mishkan-harness 0.2.4 → 0.2.5

package/README.md

@@ -14,7 +14,7 @@ MISHKAN turns Claude Code into a standing engineering organisation. Quality and
 
 It's personal, opinionated infrastructure built around one engineer's standards. To make it yours, replace `docs/engineer/profile.md` and re-sync — nothing else hardcodes the author.
 
-> **v0.2.4** — agent fleet, rules, hooks, installer are stable. Cognee knowledge stack ready to bring up locally. Observability stack (watchd + TUI) available as two `uv tool`-installable packages.
+> **v0.2.5** — agent fleet, rules, hooks, installer are stable. Cognee knowledge stack ready to bring up locally. Observability stack (watchd + TUI) available as two `uv tool`-installable packages.
 
 ---
 

package/docs/usage/01-installation.md

@@ -59,7 +59,7 @@ cd ~/path/to/harness
 node bin/mishkan.js install
 ```
 
-Or via npx (published from v0.2.0):
+Or via npx (published to npm):
 
 ```bash
 npx mishkan-harness install

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mishkan-harness",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "MISHKAN — a personal advanced SWE R&D harness for Claude Code: 45 biblically-named agents across six teams, deterministic rules + hooks, a shared research pipeline, dependency/supply-chain vetting, and a Cognee-backed knowledge graph. Installs into ~/.claude.",
   "type": "module",
   "bin": {

package/payload/mishkan/observability/watch/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "mishkan-watch"
-version = "0.1.0"
-description = "MISHKAN observability TUI — Textual client that reads the mishkan-watchd UNIX socket and renders the 5-tab dashboard."
+version = "0.2.5"
+description = "MISHKAN observability TUI — Textual client that reads the mishkan-watchd UNIX socket and renders the 8-tab dashboard."
 readme = "../README.md"
 requires-python = ">=3.11"
 license = {text = "MIT"}

package/payload/mishkan/observability/watch/src/mishkan_watch/__init__.py

@@ -1,3 +1,3 @@
 """MISHKAN observability TUI — mishkan-watch."""
 
-__version__ = "0.1.0"
+__version__ = "0.2.5"

package/payload/mishkan/observability/watchd/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mishkan-watchd"
-version = "0.1.0"
+version = "0.2.5"
 description = "MISHKAN observability daemon — aggregates event bus + filesystem polls into a UNIX-socket snapshot+delta stream for mishkan-watch."
 readme = "../README.md"
 requires-python = ">=3.11"

package/payload/mishkan/observability/watchd/src/mishkan_watchd/__init__.py

@@ -1,3 +1,3 @@
 """MISHKAN observability daemon — mishkan-watchd."""
 
-__version__ = "0.1.0"
+__version__ = "0.2.5"

