Agents were assuming the org infra repo is what Flux watches directly.
The actual flow is: org/infra → cpfarhood/kubernetes (Flux watches this).
New policy explains:
- Existing resources: commit to org infra repo, Flux picks it up
- New resources (namespaces, kustomizations, secrets): also needs
a cpfarhood/kubernetes change — escalate to the board
- Never assume committing to org infra repo is always sufficient
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Each org now has a -dev namespace where agents can freely use kubectl
for testing and iteration. Production namespaces remain Flux-only.
Access model:
- Cluster-wide: read-only
- Production namespace: read-write (Flux-managed, no manual kubectl)
- Dev namespace: read-write (agents may use kubectl freely)
Co-Authored-By: Paperclip <noreply@paperclip.ing>
All infra changes go through the infra repo and Flux reconciliation.
No manual kubectl apply, no direct cluster modifications.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Provides every agent with the exact API calls for creating assigned
issues and reassigning existing ones. Includes curl examples with
assigneeAgentId, parentId, and run ID headers.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Updated across all POLICIES.md and SOUL.md files in all orgs.
Merging is a step in the process, not the finish line.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Chris Farhood