brain backup 2026-09-14

projects/factory/reyna-cli.md

@@ -0,0 +1,44 @@
+---
+project_key: reyna-cli
+status: active
+factory_maturity: discovery
+updated: 2026-08-17
+---
+
+# Reyna CLI — Project Definition
+
+## Purpose
+
+Reyna CLI is the private Mac mini operations platform for privacy-sensitive Apple integrations, family operations, and controlled local/LAN service capabilities.
+
+## Execution map
+
+| Host | Repository / service | Paseo-project role | Status |
+|---|---|---|---|
+| Mac mini `.102` | `~/Projects/platform/reyna-cli` (symlinked/known as `~/Projects/reyna-cli`), Gitea `adolforeyna/reyna-cli` | `Reyna CLI · Main` | Registered local workspace `wks_5d711dc3ed4df37e`; local ignored/untracked device artifacts exist |
+
+## Personas
+
+- Planner: maps requested capability to privacy and system boundaries.
+- Privacy-boundary implementer: isolated worktree code changes only.
+- Test verifier: runs exact CLI/unit/integration checks.
+- Security reviewer: checks command injection, secret handling, permissions, network exposure, and unintended Apple-data access.
+- Release steward and deployment executor: separate, approval-gated roles.
+
+## Safety boundaries
+
+- TCC permissions, Apple data, credentials, LaunchAgents, gateway configuration, and LAN listener exposure are separate approval boundaries.
+- Never use a source-changing agent in the shared `main` checkout.
+- Do not include data from Calendar, Contacts, Notes, Reminders, or authentication stores in agent prompts or brain records.
+
+## Factory readiness next actions
+
+1. Discover the repository's actual test/build/lint commands.
+2. Register a local main-checkout Paseo workspace after checking the current local state.
+3. Establish `paseo.json` with only audited, non-publishing commands.
+4. Pilot a low-risk worktree change before scheduling quality automation.
+
+## Related records
+
+- `../reyna_cli_browser_control.md`
+- `../../areas/operations/services_inventory.md`