Agent modes and an always-on Lightsail machine¶
1. The MMDEP workflow, step by step¶
| Step | What happens | Who |
|---|---|---|
| W1 Request | A Work Request issue is written and labelled (role:, state:ready) |
PM or lead |
| W2 Shape | The request is made bounded: files, branch, limits, acceptance | Task shaper |
| W3 Claim | state:ready → state:in-progress, verified |
Working agent |
| W4 Work | Branch, code or document changes | Coder |
| W5 Run | Tests, Python reports, Selenium checks | Coder or Test Runner |
| W6 Review | An independent review from a different vendor | Reviewer |
| W7 Result | PR plus a Work Result comment; label → state:review |
Working agent |
| W8 Record | Ledger and digest; MMDEP items where needed | MMDEP / PM |
| W9 Decide | Approve, merge, release | Atul only, always (GitHub and GitLab from the phone or web; MMDEP items need the hub) |
"Completes the workflow" below means W1–W8 without Atul relaying anything. W9 stays human in every mode.
2. Inventory and classification¶
2.1 Browser mode: runs in the vendor's cloud or in a browser¶
| Agent / tool | Where it actually runs | Steps it can do | Limits |
|---|---|---|---|
| Claude Code on the web, and scheduled cloud sessions (this reviewer chat; routines) | Anthropic's cloud, Linux; never sleeps | W1–W8 for GitHub repos: issues, labels, branches, tests on Linux, PRs, comments, digests | GitHub only (no GitLab repos); network limited by the environment's settings; no Windows; no MMDEP hub; draws on the Claude plan |
| Claude chat / Projects | Anthropic's cloud | W1, W2, W6 (reading through connectors), drafting | No repo execution by itself |
| ChatGPT: chat, Projects, agent mode, Codex cloud, scheduled and event tasks, GitHub connector | OpenAI's cloud; never sleeps | W1–W7 for GitHub repos (Codex cloud runs tests in a container; the connector writes issues and PRs); triage and digests by scheduled task | GitHub-centred; GitLab only by driving a browser; ChatGPT plan limits |
| Gemini web | Google's cloud | W2, W6 on pasted content | No repo access by itself |
| Claude in Chrome / Opera Browser Connector | Atul's machine (his Chrome or Opera, his sign-ins) | Anything a person can do in a browser, including GitLab, the website, test pages | Needs the machine awake; acts as Atul; Opera's connector is currently broken ("Update required") |
| GitHub / GitLab web UI | Vendor cloud | W9 (Atul's approvals and merges, also from the phone) | — |
Verdict for browser mode: it can complete W1–W8 for GitHub projects whose work and tests need no Windows and no private network: - MCRM: fully (documentation work and reviews). - MMDEP documentation: fully. - Portfolio Engine: partly. Its tests and reports call the MoneyMarche API, which works only if the cloud environment's network access allows it.
It can't complete: - GitLab projects (website, WPDev, API, MM-Cron, governance), except by driving a browser on an awake machine; - the MMDEP hub; - TEA collectors (SSH and AWS); - Windows-specific work.
Its strength: these run in the vendors' clouds, so they never sleep. No machine of ours is needed.
2.2 Terminal mode: runs on a machine we control¶
| Agent / tool | Steps | Authentication for unattended use | Limits |
|---|---|---|---|
Claude Code CLI (claude -p, headless) |
W2–W7; GitLab through git/glab; tests |
claude setup-token gives a one-year subscription token for scripts and CI (Pro or Max), or an API key |
Subscription limits; the token makes model calls only (no Remote Control, no claude.ai connectors) |
Codex CLI (codex exec) |
W4–W6 | OpenAI recommends an API key for programmatic use (billed per token); ChatGPT sign-in needs a browser | Per-token cost when unattended |
| Gemini CLI and Gemini API scripts (the AC-1 pattern) | W2 (shaping), W5 (shell), W6 (audit) | API key (paid tier for private content) | Free tier only for public or synthetic data |
| git, gh, glab | W3, W7 | Tokens; agent accounts needed for real protection | Today they act as Atul |
| MMDEP CLI, hub, dispatcher, H1 harness, Test Runner | W3–W8 | Local | Windows-specific parts: agent account, ACLs, Credential Manager, wake lock |
| pytest, Python reports, Selenium | W5 | — | Selenium needs a (headless) browser |
AWS CLI (read-only mmdep-ro), SSH collectors |
TEA evidence | Read-only profile; forced-command SSH keys | Never write credentials |
| Ollama, Antigravity local models | Backup, private work | — | Need 24 GB or more of memory; not now |
Verdict for terminal mode: it can complete W1–W8 for every project, GitLab included, with tests, reports, TEA collectors and the MMDEP hub. Its weakness is the machine: today that's a travelling laptop that sleeps.
