Install, enroll, start, and troubleshoot the Linux Nexus Agent on a target host until it connects to the Hub, installs the iptables redirect chain, listens on 19080, and produces traffic_event rows. Encodes every real failure mode hit deploying to an Ubuntu server and a kernel-6.17 Docker desktop on a censored (GFW) network: pending-enrollment (enroll skipped), "Incompatible with this kernel" (iptables-nft vs legacy on new kernels), xtables.lock permission, missing nat modules, SO_MARK self-loop 502s, PeekSNI plain-HTTP stall, SSL_CERT_FILE / browser-CA trust, DNS poisoning (DoT), TLS-SNI reset + egress proxy, QUIC/HTTP3 bypass, and local-proxy loopback bypass. Trigger keywords: deploy linux agent, install nexus-agent on linux, agent won't connect, agent not intercepting, no 19080, iptables Incompatible with this kernel, agent enrollment, browser chatgpt not monitored, agent 502, /linux-agent-deploy.
Audit and enrich a Control Plane OpenAPI spec file claim-by-claim against the handler code. Pre-commit gate for every per-kind spec under docs/users/api/openapi/control-plane/. The spec must mirror what the handlers actually implement — paths, verbs, types, status codes, IAM tiers — and carry the semantic layer only a human audit can supply: accurate field/operation descriptions, request/response examples, enum value sets, and the true required-field set. Trigger keywords: openapi review, openapi audit, review schema, audit api spec, enrich openapi, /openapi-review.
Bring the full Nexus Gateway local stack up from a clean clone — PostgreSQL + Valkey + NATS via docker-compose, four Go services (Hub / Control Plane / AI Gateway / Compliance Proxy), and the Control Plane UI (Vite). Encodes every gotcha a first-time OSS contributor hits so the model can drive the full bring-up without asking the user mid-way. Trigger keywords: run local, start local stack, local bring-up, local dev start, first-run, OSS first run, bootstrap stack, /run-local.
End-to-end smoke test for the Compliance Proxy. Use when the user wants to verify that the running compliance-proxy correctly MITM-intercepts HTTPS provider traffic on `:3128`, applies the compliance pipeline, and writes matching `traffic_event` rows (`source = 'compliance-proxy'`) plus Prometheus counters. Trigger keywords: test compliance proxy, smoke cp, verify compliance proxy, MITM smoke, /v1/messages proxy test, agent upstream simulation. No required input — credentials come from the DB (`Credential` table). Output: a Markdown report at `/tmp/test-compliance-proxy-<UTC-timestamp>.md`.
Use when building, compiling, or publishing the Nexus Gateway AWS AMI / single-instance appliance (the nexus-ami/ Packer image) and registering it to AWS. Covers the full pipeline (Go cross-compile + UI + Prisma + Packer), the EC2 vCPU-quota trap that makes the default m5.4xlarge fail with VcpuLimitExceeded on fresh accounts, the RAM-bound valkey-search compile that OOMs under 48GB, passing an AWS profile, running the ~1h build detached, and verifying the AMI. Trigger keywords: build ami, compile ami, publish ami, packer build, nexus-ami, push ami to aws.
Audit ai-gateway adapter codecs against provider-adapter-architecture.md Section 3a Rules 1-7. Detects per-adapter logic that leaked into the generic spec_adapter dispatcher, ingress bodies passed to PrepareBody without canonicalize, error envelopes that bypass the helper, prefix-lists without empirical evidence, and missing PassthroughRewrite wiring. Trigger keywords: adapter audit, adapter conformance, codec audit, provider adapter check, /adapter-conformance-check.
Use when fixing frontend bugs, UI errors, runtime crashes, or data display issues — traces page to API to backend to database, fixes mismatches, then verifies via curl login + DB queries
Full-surface smoke test for the AI Gateway + Control Plane. Tests every model in the catalog (non-stream + SSE + 2-turn cache), auto-manages routing rules (all OFF for P3; per-rule isolation for P4), cross-checks traffic_event DB rows, diffs Prometheus counters, and auto-fixes failures (investigate → edit code → build → restart gateway → rerun). Includes P3E embeddings phase: per-model six-arm suite (Arm A non-stream basic, Arm B dimensions round-trip, Arm C batch input, Arm D traffic_event cross-check, Arm E Prometheus delta, Arm F cross-ingress consistency) plus reject-asymmetry negative tests (HTTP 400 on provider capability violations). Cache and dry-run arms are explicitly skipped for embeddings (no prompt-cache semantic). Trigger keywords: smoke gateway, full smoke, test all models, verify all providers, /smoke-gateway. Inputs: user provides a virtual key (vk) and optionally --routing to enable routing-ON tests. Output: Markdown report at /tmp/smoke-gateway-<UTC-timestamp>.md