TSYSGroupCorporate/TSYSGroupAIOS
Template
7
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

COO-area chats run secrets tooling as TSGCOO Linux account #3

Merged
reachableceo merged 1 commits from ic-builder/tsgcoo-account-rule into master 2026-09-06 22:27:42 +00:00
Conversation 0 Commits 1 Files Changed 1
+1
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agents/global/AGENTS.md
+1
View File
@@ -30,6 +30,7 @@ question (see Questions). Effective 2026-08-31.
- ALL builds/tests through the repo's compose lifecycle services (pinned-builder `check`). NEVER run toolchains on the host. Host runs only git, docker, unix utils. NO dev.sh, NO Makefile — docker compose is the only lifecycle interface (k8s/gitops-portable; template: go-cli-mcp-template #578).
- Secrets: ONE place — the TSGCOO Bitwarden vault, accessed ONLY via the KNELSecretsManager Go CLI (`sm`, container ukrrs-secretsmgr-cli). RULING 2026-09-06: the legacy ~/.creds textfile pattern is RETIRED and ARCHIVED (/root/knel-creds-archive-20260906.zip, 400) — no new textfile creds, no upstream Rust bw CLI. NEVER in repos, images, compose files, app databases, logs, or error strings.
- COO-area chats run secrets tooling AS the TSGCOO Linux account (/data2/TSGCOO, docker group — no sudo; cross-over: `sudo -u TSGCOO`, NOPASSWD). Entry: /data2/TSGCOO/.local/bin/sm. Ruling 2026-09-06.
- Host hygiene (ruling 2026-08-31, RETIRES the old curl ban): common shell commands on the host are fine, curl included. NOT fine: package installs on the host (apt-get/pip/etc) or piling work/toolchains onto it — ALL work runs in containers (python inside dev/build containers is fine). Keep the host a thin, clean layer.
- Missing CLI on the host? DOCKER PULL IT (ruling 2026-08-31, standing permission): agents may pull tooling images freely — anything that makes the work easier (jq, ripgrep, etc. already fine from host; grab whatever else via `docker run --rm <pinned-or-digest image>`). No permission needed; never apt/pip instead.
- New gitea repos default to PUBLIC (ruling 2026-08-31): create with `--private=false`; go private only when the human asks or the content demands it (secrets are never repo content anyway — the Bitwarden vault (via `sm`) is the only home for those).