@miller-tech/uap 1.130.0 → 1.130.2

package/docs/guides/POLICY_PACK_PAY2U.md

@@ -0,0 +1,36 @@
+# pay2u Policy Pack
+
+A selectable, example policy pack ported from the pay2u project
+(`~/dev/miller-tech/pay2u/policies/`, originally extracted from its `AGENTS.md`
+during `uap setup`). It bundles three project-shaped policies that demonstrate
+the "custom architecture / reference" policy type — load-bearing invariants,
+cluster reference cards, and an enforcement-hooks summary.
+
+These are **advisory** policies (`RECOMMENDED`, no Python enforcer): they are
+surfaced to the agent as reviewable rules and shown in the policy matrix /
+`uap policy list`, but they do not hard-block tool calls. They are opt-in — not
+part of the default policy set — so ordinary projects aren't burdened with
+pay2u-specific content. Select the pack during `uap setup` (policy matrix →
+"pay2u policy pack") or install individually with `uap policy install <name>`.
+
+## Contents
+
+| Policy | Category | What it captures |
+|---|---|---|
+| `pay2u-architecture-rules` | architecture | The non-negotiable, ADR-indexed invariants (COOKIE-ONLY, ZITADEL-IDP, OO-UNIFIED, PIPELINE-ONLY, THREE-CLUSTERS). An edit that would violate one must STOP and surface the conflict against the referenced ADR rather than silently working around it. |
+| `pay2u-quick-reference` | reference | Cluster cheat-sheets (MAIN / OPENOBSERVE / ZITADEL — purpose, URLs, node sizing, TLS challenge type) and the 3-phase Istio cluster-recreation procedure. Fast orientation for infra work. |
+| `pay2u-enforcement-hooks` | process | The inventory of installed enforcement hooks (policy-gate, pre/post tool-use, compaction, stop, session-end) and how gating differs per harness (hard for MCP-routed tools, advisory for Codex-native edit/bash). |
+
+## Using the pack
+
+- **During setup:** `uap setup` → enable the policy engine → check **"pay2u policy pack"** in the policy matrix. All three install and enable together.
+- **Individually:** `uap policy install pay2u-architecture-rules` (etc.).
+- **Manage:** `uap policy matrix` lists every policy (built-in + pack + installed) with its status/level/stage; adjust with `uap policy toggle|enable|disable|level|stage <id>`.
+
+## Adapting for your own project
+
+This pack is intentionally pay2u-specific to serve as a worked example. To make
+your own architecture pack, copy these files, replace the invariants / cluster
+cards / hook list with yours, keep the `**Category**` / `**Level**` /
+`**Enforcement Stage**` / `**Tags**` frontmatter, and either drop them in your
+project's `./policies/` (custom policies dir) or add them here as a new pack.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.130.0",
+  "version": "1.130.2",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/schemas/policies/adr-guard.md

@@ -1,6 +1,6 @@
 # adr-guard
 
-**Category**: architecture
+**Category**: safety
 **Level**: RECOMMENDED
 **Enforcement Stage**: pre-exec
 **Tags**: adr, architecture, invariants, write-gate

package/src/policies/schemas/policies/merge-deploy-monitor-verify.md

@@ -2,7 +2,7 @@
 
 **ID**: `policy-merge-deploy-monitor-verify`
 **Name**: Merge, Deploy, Monitor, Verify Before Done
-**Category**: completion
+**Category**: release
 **Level**: REQUIRED
 **Enforcement Stage**: review
 **Version**: 1.0

package/src/policies/schemas/policies/pay2u-architecture-rules.md

@@ -0,0 +1,29 @@
+# pay2u-architecture-rules
+
+**Category**: safety
+**Level**: RECOMMENDED
+**Enforcement Stage**: pre-exec
+**Tags**: pay2u, architecture, adr, invariants, example-pack
+
+## Rule
+
+These are load-bearing. If an edit would violate one of them, STOP and
+surface the conflict — do not silently work around it.
+
+| Rule ID        | Invariant                                                                  | ADR        |
+| ---------------- | ---------------------------------------------------------------------------- | ------------ |
+| COOKIE-ONLY | Bearer tokens stay inside the cluster. FE holds only the httpOnly cookie. | ADR-0007 |
+| ZITADEL-IDP | Zitadel is the sole OIDC provider. No second IdP without ADR update. | ADR-0004 |
+| OO-UNIFIED | Unified observability plane — no parallel stacks. | ADR-0005 |
+| PIPELINE-ONLY | Infrastructure changes only via pipeline (no manual prod edits). | ADR-0006 |
+| THREE-CLUSTERS | Three independent cluster concerns must stay independent. | ADR-001 + contracts/critical_clusters.rego |
+
+Full ADR index: `docs/adr/`. UAP policies enforce these at tool-call time
+(see `agents/data/memory/policies.db`); when a policy blocks a call, read
+the relevant ADR first, then adjust the plan.
+
+---
+
+## Why
+
+Extracted from AGENTS.md during `uap setup` — a project-specific rule promoted to a reviewable UAP policy.

