SysEngineering

SCSP AI Initiative: handoff

Operational state, so work continues on any machine (work laptop, home PC) without re-deriving context. Update the State and Next sections and append to the Log at the end of every working session.

Resuming on another machine

1. git pull in sysengscripts. This file, CLAUDE.md and the root CLAUDE.md section “SCSP AI Initiative” are the durable context. Claude’s local memory does not travel between machines.
2. Confluence is the shared record: IPO → 3.M SCSP Initiative. Claude can read and update it through the Atlassian connector as aschembri@hillspire.com; page IDs are in CLAUDE.md.
3. Jira: the SCSP AI Initiative board in ITPROJ, built on epic ITPROJ-1401 (see Jira below).
4. The personal prototype lives in cos_lab/, inside this folder. Its README, CLAUDE.md and HANDOFF.md carry its state.

State (2026-10-15)

Phase: discovery. No SCSP code or infrastructure exists yet. A personal prototype of the SCSP connector is under way in cos_lab/.

• 2026-10-07 Adam brought in by SCSP’s CEO, Ylli Bajraktari. Joseph Wen created epic ITPROJ-1401 and its phase tasks the same day.
• 2026-10-09 First sync with SCSP’s AI engineers (Vesa Xerxa, Engjella Halili) and Joseph. Notes: Confluence “SCSP Sync 2026-10-09: AI Native Sync”.
• 2026-10-09 Confluence folder 3.M organized (15 pages, all Draft). This folder replaced the retired sophos/ scripts (PR #180).
• 2026-10-12 Jira board “SCSP AI Initiative” created; ITPROJ-1407 (build the board) Done.
• 2026-10-13 Prototype started (ITPROJ-1421) with GCP project adam-cos-lab (schmidtentity.com org, number 680745570527, APIs enabled).
• 2026-10-15 Google sign-in configured for the prototype (its Session A). Its code moved from a short-lived separate repo into cos_lab/, under this repo’s PR rules, Claude reviewer and CI (PR #193, merged 2026-10-16).
• 2026-10-15 The prototype’s connector (its Session B code) built and put through three adversarial security reviews: 68 confirmed findings, all fixed or deliberately deferred, 164 tests. The sign-in works end to end in real Chrome and Edge. It is on branch feat/cos-lab-connector, in its own PR since #193 merged.

Jira

• Epic ITPROJ-1401, “P1 - SCSP AI 2026: Agentic AI Capability Suite by 1/1/27 (PROJOPS)”: owner Adam, PM Joseph.
• Phase tasks (Joseph’s PM structure): ITPROJ-1402 Initiation, 1403 Planning, 1404 Execution, 1405 Monitoring & Control, 1406 Closing. New work goes under them as sub-tasks; agree placement with Joseph.
• Board “SCSP AI Initiative”: Kanban, location ITPROJ, admin Adam. Saved filter “SCSP AI Initiative (ITPROJ-1401)”, shared with the ITPROJ space, editable by Adam and Joseph: project = ITPROJ AND parentEpic = ITPROJ-1401 ORDER BY Rank ASC. parentEpic includes sub-tasks; portfolioChildIssuesOf does not work on this site.
• Columns (rebuilt 2026-10-13), one per status: Backlog → Requirements → To Do → In Progress → Waiting for Feedback → In Review → Verifying → Done, with Cancelled inside Done.
• Why it was rebuilt: the first board was created while its filter was still Jira’s default “created in the last 30 days” search across every project. A new board takes its columns from every workflow its filter touches, so it held the whole site’s statuses (three “To Do”s, four “Done”s, IO and SEC statuses, all flagged with warning icons). Fixing the filter didn’t remove them; building a new board from the corrected filter did. Lesson: “Save filter” saves the last search that was run, not the text sitting in the JQL box.
• ITPROJ statuses: Backlog, Requirements, To Do, In Progress, Waiting for Feedback, In Review, Verifying, Done, Cancelled.
• Tickets and comments Claude posts are first person, in Adam’s voice. SCSP staff will read tickets under this epic, so keep personal and internal detail out.

The prototype: cos_lab (ITPROJ-1421)

Adam’s own chief of staff, built the way SCSP plans to build one for everyone. Claude connects to one remote MCP connector on Cloud Run with Google sign-in, which reads Adam’s own GitHub, Jira and Confluence, Calendar, Gmail and Okta, all read-only. It proves the SCSP design on one person: the sign-in, per-person tools, permissions with two of Adam’s identities, Gmail by consent, and the record of use.

Now: Google sign-in is configured, and the connector is built and reviewed (2026-10-15), on branch feat/cos-lab-connector, in its own PR since #193 merged. It works with Claude Code only for now; claude.ai waits for step 7. Then: run it against real Google on Adam’s machine, and deploy it to Cloud Run. Details, the branch order and the session plan are in cos_lab/HANDOFF.md.