package/docs/engineer/profile-readable.md

@@ -1,201 +0,0 @@
-# Y4NN — Developer Profile
-*Human-readable companion to `profile.md` (this directory). Narrative form. Present-state only.*
-
----
-
-## I. Who You Are
-
-You are Ragnang-Newende Yanis Axel Dabo, known online as Y4NN and on GitHub as `Y4NN777`. Your day-job title is Junior Software Engineer, but the title and the role do not describe the same thing. Inside the company you are documented as *Mainteneur Staging & Production @ OGUN* — the engineer who owns the operational delivery pipeline for the entire Aïobi product suite. You report into an unnamed CTO / Direction Technique and collaborate with a small structured team built around clear divisions of labour. You are not solo, but on the deploy-and-operate axis you are the single point through which every Aïobi service reaches production.
-
-You are based on the France–Africa axis, working inside a company building sovereign tech infrastructure for the African market. You read, write, and code-switch between French and English with deliberate intent: French for internal meta-work, corrections, and narrative; English for technical artifacts, architecture documents, and command-line work. The brand mark *Aïobi* always carries the tréma — never *Aiobi* — and this typographic precision is treated as engineering correctness, enforced in commits, scripts, and design docs alike.
-
----
-
-## II. Where You Sit in the Team
-
-The Aïobi engineering org is small and structured around capability, not seniority. Above you sits the CTO / Direction Technique, unnamed in commits but referenced as the governance and review layer (you produce DOCX reports for them at sprint cadence). Beside you sit the feature engineers and the infra team. The feature engineers are Youssouf Kouanda (`OGUN-kal`), who leads Forms development and gates every merge request; Cephas Congo (`LEGBA-8I`), who co-develops the eshu AI assistant backend with you as an equal partner; and historically Antoine Lebaud, who built the original AïobiMeet codebase before you took over its ops and deploy layer. The infra team is HERMES, who provision hardware, with Cheick Oumar Tarnagueda (`OGUN-TCO`) providing ongoing ops support.
-
-Your seat is the bridge between feature development and infrastructure. Features land in repos, you take them through staging, harden them, deploy them, monitor them, and respond when they break. On one project — Aïobi-IAM — you are both the feature engineer and the operations engineer; you built it from scratch alone and you keep it running. On another project — AïobiOS-Guidance — you operate outside the team entirely, as a sole author of a thesis-grade Linux distribution that sits one layer below the entire Aïobi software stack.
-
-The team has clear boundaries but no platform or SRE specialist. You are already partially filling that gap by default. The aspiration of growing into a Platform / SRE role is therefore not a career pivot — it is a promotion within the seat you already occupy.
-
----
-
-## III. The Surface You Own
-
-Across the last three months you have produced 626 commits, 66,115 insertions, 11,265 deletions, and touched 1,501 files. That volume is spread across five active production-or-near-production repositories plus one personal thesis project and one harness-research project. The shape of that surface matters more than the totals.
-
-**Aïobi-IAM** is your strongest piece of work in the suite. You are its sole author, with 115 commits accounting for 100% of the codebase. Stack is Keycloak 20 with a custom Java SPI (`aiobi-user-provider`), realm configuration as YAML, theme bind-mounts for upgrade-survivable customisation, and a docker-compose hardening overlay always re-applied on recreate. The project follows the SWE-BASICS-BEFORE-CODE framework verbatim: a locked sequence of PRD, SRS, CONTRACT, ARCHITECTURE, and MODELING documents, with implementation deferred until those five are stable. The rollback runbook captures baseline state (user count, IdP count, OIDC status) before any deploy and treats rollback as an idempotent rerun of the deploy with destructive teardown in front. This is the project where the most discipline shows because nobody else's hands are on it.
-
-**AïobiMeet** is the most visible service in the suite. You did not write it originally — Antoine Lebaud authored 1,388 historical commits before your involvement — but since early 2026 you have owned its operations, deployment, and infrastructure. Your 320 commits concentrate in `docker/production`, `docker/staging`, `gitlab-ci.yml`, Keycloak realm configuration, Prometheus and Grafana monitoring, and Whisper ASR tuning. You have handled more than thirty staging incidents and eleven production incidents on this service alone, each documented in dated incident reports with timeline, root cause, and resolution. When you say you built Meet, the more precise statement is: you rebuilt and continue to own everything below the application layer, and you ship every release.
-
-**aiobi-form (Forms)** is co-owned. The feature work belongs to Youssouf Kouanda, who has merged more than twenty-five MRs in the last eight weeks. Your fifty-five commits concentrate in the production deployment infrastructure: `deploy-remote.sh`, the nginx production configuration, Traefik ingress hardening, IAM integration, staging bootstrap, and emergency hotfixes. You authored the manual security audit that catalogued forty-six findings across critical, high, and medium severity.
-
-**aiobi-docs** is the collaborative editor service forked from Impress. You contribute fifty commits in deployment and IAM integration. The most notable artifacts here are ADR-0001, which evaluates four CRDT libraries and three OT frameworks in a full trade-off matrix before locking the Yjs decision, and the staging recovery postmortem from 12 May 2026 that identifies *two* independent root causes (one applicative, one network) and explicitly refuses single-cause oversimplification.
-
-**eshu** is the AI assistant platform. You and Cephas Congo work as equal partners with thirty-seven and thirty-six commits respectively. He develops the backend features; you handle integration, OAuth flows, and production release. The stack is FastAPI with Vue 3, Capacitor for mobile, and a production AI integration layer using LangChain, CrewAI, ChromaDB, sentence-transformers, and several model providers (Groq, OpenAI, Google).
-
-**AïobiOS-Guidance** is the project that does not appear in your team repository at all. It lives at `/home/ogu/Projects/AïobiOS-Guidance/` and consists of 942 lines of shell across ten scripts and 2,549 lines of doctoral-level engineering logs across seven markdown files. It is a custom Ubuntu 24.04 LTS distribution built via Cubic chroot, hardened, debloated, branded, and persisted across upgrades using `dpkg-divert` on every vendor-controlled file. The methodology is academic in rigor: nineteen distinct issues are numbered continuously across the logs, each traced to the correct abstraction layer (one issue took six hours to trace from a CSS symptom through the Yaru gresource layer down to the AccountsService D-Bus root cause). Abandoned approaches are archived in an `_abandoned/` folder for thesis traceability. This is the work that proves you can operate at OS and systems level, not just application and infrastructure level.
-
-**MISHKAN** is the harness research project. The design document is 815 lines specifying a forty-five-agent virtual SWE organisation built natively on Claude Code, with six teams, a shared research pipeline, a five-layer architecture, a knowledge-promotion model, and a token-optimisation layer. The naming, structure, and sequence are locked; the implementation is unwritten. This is the work that signals AI-engineering research depth.
-
----
-
-## IV. The Work in Numbers
-
-The window I can see covers roughly the last three months of active development. In that window:
-
-- 626 commits across 5 active repositories
-- 66,115 insertions, 11,265 deletions
-- 1,501 distinct files touched
-- 5 distinct stacks shipping in parallel: Python, PHP, JavaScript/TypeScript, Java SPI, Bash
-- 4 environments per service: dev, staging, prod, and a secure hardened variant
-- Two daily peak windows (10:00–14:00 CET, 16:00–23:00 CET) with occasional late-night hotfix bursts between 00:00 and 04:00
-- One sustained hotfix burst of 4 production commits in 22 minutes on 12 May 2026
-- 268 `.gitlab-ci.yml` touches across repos — CI is not an afterthought, it is treated as primary infrastructure
-
-The volume is mid-level engineer output, sustained from a junior seat, across a surface area that would normally be split between two or three people.
-
----
-
-## V. How You Work
-
-### Methodology
-
-You do not ship before deciding. The clearest evidence is Aïobi-IAM, where five design documents are locked sequentially before implementation begins: a Product Requirements Document defines the problem and users, a Software Requirements Specification translates that into use cases and constraints, a Contract document fixes the invariants and guarantees the service must hold, an Architecture document chooses the structure, and a Modeling document defines the entities and protocols. Only then does code follow. The same pattern repeats in MISHKAN, where 815 lines of architecture specification precede the writing of any agent.
-
-This is paired with a verification-first debugging discipline that is explicit in your memory files. Guess-based reasoning is rejected by name — *soupçon* is the word you flag — and every fix must be anchored in an exact stacktrace, HTTP status code, or log line before it is attempted. When you identify the cause of an incident, you look for two: the staging recovery postmortem of 12 May identifies one applicative cause (environment placeholder substitution failure) and one network cause (residual Docker iptables on a dead bridge), both necessary for the incident, neither sufficient alone, and refuses to collapse them into a single tidy story.
