miclaw-app 0.2.0 → 0.4.0

package/.next/standalone/.next/server/app/commands.rsc

@@ -1,24 +1,24 @@
 1:"$Sreact.fragment"
-2:I[22140,["/_next/static/chunks/0mmpyn9fv2fjf.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"Sidebar"]
-3:I[39756,["/_next/static/chunks/0mmpyn9fv2fjf.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"default"]
-4:I[37457,["/_next/static/chunks/0mmpyn9fv2fjf.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"default"]
-6:I[97367,["/_next/static/chunks/0mmpyn9fv2fjf.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"OutletBoundary"]
+2:I[22140,["/_next/static/chunks/08fwcb._hc08b.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"Sidebar"]
+3:I[39756,["/_next/static/chunks/08fwcb._hc08b.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"default"]
+4:I[37457,["/_next/static/chunks/08fwcb._hc08b.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"default"]
+6:I[97367,["/_next/static/chunks/08fwcb._hc08b.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"OutletBoundary"]
 7:"$Sreact.suspense"
-a:I[97367,["/_next/static/chunks/0mmpyn9fv2fjf.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"ViewportBoundary"]
-c:I[97367,["/_next/static/chunks/0mmpyn9fv2fjf.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"MetadataBoundary"]
-e:I[68027,["/_next/static/chunks/0mmpyn9fv2fjf.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"default",1]
-:HL["/_next/static/chunks/0xlrze18so95w.css","style"]
+a:I[97367,["/_next/static/chunks/08fwcb._hc08b.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"ViewportBoundary"]
+c:I[97367,["/_next/static/chunks/08fwcb._hc08b.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"MetadataBoundary"]
+e:I[68027,["/_next/static/chunks/08fwcb._hc08b.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"default",1]
+:HL["/_next/static/chunks/0lb3l2a8_251j.css","style"]
 :HL["/_next/static/media/166ab60e98aadb0a-s.p.0mka4ru4_bj1d.woff2","font",{"crossOrigin":"","type":"font/woff2"}]
 :HL["/_next/static/media/797e433ab948586e-s.p.0.q-h669a_dqa.woff2","font",{"crossOrigin":"","type":"font/woff2"}]
 :HL["/_next/static/media/83afe278b6a6bb3c-s.p.0q-301v4kxxnr.woff2","font",{"crossOrigin":"","type":"font/woff2"}]
-0:{"P":null,"c":["","commands"],"q":"","i":false,"f":[[["",{"children":["commands",{"children":["__PAGE__",{}]}]},"$undefined","$undefined",16],[["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/_next/static/chunks/0xlrze18so95w.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","script","script-0",{"src":"/_next/static/chunks/0mmpyn9fv2fjf.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/_next/static/chunks/0d3shmwh5_nmn.js","async":true,"nonce":"$undefined"}]],["$","html",null,{"lang":"en","className":"inter_fe8b9d92-module__LINzvG__variable geist_mono_8d43a2aa-module__8Li5zG__variable fira_code_d18ac710-module__OladcG__variable","children":["$","body",null,{"className":"bg-surface text-text font-sans antialiased","children":["$","div",null,{"className":"flex h-screen overflow-hidden","children":[["$","$L2",null,{}],["$","main",null,{"className":"flex-1 overflow-y-auto bg-grid","children":["$","$L3",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L4",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]],"forbidden":"$undefined","unauthorized":"$undefined"}]}]]}]}]}]]}],{"children":[["$","$1","c",{"children":[null,["$","$L3",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L4",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","forbidden":"$undefined","unauthorized":"$undefined"}]]}],{"children":[["$","$1","c",{"children":["$L5",[["$","script","script-0",{"src":"/_next/static/chunks/12p3iqtw2ohfq.js","async":true,"nonce":"$undefined"}]],["$","$L6",null,{"children":["$","$7",null,{"name":"Next.MetadataOutlet","children":"$@8"}]}]]}],{},null,false,null]},null,false,"$@9"]},null,false,null],["$","$1","h",{"children":[null,["$","$La",null,{"children":"$Lb"}],["$","div",null,{"hidden":true,"children":["$","$Lc",null,{"children":["$","$7",null,{"name":"Next.Metadata","children":"$Ld"}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}],false]],"m":"$undefined","G":["$e",[["$","link","0",{"rel":"stylesheet","href":"/_next/static/chunks/0xlrze18so95w.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}]]],"S":true,"h":null,"s":"$undefined","l":"$undefined","p":"$undefined","d":"$undefined","b":"vFFhR9bZqGO0pHP7N7NNG"}
+0:{"P":null,"c":["","commands"],"q":"","i":false,"f":[[["",{"children":["commands",{"children":["__PAGE__",{}]}]},"$undefined","$undefined",16],[["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/_next/static/chunks/0lb3l2a8_251j.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}],["$","script","script-0",{"src":"/_next/static/chunks/08fwcb._hc08b.js","async":true,"nonce":"$undefined"}],["$","script","script-1",{"src":"/_next/static/chunks/0d3shmwh5_nmn.js","async":true,"nonce":"$undefined"}]],["$","html",null,{"lang":"en","className":"inter_fe8b9d92-module__LINzvG__variable geist_mono_8d43a2aa-module__8Li5zG__variable fira_code_d18ac710-module__OladcG__variable","children":["$","body",null,{"className":"bg-surface text-text font-sans antialiased","children":["$","div",null,{"className":"flex h-screen overflow-hidden","children":[["$","$L2",null,{}],["$","main",null,{"className":"flex-1 overflow-y-auto bg-grid","children":["$","$L3",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L4",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]],"forbidden":"$undefined","unauthorized":"$undefined"}]}]]}]}]}]]}],{"children":[["$","$1","c",{"children":[null,["$","$L3",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L4",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","forbidden":"$undefined","unauthorized":"$undefined"}]]}],{"children":[["$","$1","c",{"children":["$L5",[["$","script","script-0",{"src":"/_next/static/chunks/04oemklgq9z0h.js","async":true,"nonce":"$undefined"}]],["$","$L6",null,{"children":["$","$7",null,{"name":"Next.MetadataOutlet","children":"$@8"}]}]]}],{},null,false,null]},null,false,"$@9"]},null,false,null],["$","$1","h",{"children":[null,["$","$La",null,{"children":"$Lb"}],["$","div",null,{"hidden":true,"children":["$","$Lc",null,{"children":["$","$7",null,{"name":"Next.Metadata","children":"$Ld"}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}],false]],"m":"$undefined","G":["$e",[["$","link","0",{"rel":"stylesheet","href":"/_next/static/chunks/0lb3l2a8_251j.css","precedence":"next","crossOrigin":"$undefined","nonce":"$undefined"}]]],"S":true,"h":null,"s":"$undefined","l":"$undefined","p":"$undefined","d":"$undefined","b":"ykykNEJbtAXExgOj13bt9"}
 f:[]
 9:"$Wf"
 b:[["$","meta","0",{"charSet":"utf-8"}],["$","meta","1",{"name":"viewport","content":"width=device-width, initial-scale=1"}]]
-10:I[27201,["/_next/static/chunks/0mmpyn9fv2fjf.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"IconMark"]
+10:I[27201,["/_next/static/chunks/08fwcb._hc08b.js","/_next/static/chunks/0d3shmwh5_nmn.js"],"IconMark"]
 8:null
 d:[["$","title","0",{"children":"MiClaw"}],["$","meta","1",{"name":"description","content":"Claude Code configuration visualizer"}],["$","link","2",{"rel":"icon","href":"/favicon.ico?favicon.0x3dzn~oxb6tn.ico","sizes":"256x256","type":"image/x-icon"}],["$","$L10","3",{}]]
-11:I[22450,["/_next/static/chunks/0mmpyn9fv2fjf.js","/_next/static/chunks/0d3shmwh5_nmn.js","/_next/static/chunks/12p3iqtw2ohfq.js"],"ExpandableBody"]
+11:I[47258,["/_next/static/chunks/08fwcb._hc08b.js","/_next/static/chunks/0d3shmwh5_nmn.js","/_next/static/chunks/04oemklgq9z0h.js"],"CommandScopeGroup"]
 12:T1810,# Infrastructure Security Audit
 
