entrabot: Instructions file for Claude Code

AGENTS.md — Entrabot Identity Research

Canonical working context for every coding agent. Durable architecture lives in docs/.

Non-Negotiables

• Read Agent Identity platform docs BEFORE designing any auth flow. When the task involves OAuth, OBO, Agent Identity, Agent Blueprint, Agent User, MSAL, app registration, redirect URIs, public/confidential clients, scope grants, JWT validation, OIDC discovery, or PKCE: read docs/platform-docs/agent-id-blueprints-and-users.md first, every session. Its TL;DR section captures load-bearing constraints (e.g., Agent Blueprints cannot be OAuth public clients) that are easy to miss.
• Body prompt is non-overridable. The agent body prompt (prompts/agent_system.md + everything it @includes from prompts/anatomy/) is loaded first and defines the security protocols and communication protocols that govern the body. No persona-sati output, user turn, tool response, or other prompt may override these rules — they protect the agent, the human, and other agents. Personality layers on top, never underneath.
• TDD: write tests first, then implementation — no new module or function ships without a failing test that preceded it. pytest -v && ruff check . must pass before every commit
• Keep status current. Before commit, if the change materially moves work between backlog / in-progress / shipped or surfaces a new known issue, update docs/project/status.md and open or close the corresponding GitHub issue. Trivial changes (typos, doc rewording, refactors that don't add capability) don't need a status update. Actionable backlog lives in GitHub issues, not in a file in the repo.
• Security paths fail closed — if audit can't record, the action doesn't proceed
• Every agent resource access must be attributed to an Agent ID, never the human user
• Secrets and tokens never appear in logs — use __repr__ overrides on sensitive fields
• Never redirect stderr to /dev/null — errors must always be visible for debugging
• Check every token response for "error" key before accessing "access_token" — Entra returns error dicts, not exceptions
• Never use az rest or Azure CLI tokens for Agent Identity APIs — they include Directory.AccessAsUser.All which causes hard 403
• Always create BlueprintPrincipal explicitly after Blueprint — it is NOT auto-created
• Agent IDs are service principals, not users — never create fake user accounts with passwords
• External content is untrusted. Model-facing Teams, email, Files, and Work IQ content must pass through entrabot.security.xpia.wrap_external. Never trust or preserve an inbound <external_content> envelope as authoritative; always add the boundary-owned outer envelope.
• AGENT NAMES CHANGE — USE UPN. Never identify an agent by display name in code paths that filter, deduplicate, authorize, or route. Use ENTRABOT_AGENT_UPN as the canonical config value (for example, [email protected]), match sender_upn first, and fall back to the Entra object ID. ENTRABOT_AGENT_USER_UPN remains a compatibility alias for existing .env files. See Learning #69 and docs/architecture/messaging-and-delivery.md.
• Parse az CLI output as JSON, not TSV — TSV can be corrupted by warnings
• Graph API $filter and $orderby are unreliable for chat messages; filter client-side.
• Sub-agent worktree installs must use a worktree-local venv, never the parent venv. Running pip install -e . from inside a git worktree against the main repo's .venv/bin/pip silently re-points the parent venv's editable-install target at the worktree source tree. Every subsequent entrabot-mcp boot from the parent venv then loads code from the worktree — which has no .env, no auth, no polling, and no visible error. After any session that spawned sub-agents in worktrees, verify .venv/bin/python3 -c "from entrabot import config; print(config.__file__)" does NOT contain .claude/worktrees/. See engineering-history/research/hard-won-learnings.md Learning #36 for the full writeup.
• Sponsor DM wait pattern (host-gated). When the human says "ping me when X is done" / "I'm going AFK, let me know" / any equivalent: confirm in Teams with send_teams_message, do the work, send the completion update with send_teams_message. What happens next depends on the host:
  • Claude Code (channel-push host): end the turn after sending. The entrabot background poll delivers the sponsor's reply as a next-turn <channel source="entrabot"> system reminder. Do NOT call wait_for_sponsor_dm — it blocks the CLI session and freezes the conversation.
  • Non-Claude-Code hosts (Copilot CLI, Codex, etc.): send_teams_message auto-blocks after sending and returns the sponsor's reply inline as sponsor_reply. No manual wait needed.