minor tweaks

Reviewed-on: #7

CLAUDE.md

@@ -8,7 +8,7 @@ This is the GroomBook **agent skills repository** — it contains skill definiti
 
 ## Skills Overview
 
-- **coding-standards** — Engineering quality bar: priority (correctness > clarity > maintainability > performance > elegance), PR discipline, test requirements, no-hardcoded-values rules, CalVer versioning, `ghcr.io` container registry policy.
+- **coding-standards** — Engineering quality bar: priority (correctness > clarity > maintainability > performance > elegance), PR discipline, test requirements, no-hardcoded-values rules, CalVer versioning, `git.farh.net` container registry policy.
 - **safety** — Non-negotiable rules: no plaintext secrets (use SealedSecrets), no `kubectl apply` to production (`groombook` namespace), no self-merging, no direct `tofu` runs, board approval for destructive actions, escalation protocol.
 - **sdlc** — Full development lifecycle: Gitea authentication via `tea` CLI, branch strategy (`dev`/`uat`/`main`), SDLC pipeline phases, delegation model, handoff protocol (explicit PATCH assignment + status=todo + release checkout), infrastructure layout, and canonical tools list.
 

skills/coding-standards/SKILL.md

@@ -55,7 +55,7 @@ All releases use CalVer (`YYYY.MMDD.PATCH`, e.g. `2026.0504.0`). No SemVer, no c
 
 ## Container images
 
-Push to `ghcr.io` only. Never Docker Hub for first-party images.
+Push to `git.farh.net` only. Never Docker Hub for first-party images.
 
 ## When uncertain
 

skills/sdlc/SKILL.md

@@ -4,53 +4,31 @@ description: >
   Software development lifecycle for GroomBook. Covers Gitea authentication,
   branch strategy across Dev/UAT/Prod, the SDLC pipeline phases,
   PR review and merge policy, infrastructure layout, the Gitea-origin issue
-  board-approval gate, and the canonical tools list.
+  board-approval gate, the cc-cpfarhood visibility rule,
+  and delegation model tier policy.
 ---
 
 # Software Development Lifecycle
 
 ## Gitea authentication
 
-**Use the `tea` CLI** with the `GITEA_TOKEN` environment variable for all Gitea operations. Configure it once:
+**Use the `GITEA_TOKEN`** environment variable for all Gitea operations. It is already set in the agent environment. Use the **`tea`** CLI for all Gitea/Git operations (e.g., `tea issue list`, `tea pr create`). The token expires when the environment variable is rotated — re-invoke any Gitea operation if you get a 401.
 
-```bash
+Gitea is the **primary source of truth**. Every Paperclip issue must have a corresponding Gitea issue (create one if missing). Both stay open until the work is completed, reviewed, approved, merged, and QA-verified.
-tea login add --url https://git.farh.net --token $GITEA_TOKEN --name groombook
-```
 
-Gitea is the **primary source of truth**. Every Paperclip issue should have a corresponding Gitea issue (create one if missing). Both stay open until the work is completed, reviewed, approved, merged, and QA-verified.
-
-## Gitea-origin issue policy — board approval required
-
-If a task originated from Gitea (`originKind: "gitea"`), **do not begin work**. Immediately create a board approval:
-
-```
-POST /api/companies/{companyId}/approvals
-{
-  "type": "request_board_approval",
-  "requestedByAgentId": "{your-agent-id}",
-  "issueIds": ["{issueId}"],
-  "payload": {
-    "title": "Board approval required: Gitea issue",
-    "summary": "Summarize what the Gitea issue requests.",
-    "recommendedAction": "Approve to begin work.",
-    "risks": ["Work begins without board review if approved."]
-  }
-}
-```
-
-Set the issue to `blocked` with a comment linking to the approval. Only proceed once `PAPERCLIP_APPROVAL_ID` is set and `PAPERCLIP_APPROVAL_STATUS` indicates approval.
 
