# P2/P3 Senior Architect — Autonomous Sprint Prompt

Paste the block below into a new agent session with `@senior-architect`.

---

```
@senior-architect

## Mission
Autonomously complete P2/P3 Agri-Access scoring infrastructure for mpgis-farmer-platform + Agnet BFF. Work end-to-end: verify builds, apply migrations, seed credentials, run queue E2E, fix gaps, update docs. Do not stop at scaffolding — prove the flow works.

## Repos
- Backend: /Users/sohansoni/MPGIS/mpgis-farmer-platform
- BFF/UI:   /Users/sohansoni/MPGIS/Agnet

## Context (already implemented — verify & harden)
1. **@mpgis/scoring** package (`packages/scoring/`):
   - `executeScoringPipeline()` — shared by core-api inline + jobs-worker BullMQ
   - `AgriAccessScoringAdapter` — calls agri-access-worker or mock
   - `vault-loader.ts` — resolves `AdapterCredential.encryptedRef` (`env:VAR`, `vault:path#field`)
   - `hydrateScoringSecrets()` — loads worker token, Gemini key, CBU key; sets `CBU_BUREAU_LIVE=true` when URL+key exist
   - `redis-scoring.ts` — phase state, `acquireScoringLock` idempotency, Gemini 1×/session (AA-035)
   - `scoring-queue.ts` — BullMQ enqueue when `SCORING_USE_QUEUE=true` + `REDIS_URL`
   - `cbu-bureau.stub.ts` — live API when credentials present, else stub

2. **jobs-worker** (`services/jobs-worker/src/workers/scoring-worker.ts`):
   - Calls `hydrateScoringSecrets()` then `executeScoringPipeline()` (replaced hardcoded score 72)

3. **core-api** (`services/core-api/src/onboarding/onboarding.service.ts`):
   - `submit` enqueues BullMQ when queue enabled, else inline pipeline
   - `getStatus` reads phase from Redis via `getScoringPhaseRedis`

4. **K8s**: `infra/k8s/agri-access-worker-hpa.yaml` — GPU Deployment + HPA (1–4 replicas)

5. **Prisma**: `ScoringAudit` model + migration `20250626230000_scoring_audit`

6. **Agnet**: API E2E F01–F15 in `tests/e2e/bff-api-full-flow.test.ts`, report in `reports/e2e-api-flow-latest.md`

## Your deliverables (in order)
### 1. Build & migrate
- `pnpm --filter @mpgis/scoring build`
- `pnpm --filter @mpgis/core-api typecheck`
- `pnpm --filter @mpgis/jobs-worker typecheck` (ignore pre-existing `@mpgis/satai` geo-worker error if unrelated)
- `prisma migrate deploy` + `db:seed` for AdapterCredential rows

### 2. Queue path E2E (must pass)
- Start Redis, core-api, jobs-worker with:
  ```
  SCORING_USE_QUEUE=true
  REDIS_URL=redis://localhost:6379
  AGRI_ACCESS_USE_MOCK=true   # or real worker on :5001
  ```
- Submit onboarding session → verify:
  - BullMQ job completes
  - `ScoringRun` created with real adapter score (not 72)
  - `ScoringAudit` row appended
  - `OnboardingSession.status=completed`
  - Redis phase cleared after finalize
- Re-submit same session → idempotent (no duplicate ScoringRun)

### 3. Vault path
- Document + test `env:` refs via seed
- Add integration test or script for `vault:` ref against local Vault (or mock fetch)
- Production paths per spec:
  - `secret/agnet/prod/gemini` → GEMINI_API_KEY
  - `secret/agnet/prod/worker-token` → AGRI_ACCESS_WORKER_TOKEN
  - `secret/agnet/prod/cbu` → CBU_BUREAU_API_KEY

### 4. CBU live bureau
- Confirm `hydrateScoringSecrets` sets `CBU_BUREAU_LIVE=true` when URL+key loaded
- Add contract test: consent-gated UZ PINFL → `source: cbu_live` when mocked API returns 200

### 5. GPU / HPA
- Validate `agri-access-worker-hpa.yaml` against cluster conventions
- Add ServiceMonitor or custom metric `scoring_queue_depth` wiring notes if metric doesn't exist yet
- Document CPU fallback (`PRITHVI_DEVICE=cpu`) in worker README

### 6. Agnet regression
- `npm run test:contract` (22 tests)
- `npm run test:e2e:api` — refresh `reports/e2e-api-flow-latest.md`
- Enable F13–F14 if `AGRI_ACCESS_WORKER_URL` available

### 7. Docs
- Update `Agnet/specs/P2P3_ARCHITECTURE_DB_SYNC.md` with any deltas
- Update `specs/AGRI_ACCESS_INTEGRATION_PLAN.md` task checkboxes for AA-011, AA-025, AA-029, AA-033, AA-035

## Constraints
- Surgical changes only — no unrelated refactors
- Secrets never committed; use `env:` in dev seed, `vault:` in prod
- Match existing naming: `packages/scoring`, `@mpgis/scoring` barrel exports
- Prisma conventions: relations both sides, `createdAt`/`updatedAt`, indexes on queried fields

## Success criteria
- [ ] `packages/scoring` builds clean
- [ ] Queue scoring E2E: submit → worker → ScoringRun + ScoringAudit + completed session
- [ ] Idempotent re-submit (Redis lock + DB unique)
- [ ] Gemini explain capped at 1 per session (AA-035)
- [ ] CBU live auto-enables when credentials exist
- [ ] Agnet contract + API E2E green; report updated
- [ ] P2/P3 spec reflects final state

## Key env vars
SCORING_USE_QUEUE=true
REDIS_URL=redis://localhost:6379
AGRI_ACCESS_WORKER_URL=http://localhost:5001
AGRI_ACCESS_WORKER_TOKEN=dev-token
AGRI_ACCESS_USE_MOCK=true
CBU_BUREAU_API_URL=...
CBU_BUREAU_API_KEY=...
VAULT_ADDR / VAULT_TOKEN
SCORING_WORKER_CONCURRENCY=10
```

## Related docs

- [P2/P3 Architecture & DB Sync](./P2P3_ARCHITECTURE_DB_SYNC.md)
- [Agri-Access Integration Plan](./AGRI_ACCESS_INTEGRATION_PLAN.md)