What exists that the build will reuse

Thing	Where	Why it matters
Gwen’s Claude connector: OAuth 2.1 + DCR, stateless HMAC tokens, allowlist	integrations/gwen_grant_memo_agent/mcp_oauth.py, mcp_connector.py, test_mcp.py (on main since PR #181)	The SCSP connector is this pattern with Google sign-in replacing the access code and the permissions model replacing the allowlist. Gwen’s HANDOFF, “Claude connector”, has the operational lessons.
cos_lab	cos_lab/ in this folder	The prototype: hand-written Claude loop, read-only tools, a local MCP server, and the remote connector (lab/connector/): its own OAuth server with a consent page and Google sign-in, sessions, tools per person, a record of use. 164 tests. The SCSP connector’s first draft should start from it.
Harry’s deploy pipeline	.github/workflows/harry_deploy.yml	The staged deploy (no-traffic revision → health check → promote) proposed for SCSP
SCSP’s Workspace tenant	route scsp-prod, customer 101475582153570045240	Already in the helpdesk module’s routes

Facts learned (keep)

• Vertex Claude quota can be zero. On 2026-10-08 gw-admin-assistant returned 429 on the first call to Opus and Sonnet on both us and global. The single-region endpoints (us-east5, us-central1) return 404 for the 5.5 models. Request quota the day a project exists.
• Gmail read scopes are restricted. Gmail access must come from an Internal OAuth app in SCSP’s own Google Cloud organization. Outside it, Google requires verification plus a security assessment, and testing-mode tokens expire every 7 days.
• hillspire.com is out-of-org for the schmidtentity.com GCP organization (the Zoom Rooms IAP lesson). Find out which organization scsp.ai belongs to before building anything.
• No consumer AI plans with work data. Claude Code on the company account connects to remote MCP connectors with OAuth and needs no admin, so it is the prototype’s client.

From building the prototype’s connector (2026-10-15), and binding on SCSP’s:

• A consent page of our own is required. A connector that signs everyone in with one fixed Google client, on behalf of clients that register themselves, must ask the person before sending them to Google, and must let only the approving browser finish (the MCP security guidance, “confused deputy”).
• claude.ai is the open question. All of Claude’s hosted apps share one callback, so a sign-in started in someone else’s claude.ai account and forwarded looks identical on a consent page. The prototype refuses it until a two-account test proves claude.ai ties the callback to the account that started the flow. For SCSP, look at Enterprise Managed Auth (claude.com/docs/connectors/building/enterprise-managed-auth).
• Google’s hd claim needs checking. The prototype requires hd to equal the email’s domain. Whether Google reports a secondary domain or the organization’s primary one is unproven, and SCSP has two domains (scsp.ai, scsp-ap.ai). Check on the prototype’s first live sign-in.
• Test in real browsers and with a real MCP client. The worst bug (a referrer policy that made every browser send Origin: null, so nobody could sign in) passed every unit test and was caught only by driving real Chrome and Edge.
• Sessions need a shared store before more than one instance runs. One-time codes, sign-in sessions and one-time claims live in memory in the prototype, which forces a single Cloud Run instance; per-person Google tokens (step 3) need one too.
• The full list is in cos_lab/CLAUDE.md, “The connector” and “Facts learned the hard way”.

Open decisions (full list: Confluence 3.M.4)

1. Which Google Cloud organization and project host SCSP Intelligence; who administers it.
2. Google or Okta sign-in for SCSP staff; do tier and base groups exist.
3. Which AI products SCSP licenses (Claude Team/Enterprise, ChatGPT) and who the org Owner is.
4. What data SCSP approves for AI processing.
5. Where SCSP’s own code lives: this repo or an SCSP repo. (The personal prototype is settled: it lives here, in cos_lab/.)
6. Confluence access for SCSP staff: IPO is a restricted space, so adding them to it shows them all of IPO. Options are a dedicated space or page restrictions. Decide before inviting anyone.

Next

• Walk VX and EH through Architecture, Permissions Model and the discovery plan; collect answers to the open decisions. (Planned for 2026-10-12; record the outcome here.)
• Jira, with Joseph: invite VX and EH; agree where new tickets sit. (Board rebuilt 2026-10-13; delete the first board if it still exists.)
• Discovery: champions named, sessions booked, all six bases by 2026-10-23.
• Prototype (ITPROJ-1421): #193 merged 2026-10-16; the connector branch is rebased and goes up as its own PR; then the live run on Adam’s machine and Cloud Run, connected from Claude Code (cos_lab/HANDOFF.md, “Branches and PRs” and Sessions B–D).
• Get the contract and auth for SCSP Intelligence’s agent context API (/v1/context) from EH.
• SCSP connector v0, once the Google Cloud organization question is answered.

Log

• 2026-10-09 Folder created from sophos/. Confluence 3.M populated (15 pages). README, HANDOFF and CLAUDE.md written.
• 2026-10-12 Jira board and filter built on epic ITPROJ-1401; ITPROJ-1407 closed.
• 2026-10-13 Prototype repo and GCP project adam-cos-lab created; ITPROJ-1421 opened under Planning. HANDOFF refreshed before the switch to the work laptop.
• 2026-10-13 MacBook set up with Claude Code CLI. Jira board rebuilt from the corrected filter with one column per ITPROJ status.
• 2026-10-15 Prototype’s Google sign-in configured. Its code moved from the separate Hillspire/adam-cos-lab repo into cos_lab/ here; that repo is deleted once the move is merged.
• 2026-10-15 Prototype’s connector built and reviewed adversarially in three rounds (30, 22 and 16 confirmed findings, all fixed or deferred to its deploy). Branch feat/cos-lab-connector pushed; its PR follows #193. The lessons that bind SCSP’s connector are under “Facts learned”.