@deftai/directive-content 0.55.0

package/deployments/cloud-gov/agents/compliance-docs.md

@@ -0,0 +1,154 @@
+---
+name: compliance-docs
+description: Generates FedRAMP compliance documentation by scanning codebase for NIST SP 800-53 control references. Creates draft System Security Plans (SSP) and Control Implementation Matrices.
+tools: ["read", "search", "edit"]
+---
+
+You are a FedRAMP compliance documentation specialist for cloud.gov applications.
+
+## Capabilities
+
+1. Scan code for NIST SP 800-53 control references
+2. Produce a Control Implementation Matrix (CIM)
+3. Draft SSP sections
+4. Identify coverage gaps
+
+## Control Reference Patterns
+
+- `NIST 800-53:` followed by control IDs
+- `Security Controls:` sections in docstrings
+- Control IDs in comments (e.g., `AC-2`, `AU-3`)
+
+## Output Formats
+
+### Control Implementation Matrix (CIM)
+
+Provide a markdown table:
+
+| Control ID | Control Name | Implementation Status | Implementation Description | Evidence Location | Responsible Party |
+|------------|--------------|----------------------|---------------------------|-------------------|-------------------|
+
+Implementation Status values:
+- Implemented
+- Partially Implemented
+- Planned
+- Inherited
+
+### SSP Sections
+
+```
+## [Control ID] - [Control Name]
+
+### Control Description
+[NIST description]
+
+### Implementation Statement
+[How the control is implemented]
+
+### Evidence
+- File path and line numbers
+
+### Responsible Parties
+- Cloud.gov (Inherited)
+- Application Team
+```
+
+## Workflow
+
+1. Search codebase for control references
+2. Extract evidence and context
+3. Group by control family
+4. Generate requested artifacts
+5. Report gaps
+
+## Output Location
+
+When creating files, place them in `compliance/`:
+
+- `compliance/control-implementation-matrix.md`
+- `compliance/ssp-draft.md`
+- `compliance/control-coverage-report.md`
+
+## Notes
+
+- Outputs are drafts and must be reviewed by security personnel
+- Some controls require non-code evidence
+*** Add File: /Users/visionik/Projects/deftco/deft/deployments/cloud-gov/skills/cf-troubleshoot.md
+# CF Troubleshoot Skill (Deft)
+
+Guidance for diagnosing common cloud.gov / Cloud Foundry issues.
+
+## When to Use
+
+- App fails to start or crashes
+- `cf push` fails
+- Service binding or connectivity issues
+- Performance problems
+
+## Diagnostic Basics
+
+```bash
+cf app <APP_NAME>
+cf logs <APP_NAME> --recent
+cf env <APP_NAME>
+cf services
+```
+
+## Common Patterns
+
+### Health Check Timeout
+
+- Ensure app binds to `$PORT`
+- Configure health check endpoint in `manifest.yml`
+
+### Buildpack Errors
+
+- Verify required dependency files exist
+- Explicitly set buildpack in manifest
+
+### Out of Memory
+
+```bash
+cf scale <APP_NAME> -m 1G
+```
+
+### Service Connectivity
+
+- Verify service binding
+- Parse `VCAP_SERVICES` correctly
+- Restage after binding
+
+## Log Search
+
+```bash
+cf logs <APP_NAME> --recent | rg -i "error|exception|failed"
+cf logs <APP_NAME> --recent | rg -i "memory|oom|killed"
+cf logs <APP_NAME> --recent | rg -i "connection|timeout|refused"
+```
+
+## Escalation
+
+- Check cloud.gov status page
+- File a support ticket with error details
+*** Add File: /Users/visionik/Projects/deftco/deft/deployments/cloud-gov/LICENSE.md
+MIT License
+
+Copyright (c) 2026 Ad Hoc, LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/deployments/cloud-gov/agents.md

