sre-core

Files (1)

• SKILL.md

SKILL.md (first lines)

# SRE Core Agent Workflow & Guardrails

## Standard Agent Loop (always follow)
0. **Match task to an `sn-*` or `sre-*` skill** (or the kit-local README / kits/AGENTS.md). Load it explicitly before proceeding.
1. **Read `LOCAL.md`** (if present in the checkout — it is gitignored and contains machine paths).
2. **Preflight**: `GET /api/config` and confirm `vault_initialized: true` before any `POST /st`, secret writes, or storage/backup mutations.
3. **Mutate via the HTTP API only** (Bearer token from `.env` or config). Prefer `curl` (or the sentinel CLI that talks to the same API). No ad-hoc sidecar scripts that touch `.sentinel/` state directly.
4. After kit or flow changes: run `sentinel sre validate -p .` (and `sentinel sre test <kit>/` where relevant).
5. **Update twins / docs**: for every changed `.lua` also update its `*.lua.md`; for behavior changes visible to operators, update the matching page under `docs/`.

## API Discipline
- Always use the live harness API (`HARNESS_URL` + `SENTINEL_API_KEY` from `.env`).
- **Never** set the harness process env var `SENTINEL_API`.
- Cloud credentials and storage secrets live **only** in the vault (reached via `POST /st`, `POST /sc`). They are never in git, `.env`, or Lua source.
- `GET /hl`, `GET /api/config`, `GET /fl`, `GET /st`, `GET /bk/plans` are safe read entrypoints.

## Common Mistakes (avoid these)
1. Harness operations without first loading the matching `sn-*` skill.
2. `POST /st` (or any secret write) when `vault_initialized` is false.
3. Putting cloud credentials or `SENTINEL_VAULT_PASSPHRASE` into `.env` or any committed file.
4. Using the env var `SENTINEL_API` on the harness process (breaks config loading).
5. Loading an entire operator `.env` (with secrets) into a systemd unit for the harness.
6. Listing concrete flows or files inside `kit.yaml`.
7. Implementing long-running archive/backup jobs inside Lua flows instead of using harness `/bk` plans + `sn.backup.*` observation.
8. Committing `.env` or the `.sentinel/` directory.
9. Patching the private harness for pure SRE/content work (only do this for real missing API surface).

## Quick Preflight Snippet
```bash
export SENTINEL_API_KEY=$(grep '^SENTINEL_API_KEY=' .env | cut -d= -f2-)
export HARNESS_URL=${HARNESS_URL:-http://127.0.0.1:8080}
curl -s -H "Authorization: Bearer $SENTINEL_API_KEY" "$HARNESS_URL/api/config" | jq '.vault_initialized'
```

See also: root `AGENTS.md` (global layout, runtime table, key routes), `skills/sre-lua`, `skills/sre-triggers`, `skills/sre-config`, `sn-storage`, `sn-backups`, and any `kits/*/AGENTS.md` or kit README for the current directory.

From ndx-au/sre-init, MIT.

More from ndx-au/sre-init