-
-You operate under a durable-solutions rule. Workarounds — `sed` substitutions in CI, manual patches on production, temporary hacks intended to be cleaned up later — are rejected at the design stage. Any solution must work in production from the moment it lands, or it does not land.
-
-You enforce scope discipline. The pattern that appears most often in your AI corrections is the refusal of "au passage" expansion: when you specify a fix to two slider issues, you reject the introduction of a constant extraction and a ternary cleanup alongside it. The fix is the fix. Refactor decisions happen separately, with their own scoping.
-
-### Cadence
-
-Your weekly rhythm is steady but bursty. Two daily peak windows handle the majority of code work: a morning block from roughly 10:00 to 14:00 CET, and an afternoon-into-evening block from 16:00 to 23:00. Late-night activity from midnight to 04:00 correlates almost perfectly with production incident response. The 12 May overnight sprint — four prod commits in twenty-two minutes — is the signature of a single engineer working a cascading Traefik, nginx, and IPv6 health-check failure under time pressure. Weekend activity is absent in the sample window.
-
-### Commit and deployment hygiene
-
-Your commit format is strict and personal. Every commit takes the shape `type(scope) short description`, with body text spanning five to fifteen lines and including environment details, error logs, root cause, and alternatives considered. No emojis. No `Co-Authored-By` trailers. Lowercase subjects, no terminating period. The shared server protocol you follow requires `GIT_COMMITTER_NAME="TheY4NN777"` and an explicit `--author` flag on every commit, with strict prohibition on modifying the local git config. The body language flows freely between French and English depending on the audience for the message.
-
-The deployment flow is continuous and solo-managed: staging first, then validation, then a merge request from `develop` into `main`, then production. There is no semver tagging and no formal changelog except in Forms. The narrative history lives in three places — the git log, the structured DEPLOYMENT-LOG files per service per environment, and the integration journals under `docs/ops/`. CI runners live on `ops-serv` (10.13.13.14) and deploy via SSH-direct to the production runtime on `Aïobi Master` (207.180.255.229, internally 10.13.13.1), which is treated as a pure runtime with no CI presence. Health polling, hash-based config drift detection, and idempotent restart patterns are baked into every deploy script.
-
-### Documentation as habit
-
-You write extensively, almost compulsively, but always for builders rather than for end users. Your READMEs are terse — fifty to one hundred and fifty lines — because the audience already knows the system. Your design documents are heavy — three hundred to eight hundred lines — because the audience is the future engineer who has to maintain it. Runbooks are written for copy-paste safety under stress: each command is one possible failure mode, no thinking required, no parsing required. Integration journals run chronologically through gotchas and decisions, sometimes spanning eight hundred lines for a single integration phase. Postmortems are blameless and rigorous; the 12 May staging recovery doc opens with the line "not a récit pour bien paraître" — not a story written to look good.
-
-The corpus across all your projects totals roughly 654,000 tokens spread over 325 documentation files. Ninety percent of those files are written in French. They cluster into thirteen distinct document types: design specs, incident reports, postmortems, runbooks, integration journals, handover notes, architecture documents, audit reports, READMEs, deployment logs, session memory files, ADRs, feature specs, and TODO trackers. The corpus is dated, templated, and strongly interlinked. It is ready for RAG ingestion with minimal preprocessing.
-
----
-
-## VI. How You Work With AI
-
-You are an exclusive Claude Code user. There is no Cursor, no Windsurf, no Aider, no Continue, no Copilot in your stack. This is a deliberate choice, not a default — you have invested heavily in customising one tool well rather than spreading effort across many.
-
-Your customisation lives in `~/.claude/`. Five user-level agents are installed, the most developed being `aiobi-ops` — a forty-kilobyte specialist agent that distills the operational knowledge of running the Aïobi suite: more than twenty documented gotchas, more than fifteen incidents with resolution patterns, full topology awareness across Meet, Forms, IAM, Docs, and eshu. Eight slash commands handle recurring workflows like EPCT, explore, run-tasks, and watch-ci. Two bash aliases — `cc` and `ccc` — wire Claude in with skip-permissions for trusted flows. A pre-tool-use hook implemented in bun TypeScript validates every Bash invocation. The MEMORY.md system is maintained religiously: ninety-three memory files across all projects, totalling roughly forty-eight thousand tokens, distilled from session transcripts into permanent knowledge that survives session boundaries.
-
-Your delegation pattern is asymmetric and precise. Generative work — UI, CSS, SVG, animations, config templates, YAML, Keycloak SPI boilerplate — you delegate freely and accept one-shot. Stateful operations — `git push`, SSH to production, `docker exec` on production, sudo commands, schema migration execution, log forensics execution — you delegate to zero degree. Claude analyses log output; you run the command that produced it. This rule is explicit in your memory files and consistent across hundreds of session lines. You have already solved, intuitively and durably, the AI-safety question that most engineering teams are still working out.
-
-Your prompting style has evolved across sessions. Early in a project, your prompts are highly structured: explicit JSON-like blocks with `tâche`, `entrée`, `format_de_sortie`, and `exigences` keys, averaging just over a thousand characters. Late in a session, the format shifts to conversational and terse, often French command-style, with long messages dominated by terminal log dumps rather than instruction. Under pressure, the structure returns — you scale prompt rigor with task difficulty, which is the right direction. Your language code-switches deliberately: French dominates when you express frustration, narrate progress, or correct sharply, while English dominates when you issue terminal commands, reference framework names, or quote error messages.
-
-There is a measurable friction tax in your sessions, on the order of three to five percent of session time. The friction is process-shaped, not skill-shaped. The same corrections recur: commit format compliance has been corrected one hundred and twenty-nine times across sessions, Keycloak session persistence one hundred and twenty-five times, `git push` coordination fifty-three times, database schema synchronisation twenty-nine times. These are not problems you do not understand; they are problems your AI tooling has not yet been engineered to remove. They are the natural target for harness-level fixes.
-
-A separate signal worth noting: your typo density triples after 23:00 UTC, and your prompts shift in shape from structured to raw terminal dumps. Late-night sessions correlate with production incidents and produce higher error rates from Claude. This is a fatigue pattern visible in the data.
-
----
-
-## VII. The Body of Documentation You Have Built
-
-The 654,000 tokens of documentation you have produced is unusual at your tenure. It is not journal entries or scratch notes — it is structured, dated, interlinked, audience-aware engineering documentation. Twenty documents stand out as particularly high-value: the IAM design suite (PRD through MODELING), the integration journals for Forms and Docs onto IAM, the staging bootstrap journal for aiobi-docs, the cross-suite handover notes, the 12 May staging recovery postmortem, the IAM refactoring plan for aiobi-docs, the 10 April production deployment incident on Meet, the ecosystem topology snapshot from 21 April, the production deployment runbook for Keycloak, and several others.
-
-The entity density inside this corpus is high. More than twenty distinct services are named (Keycloak, PostgreSQL, Redis, Celery, Whisper, MinIO, LiveKit, Nginx, Traefik, Grafana, Sentry, GlitchTip, Loki, and others). More than thirty distinct configuration keys appear repeatedly across documents. Fifteen ports, three Keycloak realms, three IP subnets, four named hosts, multiple deployment phases, security artifacts including CVE references, and dependency versions are all consistently spelled and consistently linked. This is the property that makes a knowledge graph viable: the docs already speak in graph nodes, you just have not yet extracted them.
-
-There are quality flags. Forty-two TODO and FIXME markers exist across runbooks and incident logs. Thirty-three documents are explicitly marked as superseded or live in archive folders. Two factual contradictions exist between documents (most notably the infrastructure host name OVH versus Contabo, resolved in memory but not yet in the docs themselves). Seven documents mix French and English within a single body. No status frontmatter convention has been adopted, so the distinction between draft, live, and superseded lives only in the directory structure and in your head. These are addressable, not severe, but they shape what a RAG layer would have to handle.
-
----
-
-## VIII. Where You Are Strong
-
