Align skill files with the product strategy

index cfaa8fc..2e71ee3 100644 --- a/.agents/skills/deployment/SKILL.md +++ b/.agents/skills/deployment/SKILL.md @@ -5,7 +5,9 @@ description: How to deploy, migrate, seed, and restart the sigit.si Rails app in # Deploying sigit.si -The Rails app behind `https://sigit.si` (the code + model hosting platform). Deploys happen by pushing `main` to a bare repo whose `post-receive` hook checks out the work tree and restarts Puma. +> **Product map:** siGit Code (local agent) · siGit Code Cloud (hosted chat + Cloud Sessions) · siGit Code Cloud Agent (autonomous task → PR; planning). `sigit.si` is Git hosting; `code.sigit.si` is the home of siGit Code. Full taxonomy: [product-overview](../../../docs/product/product-overview.md). + +The Rails app behind `https://sigit.si` (Git hosting for the AI era; also serves the model library and the `/api/v1` surface the siGit Code Cloud products sign in to). Deploys happen by pushing `main` to a bare repo whose `post-receive` hook checks out the work tree and restarts Puma. ## Server facts

index d3a4e43..a80d7e5 100644 --- a/.agents/skills/design-system/SKILL.md +++ b/.agents/skills/design-system/SKILL.md @@ -2,3 +2,5 @@ name: design-system description: A skill for working with the sigit.si design system. --- + +> **Product map:** siGit Code (local agent) · siGit Code Cloud (hosted chat + Cloud Sessions) · siGit Code Cloud Agent (autonomous task → PR; planning). `sigit.si` is Git hosting; `code.sigit.si` is the home of siGit Code. Full taxonomy: [product-overview](../../../docs/product/product-overview.md).

index c2da4b9..e26dcee 100644 --- a/.agents/skills/local-environment/SKILL.md +++ b/.agents/skills/local-environment/SKILL.md @@ -2,3 +2,5 @@ name: local-environment description: A skill for working with the local environment for sigit.si --- + +> **Product map:** siGit Code (local agent) · siGit Code Cloud (hosted chat + Cloud Sessions) · siGit Code Cloud Agent (autonomous task → PR; planning). `sigit.si` is Git hosting; `code.sigit.si` is the home of siGit Code. Full taxonomy: [product-overview](../../../docs/product/product-overview.md).

index c9b16a7..cd97eb8 100644 --- a/.agents/skills/sigit-app/SKILL.md +++ b/.agents/skills/sigit-app/SKILL.md @@ -5,6 +5,8 @@ description: Use when working on the "siGit Code & Deploy" Tauri desktop app (re # siGit Code & Deploy desktop app (sigit-app) +> **Product map:** siGit Code (local agent) · siGit Code Cloud (hosted chat + Cloud Sessions) · siGit Code Cloud Agent (autonomous task → PR; planning). `sigit.si` is Git hosting; `code.sigit.si` is the home of siGit Code. Full taxonomy: [product-overview](../../../docs/product/product-overview.md). + `sigit-app` is the **Tauri desktop client** for siGit (repo `~/Repositories/sigit-app`). It is a **public client** (a shipped binary), so the public-client security rules apply — see

