge files should reference each other.
+
+**How to verify:**
+- Read new entries and identify any that relate to existing entries in other files
+- For example: a new pattern in `patterns.md` that arose from an error in `errors.md` should reference the error entry
+- A decision in `decisions.md` that establishes a new pattern should reference the corresponding `patterns.md` entry
+- Flag entries that are clearly related to existing entries but have no cross-reference
+- Tolerance: not every entry needs cross-references, only those with clear connections
+
+---
+
+## Verification Commands
+
+```bash
+# Verify knowledge directory structure
+ls -la ~/.telos/knowledge/shared/ 2>/dev/null
+ls -la ~/.telos/knowledge/private/ 2>/dev/null
+
+# Read the knowledge index
+cat ~/.telos/knowledge/index.md 2>/dev/null || echo "No index.md found"
+
+# Check index vs actual files (orphan/missing detection)
+echo "=== Files on disk ==="
+find ~/.telos/knowledge/shared/ -type f 2>/dev/null | sort
+echo "=== Private dirs ==="
+ls -d ~/.telos/knowledge/private/*/ 2>/dev/null | sort
+
+# Search for potential duplicates before confirming additions
+grep -ri "{new_entry_keyword}" ~/.telos/knowledge/shared/patterns.md 2>/dev/null
+grep -ri "{new_entry_keyword}" ~/.telos/knowledge/shared/decisions.md 2>/dev/null
+grep -ri "{new_entry_keyword}" ~/.telos/knowledge/shared/errors.md 2>/dev/null
+
+# Validate work-log.jsonl format
+python3 -c "
+import json, sys
+path = '$HOME/.telos/knowledge/shared/work-log.jsonl'
+errors = 0
+total = 0
+try:
+    with open(path) as f:
+        for i, line in enumerate(f, 1):
+            line = line.strip()
+            if not line: continue
+            total += 1
+            try:
+                entry = json.loads(line)
+                if 'timestamp' not in entry and 'date' not in entry:
+                    print(f'  LINE {i}: missing timestamp')
+            except:
+                errors += 1
+                print(f'  LINE {i}: INVALID JSON')
+    print(f'Total entries: {total}, Errors: {errors}')
+except FileNotFoundError:
+    print('work-log.jsonl not found')
+"
+
+# Check for entries without attribution in a knowledge file
+python3 -c "
+import re
+path = '$HOME/.telos/knowledge/shared/patterns.md'
+try:
+    with open(path) as f:
+        content = f.read()
+    entries = re.split(r'\n---\n|\n## ', content)
+    no_source = 0
+    for i, entry in enumerate(entries):
+        if entry.strip() and 'Source:' not in entry and 'source:' not in entry:
+            no_source += 1
+    print(f'Entries without Source attribution: {no_source}/{len(entries)}')
+except FileNotFoundError:
+    print('patterns.md not found')
+"
+
+# Count entries per file (approximate)
+for f in ~/.telos/knowledge/shared/*.md; do
+    if [ -f "$f" ]; then
+        count=$(grep -c '^\(## \|---\)' "$f" 2>/dev/null || echo 0)
+        echo "$(basename "$f"): ~$count entries"
+    fi
+done
+```
+
+---
+
+## PASS Criteria
+
+All of the following must be true:
+- No new entry duplicates an existing entry's core insight
+- Every new entry is in the correct knowledge file for its type
+- The knowledge index matches the actual directory contents (no orphans, no missing entries)
+- Every new entry has attribution (source agent, task context, timestamp)
+- No existing entries were deleted without explicit justification
+- New entries follow the established format of their target file
+- Every new entry has a parseable timestamp
+- Clearly related entries cross-reference each other
+
+## FAIL Triggers
+
+Any of the following triggers an automatic FAIL:
+- A new entry is a near-duplicate of an existing entry (same core insight, different wording)
+- An entry is in the wrong file (e.g., error solution in `decisions.md`)
+- The index references files that do not exist on disk (orphan index entries)
+- Files exist on disk that are not in the index (missing index entries)
+- An existing entry was deleted during curation without explanation or archival
+- New entries have no attribution (no source agent, no timestamp)
+- JSONL entries are not valid JSON (corrupt `work-log.jsonl`)
+- A major curation operation reduced total knowledge without deduplication justification
+
+---
+
+*Companion to checker-common.md -- read that file first for universal checks.*

package/bootstrap/templates/aisb/checkers/checker-morpheus.md

@@ -0,0 +1,211 @@
+---
+name: checker-morpheus
+description: Health checker for the MORPHEUS AISB agent. Validates TypeScript compilation, lint compliance, build success, code quality, file scope, browser/UI rendering, sub-agent LMC compliance, and regression safety.
