Orchestrator/.kiro/steering/workspace-context.md

inclusion

inclusion
auto

Workspace Context & Conventions

Git Access

• Git is NOT in the system PATH on this machine.
• Use GitHub Desktop's bundled git at: C:\Users\AndreKnie\AppData\Local\GitHubDesktop\app-3.5.8\resources\app\git\cmd\git.exe
• Private GitHub repos (e.g. DoctoDre/CV) are accessible via the locally configured GitHub credentials — no separate PAT needed.
• For git commands in shell, always use the full path: & "C:\Users\AndreKnie\AppData\Local\GitHubDesktop\app-3.5.8\resources\app\git\cmd\git.exe" <command>
• DB GitLab: https://git.tech.rz.db.de — PAT auth via PRIVATE-TOKEN header or inline URL for push.

Repo Landscape

All repos live under: c:\Users\AndreKnie\OneDrive - Deutsche Bahn\Coden\Orchestrator\

Repo	Language	Purpose	Status
CV	TypeScript/Node	Personal Knowledge Graph + CV generation	Best-structured, partially implemented
AI-Orchestrator	Python	Autonomous agent dispatcher (Symphony spec)	PAT-management done, orchestrator blocked on server
OrgMyLife	Python	Personal task/call/digest system	Productive, MCP server running
project-audit	Python	Jira/Confluence/GitLab analysis (DB internal)	Functional, script-based
Confluence_Bot	Python	CI/CD for Confluence pages	Minimal
Projekt-KIQ-HP	Node/Web	KIQ Landing Page	Frontend project
Analyse-O2C-C2S	Markdown/HTML	Strategic team analysis O2C+C2S	Active, own GitLab repo
NoteGraph	TBD	Note organization	Early stage

Secrets

• Located in .secrets at workspace root (gitignored)
• Contains: GITLAB_TOKEN_BESTELLSYSTEM, GITLAB_TOKEN_AUDIT, JIRA_TOKEN, JIRA_TOKEN_SAB, CONFLUENCE_TOKEN, CONFLUENCE_SAB, ORGMYLIFE_API_SECRET
• NEVER echo secret values in responses

Conventional Commits (all repos)

All commit messages follow Conventional Commits format:

feat(scope): description
fix(scope): description
docs(scope): description
test(scope): description
ci(scope): description
refactor(scope): description

Quality Gates (before every commit)

1. Security scan: Run gitleaks detect --source . --no-git (or equivalent) — no secrets in code
2. Lint: Run the project's linter (ruff for Python, eslint for Node, tsc --noEmit for TS)
3. Test: Run the project's test suite — minimum 80% coverage target
4. Dependency check: On Node projects, npm audit should show 0 vulnerabilities

Autonomous Mode Rules

When working autonomously (orchestrator, sub-agents):

• Make decisions based on best practices and existing code patterns
• Never push directly to main/master — always use feature branches
• Create a Merge/Pull Request for human review
• If stuck after 3 attempts: stop and document the issue clearly
• Report progress: PROGRESS: X% - what's happening (ETA: Xmin)
• Signal help needed: HELP: clear description of the problem

Testing Standards

• Minimum 80% line coverage for new code
• Use Given-When-Then structure for test cases
• Property-based testing where applicable (fast-check for TS, hypothesis for Python)
• Test happy path, edge cases, and error cases

MCP Servers (available when VPN connected)

{
  "jira": { "url": "https://taros-playground-mcp-jira-v2.apps.dbcs-prag.comp.db.de/mcp" },
  "confluence": { "url": "https://taros-playground-mcp-confluence.apps.dbcs-prag.comp.db.de/mcp" }
}

DB Internal Services

• Jira (arija): https://arija-jira.jaas.service.deutschebahn.com — PAT auth via Bearer token. Requires VPN.
• Jira (systelone/SAB): PAT auth works, but requires VPN.
• Confluence (arija): https://arija-confluence.jaas.service.deutschebahn.com — PAT auth via Bearer token works.
• Confluence (systelone/SAB): NO API/PAT support. Only accessible via HTTPS + HTML.
• GitLab: https://git.tech.rz.db.de — PAT auth via PRIVATE-TOKEN header.

Token Status (last checked: 2026-05-28)

Token	Service	Status
GITLAB_TOKEN_AUDIT	GitLab (project-audit)	✅ OK
GITLAB_TOKEN_BESTELLSYSTEM	GitLab (Bestellsystem)	✅ OK (renewed 2026-05-28)
CONFLUENCE_TOKEN	Confluence (arija)	✅ OK
CONFLUENCE_SAB	Confluence (systelone)	⚠️ No API support — HTML only
JIRA_TOKEN	Jira (arija)	❓ Not testable without VPN
JIRA_TOKEN_SAB	Jira (systelone)	❓ Not testable without VPN
ORGMYLIFE_API_SECRET	OrgMyLife	✅ OK (local)
GitHub (Desktop)	GitHub	✅ OK

OneDrive Compatibility

All filenames must be OneDrive-safe:

• No brackets ()[]{}, no #%&@$+=~
• No single quotes or backticks
• Replace umlauts in filenames: ä→ae, ö→oe, ü→ue, ß→ss
• Use hyphens instead of special characters

Agent Restrictions

• ONLY the human user is allowed to use sudo. Agents MUST NOT attempt to use sudo or request sudo access.