System: Fleet Dashboard

{
  "scope": {
    "host_refs": [
      "H-001"
    ],
    "system_ref": "SYS-007",
    "instance_refs": [
      "INST-007"
    ]
  },
  "context_notes": [
    "This system is an internal Docker fleet dashboard.",
    "Database credentials use read-only role fleet_dashboard_ro.",
    "Access is restricted via Tailscale and Caddy reverse proxy.",
    "Container runs as non-root user (appuser:1001).",
    "Primary host is infra-warden-control-01 (H-001)."
  ],
  "allowed_operations": [
    "Propose edits to Dockerfile for SYS-007 / INST-007",
    "Propose edits to docker-compose.yml for host H-001 involving SYS-007",
    "Propose read-only SQL (views, SELECTs) on fleet_control_db",
    "Suggest server.js improvements for fleet-dashboard",
    "Review and analyze container logs"
  ],
  "forbidden_operations": [
    "Dropping tables or altering schemas outside fleet schema",
    "Acting on hosts or systems not listed in scope",
    "Proposing destructive Docker commands (rm -f, network deletes) without explicit user request",
    "Modifying production database credentials",
    "Accessing systems outside INST-007 scope"
  ]
}