| 1 | # Hands - the PM's capability adapters |
| 2 | |
| 3 | A "hand" is just a worker (or script) with one tool + a return contract. The Conductor composes |
| 4 | hands for novel tasks; you rarely build a bespoke integration. Two kinds: |
| 5 | |
| 6 | ## 1. Inline hands (workers already have these) |
| 7 | Workers run `claude --dangerously-skip-permissions`, so they can already: |
| 8 | - **read / research / scrape** - MCP (homelab_context, cbm-homelab, Serena) + `WebSearch`/`WebFetch` |
| 9 | + flywheel tools (`crawl`, `http_request`, `wayback_fetch`) repurposed as research hands. |
| 10 | - **code / test / build** - edit in a worktree, run the repo's test/build commands locally. |
| 11 | These need no extra wiring. They are reversible/internal, so they run full-auto. |
| 12 | |
| 13 | ## 2. Execution hands (fire only AFTER Zion approves an outbox item) |
| 14 | `bin/flush-outbox.sh` routes an approved item of kind `<kind>` to `hands/execute-<kind>.sh`. |
| 15 | Each hand reads the outbox item (id, preview/payload) and performs the real-world action. |
| 16 | |
| 17 | | kind | hand file | status / what it needs | |
| 18 | |---------------|----------------------------|------------------------| |
| 19 | | email | execute-email.sh | NEEDS sender identity (policy.yaml sender_identities) + SMTP/API creds | |
| 20 | | dm / social | execute-social.sh | NEEDS account + API token per platform | |
| 21 | | git_push | execute-git_push.sh | reuses zionboggan GH PAT (prefix `env -u GH_TOKEN -u GITHUB_TOKEN`) | |
| 22 | | publish | execute-publish.sh | reuses npm token (~/.npmrc on CT215) | |
| 23 | | deploy | execute-deploy.sh | reuses CF global key + wrangler (see MASTER_ACCESS_REFERENCE) | |
| 24 | | infra | execute-infra.sh | control plane CT244:8765 (wake/sleep) or pct exec via pve | |
| 25 | | browser | execute-browser.sh | NEEDS Playwright worker on a CT (headless, or headed via 3060) | |
| 26 | |
| 27 | **Design rule:** a hand never decides *whether* to act - approval already happened. It just |
| 28 | executes the approved payload, logs the result, and exits non-zero on failure so flush can mark it. |
| 29 | |
| 30 | Start order (Zion): give the outreach sender identity -> wire execute-email.sh first (that's the |
| 31 | "pursue testers" engine), then execute-browser.sh, then the code/deploy hands (creds already exist). |