 Scan all AWS infrastructure modules for security issues across four categories: IAM least-privilege, unprotected API routes, encryption, and factory module bypass.
@@ -131,8 +131,8 @@ Each sub-agent should write its report in this format:
 
 After the aggregation agent completes, tell the user the full report is at `/tmp/infra-security-audit/SUMMARY.md` and output the brief summary.
 
-Read the actual .tf files — don't guess based on module names. When a wildcard resource is found, check if it's a known AWS requirement before flagging.5:["$","div",null,{"className":"mx-auto max-w-5xl px-8 py-10","children":[["$","div",null,{"className":"mb-8","children":[["$","div",null,{"className":"flex items-baseline gap-3","children":[["$","h1",null,{"className":"text-2xl font-medium tracking-tight","children":"Commands"}],["$","span",null,{"className":"text-sm text-text-muted","children":12}]]}],["$","p",null,{"className":"mt-1 text-sm text-text-muted","children":"Procedural commands across projects"}]]}],[["$","div","infrastructure",{"className":"mb-8","children":[["$","div",null,{"className":"flex items-center gap-2 mb-3","children":[["$","span",null,{"className":"inline-flex items-center px-2 py-0.5 text-xs font-medium rounded-sm bg-surface-raised text-text-dim","children":"INFRASTRUCTURE"}],["$","span",null,{"className":"text-xs text-text-dim font-mono","children":"~/Desktop/infrastructure/.claude/commands"}]]}],["$","div",null,{"className":"space-y-3","children":[["$","div","/Users/gabry/Desktop/infrastructure/.claude/commands/security-audit.md",{"id":"security-audit","className":"border border-border rounded-sm p-5 scroll-mt-4 ","children":[["$","h3",null,{"className":"text-sm font-medium","children":"security-audit"}],["$","$L11",null,{"content":"$12","previewLines":3}]]}]]}]]}],"$L13","$L14"],false]}]
-15:T368e,# Broken Access Control Scan
+Read the actual .tf files — don't guess based on module names. When a wildcard resource is found, check if it's a known AWS requirement before flagging.5:["$","div",null,{"className":"mx-auto max-w-5xl px-8 py-10","children":[["$","div",null,{"className":"mb-8","children":[["$","div",null,{"className":"flex items-baseline gap-3","children":[["$","h1",null,{"className":"text-2xl font-mono font-medium tracking-tight","children":"Commands"}],["$","span",null,{"className":"font-mono text-sm text-text-dim","children":12}]]}],["$","p",null,{"className":"mt-1 text-sm text-text-muted","children":"Procedural commands across projects"}]]}],[["$","div","/Users/gabry/Desktop/infrastructure",{"className":"mb-8","children":[["$","div",null,{"className":"flex items-center gap-2 mb-3","children":[["$","span",null,{"className":"font-mono text-xs text-text-dim","children":["[","INFRASTRUCTURE","]"]}],["$","span",null,{"className":"text-xs text-text-dim font-mono","children":"~/Desktop/infrastructure"}]]}],["$","$L11",null,{"commands":[{"name":"security-audit","body":"$12","filePath":"/Users/gabry/Desktop/infrastructure/.claude/commands/security-audit.md","scope":{"type":"project","projectName":"infrastructure","projectPath":"/Users/gabry/Desktop/infrastructure"}}],"scopePath":"/Users/gabry/Desktop/infrastructure"}]]}],"$L13","$L14","$L15"],false]}]
+16:T368e,# Broken Access Control Scan
 
