argus-runtime-orchestration

name	argus-runtime-orchestration
description	Portable outer-operator procedure for durable Argus missions across five hosts.

Argus runtime orchestration

Use when a task benefits from durable state, artifacts, experiments, background execution, independent review, pause/resume, or continuation beyond one model turn. Do not use for a quick answer, simple read-only inspection, or a small operation the current host can safely finish and verify directly.

Known limitations

• Argus does not provide a universally portable push/callback from Needs you into every outer operator. The outer operator must actively inspect compact Argus status/output at meaningful boundaries. Intervention detection may not be real-time when the host cannot maintain durable monitoring, and this skill forbids claiming unattended supervision in that case.
• The Hermes Agent and Claude Code adapters are currently documentation-validated rather than locally execution-tested on this host.
• Some Copilot CLI skill commands in current documentation are absent from the locally tested 1.0.39 build, so feature detection is required.

Two-party operating model and configuration

There are exactly two operational parties:

1. The outer operator: OpenClaw, Hermes Agent, Claude Code, Codex CLI, Copilot CLI, or another shell-capable agent following this skill. It stages the mission, launches and observes Argus, handles operator questions within delegated authority, verifies artifacts, and reports compactly.
2. Argus: the durable supervised system that plans, executes, reviews, persists state, surfaces questions, and produces evidence and artifacts.

Any model/provider CLI Argus uses internally—such as codex, copilot, claude, pi, opencode, or grok—is Argus configuration and an implementation detail, not a third role, peer actor, or separate party in this procedure. The outer operator may select or verify Argus's configured internal model/provider during preflight when operationally necessary and authorized; otherwise it treats Argus as one durable supervised system. Do not infer Argus configuration from the outer operator's identity, even when names happen to match.

Resolve the executable explicitly; do not assume one universal install path. POSIX shell:

if [ -n "${ARGUS_BIN:-}" ]; then
  : # operator supplied an executable path
elif command -v argus >/dev/null 2>&1; then
  ARGUS_BIN="$(command -v argus)"
elif [ -n "${ARGUS_INSTALL:-}" ]; then
  ARGUS_BIN="$ARGUS_INSTALL/.venv/bin/argus"
else
  echo "Set ARGUS_BIN or ARGUS_INSTALL" >&2; exit 2
fi

Native PowerShell:

if ($env:ARGUS_BIN) {
  $ArgusBin = $env:ARGUS_BIN
} elseif (Get-Command argus -ErrorAction SilentlyContinue) {
  $ArgusBin = (Get-Command argus).Source
} elseif ($env:ARGUS_INSTALL) {
  $ArgusBin = Join-Path $env:ARGUS_INSTALL ".venv\Scripts\argus.exe"
} else {
  throw "Set ARGUS_BIN or ARGUS_INSTALL"
}

The command examples below use POSIX "$ARGUS_BIN" ... syntax. In PowerShell, invoke the resolved path as & $ArgusBin ....

For a source checkout, ARGUS_INSTALL="$HOME/src/Argus" is an example only, not a portable default. Record the resolved absolute executable path. Never download, reinstall, alter Argus's internal model/provider configuration, or widen permissions silently.

Core operating procedure

1. Choose one owned workdir and a real security boundary. Use a dedicated absolute directory per Argus project. Never overlap another active Argus project's directory hierarchy. Do not move, delete, or share-write it while its daemon is active. True parallel work gets separate projects. The workdir is an ownership boundary, not a sandbox. ARGUS_SKILL_SAFE_MODE=1 adds guardrails but is not itself isolation for every backend. Before staging sensitive inputs, require verified sandboxing for the selected backend or run Argus in an appropriately isolated OS/container boundary. Default unattended mode may grant internal agents access beyond the workdir.
2. Stage bounded inputs. Copy only task-relevant, disclosure-safe inputs under inputs/. Write OBJECTIVE.md with outcome, non-goals, output paths, acceptance checks, authority limits, and review/citation requirements. Do not stage ambient conversation history, credentials, or unrelated private data.
3. Preflight from the exact workdir. Run "$ARGUS_BIN" doctor, then probe "$ARGUS_BIN" --status. Use doctor --deep only when backend authentication must be verified; do not add that network/auth latency to every routine preflight. Deep Doctor is not universal proof of live authentication: when it reports an unchecked token, offline capability, or unreachable route, use that backend's documented non-mutating live readiness probe before dispatch. Continue only if the required checks pass, the intended project/workdir is identified, no ownership conflict exists, and any operationally required internal model/provider choice is installed and authenticated. The outer operator may select or verify that Argus configuration here when authorized, but must not treat it as another operational party. The current Argus top-level help is intentionally terse and may omit supported automation flags; before using --notify, daemon, bounded, or API surfaces against another build, verify them from that build's docs/parser or a safe probe. See references/argus-runtime-surfaces.md.
4. Keep internal execution configuration explicit only when needed. Prefer Argus's already configured, installed, authenticated internal model/provider. Qualify provider names where Argus requires it. Do not silently change configuration after a failed readiness check; diagnose first and obtain approval when the change exceeds delegated authority.
5. Dispatch one standalone mission. From the workdir, give Argus a self-contained objective naming staged inputs and outputs. Request inspect → execute → validate → repair → final-artifact closure. Defer to Argus's native risk/Vertical review policy; explicitly require independent review only when the task contract or material risk requires it. Keep one bounded deliverable per mission. For a one-off bounded mission where reusable learning is not requested and deployment policy permits, set to avoid the default post-task learning model call; otherwise preserve the configured learning policy. Use the interactive cockpit when available; for detached execution, use Argus's documented daemon/bounded surfaces rather than an improvised shell loop.

Capability fallbacks

• No native skill discovery: provide the full bundle or explicitly instruct the host to read this file and the matching adapter; do not claim automatic activation.
• No shell: the host cannot directly operate local Argus. Use an approved remote shell/terminal integration or hand off exact operator steps; mark execution blocked rather than simulating it.
• Shell but no process API: prefer Argus --daemon only when the environment preserves processes; always persist project/workdir identity and re-enter with status/cockpit. Do not background with fragile &, nohup, or sleep/poll loops unless the host's documented environment makes that the only approved path.
• Process API but not durable across host sessions: use it for live logs only; durable Argus project state remains the recovery anchor, and the daemon may need to be relaunched.
• No HTTP/API client: use terminal/Web cockpit and --status. Never require API access for the question loop.
• No interactive approval route: fail closed on approval-gated actions. Split safe preflight from mutating launch, or ask the human to approve through that host's supported UI. Never bypass approval/sandbox flags merely to run unattended.
• No unattended execution allowed: keep an interactive session open or stop with a precise resume instruction and unresolved state. Report monitoring as conditional, not active.

Privacy, authority, and return

Stage minimum data. Keep Web UI loopback-only unless the user approves protected remote access. Current user instructions and fresh evidence override prior plans or runtime suggestions.

Return to the invoking surface only: workdir/project identity, compact outcome/frontier, Reviewer verdict, artifact paths, decisive validation, citation exceptions, and unresolved operator-owned question/blocker. Do not assume that surface is a parent chat.