1---2name: open-horizons-backstage-aeg3description: Use when editing the Open Horizons Backstage AEG feature, its proxy, actions, agent registry, configuration, or scaffold integration.4---56<!-- Generated from harness/github-copilot/plugins/open-horizons-platform/instructions/open-horizons-backstage-aeg.instructions.md by harness/claude-code/scripts/convert_from_copilot.py. Edit the source, not this file. -->78# Open Horizons Backstage AEG feature910These instructions apply to the Backstage AEG presentation, proxy, action, configuration, agent11registry, and scaffold integration matched by the `applyTo` globs. They are authoritative for passive12identity, lifecycle, tool-contract, and verification conventions in those files; the authenticated AEG13service owns runtime policy and authorization, while the `open-horizons-backstage-aeg-feature` skill14owns ordered workflows.1516## Boundaries1718- Keep Backstage as the authenticated presentation and integration surface; orchestration policy,19 lifecycle transitions, role enforcement, and audit decisions belong to the AEG service.20- Derive actor identity from the authenticated principal. Do not accept model-authored actor IDs,21 roles, tenant IDs, or identity claims in run, decision, or proposal requests.22- Keep G1 and G2 in the AEG decision workflow. Expose G3 pull-request and G4 production status and23 deep links only; never implement those approvals in chat.24- Keep logical AEG agent names independent of model providers, model IDs, and worker-engine defaults.25 Use `inherit` unless an approved run policy requires a specific engine.2627## Contracts2829- Use stable typed tools, bounded responses, explicit read-only or mutating classification, and30 server-side authorization for every invocation.31- Preserve `CONSTITUTION.md`, FRD/NFRD EARS requirements, ADRs, `specs/tasks.yaml`, findings, and32 `specs/traceability.yaml` as the lifecycle evidence chain.33- Keep the Backstage action and proxy thin. New lifecycle rules belong in the AEG service, not in34 frontend components, Scaffolder actions, or prompt text.35- Put endpoints and credentials in approved configuration and secret providers. Never expose them36 in frontend bundles, catalog entities, logs, tool schemas, or versioned app configuration.37- Return safe errors with correlation IDs; do not expose raw provider responses, prompts, tokens,38 stack traces, or authorization details.3940## Verification4142- Test authentication separately from authorization and verify denied tools are neither executable43 nor represented as successful.44- Add contract coverage for malformed input, unavailable dependencies, bounded lists, timeout,45 rejected G1/G2 decisions, and actor-field rejection.46- Verify G3/G4 remain status-only and that every mutating tool reaches a human approval boundary.47- Validate requirement-to-resource traceability and preserve missing evidence as an explicit blocker.4849## Conventions5051| Rule | Rationale |52| --- | --- |53| Derive the actor from the authenticated principal. | Model-authored identity fields permit impersonation and weaken audit evidence. |54| Keep lifecycle policy in the AEG service. | Thin Backstage adapters prevent policy drift across UI, actions, prompts, and APIs. |55| Classify every tool as read-only or mutating. | Hosts and hooks need stable metadata to enforce human approval. |56| Preserve AEG-native artifact names and traceability. | Stable evidence makes gates, findings, and delivery status independently reviewable. |57| Keep model and worker-engine choices outside logical agent identities. | The feature remains portable across supported execution engines. |5859## Do / Do Not6061| Do | Do not |62| --- | --- |63| Enforce authorization in the backend for every action. | Treat hidden UI controls or tool discovery as authorization. |64| Return bounded, typed results and safe correlation IDs. | Expose raw provider errors, prompts, credentials, or stack traces. |65| Keep G3 and G4 as status and deep-link surfaces. | Approve pull requests or production promotion through chat. |66| Add contract tests at authentication, authorization, and mutation boundaries. | Rely on instructions or agent prose as an enforcement control. |6768## Checklist Before Opening a PR6970- [ ] The change stays within the Backstage AEG feature and preserves the service responsibility split.71- [ ] Actor identity is server-derived and model-controlled actor fields are rejected.72- [ ] Tool schemas, bounds, mutation classification, and authorization behavior are tested.73- [ ] G1/G2 and G3/G4 approval boundaries remain distinct.74- [ ] Secrets, raw provider failures, prompts, and tokens do not enter frontend or model-visible output.75- [ ] AEG artifacts and requirement-to-resource traceability remain internally consistent.76- [ ] Focused Backstage tests and the AEG contract validator pass.77
paulasilvatech