3. A Lightsail machine: what it can run¶
Prices are from AWS's Lightsail page (USD a month with a public IPv4 address, before 18% GST). The Mumbai region includes half the transfer allowance, which is ample here.
| Option | Price | Runs | Fits |
|---|---|---|---|
| L1 Linux 4 GB, 2 vCPU, 80 GB | 24 (≈ 28 with GST) | Terminal mode: Claude Code CLI, Codex CLI, Gemini CLI and API scripts, git/gh/glab, Python, pytest, headless Selenium (one browser at a time), AWS CLI read-only, collectors | One or two projects, one agent at a time; DR-003's B2 |
| L2 Linux 8 GB, 2 vCPU, 160 GB | 44 (≈ 52) | L1 plus a light desktop (XFCE and VNC over SSH) with Chrome or Opera, so Claude in Chrome or the Opera connector run there instead of on the laptop; or two or three agents in parallel | Both modes on one machine |
| L3 Windows 4 GB / 8 GB | 44 / 74 (≈ 52 / 87) | The MMDEP hub unchanged (it's Windows-first), plus terminal and browser | Only if the hub itself must leave the laptop; Windows takes much of 4 GB itself, so 8 GB is realistic |
| L4 Linux 16 GB, 4 vCPU | 84 (≈ 99) | Everything, plus several agents in parallel | Not needed yet; still too small for good local models |
Notes: - Burst CPU: Lightsail's 2-vCPU bundles are burstable. Long test runs can be throttled once burst credits run out. That's acceptable for one project, and a reason to keep heavy suites sequential. - The MMDEP hub stays on the laptop with L1 and L2. The VM does forge work: issues, branches, PRs, reviews, tests and reports. Approvals still happen in the hub and on PRs, as DR-003 §4 requires. Porting the hub to Linux would be a separate story: the store, CLI and dispatcher are Python, and the agent-account and ACL layer would become a separate Linux user plus file permissions. - Never sleeps: a Lightsail instance runs until stopped. Unattended security updates and a nightly snapshot keep it healthy. A snapshot of 80 GB costs about USD 4 a month at USD 0.05 per GB-month, and only changed blocks are charged after the first.
4. Security, cost and performance on the VM¶
| Area | Rule on the VM |
|---|---|
| Identity | Agents use agent accounts (a GitHub collaborator; a GitLab Developer), never Atul's tokens. Claude's one-year token is Atul's subscription: kept in a file readable only by the agent user, and revoked if the VM is lost |
| Access | Lightsail firewall: SSH only, key-based, from Atul's IP or the Lightsail browser console; no inbound web; a desktop (L2) only through an SSH tunnel |
| Least privilege | A separate Linux user agent, no sudo. No deploy keys. AWS read-only only. SSH to production servers only through forced-command read-only keys, for TEA |
| Data | No client data on the VM (spec §5B); synthetic or public data plus repository content; paid Gemini for private repos |
| Terms | Claude Code: setup-token is documented for scripts and CI. Codex: an API key for programmatic use. ChatGPT web agents stay in the browser. Recheck vendor terms before switching on (DR-003 §4.2) |
| Cost | L1 ≈ USD 28 plus snapshots ≈ 4, plus API tokens (Gemini small; Codex only if used). Partly offset by dropping Copilot and by the snapshot clean-up of DR-003 §6 (≈ USD 5–10 a month) |
| Performance | One agent at a time on L1; sequential test suites; upgrade L1 → L2 by restoring a snapshot to a bigger bundle if needed |
5. Recommendation¶
- Keep browser-mode work in the vendors' clouds, since they never sleep: MCRM reviews and the digest (Claude cloud sessions), ChatGPT's project work, and Codex cloud for GitHub repos. No machine needed.
- Take L1 (Linux 4 GB) for terminal mode on one project first. This is DR-003's B2, pre-approved in principle, so it needs its approve item: vendor-terms check, cost estimate, scope, the IAM setup, and the agent accounts. Suggested first project: Portfolio Engine. It's on GitHub, its main need is running tests and Python reports, it reaches the MoneyMarche API over the internet, and it's lower risk than the website. The website follows once GitLab agent accounts exist.
- Move to L2 (8 GB) only if browser control has to run unattended on the VM, for example WPDev's Opera or Chrome testing.
- Windows (L3) only if we decide to move the MMDEP hub off the laptop. The alternative is porting the hub to Linux.
- Timing: setting up a VM before 16 Oct is possible but tight. Safer: decide now, set it up after the vacation, and rely on the cloud sessions while Atul is away.
6. Decisions for Atul¶
- Agree that browser-mode work stays in the vendors' clouds, and that the VM is for terminal mode?
- L1 (Linux 4 GB, ≈ USD 28 a month) now, or L2 (8 GB, ≈ USD 52) for both modes?
- First project on the VM: Portfolio Engine (recommended) or the website?
- Set it up before 16 Oct, or after the vacation?