# infra

## Scope
- Covers infrastructure assets under `infra/`.

## Architecture Design
- `docker/` owns local and runtime Compose orchestration.
- `postgres/` owns the database image, migrations, and verification scripts.
- `redis/` owns Redis configuration and stream provisioning.
- `healthcheck/` owns the reusable Go healthcheck binary used by service images.
- `secrets/` owns local secret-file generation.
- `scripts/` owns operator probes for the local stack.

## Required
- Must keep each infrastructure concern in its own subdirectory.
- Must keep runtime, local-development, secret, schema, and probe concerns separated.
- Must keep host ports consistent with the Compose files and product-isolation rules.

## Forbidden
- Must not place service business logic or reusable SDK code in this directory.
- Must not commit generated secret files, backups, cache output, or database dumps.
- Must not duplicate configuration already owned by a service or package manifest.

## Validation
- Validate touched infrastructure with the owning script or Compose command for that subdirectory.

