Initial monorepo structure

2026-06-30 20:37:40 +02:00
commit 2f2b295531
121 changed files with 39171 additions and 0 deletions
@@ -0,0 +1,71 @@
+---
+inclusion: auto
+---
+
+# MCP Server Configuration
+
+## Available MCP Servers (require VPN)
+
+These MCP servers are hosted on DB's OpenShift cluster (dbcs-prag) and available when connected to the corporate network:
+
+### Jira + Confluence (Atlassian MCP — NEUER kombinierter Server)
+- URL: `https://taros-playground-mcp-atlassian.apps.dbcs-prag.comp.db.de/mcp`
+- Capabilities: 72+ Tools — Jira issues, transitions, comments + Confluence pages (read/write)
+- Headers required:
+  - `Authorization: Bearer <JIRA_TOKEN>`
+  - `X-Jira-Host: arija-jira.jaas.service.deutschebahn.com` (ohne https://)
+  - `X-Jira-Projects: O2CO2C,O2CAAPN,*` (komma-separiert, Wildcards möglich)
+  - `X-Jira-Mode: read` (oder `write`)
+- Replaces: mcp-jira-v2 (deprecated) and mcp-confluence (separate)
+- Use for: Team velocity, sprint data, bug tracking, Confluence pages
+
+### Jira MCP v2 (DEPRECATED)
+- URL: `https://taros-playground-mcp-jira-v2.apps.dbcs-prag.comp.db.de/mcp`
+- Status: DEPRECATED — use mcp-atlassian instead
+
+### Confluence MCP (standalone, still works)
+- URL: `https://taros-playground-mcp-confluence.apps.dbcs-prag.comp.db.de/mcp`
+- Still functional but mcp-atlassian is the preferred replacement
+
+### DB Context (dbctx)
+- URL: `https://taros-playground-dbctx.apps.dbcs-prag.comp.db.de/mcp`
+- Capabilities: DB-specific context and tooling
+- Use for: General DB knowledge, terminology, organizational context
+
+### Teamlandkarte MCP (local, stdio)
+- Repo: https://git.tech.rz.db.de/ThomasHandke/teamlandkarte-mcp
+- Type: Local stdio server (Python, requires uv + Data Lake credentials)
+- Capabilities: Match tasks to employees/teams by competences, browse free capacities, team profiles
+- Use for: Finding teams (INKA, Data Science), capacity analysis, competence mapping
+- Requires: DATA_LAKE_USERNAME, DATA_LAKE_PASSWORD, AZURE_OPENAI_EMBEDDING_API_KEY
+- NOT yet configured (needs credentials)
+
+### BEAM MCP (local, stdio) — EDUCATIONAL USE ONLY
+- Repo: https://git.tech.rz.db.de/beta/ai/mcp/beam-mcp
+- Type: Local stdio server (Node.js, requires Edge browser for login)
+- Capabilities: Enterprise Architecture (LeanIX/BEAM) — applications, domains, components, diagrams
+- Use for: System landscape, application dependencies, architecture diagrams
+- ⚠️ ACTIVE USE NOT PERMITTED due to data protection concerns. Educational reference only.
