Gatekeeper agent setup¶

Each gatekeeper role can be assigned to an agent. This document lists the minimum tools each agent needs. Every gatekeeper gets the Conductor MCP for docs plus Notion for reading their assigned work.

Notion access by role¶

Notion uses the native Projects & Tasks template. Portfolio Manager creates Projects and Tasks. Every gatekeeper reads Tasks assigned to them via a filtered view.

Gatekeeper	Database	Access	Filter
Portfolio Manager	Projects, Tasks	Read + Write	(all)
Product Manager	Tasks	Read + Write	Line = product
Engineering Lead	Tasks	Read	Line = software
Editor-in-Chief	Tasks	Read	Line = editorial
Engagement Manager	Tasks	Read	Line = services
Platform Engineer	Tasks	Read	Line = operate

Set up Notion access:

# All gatekeepers need this
pip install ntn
$env:NOTION_API_TOKEN = "<from Bitwarden: CONDUCTOR_NOTION_READ_TOKEN>"
ntn whoami

Conductor MCP (all gatekeepers)¶

{
  "mcpServers": {
    "conductor": {
      "url": "https://conductor-konstant.hectorsanchez.eu/mcp",
      "headers": { "Authorization": "Bearer ${CONDUCTOR_MCP_AUTH_TOKEN}" }
    }
  }
}

Portfolio Manager¶

Tools: Notion (Projects + Tasks, read + write). Portfolio Manager is the project manager.

Guides to read:

about/workflow.md                # The 4 paths, handoff points
lines/portfolio.md               # Portfolio stages: Intake → Review
lines/index.md                   # Cross-line flow diagram
reference/roles/gatekeepers.md    # Handoff protocol
reference/notion-hierarchy.md     # Projects & Tasks model
registry/initiatives.md          # Current active Initiatives

What this agent does: creates Projects (Initiatives), creates Tasks and assigns them to gatekeepers, sets priority (P1/P2/P3) and review dates, monitors progress via board view, enforces WIP caps. When a gatekeeper completes their task, the Portfolio Manager creates the next Task for the next gatekeeper.

Cannot do: write code, publish content, manage infrastructure.

Product Manager¶

Tools: Notion (Tasks, read + write — Product line only).

Guides to read:

lines/product.md                  # Product stages, build-gate conditions
lines/software/estate/chooser.md  # Prototype/Lab/Portfolio-org decision
reference/roles/gatekeepers.md    # Handoff protocol

What this agent does: receives Tasks from Portfolio Manager, evaluates market, runs scorecard, decides estate at Build-gate. Reports completion back. Portfolio Manager creates the next Task for Engineering Lead.

Cannot do: write code, deploy software, publish content.

Engineering Lead¶

Tools: git, gh, IDE, test runner, deploy tools, plus Notion (read-only, Software workstreams).

Tool	Verify	Purpose
Notion (ntn)	`ntn whoami`	Read Initiative outcome, DoD, estate, assigned Software workstream
git	`git --version`	Source control
gh	`gh auth status`	PRs, issues, releases
IDE	Project-specific	Write code
Test runner	Project-specific	Verify
secret-gate	`command -v secret-gate` / `secret-gate status` (pwsh 7.2+ on Windows)	Deploy secrets
promote-software	`Get-Command promote-software.ps1`	Promote releases
first-deploy	`Get-Command first-deploy`	Bootstrap new app on konstant

Guides to read:

lines/software/overview.md       # Software stages, estate shapes
lines/software/patterns/         # Deployment patterns
lines/software/lifecycle/        # Promote and deploy choreography
lines/software/estate/           # Estate rules
reference/standards/secrets.md   # Never commit secrets
reference/standards/github-first.md  # Issue → branch → PR → merge
reference/security/socket-activation.md  # Service type → systemd config

What this agent does: receives Tasks from Portfolio Manager, reads the estate set by Product Manager from the Task properties, frames scope and architecture, implements, verifies, promotes, deploys. Marks Task complete when done. Portfolio Manager creates next Tasks for Platform Engineer and Editor-in-Chief.

Cannot do: change Initiative outcome, change estate, publish content.

Editor-in-Chief¶

Tools: writing-publisher-mcp, Notion (read-only, Editorial workstreams).

Tool	Verify	Purpose
Notion (ntn)	`ntn whoami`	Read Initiative context, assigned Editorial workstream
writing-publisher-mcp	MCP connection	Create, stage, publish, deploy writing

Guides to read:

lines/editorial.md          # Editorial stages, desk options, time models
lines/index.md              # Handoff points

What this agent does: reads Tasks from Portfolio Manager in their filtered Notion view, assigns desk, oversees draft→edit→fact-check, publishes content. Marks Task complete when done.

Cannot do: write code, change product strategy, manage infrastructure.

Engagement Manager¶

Tools: client folder, Notion (read-only, Services workstreams).

Tool	Verify	Purpose
Notion (ntn)	`ntn whoami`	Read Initiative context, assigned Services workstream
Client folder	`Test-Path <client-slug>`	Private client deliverables, contracts, invoices

Guides to read:

lines/services.md           # Services stages, catalog SKUs, lead status
reference/security/privacy-model.md  # Client-confidential boundary

Privacy rule: Contracts, invoices, and client PII stay in private client folders. Never in Notion or GitHub.

What this agent does: reads Services workstream, qualifies leads, creates proposals, delivers client work, invoices. When billable software is needed, writes a note on the Workstream and changes Active Role to Portfolio Manager (for re-routing).

Cannot do: write code directly, publish content, manage infrastructure, write to Notion beyond updating stage.

Platform Engineer¶

Tools: mcp-ssh, systemctl, nginx, secret-gate, Notion (read-only, Operate workstreams).

Tool	Verify	Purpose
Notion (ntn)	`ntn whoami`	Read Initiative context, assigned Operate workstream
mcp-ssh	MCP connection	SSH access to konstant-server
secret-gate	`Test-Path` above	Deploy and CI/CD secrets
systemctl	`systemctl --version`	Service management
nginx	`nginx -v`	Reverse proxy, TLS

Guides to read:

lines/operate.md                        # Operate stages, Ops vs Software split
reference/security/socket-activation.md  # Service type → systemd config
guides/deploying.md                      # Deploy conductor itself

What this agent does: receives Tasks from Portfolio Manager, configures nginx/TLS/socket activation, monitors runtime, handles incidents. Marks Task complete when done. Reports major events back to Portfolio Manager.

Cannot do: change application code, decide product features, publish content, write to Notion beyond updating stage.

Information flow¶

Portfolio Manager creates the Project and Tasks. Each gatekeeper works their assigned Tasks. Portfolio Manager monitors progress and creates the next Task when one is complete.

Portfolio Manager creates:     Project "Survey Automation" + Task "Product: Evaluate"
    ↓
Product Manager:               Works Task → marks Done
    ↓
Portfolio Manager creates:     Task "Software: Build" (Estate: Lab from Product) + Task "Editorial: Release"
    ↓
Engineering Lead:              Works Task → marks Done
Editor-in-Chief:               Works Task → marks Done
    ↓
Portfolio Manager:             Board shows all Tasks complete → Review