 ## Branch strategy
 
 Three long-lived branches map to the three deployment environments:
 
-| Branch | Environment | Who merges |
+| Branch | Environment | Who merges | Prerequisites for merge |
-|--------|-------------|-----------|
+|--------|-------------|-----------|-----------|
-| `dev`  | Dev         | Engineer (self-merges after CI passes)            |
+| `dev`  | Dev         | Engineer | None (self-merges after CI passes) |
-| `uat`  | UAT         | QA (merges after code review)        |
+| `uat`  | UAT         | Engineer | QA code review approval |
-| `main` | Production  | UAT (validates browser, then merges)       |
+| `main` | Production  | Engineer | UAT validation & CTO code review |
 
-**Engineers always target `dev`** — never `uat` or `main` directly. Feature branches: `<agent-name>/<short-description>`.
+**Engineers always target `dev` first** — never `uat` or `main` directly.
+- Feature branches: `<agent-name>/<short-description>`.
 
 ## Pull requests
 
@@ -60,93 +38,72 @@ All changes happen via pull request. Always include `cc @cpfarhood` at the botto
 tea pr create --base dev --title "..." --body "... cc @cpfarhood"
 ```
 
-## PR review & merge policy
+Gitea branch protection requires CI checks to pass.
-
-### Dev branch (`dev`)
-
-- **Engineer** self-merges after CI passes. No review required. Dev is for validation, not quality gates.
-- **QA (Lint Roller `525c2c39-1196-4682-9cd1-0bcfcb0d0f31`)** reviews the PR. Fail → back to engineer directly with exact details.
-
-### UAT branch (`uat`)
-
-- **QA (Lint Roller)** merges `dev → uat` after approval.
-- **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`).
-
-### Main branch (`main`)
-
-- **UAT (Shedward Scissorhands `c24bab42-4a3c-4a80-b4df-425eeb77088f`)** validates the deployed application via Playwright browser testing.
-- **UAT** merges `uat → main` after validation passes.
-- **CI** deploys automatically to Production (`https://demo.groombook.dev`).
-
-`@cpfarhood` is cc'd for visibility on all PRs — never as a reviewer.
 
 ## SDLC pipeline
 
 ### Phase 1 — Dev
 
-1. **Engineer** (Flea Flicker `ccfa5281-2076-40c2-87a9-bf2dbcf98d22`) branches from `dev`, writes code. GitOps deploys to dev on demand.
+1. **Engineer** branches from `dev`, writes code.
-2. **Engineer** opens a PR against `dev`. CI must pass.
+2. **Engineer** opens a PR against `dev`.
-3. **Engineer** self-merges after CI passes.
+3. **CI** fail → back to **Engineer**.
-4. **CI** builds and deploys automatically to Dev (`https://dev.groombook.dev`).
+4. **CI** pass → **Engineer** merges PR.
-5. **QA (Lint Roller `525c2c39-1196-4682-9cd1-0bcfcb0d0f31`)** reviews the PR. Fail → back to engineer.
+5. **CI** builds and deploys automatically to Dev (`https://dev.groombook.dev`).
-6. QA approves and hands off to CTO.
-7. **CTO (The Dogfather `c370d244-3c3b-4f21-a403-4cdc9dbdbf96`)** reviews the PR. Fail → back to engineer.
-8. **CTO** merges the dev PR.
 
 ### Phase 2 — UAT promotion
 
-9. **QA (Lint Roller)** merges `dev → uat` after CTO approval.
+1. **Engineer** opens a PR from `dev` to `uat`.
-10. **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`).
+2. **CI** fail → back to **Engineer** (return to Phase 1).
-11. **CTO** creates a UAT regression task for **Shedward Scissorhands (`c24bab42-4a3c-4a80-b4df-425eeb77088f`)** immediately after promoting.
+3. **CI** pass → **QA** performs code review.
+4. **QA** rejected → back to **Engineer** (return to Phase 1).
+5. **QA** approved → **Engineer** merges PR.
+6. **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`).
 
