What changed, and why
The last workload leaves the cluster. This PR carries the infra half of Everwhen's move to Vercel: the DNS flip, the retirement of infra/k8s/everwhen, and the point where the docs admit what the cluster has become, which is plumbing with nothing left to plumb. CLAUDE.md now calls it a decommission candidate in so many words. Actually decommissioning is a separate decision, and this PR deliberately does not make it.
The app half is mseeks/everwhen#356 (Dockerfile out, CI slimmed, Sentry server init moved to serverless injection). Terraform's footprint stays what it has been through all four migrations: the DNS zone it already owned. No vercel provider. No token.
dns.tf: apex in place, www replaced, redirect moved
Mechanically this is the 2ls.tech flip again. The apex stays an A record. Re-pointing it is an in-place update, no gap, since a CNAME is illegal at a zone apex and Vercel hands out an anycast address for exactly that case. www changes type, and a type change forces replacement. The www 301 needs a new home too. A dedicated everwhen-www-redirect Ingress used to serve it on the cluster; after the flip, the dashboard's domain-redirect setting serves it from Vercel's edge instead.
The rewritten zone tail: one comment block, the apex A, the www CNAME. Mail records above are untouched.
infra/dns.tf · 367 lines
infra/dns.tf
⋯ 337 lines hidden (lines 1–337)
1# DNS — reverse-engineered from the live DigitalOcean zones and imported into
2# state (target: `terraform plan` reports no changes).
3#
4# SOA and the default DigitalOcean NS records (ns1/2/3.digitalocean.com) are
5# managed automatically by DO and are intentionally NOT declared here.
6#
7# Every zone here is an iCloud Custom Email Domain (Apple) setup: MX -> icloud
8# mail, an SPF TXT, an apple-domain verification TXT, and a DKIM CNAME.
9# (mseeks.me additionally carries the zo-k8s load-balancer A records below.)
10#
11# SPF quoting gotcha: write SPF TXT values WITHOUT surrounding quotes (e.g.
12# `v=spf1 include:icloud.com ~all`). DigitalOcean adds the DNS wire quotes on
13# its own, so escaping quotes into the value makes `terraform apply` CREATE a
14# doubly-quoted record (`""v=spf1 ...""`) that SPF verifiers reject. `plan`
15# won't warn you: the provider compares TXT values quote-insensitively, so even
16# a broken live record shows no drift. The mseeks.me / msull92.com SPF entries
17# still carry escaped quotes but resolve clean (created pre-terraform); left
18# as-is because recreating them from the quoted value would re-break them.
19# playeverwhen.com and 2ls.tech below use the correct unquoted form.
21# ============================== mseeks.me ==============================
23resource "digitalocean_domain" "mseeks_me" {
24 name = "mseeks.me"
25}
27resource "digitalocean_record" "mseeks_me_mx_01" {
28 domain = digitalocean_domain.mseeks_me.name
29 type = "MX"
30 name = "@"
31 value = "mx01.mail.icloud.com."
32 priority = 10
33 ttl = 14400
34}
36resource "digitalocean_record" "mseeks_me_mx_02" {
37 domain = digitalocean_domain.mseeks_me.name
38 type = "MX"
39 name = "@"
40 value = "mx02.mail.icloud.com."
41 priority = 10
42 ttl = 14400
43}
45resource "digitalocean_record" "mseeks_me_apple_domain" {
46 domain = digitalocean_domain.mseeks_me.name
47 type = "TXT"
48 name = "@"
49 value = "apple-domain=Y94Tzo0dJVhRhQxf"
50 ttl = 3600
51}
53resource "digitalocean_record" "mseeks_me_spf" {
54 domain = digitalocean_domain.mseeks_me.name
55 type = "TXT"
56 name = "@"
57 value = "\"v=spf1 include:icloud.com ~all\""
58 ttl = 3600
59}
61resource "digitalocean_record" "mseeks_me_dkim" {
62 domain = digitalocean_domain.mseeks_me.name
63 type = "CNAME"
64 name = "sig1._domainkey"
65 value = "sig1.dkim.mseeks.me.at.icloudmailadmin.com."
66 ttl = 43200
67}
69# ynab.mseeks.me -> the zo-k8s ingress Load Balancer. The LB itself is owned by
70# the DigitalOcean CCM (via the ingress-nginx Service, see infra/k8s/ingress-nginx);
71# Terraform only READS it through data.digitalocean_loadbalancer.ingress
72# (loadbalancer.tf) to keep this record's IP in sync automatically.
