TSYSGroupCorporate/TSYSGroupAIOS
Template
7
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

house rules: push-as-you-go, pfv-tsys5 fleet rolls, October hardware reality

Browse Source 
Standing permission to commit+push agent work as it lands (human monitors
via Redmine/Gitea/Discourse, not ssh/crush). Crush may reboot other VMs on
pfv-tsys5; VM 5111 reboots stay human-triggered; host never reboots
casually. Hardware window slipped to ~Oct 2026 — presume 8 vCPU / 48G
operating values on VM 5111 until then.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
[#602]
This commit is contained in:
mrcharles
2026-08-31 16:55:02 -05:00
parent b0680677a2
commit 86d8565d87
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agents/global/AGENTS.md
+7 -2
View File
@@ -30,14 +30,19 @@ question (see Questions). Effective 2026-08-31.
- ALL builds/tests through the repo's compose lifecycle services (pinned-builder `check`). NEVER run toolchains on the host. Host runs only git, docker, unix utils. NO dev.sh, NO Makefile — docker compose is the only lifecycle interface (k8s/gitops-portable; template: go-cli-mcp-template #578). - ALL builds/tests through the repo's compose lifecycle services (pinned-builder `check`). NEVER run toolchains on the host. Host runs only git, docker, unix utils. NO dev.sh, NO Makefile — docker compose is the only lifecycle interface (k8s/gitops-portable; template: go-cli-mcp-template #578).
- Secrets: ONE place — ~/.creds (0600 env files). NEVER in repos, images, compose files, app databases, logs, or error strings. Configs hold refs (env:/file:), never material. - Secrets: ONE place — ~/.creds (0600 env files). NEVER in repos, images, compose files, app databases, logs, or error strings. Configs hold refs (env:/file:), never material.
- curl is banned. HTTP from host = python3 urllib. - Host hygiene (ruling 2026-08-31, RETIRES the old curl ban): common shell commands on the host are fine, curl included. NOT fine: package installs on the host (apt-get/pip/etc) or piling work/toolchains onto it — ALL work runs in containers (python inside dev/build containers is fine). Keep the host a thin, clean layer.
- Missing CLI on the host? DOCKER PULL IT (ruling 2026-08-31, standing permission): agents may pull tooling images freely — anything that makes the work easier (jq, ripgrep, etc. already fine from host; grab whatever else via `docker run --rm <pinned-or-digest image>`). No permission needed; never apt/pip instead.
- New gitea repos default to PUBLIC (ruling 2026-08-31): create with `--private=false`; go private only when the human asks or the content demands it (secrets are never repo content anyway — ~/.creds is the only home for those).
- NO Python from agents, ever (ruling 2026-08-31, human preference): ALL text/JSON/CSV processing = bash, sed, awk, perl, cut, jq, sort/uniq. Never python one-liners; HTTP = curl. Same rule for anything you hand the human: shell only.
- 100% compose lifecycle: every container is a compose service with container_name; storage in named volumes; no ad-hoc docker run for services, no manual renames. Scoped ops only — NEVER bare `down`. - 100% compose lifecycle: every container is a compose service with container_name; storage in named volumes; no ad-hoc docker run for services, no manual renames. Scoped ops only — NEVER bare `down`.
- Image tags: digests or pinned versions, NEVER :latest. - Image tags: digests or pinned versions, NEVER :latest.
- Container naming: `ukrrs-<fleet>-<function>[-beta]` (prod) / same with -beta (beta lane). Compose project mirrors the lane. - Container naming: `ukrrs-<fleet>-<function>[-beta]` (prod) / same with -beta (beta lane). Compose project mirrors the lane.
- DNS names over IP literals (documented exception: the gateway's tailscale service bind). - DNS names over IP literals (documented exception: the gateway's tailscale service bind).
- Every command touching a remote system gets `timeout`: 30s reads / 120s standard / 300s deploys. A hung command is a FAILED command — diagnose, never blind-retry. - Every command touching a remote system gets `timeout`: 30s reads / 120s standard / 300s deploys. A hung command is a FAILED command — diagnose, never blind-retry.
- Time-box: if stuck twice on the same approach, change approach or record a question. - Time-box: if stuck twice on the same approach, change approach or record a question.
- NEVER push to remotes unless the human asked (repo policies may demand commits; pushes stay human-gated). - PUSH AS YOU GO (ruling 2026-08-31, standing permission): agents commit AND push work as it lands — do not wait for the human. The human's primary monitoring surface is Redmine/Gitea/Discourse activity, not ssh to hosts or running crush. Never force-push; respect branch protections.
- pfv-tsys5 fleet rolls (ruling 2026-08-31): crush may reboot OTHER VMs on pfv-tsys5 (sectestbed fleet) via `qm` as needed. VM 5111 (the human workstation hosting crush sessions) reboots only when the human pulls the trigger. The PVE host itself NEVER reboots casually (NFS server for -02). Hardware window slipped to ~OCT 2026: presume VM 5111 stays 8 vCPU / 48G until that window — plan on interim values as the operating values.
- Locale (ruling 2026-08-31): human + fleet sit in TEXAS, America/Chicago (Central; UTC-5 in summer). Times the human says ("1638 CST") are Central local. Never re-derive weekday/date from UTC log strings — docker/journal print UTC = local +5h; e.g. 2026-08-31 is a Monday, "Friday" = 2026-09-04.
## Enforcement (mechanical, belt and suspenders) ## Enforcement (mechanical, belt and suspenders)