arifos-deploy

Files (10)

• SKILL.md
• 888-hold-matrix.md · references/
• agent-behaviors.md · references/
• change-classification.md · references/
• cicd-patterns.md · references/
• cloudflare-commands.md · references/
• constitutional-execution.md · references/
• deploy-matrix.md · references/
• file-inventory.md · references/
• verification-runbooks.md · references/

SKILL.md (first lines)

# arifOS Deploy — Sovereign Deployment Doctrine

Ditempa Bukan Diberi. Every deployment is a thermodynamic state transition. Only deploy what is proven reversible.

---

## Core Invariants (Never Change)

These are constitutional-level constraints. No tool, command, or convenience may violate them.

### The Three Surfaces

```
arifOS-fazil.com     → Hub (identity, summaries, machine discovery)
arifos.arifOS-fazil.com → Docs (full technical content)
arifOS:8080/mcp     → Runtime (constitutional tool execution)
```

**Role rule:** Hub never hosts full docs content. Docs never hosts hub content. Runtime is never a static site. These boundaries never swap.

### Machine Discovery Invariants

Machine-readable files MUST be at root-level stable canonical paths:

```
/llms.txt               → LLM context injection (text/plain)
/robots.txt             → Crawler control
/sitemap.xml            → Search indexing
/.well-known/agent.json → Agent discovery (application/json)
/.well-known/ai-plugin.json → Plugin manifest
```

**Rule:** These paths NEVER change. They never route through SPA. They never redirect. They always return correct Content-Type. If a hosting platform cannot serve a file at its canonical path, that platform is not suitable for this surface.

### Content-Type Requirements

| File | Content-Type |
|------|-------------|
| llms.txt | text/plain; charset=utf-8 |
| agent.json | application/json |
| robots.txt | text/plain |
| sitemap.xml | application/xml |

**Rule:** Any deploy that breaks Content-Type for machine files is a failed deploy.

---

## CI/CD Policy

### Push-to-Main Spine

Every deploy MUST be GitHub Actions triggered by push to main. No manual `scp` or FTP. No exceptions.

### Pre-Deploy Gates (888_JUDGE analog)

Before any production deploy, the pipeline checks:
1. Source files validated (HTML syntax, machine files present)
2. Health check endpoint reachable
3. Rollback state documented (what to revert and how)

### Health Check Requirement

Every runtime deploy MUST verify `/health` returns 200 before marking deploy complete. If health check fails, deploy is marked failed — not degraded-ok.

### Rollback Mandate (F1 AMANAH)

Every deploy MUST produce a documented rollback path before executing. Rollback must be achievable in ≤2 minutes without data loss.

**Standard rollback:** Re-run previous successful workflow. GitHub Pages and GitHub Actions both support instant rollback to previous deployment.

---

## Deploy Decision Rules

### When to Deploy Hub

Hub deploys when files in `sites/arifOS-fazil.com-source/pages/`, `assets/`, machine files, or `deploy-hub.yml` workflow change.

### When to Deploy Docs

Docs deploys when files in `arifOSmcp/sites/developer/` or `deploy-sites.yml` workflow change.

### When to Deploy Runtime

Runtime deploys when `arifOSmcp/`, `docker-compose.yml`, `Dockerfile`, or `deploy-vps.yml` change. Requires health check confirmation.

### When NOT to Deploy

Do NOT deploy if:
- Only documentation (.md) files changed
- Only planning/audit documents changed
- No content, config, or code changed

Path filters in GitHub Actions enforce this automatically.

---

## Cache Purge Doctrine

### Targeted Purge Only

Purge ONLY files whose source content changed:
- `/llms.txt` → republish when MEMORY.md, SOUL.md, or REPOS.md changes
- `/.well-known/agent.json` → republish when `waw/.well-known/agent.json` changes
- HTML pages → republish on content or layout change

### Purge Trigger

Cache purge is CI-triggered, not blanket. Default GitHub Pages cache is acceptable. Cloudflare Pages cache purge only on explicit content change.

### No Purge-Everything

Purge-everything is operationally noisy and risks collateral damage. It is forbidden as a default step.

---

## Architecture States

### State A — Stabilize (Current)

From ariffazil/arifOS, AGPL-3.0.

More from ariffazil/arifOS