-### Phase 3 — UAT testing
+### Phase 3 — User Testing & Security Review
 
-12. **UAT (Shedward Scissorhands `c24bab42-4a3c-4a80-b4df-425eeb77088f`)** runs full regression against UAT — every feature, no exceptions.
+1. **UAT (Shedward Scissorhands)** runs full regression against UAT — every feature, old and new, no exceptions.
-13. UAT fail → CTO redistributes to engineer (return to Phase 1).
+2. **UAT** fail → back to **Engineer** (return to Phase 1).
-14. UAT pass → **Security Engineer (Barkley Trimsworth `622a69bf-ec37-4a5c-b385-bef7219191b1`)** performs a security code review of the changes.
+3. **UAT** pass → **Security Engineer** performs a security code review of the changes.
-15. Security fail → CTO redistributes to engineer (return to Phase 1).
+4. **Security** fail → back to **Engineer** (return to Phase 1).
+5. **Security** pass → **Engineer** opens a PR from `uat` to `main`.
+6. **CI** fail → back to **Engineer** (return to Phase 1).
+7. **CI** pass → Begin Phase 4.
 
 ### Phase 4 — Production
 
-16. Security pass → **UAT (Shedward Scissorhands)** merges `uat → main`.
+1. **CTO** performs code review.
-17. **CI** deploys automatically to Production (`https://demo.groombook.dev`).
+2. **CTO** approved → **Engineer** merges PR.
-
+3. **CTO** rejected → back to **Engineer** (return to Phase 1).
-### Hierarchy rules
+4. **CI** deploys automatically to Production (`https://demo.groombook.dev`).
-
-* CTO rejections at Dev go directly to the engineer (not back through QA).
-* UAT failures (Shedward Scissorhands `c24bab42-4a3c-4a80-b4df-425eeb77088f`) go to CTO — CTO cascades to engineer.
-* Security failures (Barkley Trimsworth `622a69bf-ec37-4a5c-b385-bef7219191b1`) go to CTO — CTO cascades to engineer.
-* UAT rejections at Prod go to CTO.
-
-> **Penetration testing.** Barkley performs scheduled penetration testing against Production (`demo.groombook.dev`) and Demo independently of the PR workflow. Board-authorized; not triggered per-PR. Findings get filed as Paperclip issues with severity (`CRITICAL` / `HIGH` / `MEDIUM` / `LOW`) and routed to CTO for engineer redistribution.
-
 
 ## Infrastructure
 
-* **Production / Demo:** namespace `groombook`, FQDN `demo.groombook.dev`
+* **Production:** namespace `groombook`, FQDN `demo.groombook.dev`
 * **UAT:** namespace `groombook-uat`, FQDN `uat.groombook.dev`
 * **Dev:** namespace `groombook-dev`, FQDN `dev.groombook.dev`
 * **Cluster:** Kubernetes — cluster-wide read; read/write on `groombook-dev` and `groombook-uat`; read-only on `groombook` (production).
-* **Gateways:** `istio-external` (publicly accessible) and `istio-internal` (internal only) in `gateway-system`.
+* **Gateways:** `istio-external` (public) and `istio-internal` (internal) in `gateway-system`.
-* **Container registry:** `ghcr.io/groombook/<service>` only.
+* **Container registry:** `git.farh.net/groombook/<service>` only.
 
 ## Authentication
 
 * **Framework:** Better-Auth.
-* **Social login:** Google and Apple OAuth.
+* **OAuth Providers:** GroomBook (Authentik), Google and Apple.
 * **SSO:** Authentik OIDC at `https://auth.farh.net` (credentials in `authentik-credentials` secret).
 * **Never build custom authentication.**
 
 ## Deployment — 2-stage Flux GitOps
 
-**Stage 1 — CI (Gitea Actions, uses GitHub Actions-compatible YAML syntax, runs in each application repo):**
+**Stage 1 — CI (runs in each application repo):**
 - Triggered automatically on every merge to `main`
-- Builds and tags the Docker image
