# Agent Guidelines

## Secrets and Credentials Policy

**NEVER commit secrets, passwords, tokens, API keys, SSH keys, or any
credential to this repository — in source, in comments, in examples, in
documentation, or in commit messages. No exceptions.**

Rules:
1. **No secrets in code.** Credentials must come from environment variables,
   a vault, or Ansible Vault — never from a hardcoded literal.
2. **No real secrets in examples/docs.** Use placeholders like `$AWX_PASSWORD`,
   `***REMOVED***`, or `<your-token-here>`.
3. **Check before committing.** If a change introduces anything that looks like
   a secret (password assignment, `b64encode`, `AUTH =`, API key, private key
   block), stop and refactor it to read from the environment first.
4. **If a secret is ever introduced**, it must be purged from the entire git
   history (not just the working tree) with `git filter-repo --replace-text`,
   followed by a force-push. Rotating the exposed credential is mandatory.
5. **`.gitignore`** must keep secret-bearing paths ignored (e.g. `.env`, private
   keys). Add new entries as needed.

## Git Commit and Push Policy

**ALWAYS commit and push automatically. NEVER wait to be asked.**

After completing each logical unit of work, immediately:
1. Stage the relevant files
2. Commit with a well-formed message (see below)
3. Push to `origin/main`

Do NOT batch multiple unrelated changes into one commit. Do NOT leave work
uncommitted at the end of a task.

## Commit Rules

1. **Commit atomically**: Each logical change is its own commit.
2. **Use conventional commit format**:
   - `feat(scope): description` — New feature
   - `fix(scope): description` — Bug fix
   - `docs: description` — Documentation changes
   - `refactor(scope): description` — Code refactoring
   - `test(scope): description` — Test additions/changes
   - `chore: description` — Maintenance tasks
3. **Write verbose, beautifully formatted messages**:
   - Title line (50 chars max)
   - Blank line
   - Body explaining WHAT and WHY (not how)
   - Reference related files/issues
   - Include footer with attribution
4. **Push after every commit** — do not accumulate local commits.

## Example Commit

```
feat(security-hardening): implement SCAP-STIG compliance logic

Refactor apply script to implement comprehensive security hardening:

- Add GRUB bootloader permission hardening (root:root, mode 0400)
- Disable and remove autofs service per STIG requirements
- Deploy modprobe configurations for kernel module blacklisting
- Create STIG-compliant network protocol blacklist

This ensures servers meet DoD security requirements for production
deployment.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>
```

## Important

- **NEVER wait to be asked to commit and push.**
- **Commit immediately after each logical unit of work.**
- **Push after every commit.**
- **Prefer many small, focused commits over fewer large ones.**
- **Never commit secrets** — see the Secrets and Credentials Policy above.