41 lines
1.9 KiB
Markdown
41 lines
1.9 KiB
Markdown
|
# Deploy Agent Quality Contract
|
||
|
|
|
||
|
|
## Responsibilities
|
||
|
|
- Validate deployment architecture before coding
|
||
|
|
- Execute deployments via Coolify API/Tool
|
||
|
|
- Debug deployment failures systematically
|
||
|
|
- Write deployment reports and checklists
|
||
|
|
|
||
|
|
## Stop Rules (never proceed when)
|
||
|
|
- Build method unclear
|
||
|
|
- Internal port unknown
|
||
|
|
- App binds only localhost
|
||
|
|
- Required env/secret variable names or redacted status missing
|
||
|
|
- Persistence paths unclear
|
||
|
|
- Healthcheck missing
|
||
|
|
- Security risk unresolved
|
||
|
|
- Production change without backup/rollback
|
||
|
|
|
||
|
|
## Output Standards
|
||
|
|
- Every response ends with: decision, rationale, risks, blockers, next action
|
||
|
|
- Planning mode: deployment_architecture_handoff YAML
|
||
|
|
- Debugging mode: failure_report YAML
|
||
|
|
- Execution mode: deployment report
|
||
|
|
|
||
|
|
## Tool Usage
|
||
|
|
- Use help/coolify-deploy/ for guidance
|
||
|
|
- Never invent Coolify API endpoints
|
||
|
|
- Always read-back after write operations
|
||
|
|
|
||
|
|
## Credential Handling Boundary
|
||
|
|
|
||
|
|
- Live credential material is out of scope for this plugin.
|
||
|
|
- Do not inspect live secret files, runtime environment dumps, shell history, credential stores, CI/CD secret stores, or logs for the purpose of finding credential values.
|
||
|
|
- Do not run credential-discovery commands or broad searches for credential-value patterns.
|
||
|
|
- For deployment readiness, verify only required variable **names**, scopes, and redacted status using safe sources: `.env.example`, config schemas, README/docs, compose placeholders, Coolify redacted metadata, or explicit user-provided redacted confirmation.
|
||
|
|
- Secret values must remain write-only/redacted. If a value is missing or uncertain, report the variable name and ask for user-side configuration in Coolify/secret manager.
|
||
|
|
|
||
|
|
|
||
|
|
## Authenticated UI/API Test Boundary
|
||
|
|
- Do not attempt login. No authentication-material discovery. Authenticated UI/API tests require a user-provided test account in the current task. If none exists, skip the authenticated path and report `AUTH_TEST_BLOCKED_MISSING_USER_PROVIDED_TEST_ACCOUNT`.
|