 Scan ALL route handlers and Lambda handlers in platform-services for broken access control vulnerabilities beyond IDOR (which is covered by the separate `idor-scan` command).
 
@@ -358,150 +358,7 @@ Write the final report to `access-control-scan-results/SUMMARY.md` with:
 
 Then output the summary to the user.
 
-Be thorough. Read the actual code — don't guess based on function names alone. When checking for role validation, trace the full dependency chain. If a role check happens in a called function or middleware rather than at the route level, note it but don't flag it as a vulnerability.13:["$","div","platform-services",{"className":"mb-8","children":[["$","div",null,{"className":"flex items-center gap-2 mb-3","children":[["$","span",null,{"className":"inline-flex items-center px-2 py-0.5 text-xs font-medium rounded-sm bg-surface-raised text-text-dim","children":"PLATFORM-SERVICES"}],["$","span",null,{"className":"text-xs text-text-dim font-mono","children":"~/Desktop/platform-services/.claude/commands"}]]}],["$","div",null,{"className":"space-y-3","children":[["$","div","/Users/gabry/Desktop/platform-services/.claude/commands/access-control-scan.md",{"id":"access-control-scan","className":"border border-border rounded-sm p-5 scroll-mt-4 ","children":[["$","h3",null,{"className":"text-sm font-medium","children":"access-control-scan"}],["$","$L11",null,{"content":"$15","previewLines":3}]]}],"$L16","$L17","$L18","$L19","$L1a","$L1b","$L1c","$L1d","$L1e"]}]]}]
-1f:T1605,# Investigate WGS Ingestion Failure
-
-You are investigating a WGS ingestion Step Function failure in production. Follow each step. Do NOT ask for user input -- work autonomously.
-
-## Input
-
-$ARGUMENTS
-
-## Step 1: Parse the Alert
-
-Extract from the input text: `correlationId`, `wgsIngestionId`, `sfnError`, `sfnStatus`.
-
-If the input is missing required fields, write a report noting the parse failure and stop.
-
-## Step 2: Query Axiom
-
-Use `mcp__axiom__queryDataset` with `startTime` = `now-24h` and `endTime` = `now`.
-
-Trace the correlationId:
-
-```apl
-['bioscope-prod']
-| where correlationId == "<correlationId>"
-| order by _time asc
-```
-
-Search by wgsIngestionId:
-
-```apl
-['bioscope-prod']
-| where data.wgsIngestionId == "<wgsIngestionId>" or message contains "<wgsIngestionId>"
-| order by _time asc
-```
-
-Focus on ERROR-level entries. Record only the key log lines needed to explain the failure -- not the full trace.
-
-## Step 3: Cross-Reference Code
-
-Read the `PLATFORM_SERVICES_PATH` and `INFRASTRUCTURE_PATH` environment variables to locate the repos.
-
-### Application code (platform-services)
-
-1. `$PLATFORM_SERVICES_PATH/packages/wgs_ingestion_service/src/wgs_ingestion_service/handlers/handle_sfn_failure.py`
-2. `$PLATFORM_SERVICES_PATH/packages/wgs_ingestion_service/src/wgs_ingestion_service/handlers/handle_initiate_ingestion.py`
-3. `$PLATFORM_SERVICES_PATH/packages/bioscope_types/src/bioscope_types/dynamodb/wgs_ingestions.py`
-
-### Infrastructure (Terraform)
-
-If the error points to a Step Function state, Lambda config, IAM permissions, or resource limits, cross-reference these files:
-
-1. `$INFRASTRUCTURE_PATH/modules/aws/wgs_ingestion/sfn.tf` -- Step Function state machine definition and pipeline flow
-2. `$INFRASTRUCTURE_PATH/modules/aws/wgs_ingestion/lambda.tf` -- Lambda function configuration (memory, timeout, layers)
-3. `$INFRASTRUCTURE_PATH/modules/aws/wgs_ingestion/iam.tf` -- IAM roles and policies for the pipeline
-4. `$INFRASTRUCTURE_PATH/modules/aws/wgs_ingestion/eventbridge.tf` -- EventBridge rule that triggers on SFN failures
-5. `$INFRASTRUCTURE_PATH/modules/aws/wgs_ingestion/dynamodb.tf` -- DynamoDB table and index definitions
-
-The execution name format is `{wgs_ingestion_id}_{kit_id}_{timestamp}`.
-
-## Step 4: Classify the Failure
-
-**Default to Bug.** Only classify as Transient if you can point to specific evidence (see criteria below).
-
-- **Bug**: Code error, unhandled exception, missing IAM permissions, missing config, infrastructure misconfiguration. Requires a code or infra fix. **This is the default classification when the root cause is unclear.**
-- **Transient**: A failure that meets ALL of these criteria:
-  1. The error is a network timeout, AWS throttling, or a known transient pattern (see below)
-  2. There is no underlying code/config/IAM issue that caused it
-  3. A redrive would be expected to succeed WITHOUT any code or infrastructure changes
-- **Data issue**: Bad input, missing files, malformed data. Requires manual intervention.
-
-You MUST justify your classification in the Root Cause section. If classifying as Transient, explicitly state why a redrive would fix it without code changes.
-
-### Example Transient Errors
