#!/bin/bash
# SessionStart hook (advisory): injects AKOS usage guidance so every new session reuses registered API knowledge first.
# Hooks cannot intercept arbitrary host networking; enforcement happens in the AKOS gateway/sandbox (see docs/threat-model.md).
cat <<'MSG'
AKOS (API Knowledge Operating System) is connected as MCP server `akos`. Before integrating or calling ANY external API:
1. `search_knowledge` then `inspect_api` — reuse an existing API Knowledge Package (AKP) and its pinned client (`generate_client`).
2. Call providers through `execute_api` (governed: policy, provenance, credentials from the vault) — never paste API keys.
3. Unknown API: `discover_api` (OpenAPI URL or probe) then `get_job`; it compiles and verifies an AKP automatically.
4. Research data: `create_dataset` → `compose_recipe` → `export_research_dataset` (verified exports fail closed).
Raw curl/requests calls from this shell are OUTSIDE the enforcement boundary and are not research-grade provenance.
MSG
exit 0