-You have unusual operational mastery for someone with a junior title. You run five production services across five stacks single-handed on the deploy and operate axis, you have sustained mid-level engineer commit velocity for at least three months, and the production system has not broken in any way that the documentation does not record and explain. The discipline that holds this together is real: idempotent rollback runbooks with pre-flight state capture, hash-based config drift detection in CI, dual root-cause identification in postmortems, copy-paste-safe runbooks under incident pressure.
-
-You have deep Keycloak expertise. The custom Java SPI you wrote, the realm YAML hardening, the bind-mount theme persistence pattern, the Infinispan JDBC session persistence configuration, the SSO federation across four applications, and the UTF-8 byte-level reconstruction (`printf '\xc3\xaf'`) in your shell scripts together represent a domain depth that is rare outside specialist identity teams.
-
-You have doctoral-level engineering methodology when you choose to apply it. The IAM design suite is one example; the AïobiOS engineering logs are the stronger one. Nineteen issues numbered continuously, each traced through the correct abstraction layer, with abandoned approaches archived rather than deleted, is a documentation practice most engineers never adopt at any career stage.
-
-You have unusual AI-tooling intentionality. The 40 KB `aiobi-ops` specialist agent is not how most engineers use Claude; it is how a few harness-builders use it. The MEMORY.md discipline is sustained, not aspirational. The asymmetric delegation rule is internally consistent. The MISHKAN spec is original research-grade work in a discourse most engineers do not engage with. The bash command validator hook, written in bun TypeScript, is the kind of detail that signals harness-first thinking.
-
-You have a rigorous debugging discipline. Verification-first, no soupçon, dual root cause when warranted, exact-stacktrace-before-fix. This is a senior-shaped habit applied at junior tenure.
-
-You have brand-and-precision discipline that crosses from typography into engineering. The Aïobi tréma enforced in every file is the cosmetic version; the UTF-8 byte-level work in shell scripts and the strict commit format are the engineering version. They are the same instinct.
-
-You have a security practice that, while not yet automated, is consistently applied: a SECURITY.md file per repo with a disclosure email, CVE references inline in dependency files (`# CVE-2024-33663 fix`), SOPS for secret management, Keycloak SSO as the single identity source for the suite, rate-limiting on FastAPI endpoints, and hardening overlays always re-applied on container recreate.
-
----
-
-## IX. Where the Work Is Not Done
-
-There are three categories of gap. They are not equivalent and they do not have the same fix paths.
-
-### Skills you have not yet acquired
-
-You have no Kubernetes. Your container orchestration ceiling is Docker Compose with multi-environment overlays, hand-rolled and excellent at that scale, but Kubernetes is the lingua franca above that scale and you do not yet speak it. You have no Terraform, Pulumi, or Helm — your infrastructure-as-code practice is imperative bash, not declarative state. You have no Go and no Rust — both languages matter for the platform and systems work your stated trajectory points toward. You have no formal SLO practice — Prometheus and Grafana are deployed, but no SLI definitions, no error budgets, no burn-rate alerts, no published SLO documents. You have no distributed-systems primitives in production — no service mesh, no mTLS between services, no circuit breakers, no formal RPC framework. You have no threat model as an artifact — security thinking is pervasive in your code but no STRIDE document, no attack tree, no formal per-system or per-service threat model exists.
-
-### Practices you have not yet automated
-
-You audit dependencies and reference CVE IDs in comments, but you do not gate your CI pipelines on SAST. No semgrep, no bandit, no trivy, no gitleaks, no OSV-Scanner blocks any merge. The practice is in your hands; it is not in the pipeline.
-
-Your documents do not close. Many integration journals and handover notes are marked "à valider avec le mainteneur" indefinitely, sitting at 836 lines without a closing version. There is no status frontmatter convention distinguishing draft, live, and superseded states. The closure ritual is missing.
-
-Your changelogs are not automated. Only Forms has a CHANGELOG.md; the rest of the suite uses the git log as an implicit changelog. The commits are conventional enough that `git-cliff` or a similar tool would auto-generate clean changelogs in under an hour of work per repo.
-
-Your test coverage varies. The aiobi-form and aiobi-docs repos have working test suites (phpunit and vitest respectively); IAM and eshu have weaker coverage. The pattern is shippable code without locked behaviour.
-
-Your AI friction is reactive. The 129 commit-format corrections and 125 session-persistence corrections in your transcript history are process problems, not knowledge problems. They recur because the rules live in memory files but are not yet baked into project initialisation, pre-commit hooks, or harness-level constraints.
-
-You have no late-night deploy rule. The data shows your prompt quality degrades after 23:00 UTC and your incidents cluster in that window. The rule does not yet exist in your `~/.claude/CLAUDE.md`.
-
-### Tooling you have designed but not built
-
-Cognee — the shared knowledge graph that MISHKAN's design depends on — is specified but not deployed. No instance is running.
-
-No MCP servers are configured in any of your projects. There are zero `.mcp.json` files across the suite. The Cognee integration, the filesystem integration, the git integration, and the security-scanner integration MISHKAN envisions all remain unbuilt.
-
-MISHKAN itself is 815 lines of design and zero lines of code. The decisions about Cognee deployment mode, local model runtime, and per-project versus user-level installation scope are still open. The agent system prompts, CLAUDE.md templates, rules content, hook implementations, skill content, curated library content, graph schema, observability pipeline, and model routing configuration are all listed in the design document as explicitly not-yet-designed.
-
-The RAG-CLI you described — the internal knowledge graph plus retrieval system over your engineering corpus — exists only in conversation. The corpus is ready; the system is not.
-
-Your MEMORY.md flat-file pattern has reached its ceiling. Ninety-three files spanning forty-eight thousand tokens, manually cross-referenced, is the largest you can carry in this format. Migration to a graph store is the natural next step.
-
-You have not yet built any Go binary for internal tooling. That language gap and the tool gap point at each other and resolve together.
-
----
-
-## X. What Is Currently Open
-
-The active work in flight is concentrated. On Aïobi-IAM, version 1.0.x is in production while 1.1.x continues; the SPI bind-mount priority escalation is open in the backlog, the Docker boltdb cleanup is acknowledged as technical debt, and the full federation across Meet and eshu is pending. The 06_IMPLEMENTATION design document is the next sequenced artifact.
-
-On Aïobi Forms, Phase 1 IAM hardening has shipped to production and Phase 2 pre-prod finition is in flight, including silent SSO deployment and JWT hardening. The forty-six audit findings are partially remediated.
-
-On aiobi-docs, staging is active and production is pending. The IAM theme migration to prod, the logout flow finalisation, the postmortem follow-ups from 12 May, and the realm_events_listener bug from 11 May are all open.
-
-On eshu, the OAuth and prod setup phase is the current focus, including the Google and Apple OAuth flows and the registry migration from 10.13.13.1 to 10.13.13.14.
-
-On AïobiMeet, the recurring open items are session persistence across Keycloak restarts, the unresolved Whisper ASR performance divergence between staging and production (suspected but unconfirmed AVX-512 CPU instruction set difference), SSO session timeout tuning, and ongoing cAdvisor memory limit adjustments.
-
-On AïobiOS-Guidance, the locked work covers user stories US-1.1 through US-1.4 (debloat, security hardening, persistent branding, GDM customisation). The next phases are AppArmor or SELinux policy authoring, LUKS encryption integration, Secure Boot signing, and ISO build automation. No CI exists yet for this project. Public release preparation is pending.
-
-On MISHKAN, the design is locked, the build has not started. The decisions blocking Phase 0 are: which deployment mode for Cognee, which local model runtime to use for the local-model agents, and whether to install at user level or per-project. Beyond those three decisions, agent system prompts, CLAUDE.md templates, rules content, hooks, skills, curated library content, the graph schema, the observability pipeline, and model routing all remain to be designed before implementation.
-
-On the RAG-CLI vision, the corpus is ready and the architecture has been discussed in conversation, but no code exists.
-
----
-
-## XI. Closing Note
-
-This document describes the present state without comparison to seniority levels, without aspirational framing, and without prescription. The work you have done is what it is. The work that remains is what it is. The strengths are evidence-anchored to specific repositories, files, and commit patterns. The gaps are factual — the named tools, named practices, and named systems that are absent from your stack today.
-
-The shape of the next quarter is determined by which of the open items you pursue, in what order, and at what depth. The shape of this document is what an agent — yours, mine, or one built into MISHKAN — should be able to load as context to operate alongside you with full awareness of who you are, how you work, what you own, and where the work is going.
-
----
-
-*Present-state profile. Updated on milestone events, role changes, or material scope shifts. Paired with `profile.md` (agent-loadable structured form, this directory).*

