Diag/beds24 UI auth 20260822

.github/aumara-beds24-binding-inventory.trigger

@@ -0,0 +1,4 @@
+BEDS24_BINDING_INVENTORY
+property=324882
+trigger=2026-08-20T19:12:00+02:00
+mode=names-only

.github/aumara-beds24-sync.trigger

@@ -0,0 +1,8 @@
+BEDS24_PHOTO_SYNC_DISCOVERY
+property=324882
+scope=property-324882-photo-sync
+trigger=2026-08-19T15:17:00+02:00
+trigger=2026-08-20T19:14:00+02:00
+mode=existing-secrets-only
+scope=property-324882-photo-sync
+intent=read-live-and-map-existing-before-booking-sync

.github/copilot-instructions.md

@@ -0,0 +1,36 @@
+# Copilot Instructions for openai-cookbook
+
+This repository contains runnable examples, notebooks, and reference articles for OpenAI APIs. Keep changes focused, minimal, and aligned with the existing cookbook structure.
+
+## Repository structure
+
+- Place notebooks and Python scripts under `examples/<topic>/`.
+- Group related assets inside topic-specific subfolders and keep filenames descriptive and lowercase with dashes or underscores.
+- Keep content discoverable by updating `registry.yaml` for new or relocated entries.
+- Keep author metadata current in `authors.yaml` when adding or moving content.
+
+## Coding and documentation expectations
+
+- Write Python to PEP 8 with four-space indentation, descriptive names, and concise docstrings.
+- Prefer clear examples over clever abstractions; document required environment variables instead of hard-coding secrets or API keys.
+- Avoid introducing network calls in tests; use fakes or mocks where appropriate.
+- For notebook changes, run them top-to-bottom and clear execution counts before committing.
+
+## Validation and workflow
+
+- Use a virtual environment for local work and install only the dependencies required by the relevant example.
+- Validate notebooks with:
+  - `python .github/scripts/check_notebooks.py`
+- If a sample includes dependencies, use the example-specific `requirements.txt` rather than installing unrelated packages.
+
+## Security and governance
+
+- Never place secrets or private operational values in code, prompts, logs, commits, or pull request text.
+- Do not change Gmail, Beds24, monitoring, deployment, access, payments, legal, tax, or external messaging without explicit task-specific authorization.
+- Follow `docs/AI_EXECUTION_POLICY.md` and `docs/CHECKPOINT_PROTOCOL.md` for AI-assisted execution.
+
+## Pull request expectations
+
+- Use concise, imperative commit messages.
+- Include a short summary, motivation, and validation details in pull requests.
+- Ensure metadata files stay in sync with new or relocated content.

.github/pull_request_template.md

@@ -6,6 +6,31 @@ Briefly describe the changes and the goal of this PR. Make sure the PR title sum
 
 Why are these changes necessary? How do they improve the cookbook?
 
+## Execution contract
+
+- **Scope:** <!-- One narrowly scoped objective, allowed paths, and exclusions -->
+- **Evidence:** <!-- Existing work inspected and any branch/commit/PR/checkpoint reused -->
+- **Tests:** <!-- Exact focused commands and results -->
+- **Stop condition:** <!-- Artifact or exact blocker that ends this execution -->
+- **Recovery point:** <!-- Branch, commit, PR, checkpoint, or clean base for resumption -->
+
+## AI execution governance
+
+- [ ] This execution has one narrowly scoped objective and this task has one PR.
+- [ ] I inspected targeted existing work before creating new work and reused a
+      recoverable branch, commit, PR, or checkpoint where available.
+- [ ] I did not rescan the whole repository, or I documented why targeted
+      inspection was insufficient in **Evidence**.
+- [ ] Scope, evidence, tests, stop condition, and recovery point are recorded
+      above.
+- [ ] No secrets or private operational values appear in code, prompts, logs,
+      commits, or PR text.
+- [ ] Gmail, Beds24, monitoring, deployment, access, payments, legal, tax, and
+      external messaging are unchanged, or explicit task-specific authorization
+      is cited in **Scope**.
+- [ ] The requested artifact is complete, no follow-on task was started, and
+      the recovery point reduces context required by the next task.
+
 ---
 
