From b0680677a2f1da31e06adf321e38816a0702e10d Mon Sep 17 00:00:00 2001 From: reachableceo Date: Mon, 31 Aug 2026 14:44:33 -0500 Subject: [PATCH] docs(rules): compose-only lifecycle doctrine (no dev.sh/Makefile); prod container suffixes --- agents/global/AGENTS.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/agents/global/AGENTS.md b/agents/global/AGENTS.md index 067c6cb..0faa31a 100644 --- a/agents/global/AGENTS.md +++ b/agents/global/AGENTS.md @@ -10,7 +10,7 @@ question (see Questions). Effective 2026-08-31. ## Promotion tiers (alpha -> beta -> uat -> prod; each slower than the last) -- alpha: build + vet + test in the digest-pinned builder (`./dev.sh check`). Nothing deployed. +- alpha: build + vet + test via the repo's compose `check` service (pinned builder). Nothing deployed. - beta: candidate image on the isolated beta lane (own Postgres, loopback bind; gateway: compose.beta.yaml, 127.0.0.1:4002) + scripted UAT. - uat: the REAL client against the beta lane (crush: `crushgw-uat`; gateway: `./promote.sh uat`). Spend lands in beta accounting only. - prod: the live stack. **HUMAN RELEASE ONLY** (gateway: `./promote.sh release`, typed by human hands). An agent NEVER promotes to prod, NEVER restarts prod for convenience. If prod must bounce, drain-aware: quiet logs, 30s graceful, in-flight turns may retry. @@ -28,7 +28,7 @@ question (see Questions). Effective 2026-08-31. ## Hard rules -- ALL builds/tests in Docker via each repo's pinned builder. NEVER run toolchains on the host. Host runs only git, docker, unix utils. +- ALL builds/tests through the repo's compose lifecycle services (pinned-builder `check`). NEVER run toolchains on the host. Host runs only git, docker, unix utils. NO dev.sh, NO Makefile — docker compose is the only lifecycle interface (k8s/gitops-portable; template: go-cli-mcp-template #578). - Secrets: ONE place — ~/.creds (0600 env files). NEVER in repos, images, compose files, app databases, logs, or error strings. Configs hold refs (env:/file:), never material. - curl is banned. HTTP from host = python3 urllib. - 100% compose lifecycle: every container is a compose service with container_name; storage in named volumes; no ad-hoc docker run for services, no manual renames. Scoped ops only — NEVER bare `down`.