-
-These LOOK like data issues but are known transient -- classify as **Transient**:
-
-- **`INTERSECT_VARIANTS` / `KeyError: 'CHR:POS:A0:A1'` / "No variants in intersection"**: Intermittent failure in `pgsc_calc` during PRS generation. Resolves on redrive.
-
-### Example Bug Patterns
-
-These may LOOK transient but are bugs -- classify as **Bug**:
-
-- **S3 403 Forbidden on HeadObject/GetObject/PutObject**: Usually a missing IAM permission on the task role, not a temporary auth issue. Check the relevant IAM policy in infrastructure. Example: BIOENG-535 where `genomics-bam-subset-processor` was missing `s3:GetObject` on its output bucket.
-- **S3 404 Not Found on expected files**: Could indicate a missing deployment artifact, misconfigured path, or a race condition in the pipeline -- not transient.
-- **Persistent STS/credential errors on FARGATE_SPOT**: If the same error recurs on redrive or appears on non-spot tasks, it is an IAM issue, not credential expiration.
-
-## Step 5: Write the Report
-
-Write the report file as: `reports/YYYY-MM-DD_<first-8-chars-of-wgsIngestionId>.md`
-
-The `reports/` directory is in the current working directory. Verify with `Glob` that the directory exists before writing. If it does not exist, create it.
-
-Keep the report concise. Only include log lines that are directly relevant to explaining the failure cause.
-
-```
-# WGS Ingestion Failure Report
-
-## Summary
-
-| Field | Value |
-|-------|-------|
-| Date | YYYY-MM-DD HH:MM UTC |
-| Correlation ID | ... |
-| WGS Ingestion ID | ... |
-| Execution Name | ... |
-| SFN Error | ... |
-| SFN Status | ... |
-
-## Key Logs
-
-Only the log lines that explain the failure (oldest first):
-
-- `TIMESTAMP` [LEVEL] message (logGroup: ...)
-
-## Root Cause
-
-<1-3 sentences. What failed and why.>
-
-## Classification
-
-**<Transient | Bug | Data issue>**
-
-## Recommended Action
-
-<1-2 sentences.>
-
-### Redrive JSON
-
-If transient, include:
-
-{
-  "executionIds": ["<execution-name>"]
-}
-
-Env-task name: `redrive-wgs-ingestion-execution`
-```
-
-## Rules
-
-- Do NOT ask for user input. Work fully autonomously.
-- Do NOT include PII/PHI. Only UUIDs, error codes, timestamps, status values.
-- Do NOT use Bash commands. Use only Read, Glob, Grep, Write, and mcp__axiom__queryDataset.
-- If Axiom queries fail, proceed with code analysis and note the gap in the report.14:["$","div","wgs-ingestion-bot",{"className":"mb-8","children":[["$","div",null,{"className":"flex items-center gap-2 mb-3","children":[["$","span",null,{"className":"inline-flex items-center px-2 py-0.5 text-xs font-medium rounded-sm bg-surface-raised text-text-dim","children":"WGS-INGESTION-BOT"}],["$","span",null,{"className":"text-xs text-text-dim font-mono","children":"~/Desktop/wgs-ingestion-bot/.claude/commands"}]]}],["$","div",null,{"className":"space-y-3","children":[["$","div","/Users/gabry/Desktop/wgs-ingestion-bot/.claude/commands/investigate-wgs-ingestion.md",{"id":"investigate-wgs-ingestion","className":"border border-border rounded-sm p-5 scroll-mt-4 ","children":[["$","h3",null,{"className":"text-sm font-medium","children":"investigate-wgs-ingestion"}],["$","$L11",null,{"content":"$1f","previewLines":3}]]}]]}]]}]
-20:Tf1d,# Add a New Model to llm-proxy-service
+Be thorough. Read the actual code — don't guess based on function names alone. When checking for role validation, trace the full dependency chain. If a role check happens in a called function or middleware rather than at the route level, note it but don't flag it as a vulnerability.17:Tf1d,# Add a New Model to llm-proxy-service
 
 Add a new LLM model to `llm-proxy-service`, ensuring accurate cost reporting.
 
@@ -587,8 +444,7 @@ If the model requires additional env vars (vertex_ai, groq, or anthropic models)
 
 1. Run `pnpm exec nx run bioscope-types:type-check` to verify the type is valid
 2. Run `pnpm exec nx run llm-proxy-service:test` to verify tests pass
-3. Run `pnpm exec nx run llm-proxy-service:lint` and `pnpm exec nx run llm-proxy-service:type-check`16:["$","div","/Users/gabry/Desktop/platform-services/.claude/commands/add-llm-proxy-service-model.md",{"id":"add-llm-proxy-service-model","className":"border border-border rounded-sm p-5 scroll-mt-4 ","children":[["$","h3",null,{"className":"text-sm font-medium","children":"add-llm-proxy-service-model"}],["$","$L11",null,{"content":"$20","previewLines":3}]]}]
-21:T1c43,# IDOR & Authorization Vulnerability Scan
+3. Run `pnpm exec nx run llm-proxy-service:lint` and `pnpm exec nx run llm-proxy-service:type-check`18:T1c43,# IDOR & Authorization Vulnerability Scan
 
 Scan ALL route handlers in platform-services for IDOR (Insecure Direct Object Reference) and authorization vulnerabilities.
 
