# K3 is an appliance target.  The product runtime and workers deliberately live
# together below /opt so they can be atomically replaced as one appliance unit.
k3-scheduler: dir-or-file-in-opt

# daemon-reload is the standard systemd maintainer-script integration; service
# start/restart itself goes through deb-systemd-invoke and is readiness-blocking.
k3-scheduler: maintainer-script-calls-systemctl

# These modes are intentionally stricter than Debian's generic data-directory
# defaults: policy.json may contain auth_token and logs may contain requests.
k3-scheduler: non-standard-dir-perm 0750 != 0755 [etc/k3-scheduler/]
k3-scheduler: non-standard-dir-perm 0750 != 0755 [opt/k3-scheduler/logs/]
k3-scheduler: non-standard-file-perm 0600 != 0644 [etc/k3-scheduler/policy.json]