73#
74# LOAD-BEARING — keep it. This is the LB's advertised hostname
75# (do-loadbalancer-hostname in infra/k8s/ingress-nginx/values.yaml). DO LBs don't
76# hairpin, so cert-manager's HTTP-01 self-check for any host on the LB
77# resolves this name out via DNS and back in. No app Ingress remains today
78# (the last, everwhen's, moved to Vercel in July 2026), but the mechanism
79# matters again the moment one returns — keep the record for as long as the
80# cluster and its LB exist.
81resource "digitalocean_record" "mseeks_me_ynab" {
82 domain = digitalocean_domain.mseeks_me.name
83 type = "A"
84 name = "ynab"
85 # Sourced from the live LB; if the LB is recreated (new IP), a plain
86 # `terraform apply` re-points this record — no hardcoded address to chase.
87 value = data.digitalocean_loadbalancer.ingress.ip
88 # Short TTL: this points at a DO LB whose IP can change if the LB is recreated,
89 # so keep resolver caches from pinning a stale address for long.
90 ttl = 300
91}
93# glassbox.mseeks.me -> Vercel. Glassbox is hosted on Vercel, not the cluster:
94# the project + custom domain are managed in the Vercel dashboard and deploys
95# ride its GitHub integration (push to main in mseeks/glassbox), so the only
96# infra Terraform owns is this record. Vercel terminates TLS at its edge — no
97# cert-manager involvement. The value is this project's own CNAME target, the
98# one the dashboard issued when glassbox.mseeks.me was added to the project
99# (Vercel mints per-project targets; the old universal cname.vercel-dns.com is
100# legacy). If the Vercel project is ever deleted and recreated, it gets a new
101# target — read the fresh value off the project's Domains tab, and only
102# re-point this record once the domain is attached there (flipped early, the
103# host serves Vercel's DEPLOYMENT_NOT_FOUND page).
104resource "digitalocean_record" "mseeks_me_glassbox" {
105 domain = digitalocean_domain.mseeks_me.name
106 type = "CNAME"
107 name = "glassbox"
108 value = "e24be5a7fd9d016f.vercel-dns-017.com."
109 # Unlike the LB A records above, the target here is stable for the life of
110 # the Vercel project, so no short-TTL churn guard is needed.
111 ttl = 3600
112}
114# static.mseeks.me -> Vercel. The `static` drop-and-share site is hosted on
115# Vercel, not the cluster: the project + domain are managed in the Vercel
116# dashboard and deploys ride its GitHub integration — a push to main in
117# mseeks/static deploys, which is also how read-thru guides publish (see
118# CLAUDE.md). Vercel terminates TLS at its edge, no cert-manager. The value
119# is this project's own CNAME target, issued by the dashboard when the domain
120# was added (per-project targets; the old universal cname.vercel-dns.com is
121# legacy). If the Vercel project is ever deleted and recreated it gets a new
122# target — read it off the project's Domains tab, and only re-point this
123# record once the domain is attached there.
124resource "digitalocean_record" "mseeks_me_static" {
125 domain = digitalocean_domain.mseeks_me.name
126 type = "CNAME"
127 name = "static"
128 value = "a4cfcb8c32267377.vercel-dns-017.com."
129 # Stable Vercel target (unlike the LB IP this used to track), so no
130 # short-TTL churn guard is needed.
131 ttl = 3600
132}
134# ============================== msull92.com ==============================
136resource "digitalocean_domain" "msull92_com" {
137 name = "msull92.com"
138}
140resource "digitalocean_record" "msull92_com_mx_01" {
141 domain = digitalocean_domain.msull92_com.name
142 type = "MX"
143 name = "@"
144 value = "mx01.mail.icloud.com."
145 priority = 10
146 ttl = 14400
147}
149resource "digitalocean_record" "msull92_com_mx_02" {
150 domain = digitalocean_domain.msull92_com.name
151 type = "MX"
152 name = "@"
153 value = "mx02.mail.icloud.com."
