# Lens: Defense-in-Depth (Ops)

Analyze infrastructure code for environmental safety and forensic reliability.

## The Ops Layers

Check if the scripts, Nix configs, or CI workflows implement these safety layers.

### 1. Environment Guards (Layer 3)
*   **Check:** Does the script explicitly verify the environment before performing destructive actions?
*   **❌ Flag:** `rm -rf`, `git init`, `nixos-rebuild`, or database migrations that run without an environment check.
*   **Fix:** Add explicit guards:
    ```bash
    if [[ "${ENV:-}" != "prod" ]]; then
      echo "Error: This script must run in PROD" >&2
      exit 1
    fi
    ```
*   **Fix (Nix):** Use assertions to prevent building production flakes on development machines if unintended.

### 2. Contextual Safety
*   **Check:** Is the script "aware" of its location?
*   **❌ Flag:** Using `cd` or `rm` on relative paths that could point to the wrong place if run from a different directory.
*   **Fix:** Use `$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)` to anchor the script to its own location.

### 3. Debug Instrumentation (Layer 4)
*   **Check:** If this deployment/script fails in CI, is there enough info to debug it without SSH access?
*   **❌ Flag:** Silencing output with `&> /dev/null` or missing `set -x` in failure blocks.
*   **Fix:** Log environment variables (excluding secrets), current directory, and tool versions on failure.

### 4. Blast Radius Redundancy
*   **Check:** If a single variable is empty, does the script fail safely or delete the root?
*   **❌ Flag:** `rm -rf "$VARIABLE/*"` where VARIABLE could be empty.
*   **Fix:** Always check variables: `[[ -n "${VARIABLE:-}" ]] || exit 1`.
