# Platform-managed environments

This directory holds environment definitions used by the onboarding scaffold.
Each file is a named environment the platform owns (an AWS account or
scoped partition, a network, a state backend, and an IAM role surfaced to
the consumer via ABAC).

A consumer never provides an AWS account, VPC, subnet, S3 state bucket, or
runner key — the platform manages all of that here.

## Files

- `dev.json` — the default dev environment (autonomous, confidence >= 0.50).
- `qa.json` — QA environment (attested, QA HITL gate, confidence >= 0.75).
  Placeholder binding (replace account_id with the real QA account).
- `prod.json` — Production environment (attested, SRE HITL gate, confidence >= 0.90).
  Placeholder binding.
- `dr.json` — DR environment (attested, SRE HITL gate, confidence >= 0.95).
  Placeholder binding.

All files validate against `schemas/environment.schema.json`. The qa/prod/dr
placeholders use `account_id: 000000000000` with a stderr warning at load
time (prompts real binding before deploying).

## How it is used

`core/environment_check.py` reads a contract's `environment` field and
looks up the matching `<name>.json` in this directory. If no matching file
exists, the check prints a friendly onboarding prompt and exits non-zero,
halting the pipeline before any work is done.

## Adding an environment

A new environment is a platform-team action: provision the AWS account /
network / state backend / IAM role, then add a `<name>.json` here and bind
it to the consumer repo. Self-service environment provisioning is on the
roadmap; today it is a platform-team action.