---
inclusion: auto
---

# Workspace Context & Conventions

## Git Access

- Git is NOT in the system PATH on this machine.
- Use GitHub Desktop's bundled git at: `C:\Users\AndreKnie\AppData\Local\GitHubDesktop\app-3.5.8\resources\app\git\cmd\git.exe`
- Private GitHub repos (e.g. DoctoDre/CV) are accessible via the locally configured GitHub credentials — no separate PAT needed.
- For git commands in shell, always use the full path: `& "C:\Users\AndreKnie\AppData\Local\GitHubDesktop\app-3.5.8\resources\app\git\cmd\git.exe" <command>`
- DB GitLab: `https://git.tech.rz.db.de` — PAT auth via PRIVATE-TOKEN header or inline URL for push.

## Repo Landscape

All repos live under: `c:\Users\AndreKnie\OneDrive - Deutsche Bahn\Coden\Orchestrator\`

| Repo | Language | Purpose | Status |
|------|----------|---------|--------|
| CV | TypeScript/Node | Personal Knowledge Graph + CV generation | Best-structured, partially implemented |
| AI-Orchestrator | Python | Autonomous agent dispatcher (Symphony spec) | PAT-management done, orchestrator blocked on server |
| OrgMyLife | Python | Personal task/call/digest system | Productive, MCP server running |
| project-audit | Python | Jira/Confluence/GitLab analysis (DB internal) | Functional, script-based |
| Confluence_Bot | Python | CI/CD for Confluence pages | Minimal |
| Projekt-KIQ-HP | Node/Web | KIQ Landing Page | Frontend project |
| Analyse-O2C-C2S | Markdown/HTML | Strategic team analysis O2C+C2S | Active, own GitLab repo |
| NoteGraph | TBD | Note organization | Early stage |

## Secrets

- Located in `.secrets` at workspace root (gitignored)
- Contains: GITLAB_TOKEN_BESTELLSYSTEM, GITLAB_TOKEN_AUDIT, JIRA_TOKEN, JIRA_TOKEN_SAB, CONFLUENCE_TOKEN, CONFLUENCE_SAB, ORGMYLIFE_API_SECRET
- NEVER echo secret values in responses

## Conventional Commits (all repos)

All commit messages follow Conventional Commits format:
```
feat(scope): description
fix(scope): description
docs(scope): description
test(scope): description
ci(scope): description
refactor(scope): description
```

## Quality Gates (before every commit)

1. **Security scan**: Run `gitleaks detect --source . --no-git` (or equivalent) — no secrets in code
2. **Lint**: Run the project's linter (ruff for Python, eslint for Node, tsc --noEmit for TS)
3. **Test**: Run the project's test suite — minimum 80% coverage target
4. **Dependency check**: On Node projects, `npm audit` should show 0 vulnerabilities

## Autonomous Mode Rules

When working autonomously (orchestrator, sub-agents):
- Make decisions based on best practices and existing code patterns
- Never push directly to main/master — always use feature branches
- Create a Merge/Pull Request for human review
- If stuck after 3 attempts: stop and document the issue clearly
- Report progress: `PROGRESS: X% - what's happening (ETA: Xmin)`
- Signal help needed: `HELP: clear description of the problem`

## Testing Standards

- Minimum 80% line coverage for new code
- Use Given-When-Then structure for test cases
- Property-based testing where applicable (fast-check for TS, hypothesis for Python)
- Test happy path, edge cases, and error cases

## MCP Servers (available when VPN connected)

```json
{
  "jira": { "url": "https://taros-playground-mcp-jira-v2.apps.dbcs-prag.comp.db.de/mcp" },
  "confluence": { "url": "https://taros-playground-mcp-confluence.apps.dbcs-prag.comp.db.de/mcp" }
}
```

## DB Internal Services

- Jira (arija): `https://arija-jira.jaas.service.deutschebahn.com` — PAT auth via Bearer token. Requires VPN.
- Jira (systelone/SAB): PAT auth works, but requires VPN.
- Confluence (arija): `https://arija-confluence.jaas.service.deutschebahn.com` — PAT auth via Bearer token works.
- Confluence (systelone/SAB): NO API/PAT support. Only accessible via HTTPS + HTML.
- GitLab: `https://git.tech.rz.db.de` — PAT auth via PRIVATE-TOKEN header.

## Token Status (last checked: 2026-05-28)

| Token | Service | Status |
|-------|---------|--------|
| GITLAB_TOKEN_AUDIT | GitLab (project-audit) | ✅ OK |
| GITLAB_TOKEN_BESTELLSYSTEM | GitLab (Bestellsystem) | ✅ OK (renewed 2026-05-28) |
| CONFLUENCE_TOKEN | Confluence (arija) | ✅ OK |
| CONFLUENCE_SAB | Confluence (systelone) | ⚠️ No API support — HTML only |
| JIRA_TOKEN | Jira (arija) | ❓ Not testable without VPN |
| JIRA_TOKEN_SAB | Jira (systelone) | ❓ Not testable without VPN |
| ORGMYLIFE_API_SECRET | OrgMyLife | ✅ OK (local) |
| GitHub (Desktop) | GitHub | ✅ OK |

## OneDrive Compatibility

All filenames must be OneDrive-safe:
- No brackets `()[]{}`, no `#%&@$+=~`
- No single quotes or backticks
- Replace umlauts in filenames: ä→ae, ö→oe, ü→ue, ß→ss
- Use hyphens instead of special characters

## Agent Restrictions
- ONLY the human user is allowed to use `sudo`. Agents MUST NOT attempt to use `sudo` or request `sudo` access.