@@ -685,8 +541,7 @@ Write the final report to `/tmp/idor-scan-results/SUMMARY.md` with:
 
 Then output the summary to the user.
 
-Be thorough. Read the actual code — don't guess based on function names alone. When in doubt about whether a check exists, read the called functions to see if ownership validation happens deeper in the call chain. If validation happens in a called function rather than at the route level, note it but don't flag it as a vulnerability.17:["$","div","/Users/gabry/Desktop/platform-services/.claude/commands/idor-scan.md",{"id":"idor-scan","className":"border border-border rounded-sm p-5 scroll-mt-4 ","children":[["$","h3",null,{"className":"text-sm font-medium","children":"idor-scan"}],["$","$L11",null,{"content":"$21","previewLines":3}]]}]
-22:T2543,# PHI/PII Data Exposure Scan
+Be thorough. Read the actual code — don't guess based on function names alone. When in doubt about whether a check exists, read the called functions to see if ownership validation happens deeper in the call chain. If validation happens in a called function rather than at the route level, note it but don't flag it as a vulnerability.19:T2543,# PHI/PII Data Exposure Scan
 
 Scan ALL application code in platform-services for Protected Health Information (PHI) and Personally Identifiable Information (PII) exposure vulnerabilities. This covers logging, error responses, API over-fetching, and any other channel where sensitive data could leak.
 
@@ -857,8 +712,7 @@ Write the final report to `/tmp/phi-exposure-scan-results/SUMMARY.md` with:
 
 Then output the summary to the user.
 
-Be thorough. Read the actual code — don't guess based on function names alone. When checking log statements, look at what the `extra` dict actually contains. When checking for model dumps, trace the model class to see what fields it includes. If a model only contains safe fields (IDs, timestamps, statuses), it's not a PHI exposure even if it's logged via `model_dump()`.18:["$","div","/Users/gabry/Desktop/platform-services/.claude/commands/phi-exposure-scan.md",{"id":"phi-exposure-scan","className":"border border-border rounded-sm p-5 scroll-mt-4 ","children":[["$","h3",null,{"className":"text-sm font-medium","children":"phi-exposure-scan"}],["$","$L11",null,{"content":"$22","previewLines":3}]]}]
-23:T1b86,# Upgrade litellm in llm-proxy-service
+Be thorough. Read the actual code — don't guess based on function names alone. When checking log statements, look at what the `extra` dict actually contains. When checking for model dumps, trace the model class to see what fields it includes. If a model only contains safe fields (IDs, timestamps, statuses), it's not a PHI exposure even if it's logged via `model_dump()`.1a:T1b86,# Upgrade litellm in llm-proxy-service
 
 Upgrade the `litellm` dependency in `llm-proxy-service` to a new version, validating that all supported models have correct pricing.
 
@@ -971,8 +825,8 @@ After presenting findings to the user and getting their approval:
 4. Run `uv sync --all-packages` from the `platform-services/` directory to update the lock file
 5. Run `pnpm exec nx run llm-proxy-service:test` to verify tests pass
 6. Run `pnpm exec nx run llm-proxy-service:lint` and `pnpm exec nx run llm-proxy-service:type-check`
-7. Run `pnpm exec nx run embedding-service:test`, `pnpm exec nx run embedding-service:lint`, and `pnpm exec nx run embedding-service:type-check`19:["$","div","/Users/gabry/Desktop/platform-services/.claude/commands/upgrade-litellm.md",{"id":"upgrade-litellm","className":"border border-border rounded-sm p-5 scroll-mt-4 ","children":[["$","h3",null,{"className":"text-sm font-medium","children":"upgrade-litellm"}],["$","$L11",null,{"content":"$23","previewLines":3}]]}]
-24:T368e,# Broken Access Control Scan
+7. Run `pnpm exec nx run embedding-service:test`, `pnpm exec nx run embedding-service:lint`, and `pnpm exec nx run embedding-service:type-check`13:["$","div","/Users/gabry/Desktop/platform-services",{"className":"mb-8","children":[["$","div",null,{"className":"flex items-center gap-2 mb-3","children":[["$","span",null,{"className":"font-mono text-xs text-text-dim","children":["[","PLATFORM-SERVICES","]"]}],["$","span",null,{"className":"text-xs text-text-dim font-mono","children":"~/Desktop/platform-services"}]]}],["$","$L11",null,{"commands":[{"name":"access-control-scan","body":"$16","filePath":"/Users/gabry/Desktop/platform-services/.claude/commands/access-control-scan.md","scope":{"type":"project","projectName":"platform-services","projectPath":"/Users/gabry/Desktop/platform-services"}},{"name":"add-llm-proxy-service-model","body":"$17","filePath":"/Users/gabry/Desktop/platform-services/.claude/commands/add-llm-proxy-service-model.md","scope":"$13:props:children:1:props:commands:0:scope"},{"name":"idor-scan","body":"$18","filePath":"/Users/gabry/Desktop/platform-services/.claude/commands/idor-scan.md","scope":"$13:props:children:1:props:commands:0:scope"},{"name":"phi-exposure-scan","body":"$19","filePath":"/Users/gabry/Desktop/platform-services/.claude/commands/phi-exposure-scan.md","scope":"$13:props:children:1:props:commands:0:scope"},{"name":"upgrade-litellm","body":"$1a","filePath":"/Users/gabry/Desktop/platform-services/.claude/commands/upgrade-litellm.md","scope":"$13:props:children:1:props:commands:0:scope"}],"scopePath":"/Users/gabry/Desktop/platform-services"}]]}]
+1b:T368e,# Broken Access Control Scan
 
