carlos / platform Public

CLAUDE.md: day-to-day admin goes through API/CLI, not direct AWS

Direct AWS (SSM, S3 console, aws CLI) is for platform work itself only.
A missing CLI/API command is a product gap to plan and build, not a
reason to drop to AWS — prompted by an agent going to Systems Manager
today because routes weren't listable via the CLI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Paul Campbell 2 months ago 2be4a0b33dc24ddf8e15a0df6edd174e7b504403 parent 1c32d73

1 file changed, +13 −0

CLAUDE.md +13 −0

diff --git a/CLAUDE.md b/CLAUDE.md

index ff4276e3c..9aa35d00c 100644

--- a/CLAUDE.md

+++ b/CLAUDE.md

@@ -26,6 +26,19 @@ Always name the model explicitly when dispatching; an omitted model silently

inherits the session's (usually the most expensive). A precise brief beats a

capable model — exact values, file paths and interfaces go in the brief.

+## Operate via API and CLI (Paul's rule, 2026-08-06)

+Day-to-day CARLOS administration goes through the console API and the

+`carlos` CLI — listing routes, inspecting apps, checking channels, all of it.

+Direct AWS access (SSM sessions, S3 console, aws CLI) is reserved for work on

+the platform itself: building CARLOS internals, provisioning infra, debugging

+below the API surface.

+If a day-to-day task has no API/CLI command, that is a product gap, not a

+license to drop to AWS: plan and build the command (or file the gap) instead

+of working around it. (2026-08-06: an agent couldn't list routes via the CLI

+and went to Systems Manager — the missing command was the bug.)

## Build & test

- `go build ./...`, `go vet ./...`, `go test ./... -count=1` — all clean, all