added repo

2026-08-26 04:03:34 +05:30
parent 2389ec1fd6
commit 1055e1394f
150 changed files with 12395 additions and 0 deletions
@@ -0,0 +1,60 @@
+# Escalation Matrix — `devops-infra-argo-config`
+
+> When an agent or human hits a boundary, blocker, or incident in this repo, use this matrix to determine who to contact and how fast.
+>
+> **Audience:** Agents (to know when to halt and hand off), on-call humans (to know who owns what).
+>
+> Per [AI Blitz Plan §5.2](AGENT_BOUNDARIES.md). Layer: **1-T**.
+
+---
+
+## Escalation triggers
+
+| Situation | Urgency | Who | How |
+| --------- | ------- | --- | --- |
+| Agent would need to edit `repository.yaml` | Non-urgent | Platform team | Slack `#devops-tech` — this is automation-owned |
+| Agent would need to push to `main`/`develop`/`pre-prod` directly | Non-urgent | Platform team | Open PR instead; if truly urgent, page on-call |
+| `generic-argo-apps-chart/` change needed | Non-urgent | Platform team senior review | PR + explicit sign-off from two platform team members |
+| Helm render failure after PR merge, tools broken | **Urgent** | On-call platform engineer | PagerDuty `Devops` + Slack `#devops-tech` |
+| ArgoCD sync stuck on a cluster > 10 minutes | **Urgent** | On-call platform engineer | PagerDuty `Devops` + Slack `#devops-tech` |
+| Accidental secret committed to git | **Critical** | Platform team lead + security | Slack `#devops-tech` immediately; do NOT merge; requires history purge |
+| Incubator file deleted, cluster tooling orphaned | **Critical** | On-call platform engineer | PagerDuty `Devops` + Slack `#devops-tech` — restore file immediately |
+| `clusterSpec.destination.name` changed to wrong cluster | **Critical** | On-call platform engineer | Revert PR immediately; tools may be deploying to wrong cluster |
+| `teamSpec.source.repoURL` changed | **Critical** | On-call platform engineer | Revert PR immediately; all cluster tools affected |
+| AppProject (`sre`/`sec`) modified | **Urgent** | Platform team + security | Security review required before merge |
+| Pre-commit hooks consistently failing on valid YAML | Non-urgent | Platform team | Slack `#devops-tech` — may be hook version issue |
+| Cluster decommission requested | Non-urgent | Platform team + cluster owner | Coordinated removal: incubator + values files + helm-overrides cleanup |
+
+---
+
+## Urgency definitions
+
+| Level | Meaning | Response time |
+| ----- | ------- | ------------- |
+| **Critical** | Production tooling broken or security incident | Page immediately; respond in < 15 min |
+| **Urgent** | Cluster sync stuck, tools not deploying | Page if outside business hours; Slack if in-hours; respond in < 1 hour |
+| **Non-urgent** | Question, blocked agent, process clarification | Slack message; respond in same business day |
+
+---
+
+## Contact channels
+
+| Channel | Purpose |
+| ------- | ------- |
+| Slack `#devops-tech` | Day-to-day questions, production incidents, and security-sensitive issues (secret exposure, AppProject changes) |
+| PagerDuty `Devops` | On-call page for critical/urgent issues outside business hours |
+
+---
+
+## Agent halt protocol
+
+When an agent reaches a Layer 3 boundary or an unresolvable blocker:
+
+1. **Stop** — do not attempt a workaround.
+2. **State** what operation was attempted and why it's blocked (cite rule from [SANCTITY_RULES.md](SANCTITY_RULES.md) or [AGENT_BOUNDARIES.md](AGENT_BOUNDARIES.md)).
+3. **Recommend** the correct human path (e.g., "Open a PR targeting platform team review" or "Page on-call via PagerDuty").
+4. **Do not retry** the blocked operation with slightly different parameters.
+
+Example halt message:
+
+> Blocked by R5 (SANCTITY_RULES.md): `repository.yaml` is owned by `registry-bootstrap` automation and must not be hand-edited. To change ownership metadata, the request must go to the upstream automation team via Slack `#devops-tech`.