# Plan: F2 Completion + F3 Knowledge Plane CLI Integration

## Goal
Complete F2 (minimal complete agent flow) engineering fixes and transition to F3 (knowledge plane / mySecondBrain26) with CLI entry points for knowledge ingest/search.

## Current State
- **Phase:** F2 (minimal complete agent flow)
- **Gate 1:** ✅ Green — pytest 764 passed, ruff clean, mypy clean (87 files)
- **Authoritative plan:** `.kilo/plans/CyberBrain26cil-031026-v2.md`
- **Research complete:** R1 (Embedding API), R2 (Test Isolation), R3 (llama.cpp proxy), R4 (Customer Discovery), R5 (Audit Chain HMAC)
- **Jurassic AI research complete:** Knowledge plane integration design documented

## Open Engineering Items (F2 Completion)

### 1. Fix `plan --steps N` (agents/orchestrator.py:153)
**Problem:** `PlannerAgent.execute` ignores `max_steps` and always returns `range(1, 4)`.  
**Fix:** Respect `max_steps` parameter from roadmap step data.  
**Impact:** This is the #3 priority engineering fix per SESSION_HANDOFF_2026-11-03.

### 2. Fix `plan` durable COMPLETED row never refreshed (ptah_bridge.py)
**Problem:** `plan` writes durable task row (`ptah:<id>:step-0`) whose COMPLETED result is never refreshed. Re-running `plan` with same `--id` reuses stale plan.  
**Fix:** Refresh durable task result from SQLite after step completion.  
**Impact:** Per SESSION_HANDOFF_2026-11-03, #4 priority fix.

### 3. Fix `--scopes` trap (ACTION_SCOPE_REQUIREMENTS missing 4 actions)
**Problem:** `--scopes` applies only to the `coder` role. Security/evaluator steps carrying code pass scope gate and are blocked later at policy/approval. ACTION_SCOPE_MAP missing four actions.  
**Fix:** Add four missing sensitive actions to `ACTION_SCOPE_REQUIREMENTS` in `src/cyberbrain26/security_plane/actions.py` (see comment lines 259-260: four sensitive actions swallowed before policy gate).  
**Impact:** Security hardening; per PROJECT_STATUS.md:213, `ACTION_SCOPE_MAP` missing four actions.

### 4. Add `__main__` guard to cli.py (cli.py:missing)
**Problem:** `python3 -m cyberbrain26.cli` silently exits 0 and does nothing, because there is no `__main__` guard.  
**Fix:** Add `if __name__ == "__main__"` block that invokes the app CLI.  
**Impact:** Per PROJECT_STATUS.md:201, verified in this review.

## F3 Knowledge Plane CLI Integration

### 5. Add `cyberbrain knowledge ingest /path/to/docs` CLI command
- Import `MemoryService` from `cyberbrain26.knowledge_plane`
- Walk directory, classify files, chunk, embed via Ollama `qwen3-embedding:0.6b` (dim=1024), store in LanceDB
- Audit every write via existing AuditLog
- Record `knowledge_doc_id` in manifest entries

### 6. Add `cyberbrain knowledge search "dotaz"` CLI command
- Accept natural language query
- Use `KnowledgeNavigator.search_by_keyword()` + vector search over LanceDB
- Return ranked results with source metadata

### 7. Update `docs/CAPABILITIES.md` — mark knowledge plane as `WORKING` with `path:line` evidence

## Validation Plan

### Gate 1 (PŘED - before any src/ change)
- `pytest -q`: 764 passed (already green)
- `ruff check src/cyberbrain26/`: passed (already green)  
- `mypy src/cyberbrain26`: Success, 87 source files (already green)

### Gate 2 (PO - post-change)
- Same commands + diff + coverage must be green
- All new CLI commands must not break existing tests
- No new ruff/mypy errors

### Manual E2E
- `cyberbrain knowledge ingest /tmp/test_docs` — verify files → knowledge plane → LanceDB
- `cyberbrain knowledge search "TODO"` — verify semantic search returns relevant results
- `cyberbrain --help` — verify new `knowledge` subcommand visible

## Open Questions (decision points for implementation agent)
1. **Four missing ACTION_SCOPE_REQUIREMENTS actions:** Which four sensitive actions from lines 259-260 need explicit scoping? (Recommendation: add them all; they are `publish_content`, `send_external_message`, `data_upload`, and one pentest action — confirm by reading actions.py:259-278)
2. **Default poll interval for ingest autopilot:** Keep default 5s from unified-ingest-autopilot-plan, or adjust?
3. **Knowledge plane conditional registration:** Only register `note/doc/code/media` categories, skip `ai-export/other`? (Per unified-ingest-autopilot-plan: conditional register based on category)

## Receipt
Every claimed change needs `file:line` + one verifying command (`git status --porcelain`, `grep -c`). No receipt = `REJECT_UNVERIFIED`.