Coding Agent Integration Prompt

Use this as the canonical one-prompt handoff when a coding agent owns the app backend integration. Replace placeholders, then paste the fenced prompt into the coding agent working in the app repo.

You are integrating this app backend with General Augment.

Outcome
- Use General Augment as the managed agent backend for app-owned agent turns.
- Keep the app UI and auth in this repo.
- Add one trusted backend route that calls General Augment `POST /v1/responses`.
- Use the app's stable signed-in user id as the Responses API `user` value.
- Store response id and `metadata.general_augment_trace_id` in app logs.
- Return a ready/blocked verdict with exact evidence.

Inputs
- General Augment API base URL: https://api.generalaugment.com
- General Augment project id or slug: <project-id-or-slug>
- Server-side project API key env var: GENAUG_API_KEY
- Optional admin key env var for setup tasks only: GENAUG_ADMIN_API_KEY
- App user id source: <signed-in-user-id-field>
- App framework/backend entrypoint: <detect-from-repo>
- Optional OpenAPI spec URL or file: <openapi-url-or-none>

Non-negotiables
- Keep `GENAUG_API_KEY` and `GENAUG_ADMIN_API_KEY` server-side only.
- Do not put General Augment keys in browser, mobile, client logs, analytics,
  request metadata, memory facts, SOUL.md, skills, or tool definitions.
- Do not create a custom agent runner when `/v1/responses` can own the turn.
- Do not enable destructive tools until product approval UX exists.
- Treat missing auth, keys, network, billing, provider setup, or CLI access as a
  blocker and report the exact missing action.

Implementation
1. Inspect the repo and identify the backend route/server action that should own
   agent calls. Prefer the existing server framework and package manager.
2. Add or update a server-only General Augment client:
   - URL: `${GENAUG_API_BASE_URL}/v1/responses`
   - Headers: `Authorization: Bearer ${GENAUG_API_KEY}`
   - Include `X-Project-ID: <project-id>` when the key is not project-scoped.
   - Body: `model`, `user`, `input`, `metadata.feature`, `metadata.trace_id`.
3. Add app logging for:
   - General Augment response id
   - `metadata.general_augment_trace_id`
   - app trace/request id
   - status/error category without secret values
4. Handle failure paths:
   - `402`: surface budget, plan, or credit setup as a user/admin-visible blocker.
   - `429`: retry with bounded backoff and respect `Retry-After` when present.
   - 5xx/network: retry only when idempotent, then show a recoverable failure.
5. Add explicit memory writes only for durable user facts. Use the same app user id
   for memory `user_id` and Responses `user`.
6. If an OpenAPI spec is available, run `genaug integrate <spec> --name <project>
   --auto-deploy`, review generated tools, keep writes approval-required, and keep
   destructive tools disabled until reviewed.
7. If identity linking is needed for phone, Telegram, WhatsApp, or user-owned
   credentials, call setup endpoints from trusted backend/admin code with
   `GENAUG_ADMIN_API_KEY`, not the project API key used for app traffic.
8. Add focused tests for the backend helper, error mapping, and at least one
   successful app route call with mocked General Augment responses.

Verification
- `genaug --version`
- `genaug doctor --json`
- `genaug auth whoami`
- `genaug smoke --project <project> --message "Reply exactly with: ok" --json`
- `genaug verify --project <project> --json`
- `genaug onboarding verify --project <project> --json`
- Run the app repo's relevant lint, typecheck, test, and build commands.

Ready/blocked report
Return:
- files changed
- commands run and pass/fail status
- response id
- trace id
- dashboard links from `genaug verify`
- CLI/API/package versions
- 402/429 behavior implemented
- any missing key, auth, billing, provider, network, memory, trace, dashboard, or
  production deploy blocker

Use the generated dashboard or CLI CODING_AGENT_PROMPT.md when it exists because it fills in the project id, slug, and generated tool context. This canonical prompt is the fallback contract for repos that have not generated a project-specific handoff yet.