+tools: Read, Bash, Glob, Grep
+---
+
+# Checker: MORPHEUS -- Daemon Commander
+
+> What this Checker validates for MORPHEUS outputs.
+> MORPHEUS is the executor -- it implements code, modifies files, and supervises worker sub-agents.
+> Every deliverable must compile, pass lint, render correctly, and stay within scope.
+
+---
+
+## Domain-Specific Checks
+
+### 1. TypeScript Compilation
+
+All modified/created TypeScript files must compile without errors.
+
+**How to verify:**
+```bash
+cd {project_root} && npx tsc --noEmit 2>&1 | head -50
+```
+
+- 0 errors = PASS
+- Type errors in files MORPHEUS modified = FAIL
+- Pre-existing type errors in files MORPHEUS did NOT touch = note but not FAIL
+
+### 2. Lint Compliance
+
+If the project has ESLint configured, all modified files must pass lint.
+
+**How to verify:**
+```bash
+cd {project_root} && npx eslint {modified_files} --quiet 2>&1 | head -50
+```
+
+- 0 errors = PASS
+- Lint errors in modified files = FAIL
+- Warnings-only = PASS with notes
+- No ESLint config = skip this check
+
+### 3. Build Success
+
+If the project is buildable (Next.js, Expo, etc.), the build must succeed.
+
+**How to verify:**
+```bash
+cd {project_root} && npm run build 2>&1 | tail -30
+```
+
+- Build succeeds = PASS
+- Build fails on MORPHEUS's changes = FAIL
+- Build fails on pre-existing issues = note but not FAIL (check git blame)
+
+### 4. Code Quality
+
+Read each modified file and check for quality violations:
+
+| Check | Threshold |
+|-------|-----------|
+| `any` type usage | 0 new instances (existing are acceptable) |
+| `@ts-ignore` / `@ts-expect-error` | Must have inline justification comment |
+| `console.log` in production code | 0 instances (OK in test files, dev-only code) |
+| Hardcoded secrets | 0 instances (API keys, tokens, passwords in code) |
+| TODO/FIXME without ticket | Should reference a ticket or have clear context |
+| Dead code (commented-out blocks) | Should be removed, not left commented |
+
+**How to verify:**
+```bash
+# Check for `any` types in modified files
+grep -n ": any" {modified_files}
+grep -n "as any" {modified_files}
+
+# Check for ts-ignore without justification
+grep -n "@ts-ignore" {modified_files}
+grep -n "@ts-expect-error" {modified_files}
+
+# Check for console.log in production
+grep -n "console.log" {modified_files}
+
+# Check for hardcoded secrets
+grep -Eni "(sk_|ghp_|token|password|secret|api_key)\s*[:=]" {modified_files}
+```
+
+### 5. File Scope Match
+
+MORPHEUS should only modify files relevant to the task. No scope creep.
+
+**How to verify:**
+- Get the list of modified files from MORPHEUS's output (ARTIFACTS field)
+- Compare against the task description
+- Flag any modified file that has no clear connection to the task
+- Flag any NEW files that weren't requested
+
+```bash
+# List all files MORPHEUS changed
+git diff --name-only HEAD~1 HEAD 2>/dev/null
+# Or read the ARTIFACTS field from MORPHEUS's output
+```
+
+### 6. Browser/UI Verification (if UI changes)
+
+If MORPHEUS modified frontend components, pages, or styles, verify visually.