 Scan ALL route handlers and Lambda handlers in platform-services for broken access control vulnerabilities beyond IDOR (which is covered by the separate `idor-scan` command).
 
@@ -1198,8 +1052,7 @@ Write the final report to `access-control-scan-results/SUMMARY.md` with:
 
 Then output the summary to the user.
 
-Be thorough. Read the actual code — don't guess based on function names alone. When checking for role validation, trace the full dependency chain. If a role check happens in a called function or middleware rather than at the route level, note it but don't flag it as a vulnerability.1a:["$","div","/Users/gabry/Desktop/ps-copy/platform-services/.claude/commands/access-control-scan.md",{"id":"access-control-scan","className":"border border-border rounded-sm p-5 scroll-mt-4 ","children":[["$","h3",null,{"className":"text-sm font-medium","children":"access-control-scan"}],["$","$L11",null,{"content":"$24","previewLines":3}]]}]
-25:Tf1d,# Add a New Model to llm-proxy-service
+Be thorough. Read the actual code — don't guess based on function names alone. When checking for role validation, trace the full dependency chain. If a role check happens in a called function or middleware rather than at the route level, note it but don't flag it as a vulnerability.1c:Tf1d,# Add a New Model to llm-proxy-service
 
 Add a new LLM model to `llm-proxy-service`, ensuring accurate cost reporting.
 
@@ -1285,8 +1138,7 @@ If the model requires additional env vars (vertex_ai, groq, or anthropic models)
 
 1. Run `pnpm exec nx run bioscope-types:type-check` to verify the type is valid
 2. Run `pnpm exec nx run llm-proxy-service:test` to verify tests pass
-3. Run `pnpm exec nx run llm-proxy-service:lint` and `pnpm exec nx run llm-proxy-service:type-check`1b:["$","div","/Users/gabry/Desktop/ps-copy/platform-services/.claude/commands/add-llm-proxy-service-model.md",{"id":"add-llm-proxy-service-model","className":"border border-border rounded-sm p-5 scroll-mt-4 ","children":[["$","h3",null,{"className":"text-sm font-medium","children":"add-llm-proxy-service-model"}],["$","$L11",null,{"content":"$25","previewLines":3}]]}]
-26:T1c43,# IDOR & Authorization Vulnerability Scan
+3. Run `pnpm exec nx run llm-proxy-service:lint` and `pnpm exec nx run llm-proxy-service:type-check`1d:T1c43,# IDOR & Authorization Vulnerability Scan
 
 Scan ALL route handlers in platform-services for IDOR (Insecure Direct Object Reference) and authorization vulnerabilities.
 
@@ -1383,8 +1235,7 @@ Write the final report to `/tmp/idor-scan-results/SUMMARY.md` with:
 
 Then output the summary to the user.
 
-Be thorough. Read the actual code — don't guess based on function names alone. When in doubt about whether a check exists, read the called functions to see if ownership validation happens deeper in the call chain. If validation happens in a called function rather than at the route level, note it but don't flag it as a vulnerability.1c:["$","div","/Users/gabry/Desktop/ps-copy/platform-services/.claude/commands/idor-scan.md",{"id":"idor-scan","className":"border border-border rounded-sm p-5 scroll-mt-4 ","children":[["$","h3",null,{"className":"text-sm font-medium","children":"idor-scan"}],["$","$L11",null,{"content":"$26","previewLines":3}]]}]
-27:T2543,# PHI/PII Data Exposure Scan
+Be thorough. Read the actual code — don't guess based on function names alone. When in doubt about whether a check exists, read the called functions to see if ownership validation happens deeper in the call chain. If validation happens in a called function rather than at the route level, note it but don't flag it as a vulnerability.1e:T2543,# PHI/PII Data Exposure Scan
 
 Scan ALL application code in platform-services for Protected Health Information (PHI) and Personally Identifiable Information (PII) exposure vulnerabilities. This covers logging, error responses, API over-fetching, and any other channel where sensitive data could leak.
 
@@ -1555,8 +1406,7 @@ Write the final report to `/tmp/phi-exposure-scan-results/SUMMARY.md` with:
 
 Then output the summary to the user.
 