154 priority = 10
155 ttl = 14400
156}
158resource "digitalocean_record" "msull92_com_apple_domain" {
159 domain = digitalocean_domain.msull92_com.name
160 type = "TXT"
161 name = "@"
162 value = "apple-domain=SLKQpEYsouHgb3mI"
163 ttl = 3600
164}
166resource "digitalocean_record" "msull92_com_spf" {
167 domain = digitalocean_domain.msull92_com.name
168 type = "TXT"
169 name = "@"
170 value = "\"v=spf1 include:icloud.com ~all\""
171 ttl = 3600
172}
174resource "digitalocean_record" "msull92_com_dkim" {
175 domain = digitalocean_domain.msull92_com.name
176 type = "CNAME"
177 name = "sig1._domainkey"
178 value = "sig1.dkim.msull92.com.at.icloudmailadmin.com."
179 ttl = 43200
180}
182# ============================== 2ls.tech ==============================
183# HCL resource names can't start with a digit, so these use a `_2ls_tech`
184# prefix (a leading underscore is valid) rather than the plain `2ls_tech`
185# the mseeks_me/msull92_com convention would suggest.
187resource "digitalocean_domain" "_2ls_tech" {
188 name = "2ls.tech"
189}
191resource "digitalocean_record" "_2ls_tech_mx_01" {
192 domain = digitalocean_domain._2ls_tech.name
193 type = "MX"
194 name = "@"
195 value = "mx01.mail.icloud.com."
196 priority = 10
197 ttl = 14400
198}
200resource "digitalocean_record" "_2ls_tech_mx_02" {
201 domain = digitalocean_domain._2ls_tech.name
202 type = "MX"
203 name = "@"
204 value = "mx02.mail.icloud.com."
205 priority = 10
206 ttl = 14400
207}
209resource "digitalocean_record" "_2ls_tech_apple_domain" {
210 domain = digitalocean_domain._2ls_tech.name
211 type = "TXT"
212 name = "@"
213 value = "apple-domain=KAYDndJUw5TrEwCe"
214 ttl = 3600
215}
217# Google Search Console domain verification (TXT at the apex). Value UNQUOTED
218# like the apple-domain record above — DigitalOcean adds the DNS wire quotes
219# itself (see the SPF quoting gotcha at the top of this file).
220resource "digitalocean_record" "_2ls_tech_google_site_verification" {
221 domain = digitalocean_domain._2ls_tech.name
222 type = "TXT"
223 name = "@"
224 value = "google-site-verification=9e1Dm56-fdkP2jTv1pGNI5II2ol0pR6Xtw8RtS1gXwM"
225 ttl = 3600
226}
228# SPF value UNQUOTED on purpose — see the SPF quoting gotcha at the top of this
229# file. Recreated once (terraform apply -replace) to strip the doubly-quoted
230# `""v=spf1 ...""` the original escaped-quote value produced on create.
231resource "digitalocean_record" "_2ls_tech_spf" {
232 domain = digitalocean_domain._2ls_tech.name
233 type = "TXT"
234 name = "@"
235 value = "v=spf1 include:icloud.com ~all"
236 ttl = 3600
237}
239resource "digitalocean_record" "_2ls_tech_dkim" {
240 domain = digitalocean_domain._2ls_tech.name
241 type = "CNAME"
242 name = "sig1._domainkey"
243 value = "sig1.dkim.2ls.tech.at.icloudmailadmin.com."
244 ttl = 43200
245}
247# 2ls.tech (+ www) -> Vercel. The Two Ls company site is hosted on Vercel, not
248# the cluster: the project + both domains are managed in the Vercel dashboard
249# and deploys ride its GitHub integration (push to main in mseeks/2ls.tech).
250# Vercel terminates TLS at its edge (no cert-manager), serves the apex, and
251# redirects www to it. The mail/verification records above are unaffected.
252#
253# Values: both are this project's own targets, issued by the dashboard when
254# the domains were added (Vercel mints per-project values now; the universal
255# 76.76.21.21 / cname.vercel-dns.com are legacy). If the Vercel project is
256# ever deleted and recreated it gets new targets — read them off the
257# project's Domains tab, and only re-point these records once the domains
258# are attached there.
259resource "digitalocean_record" "_2ls_tech_apex" {
260 domain = digitalocean_domain._2ls_tech.name
261 type = "A"
262 name = "@"
263 value = "216.198.79.1"
264 # Stable Vercel target (unlike the LB IP this used to track), so no
265 # short-TTL churn guard is needed.
