🐳 Project 4: a third executor

Goal: start dsh in the right mode and confirm the panel responds before anything else.

cd ~/projetos/dsh-sandbox

# see what state it is in right now (it may have been up for days)
./dsh status

# for this project: local mode (projects mounted + Ollama only)
./dsh local

# the panel only listens on loopback; from outside, use an SSH tunnel
curl -sf -o /dev/null -w '%{http_code}\n' http://127.0.0.1:9080
# expected: 200

# container and memory cap
docker ps --filter name=dsh-orchestrator-runtime-1

# when you are done
./dsh off

How to verify: ./dsh status shows the active mode and curl returns 200. If you need access from another machine, the way is ssh -L 9080:127.0.0.1:9080 … — dsh refuses to bind to 0.0.0.0 by the authors' design, and the app has no authentication at all.

Goal: apply the patch that adds the third destination, keeping drift as the check for all three.

# --- in scripts/sync-skills.sh, right after `mkdir -p skills dist` ---

# resolve each runtime's destination folder (dsh breaks the ~/.<rt>/skills pattern)
dest_for() {
  case "$1" in
    claude|codex) printf '%s/.%s/skills/%s\n' "$HOME" "$1" "$2" ;;
    dsh)          printf '%s/projetos/dsh-skills/%s\n' "$HOME" "$2" ;;
    *) return 1 ;;
  esac
}
# dsh consumes the SAME format as Claude: the source is dist/claude
src_for() {
  case "$1" in dsh) echo claude ;; *) echo "$1" ;; esac
}

# --- in the `drift` verb: replace `for rt in claude codex` with: ---
      for rt in claude codex dsh; do
        out="$d/dist/$(src_for "$rt")/$s"; tgt="$(dest_for "$rt" "$s")"
        [ -d "$out" ] && [ -d "$tgt" ] || { echo "[não instalada] $s → $rt"; continue; }
        if diff -rq "$out" "$tgt" >/dev/null; then echo "[ok] $s → $rt"; else echo "[DRIFT] $s → $rt"; rc=1; fi
      done

# --- in the `install` verb: replace `for rt in claude codex` with: ---
    for rt in claude codex dsh; do
      case "$tgt" in --both) [ "$rt" = dsh ] && continue ;; --all) ;; --$rt) ;; *) continue ;; esac
      out="skills/$s/dist/$(src_for "$rt")/$s"; [ -d "$out" ] || { echo "rode build antes: $out"; exit 1; }
      dest="$(dest_for "$rt" "$s")"
      [ -e "$dest" ] && cp -a "$dest" "$(dirname "$dest")/.$s.bak-$(date +%s)"
      mkdir -p "$(dirname "$dest")"; cp -a "$out" "$dest"; echo "instalada: $dest"
      # kept from the original: Codex also discovers skills in ~/.agents/skills
      [ "$rt" = codex ] && [ -d "$HOME/.agents/skills" ] && cp -a "$out" "$HOME/.agents/skills/$s" && echo "espelhada: ~/.agents/skills/$s"
    done

How to verify: bash -n scripts/sync-skills.sh passes with no syntax errors, and scripts/sync-skills.sh drift now prints three lines per skill instead of two — the third ending in → dsh.

Goal: bring the three hand-copied skills into the canonical flow and get drift down to zero.

cd ~/projetos/agente-claude-codex

# 1. save the current copies before overwriting (they are the known good state)
cp -a ~/projetos/dsh-skills ~/projetos/dsh-skills.bak-$(date +%Y%m%d)

# 2. import into the canonical source (from the Claude original)
scripts/sync-skills.sh import formato-curso-v2 formato-curso-v5 capa-inema
scripts/sync-skills.sh build

# 3. now install into dsh as well
for s in formato-curso-v2 formato-curso-v5 capa-inema; do
  scripts/sync-skills.sh install "$s" --dsh
done

# 4. the proof
scripts/sync-skills.sh drift; echo "rc=$?"
# expected: only [ok] lines, rc=0

How to verify: rc=0 and no [DRIFT] lines. If drift shows up right after the install, the hand-made copy had some local edit that never made it back to the source — compare it with the backup from step 1 and carry the difference into skills/<nome>/ before moving on.