new file mode 100644 index 0000000..aec0b2f --- /dev/null +++ b/.agents/skills/sigit-code-cloud-agent/SKILL.md @@ -0,0 +1,108 @@ +--- +name: sigit-code-cloud-agent +description: Reference for siGit Code Cloud Agent, the autonomous, sandboxed coding agent (task -> pull request) we are building. Use when working on the agent product surface: the AgentRun lifecycle, the AWS sandbox that runs siGit Code headless, per-run scoped tokens, the GitHostAdapter (sigit.si first, then GitHub/GitLab), or anything that turns a delegated task into a reviewed PR. Distinct from siGit Code Cloud (the hosted chat); see the sigit-code-cloud skill for that. +--- + +# siGit Code Cloud Agent + +**siGit Code Cloud Agent** is autonomous, sandboxed siGit Code that solves an +issue or task in a Git repository and opens a pull request, working in the +background like a human developer. The user delegates a task and walks away; the +agent works on its own and comes back with a PR to review. + +Status: **planning**. The full strategy, architecture, pricing, and roadmap are in +[`docs/product/sigit-code-cloud-agent-plan.md`](../../../docs/product/sigit-code-cloud-agent-plan.md). +The product map (how this sits next to the other products) is in +[`docs/product/product-overview.md`](../../../docs/product/product-overview.md). + +## Where it fits (and the naming that matters) + +- **siGit Code** — the local agent. The engine. +- **siGit Code Cloud** — the hosted **chat** (interactive, synchronous). Its work + unit is a **session**. See the `sigit-code-cloud` skill. +- **siGit Code Cloud Agent** — this. Autonomous, asynchronous. Its work unit is an + **agent run** (one delegated task -> autonomous work -> PR). + +Load-bearing: **"session" belongs to the chat product; the agent's unit is a +"run".** Never call the agent or its runs "sessions". `/cloud/sessions` is chat +history, not agent runs. + +## What it is and is not + +- **Engine:** siGit Code, run **headless** in an ephemeral **sandbox** (AWS), with + hosted inference. The agent clones the repo, edits, runs build/test, iterates, + and pushes a branch. The agent loop and tools already exist in `getsigit/sigit`; + the new work is running it headless and the orchestration around it. +- **Repo target:** **sigit.si first**, then **GitHub, GitLab, and other Git + hosts**. Scope is **Git only** (no SVN, Mercurial, or other VCS). Keep clone / + branch-push / PR-open behind a `GitHostAdapter` seam from day one so the agent + is not welded to our own forge. +- **Output:** a **pull request** on the target Git host (a pushed branch + review + surface). A human reviews and merges. The agent never auto-merges. +- **MVP trigger (decided):** from a repo on sigit.si, the user describes a task and + the agent produces a PR. Formal issue-assignment is a fast-follow (needs an + Issues feature and the host adapters). +- **Copilot analog:** the Copilot coding agent (the cloud agent), not Copilot Chat. + +## Architecture (two planes; inference reused) + +``` +Control plane (Rails, sigit-si) + AgentRun model (lifecycle) + controller + job + Web "Run agent" UI, live run log (SSE), diff -> PR + Mints per-run scoped tokens (git push + inference), enforces caps/metering + | RunTask (aws-sdk) ^ SSE/webhook: logs, status, diff + v | +Execution plane (AWS) + Ephemeral sandbox (Fargate task v1 -> Firecracker microVM at scale) + clones repo (scoped git token) -> runs siGit Code headless + OPENAI_BASE_URL = https://sigit.si/api/v1 (per-run inference token) + edits / runs build+test -> pushes head branch -> PR via GitHostAdapter + Private subnet, egress allowlist, hard caps (wall-clock, tokens, tool calls) + | /v1/chat/completions (per-run token) + v +Inference (unchanged): Api::V1::ChatCompletionsController -> OndeCloudService -> Onde Cloud + Existing entitlement gate, allowance metering, and identity masking all apply. +``` + +The agent is "just another client" of the inference endpoint siGit Code Cloud +already operates, so the entitlement / metering / identity-masking path is reused +unchanged. Because the agent's inference token is minted server-side per run with +a budget, there is no public client holding credentials, which also closes the +standing "inference token <-> Onde Cloud auth" gap for this path. + +## Safety (non-negotiable, because it runs code on our infra) + +- Per-run hard caps: wall-clock timeout, CPU/memory, inference token budget (tied + to a new `AgentUsage`), max tool calls, max sandbox lifetime. +- Network **egress allowlist** (sigit.si + package registries only). The single + most important control. +- Ephemeral, **scoped** credentials only; nothing long-lived in the sandbox. +- Human-in-the-loop: the agent opens a PR, never auto-merges. +- Per-plan concurrency caps; real cancellation tears down the sandbox. +- Identity hygiene: run logs, PR titles/bodies, and errors stay neutral (same rule + as chat); never disclose the upstream model or provider. + +## Pricing shape + +Runs cost sandbox compute (Fargate per-second) **plus** inference tokens, so +metering captures both (`AgentUsage`: runs, agent-seconds, tokens). Sandbox time +is rounding error; price on metered inference per run. Included-run bundles per +plan, mirroring `Subscription::CLOUD_ALLOWANCE`. See the plan doc for the worked +model and the `[FILL FROM PHASE 0]` inputs. + +## Dependencies / open items + +- **No PRs or Issues on sigit.si yet.** A minimal PR surface is on the critical + path; v1 can ship as "pushed branch + compare view". Issues gate + issue-assignment. +- **AWS is net-new infra** (VPC/IAM/NAT/egress-allowlist). No `aws-sdk` in the app + yet. +- **siGit Code has no headless one-shot mode yet** (TUI or ACP only). Adding a + headless runner that drives the existing loop non-interactively and exits is the + first build step (do not start building until asked). + +## Status + +Spec and plan only. Nothing built. Do not start implementation without an explicit +go-ahead; this skill is the reference for when we do.