+
+## Other Noteworthy Servers (not yet configured)
+
+| Server | Use Case | Priority |
+|--------|----------|----------|
+| DataLake MCP | SQL on Trino (quantitative data) | Medium — when we need metrics |
+| Foundations MCP | ADRs, Standards, Capabilities | Medium — for architecture comparison |
+| gitlab-mcp | GitLab integration via glab | Low — we use direct API calls |
+| sonarqube-mcp | Code quality metrics | Low — for team quality comparison |
+| proclib-mcp | Process library access | Medium — for process analysis |
+| mcp-agilehive | AgileHive SAFe tool | High — PI-Planning data, team capacity |
+
+## Fallback (without VPN)
+
+When MCP servers are unreachable, use direct REST API calls:
+- Confluence: Bearer token auth against `https://arija-confluence.jaas.service.deutschebahn.com/rest/api`
+- GitLab: PRIVATE-TOKEN header against `https://git.tech.rz.db.de/api/v4`
+- Jira: Not available without VPN
+
+## Local MCP Server
+
+- OrgMyLife: Running locally, accessible via Kiro's MCP integration
+- Provides: tasks, calls, digest, projects board
@@ -0,0 +1,100 @@
+---
+inclusion: auto
+---
+
+# Session Context — Next Session Priorities
+
+## Immediate Tasks
+
+1. **Verify Jury-Voting** — `unikat.andreknie.de` is live and working
+2. **Verify NoteGraph browse** — `notes.andreknie.de/browse?token=...` (clear SB service worker first)
+3. **KIQ Docker deploy** — Docker not set up on KIQ VPS yet. Need someone with root to install Docker or find alternative
+4. **Rechnungen prüfen** — 8 receipts labeled in OrgMyLife, forward to rechnungen@d-hive.de
+
+## Key Technical Notes
+
+### Git on this machine
+- Git path: `C:\Users\AndreKnie\AppData\Local\GitHubDesktop\app-3.5.8\resources\app\git\cmd\git.exe`
+- Always use: `$gitExe = "C:\Users\AndreKnie\AppData\Local\GitHubDesktop\app-3.5.8\resources\app\git\cmd\git.exe"` then `& $gitExe <command>`
+- `gh` CLI is NOT available
+
+### OrgMyLife API
+- Endpoint: `https://api.andreknie.de`
+- Auth: `Authorization: Bearer !Z5l5vUcm!&qfhUuE=Nf`
+- Projects board: `GET/PUT /api/projects`, `POST /api/projects/create`
+- Tasks: `GET /api/tasks`, agent-ready filter: `?filter_agent=true`
+
+### NoteGraph
+- SilverBullet: `https://notes.andreknie.de` (now serves browse UI as primary)
+- Browse: `https://notes.andreknie.de/browse?token=PASSWORD`
+- Upload: `https://notes.andreknie.de/upload?token=PASSWORD`
+- Ingestion uses Mistral (`mistral-small-latest`) for enrichment and Vision OCR
+- Repo: `NoteGraph/` with `ingestion/` Python package
+- Docker on VPS: Ingestion (8001), SilverBullet (3000, internal only)
+- **When creating notes for the user, always add `AI-Source` to the tags array in frontmatter**
+
+### Jury-Voting App
+- Repo: `Jury-Voting/` (private, GitHub: DoctoDre/Jury-Voting)
+- URL: `https://unikat.andreknie.de` (password: `UNIKAT_jury`)
+- Stack: React 19 + Vite frontend, Express.js backend, JSON file persistence, SSE real-time
+- Port: 3002 on VPS, systemd service `jury-voting`
+- Caddy config: in `NoteGraph/Caddyfile` (block for `unikat.andreknie.de`)
+- Event: 15. UNIKAT Ideenwettbewerb, 19. Mai 2026, Science Park Kassel
+- 6 jurors, 11 teams, 5 criteria (1-10 scale)
+- Admin: `/admin`, Results/Beamer: `/results`
+- Future: move to `unikat.d-hive.de` (add DNS + Caddy block on KIQ VPS)
+
+### Repos in workspace
