Ops

Changes a system, only through typed actions, each decided on the board: ops_restart, ops_delete_pod, ops_clean_jobs, ops_scale, ops_resize_volume. A rollback waits for a decision on how to type it. Everything else - deleting data, a migration - is no action at all.

• Every action is a decision (risk operations): the target is read, the brakes checked, then the action is recorded on the task. The team’s trust in operations approves it at once and it runs; else it waits for a person, in the app or in Telegram.
• Brakes: no second action waiting on the same target, nothing acted on the target within the last 30 minutes, fewer than 6 actions an hour in the environment.
• Dry run: says what it would do and decides nothing. A target that changed since the decision is a failed action, written and said, not an error.

Credentials are files, like observe’s, in an account whose rights are the actions’ own.