266 ttl = 3600
267}
269resource "digitalocean_record" "_2ls_tech_www" {
270 domain = digitalocean_domain._2ls_tech.name
271 type = "CNAME"
272 name = "www"
273 value = "bae588b1e31b34e9.vercel-dns-017.com."
274 ttl = 3600
275}
277# ============================== playeverwhen.com ==============================
279resource "digitalocean_domain" "playeverwhen_com" {
280 name = "playeverwhen.com"
281}
283resource "digitalocean_record" "playeverwhen_com_mx_01" {
284 domain = digitalocean_domain.playeverwhen_com.name
285 type = "MX"
286 name = "@"
287 value = "mx01.mail.icloud.com."
288 priority = 10
289 ttl = 14400
290}
292resource "digitalocean_record" "playeverwhen_com_mx_02" {
293 domain = digitalocean_domain.playeverwhen_com.name
294 type = "MX"
295 name = "@"
296 value = "mx02.mail.icloud.com."
297 priority = 10
298 ttl = 14400
299}
301resource "digitalocean_record" "playeverwhen_com_apple_domain" {
302 domain = digitalocean_domain.playeverwhen_com.name
303 type = "TXT"
304 name = "@"
305 value = "apple-domain=DEESFXkRhJ4wE6Lm"
306 ttl = 3600
307}
309# Google Search Console domain verification (TXT at the apex). Value UNQUOTED
310# like the apple-domain record above — DigitalOcean adds the DNS wire quotes
311# itself (see the SPF quoting gotcha at the top of this file).
312resource "digitalocean_record" "playeverwhen_com_google_site_verification" {
313 domain = digitalocean_domain.playeverwhen_com.name
314 type = "TXT"
315 name = "@"
316 value = "google-site-verification=1FSmsnv2MPG_mKoCrdlSABXfyXFTaeVBETNRmLNi85o"
317 ttl = 3600
318}
320# SPF value UNQUOTED on purpose — see the SPF quoting gotcha at the top of this
321# file. DigitalOcean adds the DNS wire quotes itself.
322resource "digitalocean_record" "playeverwhen_com_spf" {
323 domain = digitalocean_domain.playeverwhen_com.name
324 type = "TXT"
325 name = "@"
326 value = "v=spf1 include:icloud.com ~all"
327 ttl = 3600
328}
330resource "digitalocean_record" "playeverwhen_com_dkim" {
331 domain = digitalocean_domain.playeverwhen_com.name
332 type = "CNAME"
333 name = "sig1._domainkey"
334 value = "sig1.dkim.playeverwhen.com.at.icloudmailadmin.com."
335 ttl = 43200
336}
338# playeverwhen.com (apex + www) -> Vercel. The Everwhen SSR app is hosted on
339# Vercel, not the cluster: the project + both domains are managed in the
340# Vercel dashboard, deploys ride its GitHub integration (push to main in
341# mseeks/everwhen), server routes run as Vercel Functions, and Vercel
342# terminates TLS at its edge (no cert-manager). www redirects to the apex at
343# Vercel's edge, replacing the old everwhen-www-redirect Ingress. The iCloud
344# MX/TXT records above are unaffected.
345#
346# Values: both are this project's own targets, issued by the dashboard when
347# the domains were added (a CNAME is illegal at a zone apex, so the apex gets
348# a per-project anycast A instead). If the Vercel project is ever deleted and
349# recreated it gets new targets — read them off the project's Domains tab,
350# and only re-point these records once the domains are attached there.
351resource "digitalocean_record" "playeverwhen_com_apex" {
352 domain = digitalocean_domain.playeverwhen_com.name
353 type = "A"
354 name = "@"
355 value = "216.198.79.1"
356 # Stable Vercel target (unlike the LB IP this used to track), so no
357 # short-TTL churn guard is needed.
358 ttl = 3600
359}
361resource "digitalocean_record" "playeverwhen_com_www" {
362 domain = digitalocean_domain.playeverwhen_com.name
363 type = "CNAME"
364 name = "www"
365 value = "739dd9fe1c5c2ea6.vercel-dns-017.com."
