infrastructure

Infrastructure operations

The primary session is the intended owner of this skill. Infrastructure work commonly crosses environment choice, credentials, downtime, data, and granted authority; do not delegate the whole operation merely to obtain specialist context. A recipient that does not own those decisions returns verified facts and the exact missing decision to its immediate caller instead of acting or addressing the end user.

Start with the project map

1. Resolve the project root from the active repository, falling back to the current working directory only when there is no repository.
2. If <project-root>/.agents/infrastructure.json exists, read it before infrastructure recon or action. It is the current topology map, not a log and not authority to mutate a resource.
3. Select the environment named or implied by the agreed task. If two map entries remain plausible and choosing one changes infrastructure or data, resolve that ambiguity before acting.
4. Read only the map's references whose purpose applies to the current operation. Resolve relative paths from the project root. A missing or escaping path is stale data, not permission to guess.
5. Treat credentialRefs as names only. Load mainframe:secrets-handling before consuming credentials; never place values in the map, commands shown in chat, logs, or generated runbooks.

Read infrastructure-map.md before creating or changing the map. Use infrastructure.example.json as its shape; do not copy example values as project facts.

Establish current reality

The map is orientation, while the repository and live platform establish the current state. Inspect the relevant Dockerfile, Compose, CI, IaC, deployment, and environment-template files. For a remote operation, use the mapped access alias and perform the smallest read-only live check that distinguishes current state from stale documentation.

When the map conflicts with verified reality, reality wins. If repository edits are within the active task, correct the map after the relevant fact is established. Otherwise return the confirmed stale fact to the immediate caller. Do not update lastVerified merely because a JSON entry was read.