package/docs/engineer/profile.md

@@ -1,754 +0,0 @@
----
-name: y4nn-profile
-description: Canonical developer profile of Y4NN. Loaded as cached context by MISHKAN agents.
-type: developer_profile
-version: 1.0
-last_updated: 2026-05-27
-scope: agent-loadable
-language: en
----
-
-# Y4NN — Developer Profile
-
-## 0. Identity
-
-```yaml
-legal_name: Ragnang-Newende Yanis Axel DABO
-handle: >_TheY4NN
-github: Y4NN777
-emails:
-  - yanisaxel.dabo@aiobi.world  # primary work
-  
-  - nage-remorqueur8o@icloud.com  # claude.ai account
-git_authors:
-  - TheY4NN777 <yanisaxel.dabo@aiobi.world>
-  - Yanis Axel Dabo <yanisaxel.dabo@aiobi.world>
-machine_identities:
-  - ogu  # current
-  - aiobi6  # prior
-title: Junior Software Engineer
-internal_role: Mainteneur Staging & Production @ OGUN
-employer: Aïobi
-languages:
-  - fr  # primary, all internal/meta work
-  - en  # secondary, technical artifacts and code
-location: France/Africa axis (Aïobi = sovereign African tech ecosystem)
-brand_rule: "Aïobi" with tréma — never "Aiobi"
-```
-
-## 1. Operating Role
-
-Build-and-deploy engineer for the Aïobi product suite. Bridge between feature development and infrastructure operations. Owns the operational delivery pipeline end-to-end across five production services. Sole owner of one (IAM). Builder of one independent thesis-grade project (AïobiOS).
-
-```yaml
-role_components:
-  - feature_engineering   # full-stack, multi-stack
-  - deployment_engineering  # staging + prod for entire suite
-  - devsecops_practice      # hardening, secret management, audits
-  - incident_response       # primary on-call
-  - documentation_authoring # design specs, runbooks, postmortems
-  - ai_tooling_engineering  # custom agents, harness design
-reports_to:
-  - cto: unnamed (Direction Technique Aïobi)
-collaborates_with:
-  - youssouf_kouanda: Forms feature lead + MR gate (OGUN-kal)
-  - cephas_congo: eshu backend co-developer (LEGBA-8I)
-  - cheick_oumar_tarnagueda: ops support (OGUN-TCO)
-  - hermes_team: hardware/server provisioning
-  - antoine_lebaud: original AïobiMeet author (less active)
-```
-
-## 2. Surface Owned
-
-### 2.1 Aïobi-IAM (sole owner)
-```yaml
-status: production
-stack: Keycloak 20 + custom Java SPI + realm YAML + theme bind-mounts
-ownership: 100%
-commits_in_window: 115
-artifacts:
-  - SWE-BASICS-BEFORE-CODE design suite: 01_PRD → 05_MODELING (locked)
-  - Custom SPI: aiobi-user-provider (Java, compiled in-pipeline)
-  - Hardening overlay (docker-compose.hardening.yml)
-  - Rollback runbook with pre-flight state capture
-  - Integration journals for Forms / Docs / Meet onboarding
-boundary: builds, integrates, hardens, deploys, operates
-```
-
-### 2.2 AïobiMeet
-```yaml
-status: production
-stack: Django + React + LiveKit + FastAPI + Keycloak SSO
-ownership: ops/infra/deploy (not original author)
-original_author: Antoine Lebaud (1388 historical commits)
-commits_in_window: 320
-boundary:
-  owns: docker/production, docker/staging, gitlab-ci.yml, Keycloak realm config,
-        Prometheus/Grafana setup, Whisper ASR tuning, hotfixes, deploys
-  does_not_own: original feature architecture, core conferencing logic
-incidents_handled: 30+ staging errors, 11 prod errors documented
-```
-
-### 2.3 aiobi-form (Forms)
-```yaml
-status: production
-stack: Laravel 11 + Nuxt 3 (dual-licensed AGPLv3 + proprietary)
-ownership: deploy + IAM integration + ops + production hotfixes
-feature_lead: Youssouf Kouanda
-mr_gate: Youssouf Kouanda (25+ merges in 8 weeks)
-commits_in_window: 55
-boundary:
-  owns: deploy-remote.sh, nginx-prod.conf, Traefik ingress, IAM integration,
-        staging bootstrap, prod hotfixes
-  does_not_own: feature development (Youssouf), core Notion-Forms fork (Julien Nahum upstream)
-audit_findings: 46 (critical/high/medium catalogued)
-```
-
-### 2.4 aiobi-docs
-```yaml
-status: staging active, prod pending
-stack: Django + Yjs/CRDT + React (Impress fork)
-ownership: deploy + IAM integration + staging
-commits_in_window: 53
-artifacts:
-  - ADR-0001 (Yjs CRDT decision, full trade-off matrix)
-  - Postmortem 2026-05-12 (staging recovery, dual root cause)
-  - Refacto plan 02 (52 KB)
-boundary:
-  owns: staging deploy, IAM theme + logout flow, CI/CD
-  shared: core docs platform (Anthony LC, Manuel Raynaud upstream)
-```
-
-### 2.5 eshu
-```yaml
-status: in development, OAuth + prod setup phase
-stack: FastAPI + Vue 3 + Capacitor + LangChain + CrewAI + ChromaDB
-ownership: integration + prod release (equal partnership)
-co_developer: Cephas Congo
-commits_in_window: 37 (Cephas: 36)
-boundary:
-  owns: prod setup, OAuth flows, deploy pipeline, develop→main merges for prod
-  does_not_own: backend feature development (Cephas)
-```
-
-### 2.6 AïobiOS-Guidance (personal/thesis)
-```yaml
-status: late prototype / pre-production
-location: /home/ogu/Projects/AïobiOS-Guidance/  (not in /theY4NN/)
-type: thesis-grade Ubuntu 24.04 LTS customisation
-stack: Cubic chroot + dpkg-divert + bash + GRUB + Plymouth + GDM + Yaru
-code_volume: 942 LOC shell across 10 scripts
-docs_volume: 2549 lines markdown across 7 engineering logs + guides
-ownership: 100% sole author
-methodology: doctoral — 19 issues numbered continuously, each traced to root cause across abstraction layer (CSS → Yaru gresource → AccountsService D-Bus → dpkg-divert)
-visibility: private — not yet public
-```
-
-## 3. Velocity Snapshot
-
-```yaml
-window: ~3 months (recent)
-total_commits: 626
-insertions: 66115
-deletions: 11265
-files_touched: 1501
-repos_active: 5 (+ AïobiOS personal)
-stacks_active: 5 (Python, PHP, JS/TS, Java SPI, Bash)
-environments_per_service: 4 (dev, staging, prod, secure)
-cadence:
-  peak_hours_cet: [10-14, 16-23]
-  hotfix_bursts: 00-04 CET, late-night
-  weekday_only: true
-  recent_hotfix_density: 4 prod commits in 22 minutes (2026-05-12 02:00-02:22)
-```
-
-## 4. Demonstrated Stack
-
-### 4.1 Languages (actively shipping)
-```yaml
-python:
-  level: strong
-  evidence: FastAPI async + Pydantic + Alembic + asyncpg, Django production, LangChain/CrewAI/ChromaDB integration
-php:
-  level: working
-  evidence: Laravel 11 production, Eloquent ORM, blade templates
-typescript_javascript:
-  level: strong
-  evidence: Nuxt 3 SSR, React, Vue 3, Vitest, component libraries, i18next
-java:
-  level: working
-  evidence: Keycloak SPI compilation, enum refactor, test suite (aiobi-user-provider)
-bash:
-  level: strong
-  evidence: deploy-remote.sh patterns, AïobiOS scripts, dpkg-divert orchestration, UTF-8 byte-level reconstruction
-yaml:
-  level: strong
-  evidence: realm config, docker-compose, GitLab CI, idempotent overlays