+- Builds and tags the Docker image: CalVer (`YYYY.MM.DD[.N]`), `latest`, and `sha-<hash>`
-- Pushes tagged images to `ghcr.io/groombook/<service>`
+- Pushes tagged images to `git.farh.net/groombook/<service>`
+- Creates a CalVer git tag in the source repo
 
 **Stage 2 — GitOps (Flux, managed externally):**
-- Flux watches `groombook/infra` as the **target** GitRepository — it is **not** a Flux bootstrap/cluster repo.
+- Flux watches `groombook/infra` as the **target** GitRepository — it is **not** a Flux bootstrap/cluster repo and must never be treated as one.
 - Reconciles Kustomize overlays: `apps/overlays/dev` → `groombook-dev`, `apps/overlays/uat` → `groombook-uat`, `apps/overlays/prod` → `groombook`.
+- Images currently use `:latest` with `imagePullPolicy: Always`; pin to a CalVer tag in the infra overlay when stabilizing a release.
 
 **Policy — Flux Image Tag Automation is DENIED.** Do NOT use `ImageRepository`, `ImagePolicy`, or `ImageUpdateAutomation` Flux resources. Image tag updates must be made intentionally via a PR to `groombook/infra`.
 
@@ -155,16 +112,16 @@ tea pr create --base dev --title "..." --body "... cc @cpfarhood"
 2. Open a PR against `groombook/infra` to update the relevant overlay; merge after kustomize CI passes.
 3. Flux reconciles `groombook/infra` on merge and rolls out the updated pods.
 
-**To force a rollout** (pick up new `:latest` on stuck pods):
+**To force a rollout without a manifest change:**
 ```bash
 kubectl rollout restart deployment/<name> -n <namespace>
 ```
 
 ## Infrastructure as Code
 
-Terraform / OpenTofu is deployed via the **Flux OpenTofu Controller** in a GitOps fashion. Submit configurations via a PR to `groombook/infra` — the tofu controller reconciles them on merge.
+Terraform (OpenTofu) is deployed via the **Flux OpenTofu Controller** in a GitOps fashion. Submit Terraform configurations via a PR to `groombook/infra` — the tofu controller reconciles them on merge.
 
-**Never run `tofu` directly.** Never `kubectl apply` against production. Production changes go through Flux only.
+**Never run `tofu` directly.** Never `kubectl apply` against production. Production changes go through Flux only. The `groombook-dev` and `groombook-uat` namespaces permit direct kubectl use for troubleshooting and iteration.
 
 ## Tools (canonical, not alternatives)
 
@@ -174,12 +131,10 @@ These are the only acceptable choices — alternatives are policy violations:
 * **Database:** CloudNativePG Operator (Postgres) — no SQLite, MariaDB, or MySQL.
 * **Cache / pub-sub:** DragonflyDB Operator — no Redis.
 * **Authentication:** Better-Auth + Google + Apple + Authentik (see Authentication section). Never build custom auth.
-* **Dependency updates:** Mend Renovate. **Dependabot is not used and will not be used.**
+* **Dependency updates:** Mend Renovate. **Dependabot is not used and will not be used.** Do not configure it.
-* **Container registry:** `ghcr.io/groombook/<service>` — no Docker Hub for first-party images.
+* **Container registry:** `git.farh.net/groombook/<service>` — no Docker Hub for first-party images.
-
+* **Browser automation:** the `playwright` MCP server (`http://playwright:8931/mcp`). Target dev only — never test production.
-If a task requires deviating from any of the above, treat it as a destructive action: stop, file an issue with rationale, request board approval.
 
 ## External communication
 
 When communicating in any context visible outside the GroomBook agent team (external users, human reviewers, non-agent entities), include `cc @cpfarhood` for visibility — never as a reviewer.
-