From 198ed883508fb1cd87cd6c6d2e112a9443854dcb Mon Sep 17 00:00:00 2001 From: Chris Farhood Date: Tue, 26 May 2026 23:01:12 -0400 Subject: [PATCH] udpate sdlc --- skills/sdlc/SKILL.md | 113 ++++++++++++------------------------------- 1 file changed, 30 insertions(+), 83 deletions(-) diff --git a/skills/sdlc/SKILL.md b/skills/sdlc/SKILL.md index af7dcfe..8f69f81 100644 --- a/skills/sdlc/SKILL.md +++ b/skills/sdlc/SKILL.md @@ -16,26 +16,6 @@ description: > Gitea is the **primary source of truth**. Every Paperclip issue must have a corresponding Gitea issue (create one if missing). Both stay open until the work is completed, reviewed, approved, merged, and QA-verified. -## Gitea-origin issue policy — board approval required - -If a task originated from Gitea (`originKind: "gitea"`), **do not begin work**. Immediately create a board approval: - -``` -POST /api/companies/{companyId}/approvals -{ - "type": "request_board_approval", - "requestedByAgentId": "{your-agent-id}", - "issueIds": ["{issueId}"], - "payload": { - "title": "Board approval required: Gitea issue", - "summary": "Summarize what the Gitea issue requests.", - "recommendedAction": "Approve to begin work.", - "risks": ["Work begins without board review if approved."] - } -} -``` - -Set the issue to `blocked` with a comment linking to the approval. Only proceed once `PAPERCLIP_APPROVAL_ID` is set and `PAPERCLIP_APPROVAL_STATUS` indicates approval. ## Branch strategy @@ -44,10 +24,11 @@ Three long-lived branches map to the three deployment environments: | Branch | Environment | Who merges | |--------|-------------|-----------| | `dev` | Dev | Engineer (self-merges after CI passes) | -| `uat` | UAT | QA (merges after code review) | -| `main` | Production | CEO (merges after UAT validation) | +| `uat` | UAT | Engineer (merges after QA code review) | +| `main` | Production | Engineer (merges after UAT validation & CTO code review) | -**Engineers always target `dev`** — never `uat` or `main` directly. Feature branches: `/`. +**Engineers always target `dev` first** — never `uat` or `main` directly. +- Feature branches: `/`. ## Pull requests @@ -57,75 +38,43 @@ All changes happen via pull request. Always include `cc @cpfarhood` at the botto tea pr create --base dev --title "..." --body "... cc @cpfarhood" ``` -Gitea branch protection requires CI checks (lint, test, build-and-push). Governance is enforced through Paperclip. - -## PR review & merge policy - -### Dev branch (`dev`) -- **Engineer** self-merges after CI passes. Dev is for validation, not quality gates. -- **QA (Lint Roller `525c2c39-1196-4682-9cd1-0bcfcb0d0f31`)** reviews the PR. Fail → back to engineer with exact details. -- QA approves and hands off to CTO. -- **CTO (The Dogfather `c370d244-3c3b-4f21-a403-4cdc9dbdbf96`)** reviews the PR. Fail → back to engineer. -- **CTO** merges the dev PR. - -### UAT branch (`uat`) -- **CTO** opens and merges a PR from `dev` to `uat`. -- **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`). -- **CTO** creates a UAT regression task for **Shedward Scissorhands (`c24bab42-4a3c-4a80-b4df-425eeb77088f`)** immediately after promoting. - -### Main branch (`main`) -- **CEO (Scrubs McBarkley `3d57c003-f02d-4ab3-b2c3-50a314590bb5`)** reviews and merges the `uat → main` PR. -- **CI** deploys automatically to Production (`https://demo.groombook.dev`). - -`@cpfarhood` is cc'd for visibility on all PRs — never as a reviewer. +Gitea branch protection requires CI checks to pass. ## SDLC pipeline ### Phase 1 — Dev -1. **Engineer (Flea Flicker `ccfa5281-2076-40c2-87a9-bf2dbcf98d22`)** branches from `dev`, writes code. GitOps deploys to dev on demand. -2. **Engineer** opens a PR against `dev`. CI must pass. -3. **Engineer** self-merges after CI passes. -4. **CI** builds and deploys automatically to Dev (`https://dev.groombook.dev`). -5. **QA (Lint Roller)** reviews the PR. Fail → back to engineer. -6. QA approves and hands off to CTO. -7. **CTO (The Dogfather)** reviews the PR. Fail → back to engineer. -8. **CTO** merges the dev PR. +1. **Engineer** branches from `dev`, writes code. +2. **Engineer** opens a PR against `dev`. +3. **CI** fail → back to **Engineer**. +4. **CI** pass → **Engineer** merges PR. +5. **CI** builds and deploys automatically to Dev (`https://dev.groombook.dev`). ### Phase 2 — UAT promotion -9. **CTO** opens and merges a PR from `dev` to `uat`. -10. **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`). +1. **Engineer** opens