Files
ai-spel-rule-engine/README.md
T
Ein Anderssono c4403f297a
Build and publish rule engine / release (push) Successful in 2m48s
Restrict worker egress and publish manifest
2026-10-20 11:42:13 +02:00

1.8 KiB

ai-spel-rule-engine

The isolated Luau evaluation service for the AI-driven Swedish life simulator. It receives bounded, versioned rule invocations over NATS and returns typed effect proposals. It has no database or AI-provider integration; the game API remains responsible for validating and committing effects.

Contract

Requests use NATS subject ai-spel.rules.evaluate.v1 and contract version 1. The canonical JSON Schema is contracts/rule-evaluation-v1.schema.json; its versioned $id is updated by the release version-bump workflow. Responses echo the correlation ID and have status evaluated or rejected.

The NATS user may subscribe only to the evaluation subject and publish only to reply inboxes. The service receives no credentials other than its own NATS identity and has no configured database or AI-provider secrets. Its chart limits pod egress to NATS and cluster DNS; Luau evaluation has no external network path.

Local commands

For source development, the Rust commands are cargo fmt --all -- --check, cargo test --workspace, and cargo clippy --workspace --all-targets -- -D warnings. Production builds, tests, image builds, and executable verification for this project are run by Gitea Actions on the existing large runner and Kubernetes.

Release deployment boundary

The API repository owns first-time NATS and Argo Application provisioning. The worker release pipeline publishes this repository's versioned image and chart, then updates the existing ai-spel-rule-engine Argo Application. It uses the AI_SPEL_TEST_KUBECONFIG repository action secret, scoped to patch that one Argo Application and read rollout health in namespace ai-spel. The one-time service-account roles are described in deploy/ci/namespace-scoped-rbac.yaml; they do not grant database, secret, workload-write, or cluster-wide access.