366 ttl = 3600
367}
The stack retired: 399 lines, seven files
Seven files, 399 lines. The everwhen stack was the biggest thing on the cluster, and its census explains the extra care this round gets:
| file | what it did | replaced by |
|---|---|---|
manifests/10-deployment.yaml | two replicas of the Nitro server (RollingUpdate with maxSurge 0 for the tight node, /favicon.ico probes, 256Mi requests) plus its Service | Vercel Functions — scale, memory, and health are platform concerns now |
manifests/20-ingress.yaml | routed the apex through the DO LB with a cert-manager cert | Vercel's edge terminates TLS |
manifests/21-www-redirect.yaml | the www→apex 301 | the dashboard's domain redirect |
secrets.example.env | the production env-var inventory — the infra/.env template install.sh turned into the everwhen-secrets Secret | the same vars, set in the Vercel dashboard |
install.sh | preflight, apply, secret checks, rollout | git push — the integration deploys |
00-namespace.yaml + README.md | the namespace and its wiring story | nothing to isolate; the app README's Hosting section |
The docs stop pretending
Zero app Ingresses remain, and three docs needed to stop pretending otherwise. cert-manager's README now sends readers to git log for its worked example. ingress-nginx's README says plainly that no app routes remain. The ynab hairpin keeps its record but loses its host list; nothing depends on it today, and it becomes load-bearing again the moment any app Ingress returns. CLAUDE.md's infrastructure section ends the workload story:
The infrastructure section: cluster plumbing only, decommission candidate.
CLAUDE.md · 85 lines
CLAUDE.md
⋯ 77 lines hidden (lines 1–77)
1# Zo
3You are **Zo**, the AI assistant for this personal workspace, home to the user's projects, code, research, and writing.
5## Identity
7You are precise, direct, and low-ceremony, a craftsperson about correctness. You do exactly what's asked and say what you think plainly. Your core domains are engineering, research, and writing.
9## Many Hands Engineering (MHE)
11MHE is the framework underpinning the agentic and code-maintenance work across this workspace. Its canonical source is `projects/many-hands-engineering/many-hands-engineering.typ` (plain-text Typst source; `many-hands-engineering.pdf` is the rendered human version). Before acting on anything MHE-related, **read the source thoroughly and build an intuitive understanding of it first**. Don't pattern-match from fragments or secondhand summaries.
13## Guidelines
15- When the user expresses a lasting preference ("from now on"), update this file to reflect that preference.
16- Do exactly what's asked, and don't expand scope. Surface adjacent improvements as suggestions, not actions. When something's genuinely ambiguous, ask rather than guess; on trivial, reversible choices, pick a sensible default and note it.
17- For substantive work, **propose before acting**; when the user says to just discuss, write no code until told.
18- Bias hard to **KISS**: the simplest design that works, accreted slowly. Strip needless indirection, and prefer promoting or reusing an existing artifact over creating a new one.
19- **Chat style:** terse and neutral. Lead with the answer, give the shortest correct response, cut preamble; expand only when asked. Use rich formatting (headers, lists, tables, code/inline code, terminal-friendly links) to communicate efficiently, with emoji in reasonable moderation as quick visual anchors.
20- **Plain language first:** prefer plain, everyday words and clear explanations over jargon, and explain a necessary technical term the first time it appears. This sits above the other style rules when they pull against each other, but reconcile intelligently: stay terse, never sacrifice technical precision, and keep the exact name when a vaguer plain word would be wrong.
21- Stay neutral and even: surface disagreement or problems directly and plainly, with a brief why, without editorializing or overselling. Say it once, then stay open to well-supported counterpoints.
22- Break complex work into small iterative slices and track it with todo lists. Narrate sparingly: a line at meaningful milestones, not step-by-step.
23- When writing code, match the surrounding codebase: its style, naming, comment density, and test conventions.
24- Keep personal-workspace plumbing (static/k8s deploy, private-repo references, local paths) out of reusable or public artifacts. It belongs only in zo's root CLAUDE.md. Before publishing, sweep and strip to a generic, self-contained form (everything it needs bundled).
25- Connected tools: read freely, but confirm before any write or send. Query judiciously. Don't over-fetch and pollute context.
26- Reads run free. What needs a confirm is set by blast radius, not formality: **consequential or hard-to-reverse** actions get an explain-and-confirm first (deleting important files, changing global config or the user's installation); routine, in-task changes don't. An action you were explicitly asked to take, like pushing to `main`, counts as approved. If a suggested fix looks wrong for the setup, say so instead of running it.