-Be thorough. Read the actual code — don't guess based on function names alone. When checking log statements, look at what the `extra` dict actually contains. When checking for model dumps, trace the model class to see what fields it includes. If a model only contains safe fields (IDs, timestamps, statuses), it's not a PHI exposure even if it's logged via `model_dump()`.1d:["$","div","/Users/gabry/Desktop/ps-copy/platform-services/.claude/commands/phi-exposure-scan.md",{"id":"phi-exposure-scan","className":"border border-border rounded-sm p-5 scroll-mt-4 ","children":[["$","h3",null,{"className":"text-sm font-medium","children":"phi-exposure-scan"}],["$","$L11",null,{"content":"$27","previewLines":3}]]}]
-28:T1b86,# Upgrade litellm in llm-proxy-service
+Be thorough. Read the actual code — don't guess based on function names alone. When checking log statements, look at what the `extra` dict actually contains. When checking for model dumps, trace the model class to see what fields it includes. If a model only contains safe fields (IDs, timestamps, statuses), it's not a PHI exposure even if it's logged via `model_dump()`.1f:T1b86,# Upgrade litellm in llm-proxy-service
 
 Upgrade the `litellm` dependency in `llm-proxy-service` to a new version, validating that all supported models have correct pricing.
 
@@ -1669,4 +1519,146 @@ After presenting findings to the user and getting their approval:
 4. Run `uv sync --all-packages` from the `platform-services/` directory to update the lock file
 5. Run `pnpm exec nx run llm-proxy-service:test` to verify tests pass
 6. Run `pnpm exec nx run llm-proxy-service:lint` and `pnpm exec nx run llm-proxy-service:type-check`
-7. Run `pnpm exec nx run embedding-service:test`, `pnpm exec nx run embedding-service:lint`, and `pnpm exec nx run embedding-service:type-check`1e:["$","div","/Users/gabry/Desktop/ps-copy/platform-services/.claude/commands/upgrade-litellm.md",{"id":"upgrade-litellm","className":"border border-border rounded-sm p-5 scroll-mt-4 ","children":[["$","h3",null,{"className":"text-sm font-medium","children":"upgrade-litellm"}],["$","$L11",null,{"content":"$28","previewLines":3}]]}]
+7. Run `pnpm exec nx run embedding-service:test`, `pnpm exec nx run embedding-service:lint`, and `pnpm exec nx run embedding-service:type-check`14:["$","div","/Users/gabry/Desktop/ps-copy/platform-services",{"className":"mb-8","children":[["$","div",null,{"className":"flex items-center gap-2 mb-3","children":[["$","span",null,{"className":"font-mono text-xs text-text-dim","children":["[","PLATFORM-SERVICES","]"]}],["$","span",null,{"className":"text-xs text-text-dim font-mono","children":"~/Desktop/ps-copy/platform-services"}]]}],["$","$L11",null,{"commands":[{"name":"access-control-scan","body":"$1b","filePath":"/Users/gabry/Desktop/ps-copy/platform-services/.claude/commands/access-control-scan.md","scope":{"type":"project","projectName":"platform-services","projectPath":"/Users/gabry/Desktop/ps-copy/platform-services"}},{"name":"add-llm-proxy-service-model","body":"$1c","filePath":"/Users/gabry/Desktop/ps-copy/platform-services/.claude/commands/add-llm-proxy-service-model.md","scope":"$14:props:children:1:props:commands:0:scope"},{"name":"idor-scan","body":"$1d","filePath":"/Users/gabry/Desktop/ps-copy/platform-services/.claude/commands/idor-scan.md","scope":"$14:props:children:1:props:commands:0:scope"},{"name":"phi-exposure-scan","body":"$1e","filePath":"/Users/gabry/Desktop/ps-copy/platform-services/.claude/commands/phi-exposure-scan.md","scope":"$14:props:children:1:props:commands:0:scope"},{"name":"upgrade-litellm","body":"$1f","filePath":"/Users/gabry/Desktop/ps-copy/platform-services/.claude/commands/upgrade-litellm.md","scope":"$14:props:children:1:props:commands:0:scope"}],"scopePath":"/Users/gabry/Desktop/ps-copy/platform-services"}]]}]
+20:T1605,# Investigate WGS Ingestion Failure
+
+You are investigating a WGS ingestion Step Function failure in production. Follow each step. Do NOT ask for user input -- work autonomously.
+
+## Input
+
+$ARGUMENTS
+
+## Step 1: Parse the Alert
+
+Extract from the input text: `correlationId`, `wgsIngestionId`, `sfnError`, `sfnStatus`.
+
+If the input is missing required fields, write a report noting the parse failure and stop.
+
+## Step 2: Query Axiom
+
+Use `mcp__axiom__queryDataset` with `startTime` = `now-24h` and `endTime` = `now`.
+
+Trace the correlationId:
+
+```apl
+['bioscope-prod']
+| where correlationId == "<correlationId>"
+| order by _time asc
+```
+
+Search by wgsIngestionId:
+
+```apl
+['bioscope-prod']
+| where data.wgsIngestionId == "<wgsIngestionId>" or message contains "<wgsIngestionId>"
+| order by _time asc
+```
+
+Focus on ERROR-level entries. Record only the key log lines needed to explain the failure -- not the full trace.
+
+## Step 3: Cross-Reference Code
+
+Read the `PLATFORM_SERVICES_PATH` and `INFRASTRUCTURE_PATH` environment variables to locate the repos.
+
+### Application code (platform-services)
+
+1. `$PLATFORM_SERVICES_PATH/packages/wgs_ingestion_service/src/wgs_ingestion_service/handlers/handle_sfn_failure.py`
