@cubis/foundry 0.3.82 → 0.3.84

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/gin-golang/evals/assertions.md

@@ -1,37 +0,0 @@
-# Gin Golang Eval Assertions
-
-## Eval 1: CRUD API with Validation
-
-### gin-new-explicit-middleware
-Verifies the engine is created with `gin.New()` rather than `gin.Default()`, giving the developer full control over which middleware runs and in what order. Recovery must be first (to catch panics in all subsequent middleware), logging must come next, and authentication should only apply to the protected route group. This catches responses that use `gin.Default()` without understanding its implicit middleware or that apply auth globally.
-
-### binding-validation-tags
-Verifies request structs use Gin's binding tag system with `binding:"required"` and range constraints, plus a custom validator for the slug field registered through the validator engine. The response must use `c.ShouldBindJSON()` instead of `c.BindJSON()` to retain control over error formatting. This assertion catches responses that skip validation, use the wrong bind method, or validate manually in the handler body.
-
-### structured-error-response
-Verifies error responses follow a consistent JSON structure across the entire API surface. The central handler must distinguish between validation errors (which produce field-level detail), sentinel business errors (which map to specific status codes), and unexpected errors (which produce 500 without leaking internals). This tests for production-grade error consistency rather than ad-hoc per-handler formatting.
-
-### release-mode-and-proxy
-Verifies production hardening is applied: Gin's mode is set to release to suppress debug logging and route dumps, and trusted proxies are explicitly configured to prevent `X-Forwarded-For` spoofing. This catches responses that leave Gin in debug mode or trust all proxies by default, both of which are security concerns in production.
-
-### table-driven-handler-tests
-Verifies tests are structured as table-driven subtests covering the three critical paths: valid input producing 201, missing required fields producing 400 with field-level errors, and invalid values producing 400 with validation details. Tests must use `httptest.NewRecorder` with `router.ServeHTTP` for full integration or `gin.CreateTestContext` for isolated unit tests. This catches responses that only test the happy path or lack structured assertions on error shape.
-
----
-
-## Eval 2: Middleware Integration Testing
-
-### request-id-middleware
-Verifies the request ID middleware generates a UUID and propagates it both into the Gin context (for downstream middleware/handlers) and into the response header. The test must check that the `X-Request-Id` header exists and is a valid UUID. This ensures traceability works end-to-end and is verifiable from the client side.
-
-### auth-middleware-test
-Verifies the auth middleware correctly extracts and validates tokens, stores the user in context for downstream handlers, and returns a structured 401 error when authentication fails. The test must cover both the success path (request passes through to the handler) and the failure path (request is aborted with proper JSON). This catches middleware that forgets to call `c.Abort()` or returns plain text errors.
-
-### middleware-order-test
-Verifies the test suite explicitly validates that middleware runs in the intended order. Request ID must be set before logging runs (so the logger includes it), and auth must run after logging (so rejected requests are still logged). This is tested through response inspection or log output verification. This catches architectures where auth silently drops requests before they are logged.
-
-### rate-limiter-test
-Verifies the rate limiter works per-client-IP using a token bucket or similar algorithm, and the test demonstrates the threshold by sending sequential requests and observing the transition from 200 to 429. The response should include a `Retry-After` header or equivalent information. This catches rate limiters that are not actually enforced or that use a global counter instead of per-IP tracking.
-
-### logging-captures-status
-Verifies the logging middleware captures the actual response status code by recording it after `c.Next()` returns, not before. The test must demonstrate that when a downstream handler returns 404 or 500, the log entry reflects that status code accurately. This catches a common bug where logging middleware logs the status before the handler has set it, always showing 200.

