Skip to content

chore: drop cross-product pattern references from shipped content #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
capotej merged 1 commit into from
Aug 30, 2026
Merged

chore: drop cross-product pattern references from shipped content #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions template/.agents/skills/setup-dispatch/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,8 @@ service whose `DesiredCount` is a parameter (default `1`); the setup skill
passes `0` on the first deploy — before the SSM secrets exist and the aws_ssm
plugin is installed and configured (Phase 5) — then scales to 1. Secrets are **not**
owned by the stack — they live in SSM Parameter Store as namespaced
SecureStrings that the user writes in Phase 3. This is the piranesi pattern: it
keeps secrets out of template diffs and lets them survive stack deletes.
SecureStrings that the user writes in Phase 3. This keeps
secrets out of template diffs and lets them survive stack deletes.

## Prerequisites

Expand Down Expand Up @@ -815,8 +815,8 @@ Report to the user:
layout works directly via host bind-mounts on the EBS volume — no custom
`Dockerfile` or `entrypoint.sh` is needed. Do not build a derived image.

- **Secrets live in SSM, not Secrets Manager.** Following the piranesi pattern,
secrets are namespaced SecureString parameters (`/dispatch/KEY`) that the user
- **Secrets live in SSM, not Secrets Manager.**
Secrets are namespaced SecureString parameters (`/dispatch/KEY`) that the user
writes. The `/dispatch/` namespace is hardcoded in the template so the
deployer IAM policy can pin `parameter/dispatch/*`. They are not
CloudFormation resources, so stack updates never clobber their values and
Expand Down
6 changes: 3 additions & 3 deletions template/.agents/skills/setup-dispatch/template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,14 +263,14 @@ Resources:
TargetKeyId: !Ref SsmKmsKey

# ── Secrets are NOT CloudFormation resources ──────────────────────────────
# Following the piranesi pattern, secrets live in SSM Parameter Store as
# Secrets live in SSM Parameter Store as
# namespaced SecureString parameters (e.g. /dispatch/OPENROUTER_API_KEY) that
# the USER writes in a skill phase (Phase 2) before the service scales up.
# They are not owned by this stack, so they survive stack deletes and stack
# updates never clobber their values.
#
# Secrets live as SSM SecureString parameters under /dispatch/ (the piranesi
# pattern) and are NOT CloudFormation resources, so they survive stack
# Secrets live as SSM SecureString parameters under /dispatch/ and are NOT
# CloudFormation resources, so they survive stack
# updates/deletes. They reach the container two ways:
#
# 1. aws_ssm secret-source plugin (hermes-aws-ssm-secret-source) — resolves
Expand Down
2 changes: 1 addition & 1 deletion template/AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ You can use web-search-prime to look things up that aren't obvious in the reposi
replacement. SQLite's WAL mode needs a real local block device (it is unsafe
on NFS), which is the reason state is on EBS.
- Secrets are **SSM SecureString** parameters under the claw's `/dispatch/KEY`
namespace, written by the user in setup Phase 3 (piranesi pattern). Not
namespace, written by the user in setup Phase 3. Not
stack-owned, so they survive stack updates/deletes. A Hermes secret-source
plugin (`aws_ssm`, installed in setup Phase 5) resolves every `/dispatch/*`
parameter into the gateway env at startup, using the TaskRole's SSM-read
Expand Down