index bdad5a6..0ff8c5e 100644 --- a/.agents/skills/sigit-code-cloud/SKILL.md +++ b/.agents/skills/sigit-code-cloud/SKILL.md @@ -1,14 +1,15 @@ --- name: sigit-code-cloud -description: Reference for siGit Code Cloud, the hosted inference offering for siGit Code. Use when working on the cloud product surface: the sigit login/logout/whoami account commands, the credential store, provider/backend selection (on-device vs siGit Code Cloud vs BYO endpoint), neutral quality tiers, or the onde-cloud API behind it. Covers the Copilot/Azure layering, the decoupled InferenceBackend engine, auth via sigit.si/api/v1, and what must never leak to the client. +description: Reference for siGit Code Cloud, the hosted CHAT product for siGit Code (interactive, signed-in, no local model). Use when working on the cloud chat surface: the sigit login/logout/whoami account commands, the credential store, provider/backend selection (on-device vs siGit Code Cloud vs BYO endpoint), neutral quality tiers, the persisted Cloud Sessions API, or the onde-cloud API behind it. Covers the Copilot-Chat/Azure layering, the InferenceBackend engine, auth via sigit.si/api/v1, and what must never leak to the client. The autonomous task->PR product is siGit Code Cloud Agent; see the sigit-code-cloud-agent skill. --- # siGit Code Cloud -**siGit Code Cloud** is the hosted inference offering for **siGit Code**. The -product framing is deliberate: +**siGit Code Cloud** is the hosted **chat** for **siGit Code**: interactive, +signed-in, model in the cloud instead of on the device. The product framing is +deliberate: -- **siGit Code Cloud is the product**, like GitHub Copilot. The user signs in, +- **siGit Code Cloud is the product**, like Copilot **Chat**. The user signs in, picks a quality tier, and it works. They never see an API key, a base URL, or the name of any model provider. - **Onde Cloud is the infrastructure**, like Azure. It is the OpenAI-compatible @@ -16,10 +17,18 @@ product framing is deliberate: - **Onde Cloud, in turn, routes to upstream providers** (today Anthropic) and hides them too, see the onde-cloud `router`/`anthropic` modules. -Keep the names straight (see the `branding` skill): the product is `siGit Code`, -the hosted tier is `siGit Code Cloud`, the CLI is `sigit`, the company is -`smbCloud`, the inference infrastructure is `Onde Cloud` / `Onde Inference`, and -the on-device Rust crate is `onde`. +**This is the chat product, not the agent.** The autonomous, sandboxed +task -> pull request product is **siGit Code Cloud Agent** (see the +`sigit-code-cloud-agent` skill). Chat's work unit is a **session**; the agent's is +a **run**. Keep them separate. Full product map: +[`docs/product/product-overview.md`](../../../docs/product/product-overview.md). + +Keep the names straight (see the `branding` skill): the local agent is +`siGit Code`, the hosted chat is `siGit Code Cloud`, the autonomous one is +`siGit Code Cloud Agent`, the CLI is `sigit`, the company is `smbCloud`, the +inference infrastructure is `Onde Cloud` / `Onde Inference`, and the on-device +Rust crate is `onde`. `sigit.si` is Git hosting; `code.sigit.si` is the home of +siGit Code. ## The layering (why it's built this way) @@ -113,6 +122,30 @@ model. To use the cloud after signing in, pick a tier in `/models`. `~/.config/sigit/credentials.toml` (`$SIGIT_CONFIG_DIR` override), mode `0600`, holding `access_token` (+ email for display). +## Cloud Sessions (persisted chat) and the web app + +siGit Code Cloud chat conversations are saved as **Cloud Sessions** (short: +sessions), so they sync across signed-in surfaces and can be resumed. "Session" +means a chat conversation and belongs to this product only; the agent's unit is a +"run" (see `sigit-code-cloud-agent`). + +- **Models (sigit-si):** `CloudSession` (UUID primary key, since it appears in a + shareable URL) `has_many :cloud_messages`; `append_message!` auto-titles from + the first user turn and tracks activity. `CloudMessage` roles are + `user`/`assistant`/`system`. +- **API:** `Api::V1::CloudSessionsController`, token-scoped to `current_user`, at + `path: "sessions"` (kept distinct from the auth `SessionsController`): + `GET/POST /api/v1/sessions`, `GET/PATCH/DELETE /api/v1/sessions/:id`, and + `POST /api/v1/sessions/:id/messages`. +- **Streaming is unchanged:** clients still stream from `/api/v1/chat/completions`; + these endpoints only persist the transcript. The client appends the user message + on send and the assistant message when the stream finishes. +- **Web app:** `sigit-app/apps/code-cloud-web` is the SvelteKit client at + **code.sigit.si**. `/cloud` is the chat; `/cloud/sessions` and + `/cloud/sessions/<uuid>` are the saved history. Same `/api/v1` surface, + same-origin in production. (Root `/` is the on-device dashboard for signed-in + users and the marketing landing for signed-out ones.) + ## Onde Cloud side (the API the cloud tier calls) Repo: `onde-cloud` (Rust/axum, OpenAI-compatible). @@ -215,5 +248,8 @@ Onde Inference's — siGit pays Onde as a customer; here siGit charges its end u `app_secret` in the `sigit` binary (public-client violation). - Letting a persisted local model name show in the title while routing to the cloud (guard with `InferenceBackend::is_remote()`). -- Mixing the names: `siGit Code` (product), `siGit Code Cloud` (hosted tier), - `sigit` (CLI), `smbCloud` (company), `Onde Cloud` (infrastructure). +- Mixing the names: `siGit Code` (local agent), `siGit Code Cloud` (hosted chat), + `siGit Code Cloud Agent` (autonomous, task -> PR), `sigit` (CLI), `smbCloud` + (company), `Onde Cloud` (infrastructure). +- Calling a chat conversation a "run", or the agent's work a "session". Chat has + **sessions**; the agent has **runs**.