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/gin-golang/evals/evals.json

@@ -1,74 +0,0 @@
-[
-  {
-    "id": "gin-crud-validation",
-    "prompt": "Build a Go Gin CRUD API for a product catalog service. Create endpoints for listing, creating, reading, updating, and deleting products under /api/v1/products. Use gin.New() with explicit middleware registration: custom recovery, structured JSON logging, and JWT auth middleware on protected routes. Validate all request bodies with struct binding tags including required fields, min/max constraints, and a custom 'slug' validator. Return structured JSON error responses from a central error handler. Set Gin to release mode in production. Include table-driven tests for the create endpoint covering valid input, missing required fields, and invalid field values.",
-    "assertions": [
-      {
-        "id": "gin-new-explicit-middleware",
-        "type": "contains_concept",
-        "expected": "Engine is created with gin.New() instead of gin.Default(), and middleware is added explicitly with router.Use() in the correct order: recovery first, then logging, with auth middleware applied at the group level for protected routes only",
-        "weight": 1.0
-      },
-      {
-        "id": "binding-validation-tags",
-        "type": "contains_concept",
-        "expected": "Request structs use binding tags like binding:\"required\", binding:\"min=1,max=1000\", and a custom validator registered with binding.Validator.Engine() for the slug field, with c.ShouldBindJSON() used instead of c.BindJSON()",
-        "weight": 1.0
-      },
-      {
-        "id": "structured-error-response",
-        "type": "contains_concept",
-        "expected": "A central error handling function or middleware maps validation errors (validator.ValidationErrors), sentinel errors, and unknown errors to a consistent JSON envelope with status code, error code string, message, and optional field-level details array",
-        "weight": 1.0
-      },
-      {
-        "id": "release-mode-and-proxy",
-        "type": "contains_concept",
-        "expected": "gin.SetMode(gin.ReleaseMode) is called for production, and router.SetTrustedProxies is configured with specific CIDR ranges or set to nil to prevent proxy header spoofing",
-        "weight": 1.0
-      },
-      {
-        "id": "table-driven-handler-tests",
-        "type": "contains_concept",
-        "expected": "Tests use httptest.NewRecorder with router.ServeHTTP or gin.CreateTestContext, organized as table-driven subtests with t.Run covering valid creation (201), missing required fields (400 with field errors), and invalid field values (400 with validation details)",
-        "weight": 1.0
-      }
-    ]
-  },
-  {
-    "id": "gin-middleware-integration",
-    "prompt": "Create a comprehensive middleware integration test suite for a Gin application. The application has: (1) a request ID middleware that generates UUIDs and sets X-Request-Id header, (2) a structured logging middleware using slog that logs method, path, status, and latency with the request ID, (3) an auth middleware that validates Bearer tokens and sets the user in gin context with c.Set(), (4) a rate limiting middleware using a token bucket per IP. Write integration tests that verify: middleware execution order, request ID propagation through the chain, auth rejection with proper error format, rate limiter triggering after threshold, and that the logging middleware captures the correct status code even when downstream handlers error.",
-    "assertions": [
-      {
-        "id": "request-id-middleware",
-        "type": "contains_concept",
-        "expected": "Request ID middleware generates a UUID, sets it in the Gin context with c.Set() and in the response header X-Request-Id, and the test verifies the header is present and is a valid UUID format in the response",
-        "weight": 1.0
-      },
-      {
-        "id": "auth-middleware-test",
-        "type": "contains_concept",
-        "expected": "Auth middleware extracts Bearer token from Authorization header, validates it, stores the user in context with c.Set(), and calls c.Abort() with a structured 401 JSON response on failure. Tests verify both successful auth pass-through and rejection with the correct error envelope",
-        "weight": 1.0
-      },
-      {
-        "id": "middleware-order-test",
-        "type": "contains_concept",
-        "expected": "Integration test verifies middleware execution order by checking that request ID is available to the logging middleware, auth runs after logging so failed auth attempts are still logged, and the test demonstrates this ordering through response headers or logged output inspection",
-        "weight": 1.0
-      },
-      {
-        "id": "rate-limiter-test",
-        "type": "contains_concept",
-        "expected": "Rate limiter uses a token bucket or sliding window per client IP, and the test sends requests in a loop verifying that responses succeed up to the limit and then return 429 Too Many Requests with a Retry-After header or structured error response",
-        "weight": 1.0
-      },
-      {
-        "id": "logging-captures-status",
-        "type": "contains_concept",
-        "expected": "Logging middleware wraps c.Next() to capture the response status code after handler execution, and the test verifies that error responses from downstream handlers (like 404 or 500) are correctly reflected in the structured log output, not just the pre-handler state",
-        "weight": 1.0
-      }
-    ]
-  }
-]

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/gin-golang/examples/01-crud-api-with-validation.md

@@ -1,219 +0,0 @@
-# Example: CRUD API with Validation
-
-## Prompt
-
-> Build a Gin CRUD API for an inventory service with products under /api/v1/products. Include validation with struct binding tags, a custom slug validator, and structured error responses. Use gin.New() with explicit middleware.
