atelier/domains/devops/environments.md

# Environments — Derived Rules

> Derives from `domains/devops/first-principles.md` P1 (Reproducibility), P6 (Configuration as Code), P7 (Immutability).

## Environment Parity (P1 Reproducibility)

- Dev, staging, prod are the same system, different data.
- The same artifact runs in all three. The same config schema, different values.
- "Works on my machine" is a parity failure. The machine is the pipeline.

## Configuration (P6 Configuration as Code)

- Config is in the repo (default values) + environment overrides (secrets, endpoints).
- No snowflake servers. No "this one is different because we edited it in prod."
- Config changes are PRs, not SSH sessions.

## Secrets (P9 Secret Hygiene via security)

- Secrets are per-environment. Dev secrets ≠ prod secrets.
- Secrets come from a secrets manager (Vault, AWS Secrets Manager, Doppler), not env files in prod.
- `.env` files are for local dev only. Prod uses the manager.

## Promotion (P5 Progressive Delivery via devops)

- Code moves dev → staging → prod. Never the reverse.
- A hotfix to prod is backported to staging and dev. Don't let them diverge.
- Promotion is automated. The pipeline decides when code is ready, not a human.

## Data (P1, domains/data P8 Lifecycle Awareness)

- Prod data is sacred. Never copy prod to dev without anonymization.
- Staging uses prod-like data (anonymized, sampled). Dev uses synthetic data.
- A test that runs against prod data is a test that can destroy prod data. Don't.

## What Violates Environment Discipline

| Violation | Principle |
|-----------|-----------|
| "It works on my machine" | P1 Parity |
| Manual config edit in prod | P6 Configuration as Code |
| Dev secret reused in prod | P9 Secret Hygiene |
| Copy prod DB to dev | P1, data P8 |
| Hotfix in prod not backported | P5 (divergence) |
| A snowflake server | P1, P6 |