+- `OrgMyLife/` — Personal task/coordination system (FastAPI + PostgreSQL)
+- `AI-Orchestrator/` — Agent orchestration (Python)
+- `NoteGraph/` — Knowledge base (SilverBullet + ingestion pipeline)
+- `Confluence_Bot/` — Confluence automation (PowerShell)
+- `Projekt-KIQ-HP/` — KIQ homepage (React/Vite, currently uses Supabase)
+- `Jury-Voting/` — UNIKAT Jury Voting (React/Vite + Express)
+- `project-audit/` — DB enterprise project audit data (GitLab)
+
+### Deploy pattern
+- Push to main → GitHub Actions → SSH to VPS → deploy
+- Secrets via GitHub repo secrets
+- Caddy reverse proxy managed via `NoteGraph/Caddyfile`
+
+### Deploy pattern for private repos (no git on VPS)
+- Build in GitHub Actions (checkout → npm ci → npm run build)
+- Create tar.gz archive of built artifacts
+- Upload via `appleboy/scp-action` to VPS `/tmp/`
+- Extract via `appleboy/ssh-action`, install deps, restart systemd service
+- This avoids needing git credentials on the VPS
+
+### VPS (217.160.174.2)
+- Caddy handles HTTPS for all domains (auto Let's Encrypt)
+- OrgMyLife on port 8000 (`api.andreknie.de`)
+- SilverBullet on port 3000 (`notes.andreknie.de`)
+- Ingestion on port 8001 (`notes.andreknie.de/upload`)
+- Jury-Voting on port 3002 (`unikat.andreknie.de`)
+- SSH: root@217.160.174.2, key stored as `DEPLOY_SSH_KEY` in GitHub repos
+- Node.js 20 installed via nodesource
+- No rsync installed — use tar+scp for file transfer
+- No docker on this VPS for Jury-Voting (runs as systemd service with tsx)
+
+### Projekt-KIQ-HP (separate VPS: projekt-kiq.d-hive.de)
+- Deploy user: `github-deploy`
+- Static site deployed via rsync to `/opt/projekt-kiq/site`
+- Caddy config at `/etc/caddy/Caddyfile` (managed by KIQ deploy workflow)
+- Has rsync available
+- SSH key: `DEPLOY_SSH_KEY` in KIQ GitHub repo
+
+### Express 5 Gotchas
+- Do NOT pass `app` to functions typed as `Express` — route registration silently fails at runtime
+- Use `Router()` and `app.use(router)` pattern instead
+- The `Express` type from `@types/express` doesn't match Express 5 runtime correctly
+- SPA catch-all: use middleware (`app.use`) not `app.get('/{*splat}')` — the splat syntax can interfere
+
+### DB GitLab (project-audit)
+- Requires `scm-info.yaml` in repo root for security scans
+- Format: `version: v3`, `license: LicenseRef-DBISL`, `contacts:`, `confidentiality: internal`, `reference-ids: none`
+- GitLab URL: `git.tech.rz.db.de/AndreKnie/project-audit`
+
+### DNS
+- `andreknie.de` DNS managed externally (takes ~5 min to propagate new subdomains)
+- Add A record pointing to 217.160.174.2 for new subdomains
+- Caddy auto-provisions HTTPS certificates once DNS resolves
@@ -0,0 +1,108 @@
+---
+inclusion: auto
+---
+
+# Workspace Context & Conventions
+
+## Git Access
+
+- Git is NOT in the system PATH on this machine.
+- Use GitHub Desktop's bundled git at: `C:\Users\AndreKnie\AppData\Local\GitHubDesktop\app-3.5.8\resources\app\git\cmd\git.exe`
+- Private GitHub repos (e.g. DoctoDre/CV) are accessible via the locally configured GitHub credentials — no separate PAT needed.
+- For git commands in shell, always use the full path: `& "C:\Users\AndreKnie\AppData\Local\GitHubDesktop\app-3.5.8\resources\app\git\cmd\git.exe" <command>`
+- DB GitLab: `https://git.tech.rz.db.de` — PAT auth via PRIVATE-TOKEN header or inline URL for push.
