0aee2c0981
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
1.6 KiB
Markdown
21 lines
1.6 KiB
Markdown
# Environment Quarantine Operations
|
|
|
|
Legacy `<name>.env` is input evidence, never current launch authority. Projection preparation classifies it deterministically:
|
|
|
|
- generated roster keys → discard and regenerate;
|
|
- allowed strict local keys → relocate to private `.env.local`;
|
|
- malformed, duplicate, unknown, sensitive-looking, shell-bearing, unsafe, or command-override entries → move the legacy input to private `.env.quarantine`.
|
|
|
|
## Safe response
|
|
|
|
1. Stop and read the stable error code and reported key name/hash. Do not request or paste the value.
|
|
2. Confirm the canonical roster contains the intended non-sensitive desired state.
|
|
3. If the key is an allowed local machine-data field, place only its validated data form in `.env.local` under private permissions.
|
|
4. Remove unsupported intent rather than translating it into commands, channels, secret references, or unknown `MOSAIC_AGENT_*` keys.
|
|
5. Regenerate `.env.generated` from the roster and rerun a dry-run/verification gate.
|
|
6. Retain quarantine evidence privately until the operator's normal retention process permits removal.
|
|
|
|
The launcher never reads quarantine. Public/JSON diagnostics expose stable code, key name where safe, and SHA-256 only—never a legacy sensitive value, credential, rejected command, or full line. Quarantine does not prove remediation, backup, migration, or rollback.
|
|
|
|
See [generated launch chain](../concepts/generated-env-launch-chain.md), [generated environment boundary](../reference/generated-env-boundary.md), and [migration field disposition](../migration/v1-to-v2.md#field-disposition).
|