package/src/policies/schemas/policies/pay2u-enforcement-hooks.md

@@ -0,0 +1,29 @@
+# pay2u-enforcement-hooks
+
+**Category**: workflow
+**Level**: RECOMMENDED
+**Enforcement Stage**: pre-exec
+**Tags**: pay2u, hooks, enforcement, example-pack
+
+## Rule
+
+The following enforcement hooks are installed and run automatically:
+
+- **uap-policy-gate.sh** - DB-driven policy gate (policies.db + .policy-tools/*.py)
+- **pre-tool-use-edit-write.sh** - Blocks edits outside worktree directories
+- **pre-tool-use-bash.sh** - Blocks dangerous commands (force push, terraform apply, etc)
+- **post-tool-use-edit-write.sh** - Runs build gate + backup reminder after edits
+- **post-compact.sh** - Re-injects policy awareness after context compaction
+- **stop.sh** - Completion gate checklist + session cleanup
+- **session-end.sh** - Agent deregistration + backup retention
+
+> **Gating note (Codex):** Codex CLI has no native pre-tool-use *hook event*,
+> so it cannot auto-run these scripts before every tool the way Claude Code does.
+> Policy gating is enforced two ways: (1) **hard** for tools routed through the
+> UAP MCP server (`[mcp_servers.uap]` below) — `execute_tool` runs the PolicyGate;
+> (2) **advisory** for Codex-native edit/bash — run `bash .codex/hooks/uap-policy-gate.sh`
+> per the lifecycle above. `uap hooks doctor` reports Codex as MCP-gated.
+
+## Why
+
+Extracted from AGENTS.md during `uap setup` — a project-specific rule promoted to a reviewable UAP policy.

package/src/policies/schemas/policies/pay2u-quick-reference.md

@@ -0,0 +1,89 @@
+# pay2u-quick-reference
+
+**Category**: custom
+**Level**: RECOMMENDED
+**Enforcement Stage**: pre-exec
+**Tags**: pay2u, reference, clusters, example-pack
+
+## Rule
+
+### Cluster Cheat Sheet
+
+```text
+MAIN (do-syd1-pay2u)
+  Purpose: Applications (API, Web, CMS)
+  URL: https://app.pay2u.com.au
+  Nodes: 3x s-4vcpu-8gb-amd
+  TLS: HTTP-01 challenges OK
+
+OPENOBSERVE (do-syd1-pay2u-openobserve)
+  Purpose: ALL Observability (logs, metrics, traces)
+  URL: https://observe.pay2u.com.au
+  Nodes: 3x s-2vcpu-8gb-amd
+  TLS: DNS-01 challenges ONLY (Istio, no nginx)
+
+ZITADEL (do-syd1-zitadel)
+  Purpose: ALL Authentication (Zitadel IAM)
+  URL: https://auth.pay2u.com.au
+  Nodes: 3x s-2vcpu-4gb-amd
+  TLS: DNS-01 challenges ONLY (Istio, no nginx)
+```
+
+### Cluster Recreation
+
+See: `docs/architecture/CLUSTER_RECREATION_GUIDE.md`
+
+**3-Phase Deployment** (for Istio clusters):
+
+1. Phase 1: Create cluster (`enable_*_cluster=true`, other flags `false`)
+2. Phase 2: Deploy Istio + cert-manager (`enable_*=true`, gateway `false`)
+3. Phase 3: Enable Gateway/VirtualService (`enable_*_istio_gateway=true`)
+
+**NEVER use nginx ingress** - Istio handles all ingress via Gateway resources.
+
+### Key Workflows
+
+```text
+cd-frontend-multicloud.yml  # Frontend
+cd-products-api.yml         # Backend API
+iac-terraform-cicd.yml      # Infrastructure
+security-unified.yml        # Security scans
+```
+
+### Database Stack
+
+```text
+PostgreSQL: CNPG with pgEdge + Spock 5.0.4
+Pooler: PgDog v0.1.32 (replaced PgCat Dec 2025)
+HA: 2 instances per cluster (n+1)
+```
+
+### IaC Exceptions (Intentionally NOT in Terraform)
+
+```text
+OPERATOR-MANAGED (auto-generated, do not import):
+  - CNPG secrets: *-app, *-ca, *-replication, *-server, *-superuser
+  - CNPG services: *-r, *-ro, *-rw (managed by CNPG operator)
+  - Redis ConfigMaps: redis-configuration, redis-health, redis-scripts
+  - CNPG monitoring: cnpg-default-monitoring ConfigMap
+
+EPHEMERAL (created by CI jobs, cleaned up automatically):
+  - k6 network policies: allow-k6-*-egress, allow-k6-*-to-api
+  - ACME solver: cm-acme-http-solver-* pods/services
+
+SYSTEM (Kubernetes-managed, never import):
+  - kube-node-lease, kube-public namespaces
+  - default ServiceAccount tokens
+```
+
+---
+
+**See CLAUDE.md for detailed architecture, configuration, and troubleshooting.**
+
+</coding_guidelines>
+
+# AGENTS.md - UAP Integration for Codex CLI
+
+## Why
+
+Extracted from AGENTS.md during `uap setup` — a project-specific rule promoted to a reviewable UAP policy.

package/src/policies/schemas/policies/ship-loop-gate.md

@@ -1,6 +1,6 @@
 # ship-loop-gate
 
-**Category**: process
+**Category**: workflow
 **Level**: REQUIRED
 **Enforcement Stage**: pre-exec
 **Tags**: ship-loop, task, completion, evidence, merge-deploy-monitor-verify