-
-## Expected Output
-
-The skill should produce a complete Gin application with validation and structured errors:
-
-### Application Bootstrap
-
-```go
-package main
-
-import (
-    "net/http"
-    "os"
-    "os/signal"
-    "syscall"
-    "time"
-
-    "github.com/gin-gonic/gin"
-    "github.com/gin-gonic/gin/binding"
-    "github.com/go-playground/validator/v10"
-)
-
-func main() {
-    if os.Getenv("GIN_MODE") == "release" {
-        gin.SetMode(gin.ReleaseMode)
-    }
-
-    router := gin.New()
-    router.SetTrustedProxies([]string{"10.0.0.0/8", "172.16.0.0/12"})
-
-    // Register custom validators
-    if v, ok := binding.Validator.Engine().(*validator.Validate); ok {
-        v.RegisterValidation("slug", validateSlug)
-    }
-
-    // Explicit middleware stack
-    router.Use(gin.CustomRecoveryWithWriter(os.Stderr, recoveryHandler))
-    router.Use(requestIDMiddleware())
-    router.Use(structuredLoggerMiddleware())
-
-    // Public routes
-    router.GET("/health", healthHandler)
-
-    // Protected API group
-    api := router.Group("/api/v1")
-    api.Use(jwtAuthMiddleware())
-    {
-        api.GET("/products", listProducts)
-        api.POST("/products", createProduct)
-        api.GET("/products/:id", getProduct)
-        api.PUT("/products/:id", updateProduct)
-        api.DELETE("/products/:id", deleteProduct)
-    }
-
-    // Graceful shutdown
-    srv := &http.Server{
-        Addr:         ":8080",
-        Handler:      router,
-        ReadTimeout:  10 * time.Second,
-        WriteTimeout: 10 * time.Second,
-        IdleTimeout:  120 * time.Second,
-    }
-
-    go func() {
-        if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
-            log.Fatalf("listen: %s\n", err)
-        }
-    }()
-
-    quit := make(chan os.Signal, 1)
-    signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)
-    <-quit
-
-    ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-    defer cancel()
-    srv.Shutdown(ctx)
-}
-```
-
-### Request Structs with Binding Tags
-
-```go
-type CreateProductRequest struct {
-    Name     string  `json:"name" binding:"required,min=1,max=200"`
-    Slug     string  `json:"slug" binding:"required,slug"`
-    Price    float64 `json:"price" binding:"required,gt=0,lte=999999"`
-    Category string  `json:"category" binding:"required,oneof=electronics books clothing food"`
-    SKU      string  `json:"sku" binding:"required,len=10"`
-}
-
-type UpdateProductRequest struct {
-    Name     *string  `json:"name" binding:"omitempty,min=1,max=200"`
-    Price    *float64 `json:"price" binding:"omitempty,gt=0,lte=999999"`
-    Category *string  `json:"category" binding:"omitempty,oneof=electronics books clothing food"`
-}
-
-// Custom slug validator
-func validateSlug(fl validator.FieldLevel) bool {
-    slug := fl.Field().String()
-    matched, _ := regexp.MatchString(`^[a-z0-9]+(?:-[a-z0-9]+)*$`, slug)
-    return matched
-}
-```
-
-### Handler with Structured Error Response
-
-```go
-func createProduct(c *gin.Context) {
-    var req CreateProductRequest
-    if err := c.ShouldBindJSON(&req); err != nil {
-        handleValidationError(c, err)
-        return
-    }
-
-    product, err := productService.Create(c.Request.Context(), req)
-    if err != nil {
-        handleError(c, err)
-        return
-    }
-
-    c.JSON(http.StatusCreated, product)
-}
-
-func handleValidationError(c *gin.Context, err error) {
-    var ve validator.ValidationErrors
-    if errors.As(err, &ve) {
-        fields := make([]FieldError, len(ve))
-        for i, fe := range ve {
-            fields[i] = FieldError{
-                Field:   fe.Field(),
-                Tag:     fe.Tag(),
-                Message: fieldErrorMessage(fe),
-            }
-        }
-        c.JSON(http.StatusBadRequest, ErrorResponse{
-            Code:    "VALIDATION_ERROR",
-            Message: "Request validation failed",
-            Details: fields,
-        })
-        return
-    }
-    c.JSON(http.StatusBadRequest, ErrorResponse{
-        Code:    "BAD_REQUEST",
-        Message: err.Error(),
-    })
-}
-```
-
-### Table-Driven Tests
-
-```go
-func TestCreateProduct(t *testing.T) {
-    router := setupTestRouter()
-
