# The Parich: dev zone

> Home of the dev team and AI agents, separate from end users: https://dev.theparich.com
> Split off the deploy channel on 2026-11-06 (same-day plan). The deploy channel keeps
> its own guide at https://deploy.theparich.com/llms.txt
> This file is written for humans and AI agents that build or change theparich systems.

## What this zone is

dev.theparich.com is the front door for the people who build the system: developers and the
AI agents that work with them. End users stay on the normal doors (theparich.com and the ERP).

One page answers one question:

| Question | Where | Login |
|---|---|---|
| ตอนนี้ระบบปกติไหม / is anything down | https://status.theparich.com | ไม่ต้อง (public) |
| ระบบทั้งหมดมีอะไรบ้าง เชื่อมกันยังไง | https://dev.theparich.com/map/houses.html | ไม่ต้อง (public) |
| deploy / restart / stop / start | https://dev.theparich.com/console.html | ต้อง (API key หรือ SSO) |
| อ่านโค้ดทุก repo ของ org (browser) | https://dev.theparich.com/repos.html | ต้อง (key ที่มี grant dev-code) |
| rules ที่บังคับใช้ทุกบ้าน (มี IP/พอร์ตภายใน) | GET /v1/repos/theparich-standards/file?path=docs/reference/central/rules.md&ref=main | ต้อง (key ที่มี grant dev-code; admin/owner ผ่านเสมอ) |
| คู่มือของ api ตัวจริง | https://dev.theparich.com/v1/llms.txt | ไม่ต้อง (public) |
| คู่มือช่องทาง deploy ฉบับเดิม | https://deploy.theparich.com/llms.txt | n/a |

status และ map ไม่ต้องล็อกอิน: **status = ขึ้นหรือไม่ (อ่านอย่างเดียว)** ·
**map = แผนที่ความสัมพันธ์** · console = ควบคุม (กด build / สั่ง container) ·
repos = อ่านโค้ด (อ่านอย่างเดียว)

## Console and its rights

- `/console.html` talks to the deploy agent at `/api/*` on this same origin (reverse proxy
  to tp-agent). Login ways: an API key (`tpk_...`) as before, or the "บัญชี The Parich" button
  (SSO through theparich-auth; status below).
- **Who may press deploy**: roles `owner`/`admin` always; anyone else needs the `dev-deploy`
  grant on their account. The agent refreshes `/etc/theparich-deploy/grants.tsv` hourly from
  the ERP `user_permissions` table (`module in (dev-code, dev-deploy)`). Without rights the
  agent answers 403 with a Thai message; the console shows the same state per session.
- `db` and `auth` services stay locked on this channel (infra / D-1).

## Repo browser and code routes

- `repos.html` uses `GET /v1/repos` and `GET /v1/repos/{repo}/file?path=...&ref=main` through
  the `/v1/` reverse proxy of this domain (same origin, no CORS involved). It takes a `tpk_`
  key saved in localStorage and explains 401/403/404/413/429 in Thai.
- All code routes need the `dev-code:VIEW` grant; `admin`/`owner` always pass.
- Limits per person: 60 file reads/min, 60 repo listings/min, 10 zips/min. One file is capped
  at 1 MB; bigger means the zip route.

## Rules

`/rules.md` is deliberately NOT served publicly on this domain. The file carries internal IPs
and ports and its header says LAN only (ruling on record). The supported way to read it is the
repo route in the table above.

## For AI agents

- **MCP first**: the `erp-theparich` MCP server describes itself. Call `about_theparich` before
  assuming any tool exists, then `describe_tools` for the catalogue.
- **Code through the api repo routes** (all three need a key with grant `dev-code`;
  `admin`/`owner` always pass):
  - `GET /v1/repos`: list the org's repos, sorted by name
  - `GET /v1/repos/{repo}/file?path=guidelines/README.md&ref=main`: one file at a time (60/min),
    the everyday way to read code
  - `GET /v1/repos/{repo}/zip?ref=main`: the whole repo (10/min)
- **Reading order**: start at `theparich-standards/guidelines/ai-onboarding.md` (via the repo
  route above, or raw.githubusercontent.com). It names the files to read next and the red lines
  on data.

## Status (as of 2026-11-06)

- Console (key login + dev-deploy gate) and the repo browser are live at the URLs above.
- SSO button on the console is built and wired end to end but is **pending-owner**: the app
  "dev console" with callback `https://dev.theparich.com/auth/callback` has not been registered
  at the auth admin yet. Until then the auth login page answers `app_not_found` after the
  popup opens. The placeholder app_id lives in `/auth-config.js`.