# Agent notes

This repository holds one Ansible playbook per service. Read
[CODING_STANDARDS.md](CODING_STANDARDS.md) before adding or changing a playbook.

- Checks: run `./scripts/check.sh`. Add `--changed` while iterating to lint only
  the YAML files that differ from HEAD. CI runs the full script.
- Review baseline: `origin/main`. The review diff is `git diff origin/main...HEAD`.
- Migration spec: [docs/podman-migration.md](docs/podman-migration.md). Section 8
  lists the repo changes the migration expects.
- Issue tracker: [docs/agents/issue-tracker.md](docs/agents/issue-tracker.md).
- Scratch files: write them under `.scratch/`. It is git-ignored, and `/tmp` is
  wiped between tool calls in this environment.
- Read-only `$HOME`: if `$HOME` is read-only, point `XDG_CACHE_HOME`,
  `UV_CACHE_DIR`, `PIP_CACHE_DIR`, and `ANSIBLE_HOME` under `.scratch/`. The check
  script already does this, and a vault password file has to live there too.
- Secrets: `vars/default.yml` holds deploy values, including passwords. gitleaks
  runs before each commit and in CI. Known values are in
  [.gitleaks-baseline.json](.gitleaks-baseline.json); rotate or vault a value
  instead of adding a new entry.