-    tests := []struct {
-        name       string
-        body       interface{}
-        wantStatus int
-        wantCode   string
-    }{
-        {
-            name: "valid product",
-            body: CreateProductRequest{
-                Name: "Widget", Slug: "widget-pro",
-                Price: 29.99, Category: "electronics", SKU: "ABCDEFGHIJ",
-            },
-            wantStatus: 201,
-        },
-        {
-            name:       "missing required fields",
-            body:       map[string]string{"name": "Widget"},
-            wantStatus: 400,
-            wantCode:   "VALIDATION_ERROR",
-        },
-        {
-            name: "invalid slug format",
-            body: map[string]interface{}{
-                "name": "Widget", "slug": "INVALID SLUG!",
-                "price": 29.99, "category": "electronics", "sku": "ABCDEFGHIJ",
-            },
-            wantStatus: 400,
-            wantCode:   "VALIDATION_ERROR",
-        },
-    }
-
-    for _, tt := range tests {
-        t.Run(tt.name, func(t *testing.T) {
-            body, _ := json.Marshal(tt.body)
-            w := httptest.NewRecorder()
-            req := httptest.NewRequest("POST", "/api/v1/products", bytes.NewReader(body))
-            req.Header.Set("Content-Type", "application/json")
-            req.Header.Set("Authorization", "Bearer "+testToken)
-
-            router.ServeHTTP(w, req)
-
-            assert.Equal(t, tt.wantStatus, w.Code)
-            if tt.wantCode != "" {
-                var resp ErrorResponse
-                json.Unmarshal(w.Body.Bytes(), &resp)
-                assert.Equal(t, tt.wantCode, resp.Code)
-            }
-        })
-    }
-}
-```
-
-## Key Observations
-
-- `gin.New()` is used instead of `gin.Default()` for explicit middleware control.
-- Custom slug validator is registered through `binding.Validator.Engine()`.
-- `ShouldBindJSON` is used instead of `BindJSON` to retain error handling control.
-- Update struct uses pointer fields for partial update support.
-- Graceful shutdown wraps Gin in `http.Server` for timeout and signal handling.
-- Tests are table-driven with subtests covering valid, missing, and invalid inputs.

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/gin-golang/examples/02-middleware-integration-testing.md

@@ -1,192 +0,0 @@
-# Example: Middleware Integration Testing
-
-## Prompt
-
-> Write integration tests for a Gin middleware stack: request ID, structured logging with slog, JWT auth, and rate limiting. Verify middleware execution order and that logging captures correct status codes from downstream errors.
-
-## Expected Output
-
-The skill should produce a complete middleware test suite:
-
-### Request ID Middleware
-
-```go
-func requestIDMiddleware() gin.HandlerFunc {
-    return func(c *gin.Context) {
-        id := c.GetHeader("X-Request-Id")
-        if id == "" {
-            id = uuid.New().String()
-        }
-        c.Set("requestID", id)
-        c.Header("X-Request-Id", id)
-        c.Next()
-    }
-}
-```
-
-### Structured Logging Middleware
-
-```go
-func loggingMiddleware(logger *slog.Logger) gin.HandlerFunc {
-    return func(c *gin.Context) {
-        start := time.Now()
-        path := c.Request.URL.Path
-
-        c.Next()
-
-        // Capture status AFTER handler execution
-        status := c.Writer.Status()
-        latency := time.Since(start)
-        reqID, _ := c.Get("requestID")
-
-        logger.Info("request",
-            "method", c.Request.Method,
-            "path", path,
-            "status", status,
-            "latency_ms", latency.Milliseconds(),
-            "request_id", reqID,
-            "client_ip", c.ClientIP(),
-        )
-    }
-}
-```
-
-### Integration Tests
-
-```go
-func TestRequestIDPropagation(t *testing.T) {
-    router := gin.New()
-    router.Use(requestIDMiddleware())
-    router.GET("/test", func(c *gin.Context) {
-        id, _ := c.Get("requestID")
-        c.JSON(200, gin.H{"request_id": id})
-    })
-
-    w := httptest.NewRecorder()
-    req := httptest.NewRequest("GET", "/test", nil)
-    router.ServeHTTP(w, req)
-
-    assert.Equal(t, 200, w.Code)
-
-    // Verify header is a valid UUID
-    headerID := w.Header().Get("X-Request-Id")