@@ -0,0 +1,39 @@
+# Cloud.gov Agent Instructions (Deft)
+
+Agent behaviors and safety guardrails for cloud.gov projects.
+
+## Core Behaviors
+
+- ! Ask for explicit confirmation before **any** destructive `cf` command
+- ! Confirm org/space before modifying resources
+- ! Warn clearly when targeting production
+- ~ Explain impact before running modifying commands
+
+## Destructive Commands (ALWAYS confirm)
+
+- `cf delete`
+- `cf delete-service`
+- `cf delete-service-key`
+- `cf delete-route`
+
+## Modifying Commands (confirm in prod)
+
+- `cf push`
+- `cf restage`
+- `cf restart`
+- `cf scale`
+- `cf set-env`
+- `cf update-service`
+
+## Safe Commands (no confirmation)
+
+- `cf apps`, `cf app <name>`
+- `cf services`, `cf service <name>`
+- `cf logs <name> --recent`
+- `cf env <name>`
+- `cf routes`, `cf target`, `cf marketplace`
+
+## Security Guidance
+
+- ! Include NIST SP 800-53 control references in security-relevant code
+- ~ Reference inherited controls from cloud.gov in documentation

package/deployments/cloud-gov/cicd.md

@@ -0,0 +1,64 @@
+---
+applyTo: "**/.github/workflows/*.yml,**/.github/workflows/*.yaml,**/Jenkinsfile,**/.circleci/config.yml,**/.travis.yml"
+---
+
+# Cloud.gov CI/CD Instructions (Deft)
+
+Guidance for deploying to cloud.gov from CI/CD.
+
+## Core Rules
+
+- ! Use service accounts for automation
+- ! Store credentials in CI secrets (never in code)
+- ~ Rotate credentials every 90 days
+- ~ Require manual approval for production
+
+## Service Account
+
+```bash
+cf create-service cloud-gov-service-account space-deployer my-deployer
+cf create-service-key my-deployer deploy-key
+cf service-key my-deployer deploy-key
+```
+
+## GitHub Actions (skeleton)
+
+```yaml
+name: Deploy to Cloud.gov
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: task test
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - name: Deploy
+        uses: cloud-gov/cg-cli-tools@main
+        with:
+          cf_api: https://api.fr.cloud.gov
+          cf_username: ${{ secrets.CG_USERNAME }}
+          cf_password: ${{ secrets.CG_PASSWORD }}
+          cf_org: your-org
+          cf_space: prod
+```
+
+## Best Practices
+
+- ~ Deploy from main branch only
+- ~ Gate on tests and security checks
+- ~ Use rolling or blue/green for production
+
+## References
+
+- https://docs.cloud.gov/platform/management/continuous-deployment/
+- https://docs.cloud.gov/platform/services/cloud-gov-service-account/

package/deployments/cloud-gov/deployment.md

@@ -0,0 +1,150 @@
+---
+applyTo: "**/manifest*.yml,**/Procfile,**/.cfignore,**/.profile"
+---
+
+# Cloud.gov Deployment Instructions (Deft)
+
+Guidance for deploying applications to cloud.gov using Cloud Foundry.
+
+## Prerequisites
+
+- ! Cloud Foundry CLI installed (`cf`)
+- ! Logged in to `api.fr.cloud.gov`
+- ! Targeted correct org/space
+
+## Basic Workflow
+
+1. Prepare required files (`manifest.yml`, `.cfignore`, optional `.profile`, `Procfile`)
+2. Run `cf push`
+3. Verify health and logs
+
+## Required Files
+
+### `manifest.yml` (example)
+
+```yaml
+---
+applications:
+  - name: my-app
+    memory: 512M
+    instances: 2
+    buildpacks:
+      - python_buildpack
+    env:
+      ENVIRONMENT: production
+    services:
+      - my-database
+    routes:
+      - route: my-app.app.cloud.gov
+```
+
+### `.cfignore` (example)
+
+```
+.git/
+.gitignore
+node_modules/
+__pycache__/
+*.pyc
+.env
+.env.*
+tests/
+docs/
+*.md
+!README.md
+```
+
+### `.profile` (optional)
+
+```bash
+#!/bin/bash
+export APP_STARTED_AT=$(date)
+```
+
+### `Procfile` (optional)
+
+```
+web: gunicorn app:app --bind 0.0.0.0:$PORT
+worker: python worker.py
+```
+
+## Deployment Commands
+
+```bash
+cf push
+cf push -f manifest.yml
+cf push --no-start
+cf app <APP_NAME>
+cf logs <APP_NAME> --recent
+```
+
+## Strategies
+
+### Blue/Green
+
+- Deploy new version with temporary name
+- Map routes to new version
+- Unmap routes from old version
+- Delete old version
+
+### Rolling
+
+```bash
+cf push my-app --strategy rolling
+```
+
+### Canary
+
+- Deploy canary instance
+- Map route and monitor
+- Promote or rollback
+
+## Scaling
+
+```bash
+cf scale <APP_NAME> -i 3
+cf scale <APP_NAME> -m 1G
+cf scale <APP_NAME> -k 2G
+```
+
+## Health Checks
+
+```yaml
+applications:
+  - name: my-app
+    health-check-type: http
+    health-check-http-endpoint: /health
+    timeout: 180
+```
+
+## Buildpacks
+
+Common buildpacks:
+
+- `python_buildpack`
+- `nodejs_buildpack`
+- `ruby_buildpack`
+- `java_buildpack`
+- `go_buildpack`
+- `php_buildpack`
+- `dotnet_core_buildpack`
+- `staticfile_buildpack`
+
+List available buildpacks:
+
+```bash
+cf buildpacks
+```
+
+## Troubleshooting
+
+```bash
+cf logs <APP_NAME> --recent
+cf events <APP_NAME>
+cf ssh <APP_NAME>
+```
+
+## References
+
+- https://docs.cloud.gov/platform/deployment/
+- https://docs.cloudfoundry.org/devguide/deploy-apps/