a PR from `dev` to `uat`. +2. **CI** fail → back to **Engineer** (return to Phase 1). +3. **CI** pass → **QA** performs code review. +4. **QA** rejected → back to **Engineer** (return to Phase 1). +5. **QA** approved → **Engineer** merges PR. +6. **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`). -### Phase 3 — UAT testing & security +### Phase 3 — User Testing & Security Review -11. **UAT (Shedward Scissorhands)** runs full regression against UAT — every feature, old and new, no exceptions. -12. UAT fail → CTO redistributes to engineer (return to Phase 1). -13. UAT pass → **Security Engineer (Barkley Trimsworth `622a69bf-ec37-4a5c-b385-bef7219191b1`)** performs a security code review of the changes. -14. Security fail → CTO redistributes to engineer (return to Phase 1). +1. **UAT (Shedward Scissorhands)** runs full regression against UAT — every feature, old and new, no exceptions. +2. **UAT** fail → back to **Engineer** (return to Phase 1). +3. **UAT** pass → **Security Engineer** performs a security code review of the changes. +4. **Security** fail → back to **Engineer** (return to Phase 1). +5. **Security** pass → **Engineer** opens a PR from `uat` to `main`. +6. **CI** fail → back to **Engineer** (return to Phase 1). +7. **CI** pass → Begin Phase 4. ### Phase 4 — Production -15. Security pass → **CEO (Scrubs McBarkley)** reviews and merges the production PR (`uat → main`). Fail → back to CTO. -16. **CI** deploys automatically to Production (`https://demo.groombook.dev`). - -### Hierarchy rules - -* CTO rejections at Dev go directly to the engineer (not back through QA). -* UAT failures (Shedward Scissorhands) go to CTO — CTO cascades to engineer. -* Security failures (Barkley Trimsworth) go to CTO — CTO cascades to engineer. -* CEO rejections at Prod go to CTO. - -> **Note on penetration testing:** Barkley Trimsworth performs scheduled penetration testing against Prod independently of the PR workflow. Board-authorized. Not triggered per-PR. - -## Delegation model tier - -When creating subtasks for other agents, set `modelProfile: "cheap"` only for: -- Mechanical refactors or repetitive operations -- Basic information lookups -- Well-specified, bounded updates - -Leave `modelProfile` unset for anything requiring judgment, reasoning, or QA review. When in doubt, leave it unset. +1. **CTO** performs code review. +2. **CTO** approved → **Engineer** merges PR. +3. **CTO** rejected → back to **Engineer** (return to Phase 1). +4. **CI** deploys automatically to Production (`https://demo.groombook.dev`). ## Infrastructure @@ -139,7 +88,7 @@ Leave `modelProfile` unset for anything requiring judgment, reasoning, or QA rev ## Authentication * **Framework:** Better-Auth. -* **Social login:** Google and Apple OAuth. +* **OAuth Providers:** GroomBook (Authentik), Google and Apple. * **SSO:** Authentik OIDC at `https://auth.farh.net` (credentials in `authentik-credentials` secret). * **Never build custom authentication.** @@ -172,7 +121,7 @@ kubectl rollout restart deployment/ -n Terraform (OpenTofu) is deployed via the **Flux OpenTofu Controller** in a GitOps fashion. Submit Terraform configurations via a PR to `groombook/infra` — the tofu controller reconciles them on merge. -**Never run `tofu` directly.** Never `kubectl apply` against production. Production changes go through Flux only. The `groombook-dev` and `groombook-uat` namespaces permit direct kubectl use for iteration. +**Never run `tofu` directly.** Never `kubectl apply` against production. Production changes go through Flux only. The `groombook-dev` and `groombook-uat` namespaces permit direct kubectl use for troubleshooting and iteration. ## Tools (canonical, not alternatives) @@ -186,8 +135,6 @@ These are the only acceptable choices — alternatives are policy violations: * **Container registry:** `git.farh.net/groombook/` — no Docker Hub for first-party images. * **Browser automation:** the `playwright` MCP server (`http://playwright:8931/mcp`). Target dev only — never test production. -If a task requires deviating from any of the above, treat it as a destructive action: stop, file an issue with rationale, request board approval. - ## External communication When communicating in any context visible outside the GroomBook agent team (external users, human reviewers, non-agent entities), include `cc @cpfarhood` for visibility — never as a reviewer.