scripts

Imported from generic-automation-and-it/smooth-ai-product-context-memory (scripts/AGENTS.md). Install upstream with npx skills add generic-automation-and-it/smooth-ai-product-context-memory --skill scripts. Copyright stays with the author.

AGENTS.md - Operational Scripts

TL;DR

Operational checks support operator decisions; a preflight must never repair the corpus it inspects.

Non-Negotiables

• Ticket ownership preflight is read-only, including against the default dev database. Never weaken the migration's duplicate guard or choose a keeper automatically.
• Exact provider/key and group UUID reports are sensitive operational output, not application logging. Never send them to telemetry, CI artifacts, or commits; credentials stay inside the container.
• API smoke credentials are generated per run, passed through environment variables, used only in Authorization headers, and never printed or committed.
• Verification uses a newly created isolated fixture, never the default corpus or a schema cloned from it. Cleanup may remove only resources created by that test invocation.
• Do not turn the manual remediation runbook into an automated destructive cleanup script. Membership ownership is an operator decision; preserving memories does not preserve ticket-based discoverability.

Key Behaviors

• release_policy.py permits publication only for push on refs/heads/main. PRs, tag pushes, releases, and manual dispatch fail closed. Candidates include source SHA/run/attempt; stale main builds cannot promote latest. No version-tag or GitHub Release creation path remains.
• A clean snapshot is not a reservation: writers must remain stopped from the final precheck through migration. Host startup applies migrations, so checking after startup is too late.
• Same-group repeated memberships are not cross-group ownership conflicts. Malformed containers or identity types block preflight even though some live reads treat them as absent; silently skipping them would claim migration readiness without establishing it.
• The checker needs only public.memory_group, not AGE or the ticket migration. The ticket migration runbook targets legacy data before graph backfill; it refuses installed/partially installed ticket graph objects.

Test References

• Release policy: python3 scripts/test_release_policy.py; negative event/ref matrix, fail-closed identity, and stale-main alias tests. Runs in the PR gate's "Test release policy" step.
• Operational harness: python3 scripts/tests/test_ticket_ownership.py; mocked Docker transport checks require no daemon.
• Real PostgreSQL checks: python3 scripts/tests/test_ticket_ownership.py --postgres; disposable pinned AGE container, synthetic pre-migration table only, no published ports or corpus access. Not part of the .NET suite.
• 2026-09-15 verification: 14 tests passed (transport, read-only enforcement, exact/malformed ownership, runbook rollback/commit/stale-input guards and partial-graph refusal); Dockerized ShellCheck (koalaman/shellcheck:v0.11.0, read-only mount, network disabled) and Bash syntax checks passed. This does not establish whole-migration or application-suite acceptance.

Changelog