-languages_absent: [go, rust, c, c++]
-```
-
-### 4.2 Infrastructure stack
-```yaml
-containerisation:
-  docker: strong
-  docker_compose: strong (multi-environment overlays, hash-based config drift detection, hardening overlays)
-  kubernetes: absent
-ci_cd:
-  gitlab_ci: strong (268 yml touches, environment scoping, protected vars, conditional jobs)
-  github_actions: limited (aiobi-docs only)
-iac:
-  declarative: absent (no Terraform, no Pulumi, no Helm)
-  imperative: strong (custom bash deploy patterns, SSH-direct with health polling)
-observability:
-  prometheus: deployed
-  grafana: deployed
-  sentry: deployed across 3 projects
-  glitchtip: deployed
-  loki: deployed
-  opentelemetry: absent
-  slo_definitions: absent
-  burn_rate_alerts: absent
-secrets:
-  sops: in use
-  gitlab_protected_vars: in use
-  vault: absent
-service_mesh: absent
-mtls_between_services: absent
-```
-
-### 4.3 Security stack
-```yaml
-practices:
-  - SECURITY.md per repo with disclosure policy
-  - CVE-pinned dependencies (explicit comments referencing CVE IDs)
-  - Hardening overlays for Keycloak (always re-applied on recreate)
-  - SSO across suite via Keycloak (single source of identity)
-  - Rate limiting (slowapi) on FastAPI endpoints
-  - Session security middleware
-  - Manual security audits (Forms audit: 46 findings catalogued)
-automation:
-  sast_in_ci: absent  # no semgrep, bandit, trivy, gitleaks, OSV-Scanner gates
-  dependency_scanning_in_ci: absent
-  threat_modelling_artifact: absent  # STRIDE doc not produced
-  responsible_disclosure_received: 0
-```
-
-### 4.4 Domain expertise (deep)
-```yaml
-keycloak:
-  level: deep
-  evidence: 229 mentions in transcripts, custom SPI in Java, realm YAML hardening, theme bind-mounts, JDBC session persistence (Infinispan), SSO federation across 4 apps, broker IdP setup
-docker_networking:
-  level: deep
-  evidence: Traefik routing edge cases, IPv6 vs IPv4 localhost healthcheck issues, ghost iptables on dead bridges, subnet pinning, hardening overlays
-linux_systems_customisation:
-  level: deep (AïobiOS)
-  evidence: dpkg-divert across 6 subsystems, GRUB customisation, Plymouth themes, GDM/Yaru/AccountsService layer debugging, systemd one-shot first-boot provisioning
-rag_ai_stack:
-  level: working
-  evidence: eshu uses LangChain + CrewAI + ChromaDB + sentence-transformers + Groq/OpenAI/Google models in production
-crdt_realtime:
-  level: working
-  evidence: ADR-0001 Yjs evaluation with full trade-off matrix, integration in aiobi-docs
-```
-
-## 5. Engineering Methodology
-
-### 5.1 Workflow rules (observed)
-```yaml
-design_before_code:
-  rule: PRD → SRS → CONTRACT → ARCHITECTURE → MODELING locked before implementation
-  applied_in: [Aïobi-IAM, MISHKAN]
-  source: SWE-BASICS-BEFORE-CODE framework
-explain_before_implement:
-  rule: 2-3 sentence explanation + trade-offs + wait for approval before any code change
-  source: feedback_explain_before_code.md (triggered by 3-cycle date-picker incident)
-diagnose_before_fix:
-  rule: exact stacktrace / HTTP status / log line required before any fix
-  reject: "soupçon" (guess-based) reasoning
-  source: feedback_diagnose_before_fix.md
-durable_solutions_only:
-  rule: no sed-in-CI, no manual patches, no temporary workarounds
-  must_work_in_prod: true
-  source: feedback_durable_solutions.md
-verify_before_destructive:
-  rule: git status --short before every push, read compose paths before deploy
-  source: project_aiobi-ops memory
-no_invented_facts:
-  rule: no estimation of timeframes without git log verification
-  source: feedback_no_invented_facts.md
-no_scope_creep:
-  rule: fix only what was specified; no "au passage" refactors
-  source: feedback_no_scope_creep.md
-```
-
-### 5.2 Commit discipline
-```yaml
-format: "type(scope) short description"
-extended: "type(scope) subject — body with logs, root cause, before/after"
-types_used: [fix, feat, docs, chore, hotfix, refactor, ops]
-emojis: forbidden
-co_authored_by: forbidden
-case: lowercase subject
-period_terminator: no
-shared_server_protocol:
-  - GIT_COMMITTER_NAME="TheY4NN777"
-  - --author flag explicit on every commit
-  - never modify git config
-body_style: 5-15 lines with environment details, error messages, alternatives considered
-language: French in subject and scope, French or English in body
-```
-
-### 5.3 Deployment discipline
-```yaml
-flow: staging → validate → MR develop→main → prod
-trigger: continuous deploy (no semver tags)
-narration: git log + .claude/plans/ + docs/ops/
-ci_runner_topology:
-  - runner_host: ops-serv (10.13.13.14)
-  - prod_runtime: Aïobi Master (207.180.255.229, 10.13.13.1) — pure runtime, no CI
-  - pattern: SSH-direct deploy with scoped key + sudo NOPASSWD discipline
-pre_deploy_checks:
-  - hash-based config drift detection (sha256 diff on env files)
-  - health polling with timeout + retry
-  - container restart only if config hash changed
-post_deploy:
-  - structured DEPLOYMENT-LOG.md updated per service per env
-incident_pattern:
-  - reproduce in staging first
-  - identify dual root causes (applicative + network often both present)
-  - blameless postmortem with timeline + lessons + action items
-```
-
-### 5.4 Documentation discipline
-```yaml
-audience: builders (not end-users)
-density:
-  readmes: 50-150 lines (terse)
-  design_docs: 300-800 lines (heavy)
-  runbooks: copy-paste-safe, one command per failure mode
-templates_applied:
-  - SWE-BASICS-BEFORE-CODE (PRD/SRS/CONTRACT/ARCHITECTURE/MODELING)
-  - postmortem: timeline + root causes + lessons + action items
-  - integration journal: chronological narrative with gotchas table
-language_split:
-  french: 90% (internal team-facing)
-  english: 10% (architecture, design docs, MISHKAN)
-status_marker: absent — no draft/live/superseded frontmatter convention yet
-closure_discipline: weak — many docs marked "à valider" indefinitely
-```
-
-## 6. AI-Tooling Profile
-
-### 6.1 Setup
-```yaml
-primary_tool: Claude Code (exclusive — no Cursor/Windsurf/Aider/Continue)
-user_level_dir: ~/.claude/
-user_agents:
-  - aiobi-ops (40 KB, specialised DevOps agent with 20+ documented gotchas, 15+ incidents)
-  - explore-codebase
-  - explore-docs
-  - action
-  - websearch
-user_commands: [epct, explore, run-tasks, watch-ci, commit, create-pull-request, fix-pr-comments, oneshot]
-hooks:
-  pre_tool_use: bun-TypeScript command validator (~/.claude/scripts/command-validator/)
-  stop_notification: audio cues (afplay)
-mcp_servers_configured: 0  # planned via MISHKAN, not active
-bash_aliases:
-  cc: "claude --dangerously-skip-permissions"