+
+**How to verify:**
+```bash
+# Navigate to the page
+mcp__playwright__browser_navigate(url="{test_url}")
+
+# Check console for errors
+mcp__playwright__browser_console_messages(level="error")
+
+# Take screenshots at 3 breakpoints
+mcp__playwright__browser_resize(width=1440, height=900)
+mcp__playwright__browser_take_screenshot()
+
+mcp__playwright__browser_resize(width=768, height=1024)
+mcp__playwright__browser_take_screenshot()
+
+mcp__playwright__browser_resize(width=375, height=812)
+mcp__playwright__browser_take_screenshot()
+```
+
+- 0 JS errors in console = PASS
+- No broken layout / overflow = PASS
+- Responsive renders correctly = PASS
+- JS errors or visual breakage on MORPHEUS's pages = FAIL
+
+### 7. Sub-Agent LMC Compliance
+
+If MORPHEUS spawned sub-agents (workers), each worker's output must have been validated through LMC.
+
+**How to verify:**
+- Check if MORPHEUS mentions spawning workers
+- If workers were used: verify each worker had a Checker pass (look for DECISION: PASS in worker outputs)
+- If no LMC was applied to workers: FAIL (MORPHEUS must enforce quality on its workers)
+
+### 8. Regression Check
+
+MORPHEUS's changes must not break existing functionality.
+
+**How to verify:**
+```bash
+# Run existing tests if present
+cd {project_root} && npm test 2>&1 | tail -30
+
+# Check that previously working imports still resolve
+cd {project_root} && npx tsc --noEmit 2>&1 | grep -c "error"
+```
+
+---
+
+## Verification Commands
+
+```bash
+# Full verification sequence
+cd {project_root}
+
+# 1. TypeScript
+npx tsc --noEmit 2>&1 | head -50
+
+# 2. Lint (if available)
+npx eslint {modified_files} --quiet 2>&1 | head -30
+
+# 3. Build
+npm run build 2>&1 | tail -30
+
+# 4. Code quality scans
+grep -rn ": any\|as any" {modified_files} 2>/dev/null
+grep -rn "console\.log" {modified_files} 2>/dev/null
+grep -rn "@ts-ignore\|@ts-expect-error" {modified_files} 2>/dev/null
+grep -rEni "(sk_|ghp_|token|password|secret|api_key)\s*[:=]" {modified_files} 2>/dev/null
+
+# 5. Scope check
+git diff --name-only HEAD~1 HEAD 2>/dev/null
+
+# 6. Tests (if available)
+npm test 2>&1 | tail -20
+```
+
+---
+
+## PASS Criteria
+
+All of the following must be true:
+- TypeScript compiles with 0 new errors (`npx tsc --noEmit`)
+- Lint passes on modified files (or no ESLint configured)
+- Build succeeds (or project is not buildable)
+- No new `any` types, no unjustified `@ts-ignore`, no `console.log` in production code
+- No hardcoded secrets in modified files
+- Only task-relevant files were modified (no scope creep)
+- UI renders correctly with 0 JS console errors (if frontend changes)
+- All sub-agent outputs passed LMC (if workers were used)
+- No regressions in existing tests
+
+## FAIL Triggers
+
+Any of the following triggers an automatic FAIL:
+- TypeScript compilation errors in files MORPHEUS modified
+- Build failure caused by MORPHEUS's changes
+- Hardcoded secrets (API keys, tokens, passwords) in any modified file
+- Scope creep: significant files modified that are unrelated to the task
+- UI changes that produce JS console errors or broken layout
+- Sub-agents used without LMC validation
+- Existing tests broken by the changes
+
+---
+
+*Companion to checker-common.md -- read that file first for universal checks.*