27- Never commit secrets. Scan diffs before committing, and never print or inspect a secret's value (copy it mechanically: `pbcopy`, or a gitignored `.env` between repos). Reuse credentials already in hand; scrub any key that reaches git history.
28- In personal repos, commit and push to `main` when asked. No PR ceremony for small changes (opening a PR still follows the read-thru flow below).
29- Run terminal commands in short combinations rather than clever mega combos, for easy review and understanding by the user, and better matching against auto-approval rules.
30- Always check if you're working in a git worktree.
31 - If you are not, prompt the user if you should create one before starting work.
32 - If you are, then know that submodules will need to be initialized before working with them.
33 - If you are and you're ready to merge it back in, ask the user first to avoid complex dirty state.
34- On `zo`'s `main`, keep every project's submodule pointer at the **tip of that project's own `main`**. Periodically fetch upstream and advance each pointer (committing the bumps) so they stay aligned. A current, uniform starting point keeps worktree checkouts consistent and avoids confusion over where each one begins.
36## Writing
38How to write across everything you produce: chat replies, prose and docs, code comments (not code itself), and prompts you author for models. Apply with judgment for the context; these are defaults, not absolute bans.
40- **Rhythm:** mix short and long sentences; don't let them settle into a uniform length. Break up long sentences. Vary word choice, and prefer plain, short words over long or inflated ones.
41- **Avoid these words and phrases** (prefer concrete, plain alternatives): leverage, robust, scalable, innovative, cutting-edge, state-of-the-art, seamless, synergy, synergistic, passionate, thrilled, honored, delighted, spearhead, pivotal, transformative, transformational, paradigm, unlock, unleash, empower, deep dive, delve, navigate the landscape, ever-evolving, fast-paced, dynamic environment, moreover, furthermore, additionally, in essence, in today's, in the realm of, at the intersection of, look forward to, would welcome the opportunity, excited to discuss, I'd love to discuss, tapestry, underscore, testament to, speaks volumes.
42- **Avoid these constructions:** "not just X but Y"; reflexive "X, Y, and Z" triads; "it is important / worth noting / essential / crucial that…" hedging (state it plainly); restating the same point ("in other words", "to put it simply", "put simply", "more specifically", "that is to say"), say it once.
43- **Punctuation:** go light on em-dashes (use commas, periods, or parentheses); use plain quotes, not curly ones; and split overly long, comma-stacked sentences.
45## Code
47**Stack defaults**
49| Concern | Standard |
50|---|---|
51| UI language | TypeScript |
52| Python deps | `uv` |
53| Python format + lint | `ruff` |
54| Python types | `mypy` |
55| TypeScript format / lint | `prettier` / `eslint` |
56| Config (& secrets) | Pydantic Settings (`SecretStr` for secrets) |
57| System-wide installs | `brew` |
58| Local model calls | **Gemma 4 26B MoE** via Ollama (all model calls, going forward) |
60- **Python quality bar:** strict DDD with MyPy-enforced typing so invalid states are unrepresentable; functional style where it fits, without ceremony; Google style guide (80-char lines); tests valued for meaning, not coverage.
61- **Docs:** stale docs/comments are bugs; fix them when a change invalidates one. Respect the user's hand-edits and regenerate derived artifacts *from* them; never overwrite. Write for humans and future agents alike; comments justify *why*.
63## Verification
65- **Scale rigor to the change.** Small, low-risk changes get a light touch: a quick check and a plain note of what you did. Save the full bar below for substantial or outward-facing work; don't put full-suite runs, boot-and-verify, or subagent review on a one-liner.
66- **Full suite green (for substantive changes):** nothing is done until the project's full check suite passes: tests, formatters, linters (and the project's loops), run in sensible order and re-run after each fix to confirm it resolved. Show the evidence when asked or when the result is non-obvious. Add the *discriminating* test that only the new layer could catch, not coverage padding.
67- **Boot it and lay eyes on it:** passing tests ≠ working UX. For runtime/UI work, boot the server and hand over the URL, *and* self-verify (screenshots, click controls, hunt runtime errors). For telemetry/infra, give a concrete way to observe each signal flowing: a ready query, API call, or endpoint.
68- **Independent adversarial review:** delegate serious analysis/verification to independent subagents; don't bias them with the answer you want. Canonical form: **adversarial review** (e.g. alpha-player playtests for UI, fact-checking every claim for prose).
