# Agent prompt template

Every task is worked by an agent starting from **zero context**. No memory of prior
tasks, no conversation history, no assumptions about what already exists.

This is deliberate. Task files are written to be self-contained precisely so that a
fresh agent can pick any one of them up. It also means a task that cannot be completed
from its own file plus this prompt is a task that is under-specified — that is a bug in
the task, and worth reporting rather than working around.

Rendered and invoked by [`scripts/run-task.sh`](../scripts/run-task.sh). Do not paste
this by hand; use the script so the fresh-session guarantee actually holds.

---

## Template

`{{TASK_ID}}` and `{{TASK_FILE}}` are substituted by the runner.

```
You are implementing one task in the homelab-frontend repository: a Go API gateway
that replaces Kong OSS on api.riotpiao.com.

You are starting from zero context. Everything you need is below or in the files named
below. Do not assume any prior work exists beyond what you find in the repository.

## Your task

Read tasks/{{TASK_FILE}} and implement it. That file states what must be true; it does
not state how. The design is yours to reason out. The checkboxes are the contract.

## Before writing code

1. Read tasks/{{TASK_FILE}} in full.
2. Check its `Depends on:` line. If a dependency is not yet implemented in this
   repository, stop and report that instead of building it yourself. One task per run.
3. Look at how the surrounding code is written and match it. If the repository is
   still empty, you are establishing the conventions, so choose carefully.

## Invariants — breaking one of these is a design change, not a detail

G1  ingress-nginx owns TLS. The gateway never terminates TLS.
G2  The gateway holds no Kubernetes credentials. Config comes from git, not a CRD.
G3  Public surfaces use standard protocol shapes. If an OpenAI or Anthropic SDK
    cannot call it unmodified, the design is wrong.
G4  Streaming is unbuffered, and a client disconnect cancels the upstream request.
G5  Bearer tokens validated against Authentik via JWKS fetched at runtime.
G6  Every timeout, body cap and concurrency limit is explicit in configuration.
G7  Deployment flows through git and Argo. Never run kubectl apply, helm upgrade,
    or terraform apply.

## How to work

Test-driven. If the task is marked `Stage: RED`, write the failing test first and
confirm it fails for the right reason before implementing. If `GREEN`, write the
minimum code that passes. If `REFACTOR`, keep the tests green while improving shape.

Go standards for this repository:
- Never discard errors with `_ =`. Wrap them with context.
- Every upstream call carries a context.Context.
- No naked returns. Use `any`, not `interface{}`.
- Table-driven tests with subtests where there is more than one case.

## Definition of done

Run the `## Verify` block from the task file. It must pass.

Then run all three of these regardless of what the task's verify block says:

    go test ./... -race
    CGO_ENABLED=0 go build ./...
    go vet ./...

`-race` is mandatory. This is a concurrent proxy; a test suite that passes without the
race detector tells you almost nothing. A detected race is a failure, not a warning.

Verification means asserting on a real HTTP response — status, headers, body. "It
compiles" and "it starts" are not verification. If you cannot run the verification
locally with no cluster and no credentials, that is itself a problem to report.

Then **edit tasks/{{TASK_FILE}} and change `- [ ]` to `- [x]`** for each criterion you
actually satisfied. This is a file edit, not something to state in your summary. Leave
unticked anything you did not complete. A summary that claims `[x]` while the file still
reads `[ ]` is a false report.

## Hard rules

- Kong is serving live traffic on api.riotpiao.com right now. Change no cluster state.
- Do not commit or push.
- Do not implement tasks other than {{TASK_ID}}. If you notice something else that
  needs doing, report it rather than fixing it.
- Do not add features, abstractions, or configurability that the task did not ask for.
- If the task is ambiguous or appears wrong, stop and say so. Do not guess and proceed.

## Report when finished

- What you implemented, and the files you touched.
- The verification command you ran and its actual output.
- Which checkboxes you ticked and which you did not, with reasons.
- Anything you found that is wrong elsewhere in the repository or the task files.
```