+
+## Repo Landscape
+
+All repos live under: `c:\Users\AndreKnie\OneDrive - Deutsche Bahn\Coden\Orchestrator\`
+
+| Repo | Language | Purpose | Status |
+|------|----------|---------|--------|
+| CV | TypeScript/Node | Personal Knowledge Graph + CV generation | Best-structured, partially implemented |
+| AI-Orchestrator | Python | Autonomous agent dispatcher (Symphony spec) | PAT-management done, orchestrator blocked on server |
+| OrgMyLife | Python | Personal task/call/digest system | Productive, MCP server running |
+| project-audit | Python | Jira/Confluence/GitLab analysis (DB internal) | Functional, script-based |
+| Confluence_Bot | Python | CI/CD for Confluence pages | Minimal |
+| Projekt-KIQ-HP | Node/Web | KIQ Landing Page | Frontend project |
+| Analyse-O2C-C2S | Markdown/HTML | Strategic team analysis O2C+C2S | Active, own GitLab repo |
+| NoteGraph | TBD | Note organization | Early stage |
+
+## Secrets
+
+- Located in `.secrets` at workspace root (gitignored)
+- Contains: GITLAB_TOKEN_BESTELLSYSTEM, GITLAB_TOKEN_AUDIT, JIRA_TOKEN, JIRA_TOKEN_SAB, CONFLUENCE_TOKEN, CONFLUENCE_SAB, ORGMYLIFE_API_SECRET
+- NEVER echo secret values in responses
+
+## Conventional Commits (all repos)
+
+All commit messages follow Conventional Commits format:
+```
+feat(scope): description
+fix(scope): description
+docs(scope): description
+test(scope): description
+ci(scope): description
+refactor(scope): description
+```
+
+## Quality Gates (before every commit)
+
+1. **Security scan**: Run `gitleaks detect --source . --no-git` (or equivalent) — no secrets in code
+2. **Lint**: Run the project's linter (ruff for Python, eslint for Node, tsc --noEmit for TS)
+3. **Test**: Run the project's test suite — minimum 80% coverage target
+4. **Dependency check**: On Node projects, `npm audit` should show 0 vulnerabilities
+
+## Autonomous Mode Rules
+
+When working autonomously (orchestrator, sub-agents):
+- Make decisions based on best practices and existing code patterns
+- Never push directly to main/master — always use feature branches
+- Create a Merge/Pull Request for human review
+- If stuck after 3 attempts: stop and document the issue clearly
+- Report progress: `PROGRESS: X% - what's happening (ETA: Xmin)`
+- Signal help needed: `HELP: clear description of the problem`
+
+## Testing Standards
+
+- Minimum 80% line coverage for new code
+- Use Given-When-Then structure for test cases
+- Property-based testing where applicable (fast-check for TS, hypothesis for Python)
+- Test happy path, edge cases, and error cases
+
+## MCP Servers (available when VPN connected)
+
+```json
+{
+  "jira": { "url": "https://taros-playground-mcp-jira-v2.apps.dbcs-prag.comp.db.de/mcp" },
+  "confluence": { "url": "https://taros-playground-mcp-confluence.apps.dbcs-prag.comp.db.de/mcp" }
+}
+```
+
+## DB Internal Services
+
+- Jira (arija): `https://arija-jira.jaas.service.deutschebahn.com` — PAT auth via Bearer token. Requires VPN.
+- Jira (systelone/SAB): PAT auth works, but requires VPN.
+- Confluence (arija): `https://arija-confluence.jaas.service.deutschebahn.com` — PAT auth via Bearer token works.
+- Confluence (systelone/SAB): NO API/PAT support. Only accessible via HTTPS + HTML.
+- GitLab: `https://git.tech.rz.db.de` — PAT auth via PRIVATE-TOKEN header.
+
+## Token Status (last checked: 2026-05-28)
+
+| Token | Service | Status |
+|-------|---------|--------|
+| GITLAB_TOKEN_AUDIT | GitLab (project-audit) | ✅ OK |
+| GITLAB_TOKEN_BESTELLSYSTEM | GitLab (Bestellsystem) | ✅ OK (renewed 2026-05-28) |
+| CONFLUENCE_TOKEN | Confluence (arija) | ✅ OK |
+| CONFLUENCE_SAB | Confluence (systelone) | ⚠️ No API support — HTML only |
+| JIRA_TOKEN | Jira (arija) | ❓ Not testable without VPN |
+| JIRA_TOKEN_SAB | Jira (systelone) | ❓ Not testable without VPN |
+| ORGMYLIFE_API_SECRET | OrgMyLife | ✅ OK (local) |
+| GitHub (Desktop) | GitHub | ✅ OK |
+
+## OneDrive Compatibility
+
+All filenames must be OneDrive-safe:
+- No brackets `()[]{}`, no `#%&@$+=~`
+- No single quotes or backticks
+- Replace umlauts in filenames: ä→ae, ö→oe, ü→ue, ß→ss
+- Use hyphens instead of special characters