70## Pull requests
72- Whenever you open a PR, use the **`make-read-thru`** skill to generate a code-level reading guide *of that PR's content*: a walkthrough a reviewer can read top to bottom and vouch for (size it to the change; the skill's `references/depth-and-scope.md` has the tiers).
73- **Deploy** the guide to the static site: write it to `projects/static/public/read-thru/<repo>/pr-<n>-<slug>.html` (slug = short kebab summary of the PR), then push the static repo's `main` — the site is Vercel-hosted, so the push itself deploys it.
74- In the PR body, add a **bare link, no preamble** to the page's clean URL (no `.html` suffix): `https://static.mseeks.me/read-thru/<repo>/pr-<n>-<slug>`.
75- Deploy/namespacing above is **personal-workspace-specific and lives only here**. The `make-read-thru` skill knows nothing about the static site or k8s; it just produces the HTML.
76- **Title & body:** the title is human, **terse, and specific** to the change, never generic. The body is concise, well-structured, and comprehensible, focused on *what* the change is and *why* the PR exists at all. Avoid "meta talk": don't leak conversation or process concerns into the PR, and don't over-explain things that aren't immediately relevant.
77- **Chaining dependent PRs:** when changes build on each other, chain the PRs by targeting each other in order so each reviews cleanly.
79## Infrastructure
81- `infra/` holds Terraform for personal DigitalOcean infrastructure (single source of truth for the DO account). Currently DNS plus a two-node DOKS cluster (`infra/kubernetes.tf`: `zo-k8s`, 2x `s-4vcpu-8gb` nodes in nyc3, ~$96/mo); App Platform static sites/apps later. (The ClickStack/HyperDX observability stack, the Temporal cluster, the froot worker, the model-metrics dashboard, and the Tailscale/Ollama egress that ran here were retired in July 2026. Ollama itself still runs on the Mac Studio via the `com.zo.ollama` LaunchAgent — only the cluster's tunnel to it was removed.)
82- On-cluster workloads are deployed with **kubectl/Helm + install scripts, NOT Terraform** (Terraform owns only the cluster). What remains in `infra/k8s/` is cluster plumbing only (`ingress-nginx`, `cert-manager`): every workload has moved to Vercel — everwhen (prod, `https://playeverwhen.com`) was the last, July 2026 — which makes the cluster itself a decommission candidate.
83- **Headroom:** since the 2026 stack retirements the request budget has real slack. Requests are reservations, not usage, and there's **no metrics-server**, so `kubectl top` won't work in-cluster (DO's dashboard is the source of truth for real load). Still pin **small requests** when adding pods — a pod goes `Pending` on request budget, not actual load.
84- Secrets never go in the repo: the DO token is read from `DIGITALOCEAN_ACCESS_TOKEN` via gitignored `infra/.env` (used by both terraform and doctl).
⋯ 1 line hidden (lines 85–85)
85- Project-specific deployments live centrally in `infra/` and point *outward* at public repos; never put Terraform inside the (open-source) project repos.
Verification, and the careful cutover
terraform fmt -check, init, and validate pass, and the targeted plan shows exactly the two intended record changes:
playeverwhen_com_apexwill be updated in-place —value: "174.138.116.75" -> "216.198.79.1",ttl: 300 -> 3600.playeverwhen_com_wwwmust be replaced —type: "A" -> "CNAME"(forces replacement, value739dd9fe1c5c2ea6.vercel-dns-017.com.). Plan: 1 to add, 1 to change, 1 to destroy.
The app-side gate (1458 unit tests, typecheck, lint, production build) ran from a clean path and is quoted in mseeks/everwhen#356.
The cutover order is stricter than the static rounds, because this is the product:
1. Import mseeks/everwhen in the Vercel dashboard and set every production env var (bulk-pasted from the k8s secret, never printed), then let it deploy. 2. Verify the deployment end-to-end on its .vercel.app URL before DNS moves: / and /play return 200, a real turn streams, the OG card renders, checkout-session creation answers. 3. Attach both domains (www set to redirect). The dashboard issued the per-project values at that moment; the committed ones are what it issued. Merge both PRs, apply the two targeted records. 4. Verify production, then soak: the namespace stays up as instant rollback. Deleting it — and deciding the now-empty cluster's fate — are later, separate steps.