KNELIAC/AGENTS.md

Agent Guidelines

Secrets and Credentials Policy

NEVER commit secrets, passwords, tokens, API keys, SSH keys, or any credential to this repository — in source, in comments, in examples, in documentation, or in commit messages. No exceptions.

Rules:

1. No secrets in code. Credentials must come from environment variables, a vault, or Ansible Vault — never from a hardcoded literal.
2. No real secrets in examples/docs. Use placeholders like $AWX_PASSWORD, ***REMOVED***, or <your-token-here>.
3. Check before committing. If a change introduces anything that looks like a secret (password assignment, b64encode, AUTH =, API key, private key block), stop and refactor it to read from the environment first.
4. If a secret is ever introduced, it must be purged from the entire git history (not just the working tree) with git filter-repo --replace-text, followed by a force-push. Rotating the exposed credential is mandatory.
5. .gitignore must keep secret-bearing paths ignored (e.g. .env, private keys). Add new entries as needed.

Git Commit and Push Policy

ALWAYS commit and push automatically. NEVER wait to be asked.

After completing each logical unit of work, immediately:

1. Stage the relevant files
2. Commit with a well-formed message (see below)
3. Push to origin/main

Do NOT batch multiple unrelated changes into one commit. Do NOT leave work uncommitted at the end of a task.

Commit Rules

1. Commit atomically: Each logical change is its own commit.
2. Use conventional commit format:
   • feat(scope): description — New feature
   • fix(scope): description — Bug fix
   • docs: description — Documentation changes
   • refactor(scope): description — Code refactoring
   • test(scope): description — Test additions/changes
   • chore: description — Maintenance tasks
3. Write verbose, beautifully formatted messages:
   • Title line (50 chars max)
   • Blank line
   • Body explaining WHAT and WHY (not how)
   • Reference related files/issues
   • Include footer with attribution
4. Push after every commit — do not accumulate local commits.

Example Commit

feat(security-hardening): implement SCAP-STIG compliance logic

Refactor apply script to implement comprehensive security hardening:

- Add GRUB bootloader permission hardening (root:root, mode 0400)
- Disable and remove autofs service per STIG requirements
- Deploy modprobe configurations for kernel module blacklisting
- Create STIG-compliant network protocol blacklist

This ensures servers meet DoD security requirements for production
deployment.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

Important

• NEVER wait to be asked to commit and push.
• Commit immediately after each logical unit of work.
• Push after every commit.
• Prefer many small, focused commits over fewer large ones.
• Never commit secrets — see the Secrets and Credentials Policy above.