-    assert.NotEmpty(t, headerID)
-    _, err := uuid.Parse(headerID)
-    assert.NoError(t, err, "X-Request-Id should be a valid UUID")
-
-    // Verify handler received the same ID
-    var body map[string]string
-    json.Unmarshal(w.Body.Bytes(), &body)
-    assert.Equal(t, headerID, body["request_id"])
-}
-
-func TestRequestIDPreservedFromClient(t *testing.T) {
-    router := gin.New()
-    router.Use(requestIDMiddleware())
-    router.GET("/test", func(c *gin.Context) {
-        c.Status(200)
-    })
-
-    clientID := "client-supplied-id-123"
-    w := httptest.NewRecorder()
-    req := httptest.NewRequest("GET", "/test", nil)
-    req.Header.Set("X-Request-Id", clientID)
-    router.ServeHTTP(w, req)
-
-    assert.Equal(t, clientID, w.Header().Get("X-Request-Id"))
-}
-
-func TestAuthMiddlewareRejectsInvalidToken(t *testing.T) {
-    router := gin.New()
-    router.Use(requestIDMiddleware())
-    router.Use(authMiddleware(testSecret))
-    router.GET("/protected", func(c *gin.Context) {
-        c.JSON(200, gin.H{"ok": true})
-    })
-
-    tests := []struct {
-        name       string
-        authHeader string
-        wantStatus int
-        wantCode   string
-    }{
-        {"missing header", "", 401, "UNAUTHORIZED"},
-        {"invalid format", "NotBearer xyz", 401, "UNAUTHORIZED"},
-        {"expired token", "Bearer " + expiredToken, 401, "TOKEN_EXPIRED"},
-        {"valid token", "Bearer " + validToken, 200, ""},
-    }
-
-    for _, tt := range tests {
-        t.Run(tt.name, func(t *testing.T) {
-            w := httptest.NewRecorder()
-            req := httptest.NewRequest("GET", "/protected", nil)
-            if tt.authHeader != "" {
-                req.Header.Set("Authorization", tt.authHeader)
-            }
-            router.ServeHTTP(w, req)
-
-            assert.Equal(t, tt.wantStatus, w.Code)
-            if tt.wantCode != "" {
-                var resp ErrorResponse
-                json.Unmarshal(w.Body.Bytes(), &resp)
-                assert.Equal(t, tt.wantCode, resp.Code)
-            }
-            // Request ID header should always be present
-            assert.NotEmpty(t, w.Header().Get("X-Request-Id"))
-        })
-    }
-}
-
-func TestRateLimiterTriggersAfterThreshold(t *testing.T) {
-    router := gin.New()
-    router.Use(rateLimitMiddleware(3, time.Minute)) // 3 requests per minute
-    router.GET("/limited", func(c *gin.Context) {
-        c.JSON(200, gin.H{"ok": true})
-    })
-
-    for i := 0; i < 3; i++ {
-        w := httptest.NewRecorder()
-        req := httptest.NewRequest("GET", "/limited", nil)
-        req.RemoteAddr = "192.168.1.1:1234"
-        router.ServeHTTP(w, req)
-        assert.Equal(t, 200, w.Code, "request %d should succeed", i+1)
-    }
-
-    // 4th request should be rate limited
-    w := httptest.NewRecorder()
-    req := httptest.NewRequest("GET", "/limited", nil)
-    req.RemoteAddr = "192.168.1.1:1234"
-    router.ServeHTTP(w, req)
-    assert.Equal(t, 429, w.Code)
-}
-
-func TestLoggingCapturesErrorStatus(t *testing.T) {
-    var buf bytes.Buffer
-    logger := slog.New(slog.NewJSONHandler(&buf, nil))
-
-    router := gin.New()
-    router.Use(loggingMiddleware(logger))
-    router.GET("/not-found", func(c *gin.Context) {
-        c.JSON(404, gin.H{"error": "not found"})
-    })
-
-    w := httptest.NewRecorder()
-    req := httptest.NewRequest("GET", "/not-found", nil)
-    router.ServeHTTP(w, req)
-
-    assert.Equal(t, 404, w.Code)
-
-    // Verify the log entry captured status 404, not 200
-    logOutput := buf.String()
-    assert.Contains(t, logOutput, `"status":404`)
-}
-```
-
-## Key Observations
-
-- Request ID middleware runs before logging so the logger can include the ID.
-- Auth middleware runs after request ID so rejected requests still have traceability.
-- Logging middleware captures `c.Writer.Status()` AFTER `c.Next()` so it reflects the actual response status.
-- Rate limiter test sends requests in sequence and verifies the threshold transition.
-- All tests use `httptest.NewRecorder` with `router.ServeHTTP` for full-stack integration.
-- The logging status test catches the common bug of logging status before the handler sets it.