Goal: create the prime skill and install it to all three destinations, including dsh.

cd ~/projetos/agente-claude-codex
mkdir -p skills/prime

cat > skills/prime/SKILL.md <<'MD'
---
name: prime
description: Loads the project context before any work. Use at the
  start of every session, before the first edit, and whenever you lose the thread.
---

# Prime — read before acting

Read, in this order, and only then respond:

1. `AGENTS.md` at the project root — the stable rules.
2. `context/overview.md` — the verified facts. If there is
   `context/decisions/`, also read the most recent decision.
3. `tasks/current.md` — what is in progress right now.
4. `handoffs/latest.md` — what the last session did and what the next action is.

If any of these files doesn't exist, say which one is missing instead of making things up.

Close the prime with four lines, each citing the file it came from:

- **Project:** what it is, in one sentence.
- **State:** what is done and what is pending.
- **Next action:** the exact sentence written in `handoffs/latest.md`.
- **Rule that matters most here:** the constraint from `AGENTS.md` that
  most affects the next action.
MD

scripts/sync-skills.sh build
scripts/sync-skills.sh install prime --all
ls ~/projetos/dsh-skills/prime/SKILL.md

How to verify: ls finds the file, and scripts/sync-skills.sh drift shows [ok] prime → dsh alongside claude and codex. Then, in the panel at 127.0.0.1:9080 with dsh in local mode, ask "use the prime skill on the project /projetos/<your-pilot>" and check that the four lines come back with a file name on each one.

Goal: confirm, before running readback, that the active mode is the safe one — and measure the size of the surface.

cd ~/projetos/dsh-sandbox

# how many secret files the mount would expose (count only, never the content)
find ~/projetos -maxdepth 3 \( -name '.env' -o -name '.env.*' -o -name '*credential*' \) \
  -type f 2>/dev/null | wc -l

# the active mode — before asking the panel anything
./dsh status

# direct check: does the /projetos mount exist in this container?
docker inspect dsh-orchestrator-runtime-1 \
  | python3 -c 'import json,sys; [print(m["Source"], "->", m["Destination"]) for m in json.load(sys.stdin)[0]["Mounts"]]'

# the panel must not be listening outside loopback
ss -ltnp 2>/dev/null | grep 9080
# expected: 127.0.0.1:9080 — if 0.0.0.0:9080 shows up, take it down NOW with ./dsh off

How to verify: if status says local, inspect shows /projetos mounted and ss shows only 127.0.0.1, you can proceed. Any other combination is a reason to stop and fix it before typing the first question into the panel.

Goal: run the memory preflight and record the readback result in both modes, without jumping to conclusions.

# preflight: does the ~18 GB model fit right now?
free -g | awk '/Mem:/ {print "livre:", $7, "GB"}'
# rule of thumb: under 24 GB free, don't load the 27b alongside inemavox

# who is already holding memory
ps -eo rss,comm --sort=-rss | head -5 | awk '{printf "%6.1f GB  %s\n", $1/1048576, $2}'

# models loaded in Ollama right now
ollama ps

# after the readback, record the result alongside the other two runtimes
cd ~/projetos/<seu-piloto>
mkdir -p relatorios
$EDITOR relatorios/readback-dsh-local.md    # which files were cited, and the next action it read
$EDITOR relatorios/readback-dsh-remoto.md   # same question, context pasted by hand

How to verify: both reports exist and the verdict is written in one sentence — "cited the four files, prose inferior to Claude" is a pass; "didn't cite any file in either mode" is a failure of the context layer, and then the problem is in the prime or the mount, not the model.