TSYSGroupCorporate/TSYSGroupAIOS
Template
7
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

docs(rules): compose-only lifecycle doctrine (no dev.sh/Makefile); prod container suffixes

Browse Source
This commit is contained in:
mrcharles
2026-08-31 14:44:33 -05:00
parent 8bff9567b7
commit b0680677a2
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agents/global/AGENTS.md
+2 -2
View File
@@ -10,7 +10,7 @@ question (see Questions). Effective 2026-08-31.
## Promotion tiers (alpha -> beta -> uat -> prod; each slower than the last) ## Promotion tiers (alpha -> beta -> uat -> prod; each slower than the last)
- alpha: build + vet + test in the digest-pinned builder (`./dev.sh check`). Nothing deployed. - alpha: build + vet + test via the repo's compose `check` service (pinned builder). Nothing deployed.
- beta: candidate image on the isolated beta lane (own Postgres, loopback bind; gateway: compose.beta.yaml, 127.0.0.1:4002) + scripted UAT. - beta: candidate image on the isolated beta lane (own Postgres, loopback bind; gateway: compose.beta.yaml, 127.0.0.1:4002) + scripted UAT.
- uat: the REAL client against the beta lane (crush: `crushgw-uat`; gateway: `./promote.sh uat`). Spend lands in beta accounting only. - uat: the REAL client against the beta lane (crush: `crushgw-uat`; gateway: `./promote.sh uat`). Spend lands in beta accounting only.
- prod: the live stack. **HUMAN RELEASE ONLY** (gateway: `./promote.sh release`, typed by human hands). An agent NEVER promotes to prod, NEVER restarts prod for convenience. If prod must bounce, drain-aware: quiet logs, 30s graceful, in-flight turns may retry. - prod: the live stack. **HUMAN RELEASE ONLY** (gateway: `./promote.sh release`, typed by human hands). An agent NEVER promotes to prod, NEVER restarts prod for convenience. If prod must bounce, drain-aware: quiet logs, 30s graceful, in-flight turns may retry.
@@ -28,7 +28,7 @@ question (see Questions). Effective 2026-08-31.
## Hard rules ## Hard rules
- ALL builds/tests in Docker via each repo's pinned builder. NEVER run toolchains on the host. Host runs only git, docker, unix utils. - ALL builds/tests through the repo's compose lifecycle services (pinned-builder `check`). NEVER run toolchains on the host. Host runs only git, docker, unix utils. NO dev.sh, NO Makefile — docker compose is the only lifecycle interface (k8s/gitops-portable; template: go-cli-mcp-template #578).
- Secrets: ONE place — ~/.creds (0600 env files). NEVER in repos, images, compose files, app databases, logs, or error strings. Configs hold refs (env:/file:), never material. - Secrets: ONE place — ~/.creds (0600 env files). NEVER in repos, images, compose files, app databases, logs, or error strings. Configs hold refs (env:/file:), never material.
- curl is banned. HTTP from host = python3 urllib. - curl is banned. HTTP from host = python3 urllib.
- 100% compose lifecycle: every container is a compose service with container_name; storage in named volumes; no ad-hoc docker run for services, no manual renames. Scoped ops only — NEVER bare `down`. - 100% compose lifecycle: every container is a compose service with container_name; storage in named volumes; no ad-hoc docker run for services, no manual renames. Scoped ops only — NEVER bare `down`.