 ## For new content

.github/scripts/validate_ai_execution_governance.py

@@ -0,0 +1,203 @@
+#!/usr/bin/env python3
+"""Validate repository-level AI execution governance without dependencies."""
+
+from __future__ import annotations
+
+import argparse
+import pathlib
+import re
+import shutil
+import tempfile
+
+
+REPOSITORY_ROOT = pathlib.Path(__file__).resolve().parents[2]
+REQUIRED_FILES = {
+    "AGENTS.md": (
+        "one execution has one narrowly scoped objective",
+        "one task produces one pull request",
+        "inspect the targeted existing work",
+        "do not rescan the whole repository",
+        "scope, evidence, tests, stop condition, and recovery point",
+        "stop when the requested artifact is produced",
+        "secrets or private operational values",
+        "gmail, beds24, monitoring, deployment, access, payments, legal",
+        "reduces the context required by the next execution",
+    ),
+    "docs/AI_EXECUTION_POLICY.md": (
+        "one execution must have one narrowly scoped objective",
+        "one task must produce one pull request",
+        "inspect targeted existing work before creating new work",
+        "do not rescan the whole repository",
+        "| scope |",
+        "| evidence |",
+        "| tests |",
+        "| stop condition |",
+        "| recovery point |",
+        "secrets and private operational values",
+        "without explicit, task-specific authorization",
+        "stop after the requested artifact is produced",
+        "reduce the context required by the next task",
+    ),
+    "docs/CHECKPOINT_PROTOCOL.md": (
+        "objective",
+        "scope",
+        "evidence",
+        "tests",
+        "stop condition",
+        "recovery point",
+        "reuse any recoverable branch, commit, pull request, or checkpoint",
+        "whole-repository rescan",
+        "stop immediately when the stop condition is met",
+        "reduce the context the next task must reconstruct",
+    ),
+    ".github/pull_request_template.md": (
+        "## execution contract",
+        "**scope:**",
+        "**evidence:**",
+        "**tests:**",
+        "**stop condition:**",
+        "**recovery point:**",
+        "one narrowly scoped objective",
+        "did not rescan the whole repository",
+        "no secrets or private operational values",
+        "gmail, beds24, monitoring, deployment, access, payments, legal, tax",
+        "reduces context required by the next task",
+    ),
+}
+
+SECRET_PATTERNS = (
+    re.compile(r"\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b", re.IGNORECASE),
+    re.compile(r"\b(?:sk|ghp|github_pat)_[A-Za-z0-9_-]{12,}\b"),
+    re.compile(r"\bBearer\s+[A-Za-z0-9._~+/-]{12,}\b", re.IGNORECASE),
+)
+
+
+class GovernanceValidationError(ValueError):
+    """Raised when a governance artifact is missing or incomplete."""
+
+
+def validate(root: pathlib.Path = REPOSITORY_ROOT) -> None:
+    """Validate required files, policy clauses, links, and secret hygiene."""
+    root = pathlib.Path(root)
+
+    for relative_path, required_phrases in REQUIRED_FILES.items():
+        path = root / relative_path
+        if not path.is_file():
+            raise GovernanceValidationError(f"missing required file: {relative_path}")
+
+        content = path.read_text(encoding="utf-8")
+        normalized = " ".join(content.lower().split())
+        missing = [phrase for phrase in required_phrases if phrase not in normalized]
+        if missing:
+            raise GovernanceValidationError(
+                f"{relative_path}: missing governance clause: {missing[0]}"
+            )
+
+        for pattern in SECRET_PATTERNS:
+            if pattern.search(content):
+                raise GovernanceValidationError(
+                    f"{relative_path}: possible secret or private value"
+                )
+
+    agents = (root / "AGENTS.md").read_text(encoding="utf-8")
+    for policy_path in ("docs/AI_EXECUTION_POLICY.md", "docs/CHECKPOINT_PROTOCOL.md"):
+        if policy_path not in agents:
+            raise GovernanceValidationError(f"AGENTS.md: missing link to {policy_path}")
+
+
+def _copy_governance_files(source: pathlib.Path, destination: pathlib.Path) -> None:
+    for relative_path in REQUIRED_FILES:
+        target = destination / relative_path
+        target.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copy2(source / relative_path, target)
+
+
+def self_test(root: pathlib.Path = REPOSITORY_ROOT) -> None:
+    """Run positive and negative checks against isolated fixtures."""
+    validate(root)
+
+    with tempfile.TemporaryDirectory() as temp_dir:
+        fixture = pathlib.Path(temp_dir)
+        _copy_governance_files(root, fixture)
+
+        missing_file = fixture / "docs/CHECKPOINT_PROTOCOL.md"
+        missing_file.unlink()
+        try:
+            validate(fixture)
+        except GovernanceValidationError as exc:
+            if "missing required file" not in str(exc):
+                raise
+        else:
+            raise GovernanceValidationError("self-test accepted a missing file")
+
+    with tempfile.TemporaryDirectory() as temp_dir:
+        fixture = pathlib.Path(temp_dir)
+        _copy_governance_files(root, fixture)
+
+        policy = fixture / "docs/AI_EXECUTION_POLICY.md"
+        policy.write_text(
+            policy.read_text(encoding="utf-8").replace(
+                "Stop after the requested artifact is produced",
+                "Continue with adjacent work",
+            ),
+            encoding="utf-8",
+        )
+        try:
+            validate(fixture)
+        except GovernanceValidationError as exc:
+            if "missing governance clause" not in str(exc):
+                raise
+        else:
+            raise GovernanceValidationError("self-test accepted a missing clause")
+
+    with tempfile.TemporaryDirectory() as temp_dir:
+        fixture = pathlib.Path(temp_dir)
+        _copy_governance_files(root, fixture)
+
+        template = fixture / ".github/pull_request_template.md"
+        test_secret = "".join(
+            chr(code)
+            for code in (111, 112, 115, 64, 101, 120, 97, 109, 112, 108, 101, 46, 105, 110, 118, 97, 108, 105, 100)
+        )
+        template.write_text(
+            template.read_text(encoding="utf-8") + f"\n{test_secret}\n",
+            encoding="utf-8",
+        )
+        try:
+            validate(fixture)
+        except GovernanceValidationError as exc:
+            if "possible secret" not in str(exc):
+                raise
+        else:
+            raise GovernanceValidationError("self-test accepted a secret pattern")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--root",
+        type=pathlib.Path,
+        default=REPOSITORY_ROOT,
+        help="repository root",
+    )
+    parser.add_argument(
+        "--self-test",
+        action="store_true",
+        help="run positive validation and isolated negative tests",
+    )
+    args = parser.parse_args()
+
+    if args.self_test:
+        self_test(args.root)
+        print("AI execution governance validation passed; 3 self-tests passed.")
+    else:
+        validate(args.root)
+        print(
+            "AI execution governance validation passed: "
+            f"{len(REQUIRED_FILES)} files checked."
+        )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.github/workflows/aumara-actions-heartbeat.yml