-  ccc: "claude --dangerously-skip-permissions -c"
-memory_files_per_project: 25-30  # flat-file knowledge graph at ceiling
-total_memory_tokens: ~48000 across 93 files
-```
-
-### 6.2 Delegation map (transcript-derived)
-```yaml
-high_delegation:
-  - ui_css_svg_animations  # one-shot accepted
-  - config_generation       # YAML, docker-compose, XML
-  - keycloak_spi_boilerplate
-medium_delegation:
-  - database_migrations  # generate then heavily review, execute self
-low_delegation:
-  - tests  # prefers manual verification
-zero_delegation:
-  - git_push
-  - ssh_to_prod
-  - docker_exec_on_prod
-  - sudo_operations
-  - schema_migration_execution
-  - log_forensics_execution  # ai analyses output, human runs commands
-```
-
-### 6.3 Prompting fingerprint
-```yaml
-early_session_style:
-  format: highly structured JSON (tâche/entrée/format_de_sortie/exigences)
-  avg_length_chars: 1062
-  rigor: high
-late_session_style:
-  format: conversational, terse, French command-style
-  avg_length_chars: 7948  # logs/terminal dumps included
-  rigor: scales with task difficulty — reverts to structure under pressure
-language_triggers:
-  french: emotional venting, narrative progress, sharp corrections, local observations
-  english: terminal commands, framework names, error messages, technical specs
-  mixed: 13% of messages
-fatigue_signal:
-  threshold: after 23:00 UTC
-  symptoms: typo density 3x baseline, prompts shift to raw terminal dumps, code-switching increases
-ai_collaboration_maturity: 3.5/5
-friction_tax: 3-5% of session time
-recurring_friction_topics:
-  - keycloak_session_persistence  # 125 instances
-  - commit_format_compliance       # 129 instances
-  - git_push_coordination          # 53 instances
-  - database_schema_sync           # 29 instances
-```
-
-### 6.4 Non-negotiables (durable AI rules)
-```yaml
-- aiobi_brand_uses_treme: "Aïobi" — never "Aiobi"
-- no_co_authored_by_trailers_in_commits
-- no_emojis_in_commits
-- explain_then_wait_before_implementing
-- no_scope_creep_au_passage
-- diagnose_before_fix_no_soupcon
-- no_invented_timeframes_or_facts
-- no_assistant_ssh_to_prod
-- no_assistant_git_push
-- stop_pending_action_when_user_speaks  # interruption priority
-- use_edit_tool_not_sed  # vscode visibility
-- check_both_gitlab_ci_and_deploy_remote_sh_for_deploy_logic_changes
-- shared_server_requires_git_committer_name_env_var
-- prefer_durable_over_temporary
-```
-
-## 7. Active Work — Open Scope
-
-### 7.1 Aïobi-IAM
-```yaml
-status: v1.0.x in prod, v1.1.x ongoing
-open:
-  - SPI bind-mount priority escalation (in BACKLOG.md)
-  - Docker boltdb cleanup (tech debt acknowledged)
-  - Full federation across all 4 apps (Forms done, Docs in progress, Meet/eshu pending)
-locked: design phase complete (01_PRD through 05_MODELING)
-pending: 06_IMPLEMENTATION doc
-```
-
-### 7.2 aiobi-form
-```yaml
-status: Phase 1 IAM hardening shipped, Phase 2 finition pre-prod in flight
-open:
-  - silent SSO deployment
-  - JWT hardening completion
-  - audit findings remediation (46 catalogued, partial)
-boundary: Y4NN owns deploy and IAM integration; Youssouf owns features
-```
-
-### 7.3 aiobi-docs
-```yaml
-status: staging active, prod pending
-open:
-  - IAM theme migration to prod
-  - logout flow finalisation
-  - postmortem follow-ups from 2026-05-12 staging recovery
-  - realm_events_listener bug (2026-05-11, documented)
-```
-
-### 7.4 eshu
-```yaml
-status: OAuth + prod setup phase
-open:
-  - Google + Apple OAuth completion
-  - prod deployment (registry migration 10.13.13.1 → 10.13.13.14 in progress)
-boundary: shared with Cephas Congo
-```
-
-### 7.5 AïobiMeet
-```yaml
-status: continuous ops
-open:
-  - session persistence across Keycloak restarts (recurring friction)
-  - Whisper ASR performance on staging vs prod (AVX-512 CPU divergence, unconfirmed root cause)
-  - SSO session timeout tuning
-  - cadvisor memory limits ongoing
-```
-
-### 7.6 AïobiOS-Guidance (personal/thesis)
-```yaml
-status: late prototype / pre-production
-open:
-  - AppArmor/SELinux policy phase
-  - LUKS encryption integration
-  - Secure Boot signing
-  - ISO build automation (no CI yet)
-  - public release preparation
-locked: US-1.1 through US-1.4 (debloat, security, branding, GDM customisation)
-methodology_artifact: 19 issues numbered, each traced to root cause across layers
-```
-
-### 7.7 MISHKAN (harness research)
-```yaml
-status: design v1 complete, build pending
-locked: naming (45 agents), 6 teams, init flow, 5-layer architecture, knowledge promotion model
-open_decisions:
-  - cognee_deployment_mode  # local docker vs cloud vs hybrid
-  - local_model_runtime     # ollama vs lm-studio vs llama.cpp
-  - install_scope           # user-level vs per-project
-not_yet_designed:
-  - agent_system_prompts
-  - claude_md_templates
-  - rules_files_content
-  - hook_implementations
-  - skill_implementations
-  - curated_library_content
-  - cognee_graph_schema
-  - observability_pipeline
-  - model_routing_config
-```
-
-### 7.8 RAG-CLI (planned, not started)
-```yaml
-purpose: ingest 654K-token internal doc corpus, build knowledge graph, expose CLI for engineering process improvement queries
-foundation: same Cognee instance MISHKAN needs
-status: design only
-corpus_ready: yes — 325 files, 13 doc types, strong interlinking, dated
-```
-
-## 8. Documentation Corpus (RAG-ready)
-
-```yaml
-total_files: 325
-total_size_mb: 5.6
-total_tokens_est: 654000
-language_split:
-  fr: 90%
-  en: 10%
-distribution:
-  project_docs: 226 files, 591K tokens
-  home_level_docs: 6 files, 15K tokens
-  claude_session_memory: 93 files, 48K tokens
-doc_types_identified:
-  - DESIGN_SPEC      # PRD, SRS, ARCHITECTURE, MODELING
-  - INCIDENT_REPORT
-  - POSTMORTEM
-  - RUNBOOK
-  - INTEGRATION_JOURNAL
-  - HANDOVER_NOTE
-  - ARCHITECTURE
-  - AUDIT_REPORT
-  - README
-  - DEPLOYMENT_LOG
-  - SESSION_MEMORY
-  - ADR
-  - FEATURE_SPEC
-  - TODO_TRACKER
-quality_flags:
-  todo_fixme_markers: 42
-  superseded_docs: 33
-  contradictions_detected: 2
-  mixed_language_within_doc: 7
-  status_frontmatter_present: false  # convention not yet adopted
-entity_density: high
-  services: 20+   # Keycloak, PostgreSQL, Redis, Celery, Whisper, MinIO, LiveKit, Nginx, Traefik, Grafana, Sentry, GlitchTip, Loki, etc.
-  hosts: 4 named  # id.aiobi.world, meet.aiobi.world, docs.aiobi.world, AiobiDev
-  config_keys: 30+
-  ports: 15+
-  realms: 3
-  ip_subnets: 3
-```
-
-## 9. Gaps — Factual Inventory
-
-### 9.1 Skill (study required)
-```yaml
-kubernetes:
-  status: absent
-  blocking: declarative orchestration progression
-terraform_or_pulumi:
-  status: absent
-  blocking: IaC progression beyond bash + Compose
-helm:
-  status: absent
-  blocking: K8s package distribution
-go:
-  status: absent
-  blocking: SRE/Platform tooling layer
-rust:
-  status: absent
-  blocking: systems performance work (longer-term)
-formal_slo_practice:
-  status: absent
-  components_missing: [SLI definitions, error budgets, burn-rate alerts, SLO docs]
-distributed_systems_depth:
-  status: absent
-  components_missing: [service mesh, mTLS, circuit breakers, RPC framework]
-threat_modelling_as_artifact:
-  status: absent
-  components_missing: [STRIDE doc, attack tree, formal threat model per service or per system]
-```
-
-### 9.2 Practice (process change required)
-```yaml
-sast_gates_in_ci:
-  status: not_automated
-  manual_equivalent: present (46-finding Forms audit done manually)
-  tools_missing: [semgrep, bandit, trivy, gitleaks, OSV-Scanner]
-dependency_scanning_in_ci:
-  status: not_automated
-docs_closure_ritual:
-  status: weak
-  symptom: many docs marked "à valider" indefinitely
-  fix: status frontmatter + sprint-end closure pass
-changelog_automation:
-  status: partial
-  forms_repo: present
-  others_repo: absent
-  source: git-cliff or conventional-changelog could autogenerate from existing commits
-test_coverage:
-  status: variable
-  weakest_repos: [IAM, eshu]
-  strongest_repos: [aiobi-form (phpunit), aiobi-docs (vitest)]
-ai_friction_engineering:
-  status: reactive
-  symptom: 129 commit-format corrections, 125 session-persistence corrections, 53 push-protocol corrections
-  fix: bake recurring rules into mishkan-init skill + pre-commit hooks
-late_night_deploy_rule:
-  status: absent
-  symptom: typo density 3x and prompt rigor degrades after 23:00 UTC
-```
-
-### 9.3 Tooling (build required)
-```yaml
-cognee_or_knowledge_graph:
-  status: designed, not deployed
-mcp_servers_configured:
-  status: 0 configured
-  needed: [cognee, filesystem, git, security_scanner]
-mishkan_implementation:
-  status: spec v1 complete, code at 0%
-rag_cli:
-  status: design only
-memory_to_graph_migration:
-  status: not started
-  source: 93 flat-file MEMORY.md → Cognee nodes
-go_binary_for_internal_tooling:
-  status: none built yet
-```
-
-## 10. Strengths — Factual Inventory
-
-```yaml
-operational_mastery:
-  - 5 production services across 5 stacks managed solo on deploy side
-  - 626 commits / 66K insertions in 3 months at sustained quality
-  - Real blameless postmortems authored
-  - Idempotent rollback runbooks with pre-flight state capture
-  - Hash-based config drift detection in CI
-  - Dual root-cause identification in incidents
-keycloak_deep_expertise:
-  - Custom Java SPI built from scratch
-  - Realm YAML hardening + bind-mount persistence
-  - SSO federation across multiple apps
-  - Infinispan JDBC session persistence
-  - Theme customisation including UTF-8 byte-level reconstruction
-methodology_rigor:
-  - SWE-BASICS-BEFORE-CODE applied verbatim in IAM and MISHKAN
-  - ADR-0001 with 4-CRDT × 3-OT-framework trade-off matrix
-  - AïobiOS: 19 issues numbered, each traced to root cause across abstraction layer
-  - Doctoral-level engineering log methodology
-ai_tooling_intentionality:
-  - Custom 40 KB aiobi-ops specialist agent
-  - Religious MEMORY.md discipline (93 files, 48K tokens)
-  - Asymmetric delegation rule (creative high / stateful zero)
-  - bun-TypeScript command validator hook
-  - MISHKAN architectural spec (815 lines) as original harness research
-  - Zero multi-tool sprawl by deliberate choice
-documentation_practice:
-  - 654K tokens across 325 files, 13 distinct doc types
-  - Strong interlinking, dated, templated structure
-  - Bilingual (fr/en) with deliberate split by audience
-debugging_discipline:
-  - Verification-first (no soupçon allowed)
-  - Identifies dual root causes (applicative + network)
-  - Documented refusal of guess-based fixes
-brand_precision:
-  - Aïobi tréma enforced everywhere
-  - UTF-8 byte-level work in shell when needed
-  - Commit format strict and durable
-security_practice:
-  - SECURITY.md per repo
-  - CVE-pinned dependencies with explicit comments
-  - SOPS for secret management
-  - Hardening overlays always re-applied
-  - SSO across suite via Keycloak
-```
-
-## 11. Project File Layout (Reference)
-
-```yaml
-home_root: /home/ogu/
-work_root: /home/ogu/theY4NN/
-work_repos:
-  - /home/ogu/theY4NN/Aïobi-IAM/
-  - /home/ogu/theY4NN/AïobiMeet/
-  - /home/ogu/theY4NN/aiobi-form/
-  - /home/ogu/theY4NN/aiobi-docs/
-  - /home/ogu/theY4NN/eshu/
-  - /home/ogu/theY4NN/a-obi-design-system/  # dormant
-  - /home/ogu/theY4NN/docs/
-  - /home/ogu/theY4NN/harness/  # MISHKAN design
-personal_root: /home/ogu/Projects/
-personal_repos:
-  - /home/ogu/Projects/AïobiOS-Guidance/
-claude_data:
-  - ~/.claude/
-  - ~/.claude/projects/<encoded-path>/memory/
-  - ~/.claude/projects/<encoded-path>/*.jsonl
-infra_topology:
-  - aiobi_master: 207.180.255.229 (10.13.13.1) — production runtime
-  - ops_serv: 10.13.13.14 — CI runner host
-  - aiobi_dev: shared staging server (Forms, Meet, Docs, eshu staging)
-```
-
-## 12. Operating Preferences (Cached Rules)
-
-```yaml
-session_modes:
-  exploration: default, free conversation, agents on demand
-  execution: triggered by /mishkan-init or convergence
-interruption_priority: drop pending action immediately when user speaks
-tool_choice:
-  prefer: Edit (vscode visibility)
-  avoid: sed for file modifications
-  use_for_files: Read/Edit/Write
-  reserve_for_shell: Bash only when no dedicated tool exists
-git_protocol:
-  commit: assistant may commit locally
-  push: human only
-  ssh_to_prod: human only
-  schema_migration_execution: human only
-  log_inspection_execution: human only (assistant analyses output)
-explanation_protocol:
-  before_implementing: 2-3 sentences + trade-offs + wait for approval
-  after_implementing: terse summary, do not narrate the diff
-language_protocol:
-  internal_meta_work: French acceptable
-  technical_artifacts: English preferred
-  commit_subjects: French acceptable
-output_protocol:
-  no_emojis: enforced everywhere
-  no_co_authored_by_trailers: enforced
-  detailed_explanations_over_summaries: preferred when documenting
-  no_invented_facts: verify timeframes against git log or mark as estimation
-scope_protocol:
-  fix_what_was_specified: no "au passage" cleanup
-  ask_before_widening: scope expansion requires approval
-```
-
----
-
-*Profile is canonical present-state. Update on milestone events, role changes, or major work scope shifts. Designed for agent context loading with high signal density and low ceremony.*