+2. `$PLATFORM_SERVICES_PATH/packages/wgs_ingestion_service/src/wgs_ingestion_service/handlers/handle_initiate_ingestion.py`
+3. `$PLATFORM_SERVICES_PATH/packages/bioscope_types/src/bioscope_types/dynamodb/wgs_ingestions.py`
+
+### Infrastructure (Terraform)
+
+If the error points to a Step Function state, Lambda config, IAM permissions, or resource limits, cross-reference these files:
+
+1. `$INFRASTRUCTURE_PATH/modules/aws/wgs_ingestion/sfn.tf` -- Step Function state machine definition and pipeline flow
+2. `$INFRASTRUCTURE_PATH/modules/aws/wgs_ingestion/lambda.tf` -- Lambda function configuration (memory, timeout, layers)
+3. `$INFRASTRUCTURE_PATH/modules/aws/wgs_ingestion/iam.tf` -- IAM roles and policies for the pipeline
+4. `$INFRASTRUCTURE_PATH/modules/aws/wgs_ingestion/eventbridge.tf` -- EventBridge rule that triggers on SFN failures
+5. `$INFRASTRUCTURE_PATH/modules/aws/wgs_ingestion/dynamodb.tf` -- DynamoDB table and index definitions
+
+The execution name format is `{wgs_ingestion_id}_{kit_id}_{timestamp}`.
+
+## Step 4: Classify the Failure
+
+**Default to Bug.** Only classify as Transient if you can point to specific evidence (see criteria below).
+
+- **Bug**: Code error, unhandled exception, missing IAM permissions, missing config, infrastructure misconfiguration. Requires a code or infra fix. **This is the default classification when the root cause is unclear.**
+- **Transient**: A failure that meets ALL of these criteria:
+  1. The error is a network timeout, AWS throttling, or a known transient pattern (see below)
+  2. There is no underlying code/config/IAM issue that caused it
+  3. A redrive would be expected to succeed WITHOUT any code or infrastructure changes
+- **Data issue**: Bad input, missing files, malformed data. Requires manual intervention.
+
+You MUST justify your classification in the Root Cause section. If classifying as Transient, explicitly state why a redrive would fix it without code changes.
+
+### Example Transient Errors
+
+These LOOK like data issues but are known transient -- classify as **Transient**:
+
+- **`INTERSECT_VARIANTS` / `KeyError: 'CHR:POS:A0:A1'` / "No variants in intersection"**: Intermittent failure in `pgsc_calc` during PRS generation. Resolves on redrive.
+
+### Example Bug Patterns
+
+These may LOOK transient but are bugs -- classify as **Bug**:
+
+- **S3 403 Forbidden on HeadObject/GetObject/PutObject**: Usually a missing IAM permission on the task role, not a temporary auth issue. Check the relevant IAM policy in infrastructure. Example: BIOENG-535 where `genomics-bam-subset-processor` was missing `s3:GetObject` on its output bucket.
+- **S3 404 Not Found on expected files**: Could indicate a missing deployment artifact, misconfigured path, or a race condition in the pipeline -- not transient.
+- **Persistent STS/credential errors on FARGATE_SPOT**: If the same error recurs on redrive or appears on non-spot tasks, it is an IAM issue, not credential expiration.
+
+## Step 5: Write the Report
+
+Write the report file as: `reports/YYYY-MM-DD_<first-8-chars-of-wgsIngestionId>.md`
+
+The `reports/` directory is in the current working directory. Verify with `Glob` that the directory exists before writing. If it does not exist, create it.
+
+Keep the report concise. Only include log lines that are directly relevant to explaining the failure cause.
+
+```
+# WGS Ingestion Failure Report
+
+## Summary
+
+| Field | Value |
+|-------|-------|
+| Date | YYYY-MM-DD HH:MM UTC |
+| Correlation ID | ... |
+| WGS Ingestion ID | ... |
+| Execution Name | ... |
+| SFN Error | ... |
+| SFN Status | ... |
+
+## Key Logs
+
+Only the log lines that explain the failure (oldest first):
+
+- `TIMESTAMP` [LEVEL] message (logGroup: ...)
+
+## Root Cause
+
+<1-3 sentences. What failed and why.>
+
+## Classification
+
+**<Transient | Bug | Data issue>**
+
+## Recommended Action
+
+<1-2 sentences.>
+
+### Redrive JSON
+
+If transient, include:
+
+{
+  "executionIds": ["<execution-name>"]
+}
+
+Env-task name: `redrive-wgs-ingestion-execution`
+```
+
+## Rules
+
+- Do NOT ask for user input. Work fully autonomously.
+- Do NOT include PII/PHI. Only UUIDs, error codes, timestamps, status values.
+- Do NOT use Bash commands. Use only Read, Glob, Grep, Write, and mcp__axiom__queryDataset.
+- If Axiom queries fail, proceed with code analysis and note the gap in the report.15:["$","div","/Users/gabry/Desktop/wgs-ingestion-bot",{"className":"mb-8","children":[["$","div",null,{"className":"flex items-center gap-2 mb-3","children":[["$","span",null,{"className":"font-mono text-xs text-text-dim","children":["[","WGS-INGESTION-BOT","]"]}],["$","span",null,{"className":"text-xs text-text-dim font-mono","children":"~/Desktop/wgs-ingestion-bot"}]]}],["$","$L11",null,{"commands":[{"name":"investigate-wgs-ingestion","body":"$20","filePath":"/Users/gabry/Desktop/wgs-ingestion-bot/.claude/commands/investigate-wgs-ingestion.md","scope":{"type":"project","projectName":"wgs-ingestion-bot","projectPath":"/Users/gabry/Desktop/wgs-ingestion-bot"}}],"scopePath":"/Users/gabry/Desktop/wgs-ingestion-bot"}]]}]