do-work

name

do-work

description

Autonomous AFK driver for cert-mgmt-tool GitHub issues. Picks up a ready-for-agent issue, reads PRD #1 and project docs, implements it via the tdd skill, then commits, pushes, and closes the issue. When blocked on something only the human can resolve, it comments on the issue, applies the hitl label, and stops instead of guessing. Use when asked to "do work", work an issue AFK, or run the backlog unattended.

Do Work

Autonomous, away-from-keyboard implementation of one GitHub issue end to end. The human is not watching — never block on a question. Either proceed on a safe interpretation or hand the issue back via the HITL escape hatch (§5).

Repo: kenlck/cert-mgmt-tool. Run every gh command with --repo kenlck/cert-mgmt-tool.

1. Pick the issue

• If the invocation names an issue number, use it.
• Otherwise pick the lowest-numbered open issue labeled ready-for-agent that is not labeled hitl:

gh issue list --repo kenlck/cert-mgmt-tool --state open \
  --label ready-for-agent --json number,title,labels --jq \
  'map(select((.labels|map(.name)|index("hitl"))|not)) | sort_by(.number) | .[0]'

If none qualify, stop and report "no ready issues".

2. Load project truth

Read before touching code:

• The issue body: gh issue view <id> --repo kenlck/cert-mgmt-tool
• PRD: gh issue view 1 --repo kenlck/cert-mgmt-tool
• CONTEXT.md (domain glossary) and docs/adr/0001-native-keystore-engine.md
• Relevant brain/ notes (start at brain/index.md)

Check the issue's Blocked by section. If it names an open issue, do not start — go to §5 (HITL) noting the unmet dependency.

3. Implement with TDD

The issue acceptance criteria plus PRD #1 are the approved behavior list — this is the AFK approval boundary, so do not pause for plan sign-off. Invoke the tdd skill to do the work: one red→green→refactor cycle per behavior, tests through public engine/TUI seams, go test ./... green before each commit. Honor the engine constraints in ADR 0001 and the glossary terms in CONTEXT.md.

4. Finish (success path)

Only when every acceptance criterion is met and go test ./... passes:

1. Commit with a conventional message ending in Refs: #<id>.
2. Push to main (or merge the worktree if running under Noodle).
3. Confirm CI is green for the pushed commit.
4. Close the issue with a summary comment:

gh issue close <id> --repo kenlck/cert-mgmt-tool \
  --comment "Implemented and pushed in <sha>. <one-line summary>."

5. Record any non-obvious learning in brain/ and update brain/index.md.

5. HITL escape hatch (when blocked)

Hand the issue back to the human instead of guessing when you hit:

• An ambiguity with no safe smallest-interpretation, or conflicting requirements.
• A product/irreversible decision the issue and PRD don't settle.
• Missing secrets, credentials, or access.
• An unmet dependency (§2) or a failing external system you cannot fix.
• Acceptance criteria you cannot satisfy without violating an ADR.

Do this and then stop — do not start another issue:

gh issue comment <id> --repo kenlck/cert-mgmt-tool --body \
  "🤚 Needs your input.

**Blocker:** <what is blocking>
**What I tried / found:** <context>
**Decision I need from you:** <specific question(s)>

Paused here; remove the \`hitl\` label once resolved to release it."
gh issue edit <id> --repo kenlck/cert-mgmt-tool --add-label hitl

Leave any partial work on a branch (never a broken main). Report the blocker in your final output so the human sees it without opening GitHub.

Final output

Always end with: issue number, outcome (closed / paused-hitl / no-work), changed files, verification commands run, commit sha, and residual risks.