index 0dc210a..28528f7 100644 --- a/.agents/skills/sigit-code/SKILL.md +++ b/.agents/skills/sigit-code/SKILL.md @@ -10,6 +10,12 @@ runs over ACP in editors like Zed and as an interactive terminal TUI. The repo i **public**, keep secrets, provider names, and strategy out of it (see `AGENTS.md`). +It is the **engine** for the whole family: the hosted chat (**siGit Code Cloud**) +runs the same agent against cloud inference, and the autonomous **siGit Code Cloud +Agent** (planning) runs it headless in a sandbox to open pull requests. `sigit.si` +is Git hosting; `code.sigit.si` is the home of siGit Code. Full product map: +[`docs/product/product-overview.md`](../../../docs/product/product-overview.md). + ## Codebase map (`sigit/src`) - `main.rs`: entry point. Routes to the account subcommands @@ -63,7 +69,8 @@ private skill here, not in a public code comment. See `AGENTS.md`. ## Cross-references -- `sigit-code-cloud` (this repo): the hosted inference product. +- `sigit-code-cloud` (this repo): the hosted chat product (siGit Code Cloud). +- `sigit-code-cloud-agent` (this repo): the autonomous task -> PR product (planning). - `smbcloud-auth` (this repo): the auth service. - `ai-assisted-coding` (sigit repo): the `onde` `ChatEngine` API. - `agent-client-protocol` (sigit repo): ACP.

index d0a36dc..dac57b8 100644 --- a/.agents/skills/smbcloud-auth/SKILL.md +++ b/.agents/skills/smbcloud-auth/SKILL.md @@ -5,6 +5,8 @@ description: Use when working on authentication in the sigit-si Rails app — si # smbCloud Auth in sigit-si +> **Product map:** siGit Code (local agent) · siGit Code Cloud (hosted chat + Cloud Sessions) · siGit Code Cloud Agent (autonomous task → PR; planning). `sigit.si` is Git hosting; `code.sigit.si` is the home of siGit Code. Full taxonomy: [product-overview](../../../docs/product/product-overview.md). + sigit-si does **not** own user identity. It is a **platform client** (client id `sigit`) that authenticates against the shared **smbCloud Auth** service. Treat smbCloud Auth as the source of truth for credentials; sigit-si keeps only a thin