@@ -0,0 +1,42 @@
+name: AUMARA Actions Heartbeat
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/aumara-actions-heartbeat.yml'
+
+permissions:
+  contents: write
+
+jobs:
+  heartbeat:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - uses: actions/checkout@v4
+      - name: Write heartbeat
+        run: |
+          set -euo pipefail
+          mkdir -p aumara-control-tower/checkpoints
+          python3 - <<'PY'
+          import json, datetime, os
+          r={
+            'schema':'aumara.actions-heartbeat',
+            'status':'PASS',
+            'run_id': os.getenv('GITHUB_RUN_ID'),
+            'sha': os.getenv('GITHUB_SHA'),
+            'checked_at_utc': datetime.datetime.now(datetime.timezone.utc).replace(microsecond=0).isoformat().replace('+00:00','Z')
+          }
+          open('aumara-control-tower/checkpoints/AUMARA_ACTIONS_HEARTBEAT.json','w',encoding='utf-8').write(json.dumps(r,indent=2)+'\n')
+          print(json.dumps(r))
+          PY
+      - name: Persist heartbeat
+        run: |
+          set -euo pipefail
+          git config user.name 'AUMARA Automation'
+          git config user.email 'elcidspain@gmail.com'
+          git add aumara-control-tower/checkpoints/AUMARA_ACTIONS_HEARTBEAT.json
+          git commit -m 'Record AUMARA Actions heartbeat'
+          git push origin HEAD:main