# ai-spel-rule-engine

The isolated Luau evaluation service for the AI-driven Swedish life simulator.
It receives bounded, versioned rule invocations over NATS and returns typed
effect proposals. It has no database or AI-provider integration; the game API
remains responsible for validating and committing effects.

## Contract

Requests use NATS subject `ai-spel.rules.evaluate.v1` and contract version 1.
The canonical JSON Schema is `contracts/rule-evaluation-v1.schema.json`; its
versioned `$id` is updated by the release version-bump workflow.
Responses echo the correlation ID and have status `evaluated` or `rejected`.

The NATS user may subscribe only to the evaluation subject and publish only to
reply inboxes. The service receives no credentials other than its own NATS
identity and has no configured database or AI-provider secrets. Its chart
limits pod egress to NATS and cluster DNS; Luau evaluation has no external
network path.

## Local commands

For source development, the Rust commands are `cargo fmt --all -- --check`,
`cargo test --workspace`, and `cargo clippy --workspace --all-targets -- -D warnings`.
Production builds, tests, image builds, and executable verification for this
project are run by Gitea Actions on the existing `large` runner and Kubernetes.

## Release deployment boundary

The API repository owns first-time NATS and Argo Application provisioning. The
worker release pipeline publishes this repository's versioned image and chart,
then updates the existing `ai-spel-rule-engine` Argo Application. It uses the
`AI_SPEL_TEST_KUBECONFIG` repository action secret, scoped to patch that one
Argo Application and read rollout health in namespace `ai-spel`. The one-time
service-account roles are described in `deploy/ci/namespace-scoped-rbac.yaml`;
they do not grant database, secret, workload-write, or cluster-wide access.