package/deployments/cloud-gov/logging.md

@@ -0,0 +1,43 @@
+---
+applyTo: "**/*.py,**/*.js,**/*.ts,**/*.rb,**/*.java,**/*.go,**/manifest*.yml"
+---
+
+# Cloud.gov Logging Instructions (Deft)
+
+Guidance for logging and monitoring in cloud.gov applications.
+
+## Core Rules
+
+- ! Log to stdout/stderr (no files)
+- ! Never log secrets or PII
+- ~ Use structured JSON logs
+- ~ Include request IDs and timestamps
+
+## Viewing Logs
+
+```bash
+cf logs <APP_NAME> --recent
+cf logs <APP_NAME>
+```
+
+## Structured Log Fields (suggested)
+
+- `timestamp`
+- `level`
+- `event`
+- `request_id`
+- `user_id` (anonymized)
+- `duration_ms`
+
+## Log Drains
+
+```bash
+cf cups my-log-drain -l syslog-tls://logs.example.com:6514
+cf bind-service my-app my-log-drain
+cf restage my-app
+```
+
+## References
+
+- https://docs.cloudfoundry.org/devguide/deploy-apps/streaming-logs.html
+- https://12factor.net/logs

package/deployments/cloud-gov/manifest.md

@@ -0,0 +1,121 @@
+---
+applyTo: "**/manifest*.yml,**/vars*.yml"
+---
+
+# Cloud.gov Manifest Instructions (Deft)
+
+Guidance for writing `manifest.yml` files.
+
+## Required
+
+- ! `name` must be unique in the target space
+- ! `memory` should be explicitly set
+- ~ `instances: 2+` for production workloads
+
+## Example Manifest
+
+```yaml
+---
+applications:
+  - name: my-app
+    memory: 512M
+    disk_quota: 1G
+    instances: 2
+    buildpacks:
+      - python_buildpack
+    command: gunicorn app:app
+    env:
+      ENVIRONMENT: production
+    services:
+      - my-database
+      - my-s3-bucket
+    routes:
+      - route: my-app.app.cloud.gov
+```
+
+## Properties
+
+### Resources
+
+- `memory` (e.g., `512M`, `1G`)
+- `disk_quota` (e.g., `1G`, `2G`)
+- `instances` (integer)
+
+### Buildpacks
+
+```yaml
+buildpacks:
+  - python_buildpack
+```
+
+### Command / Procfile
+
+```yaml
+command: gunicorn app:app --bind 0.0.0.0:$PORT
+```
+
+Or use a `Procfile`:
+
+```
+web: gunicorn app:app --bind 0.0.0.0:$PORT
+```
+
+### Environment Variables
+
+- ! Never store secrets in `manifest.yml`
+- ~ Use bound services or `cf set-env`
+
+### Services
+
+```yaml
+services:
+  - my-postgres
+  - my-redis
+```
+
+### Routes
+
+```yaml
+routes:
+  - route: my-app.app.cloud.gov
+```
+
+### Health Checks
+
+```yaml
+health-check-type: http
+health-check-http-endpoint: /health
+timeout: 180
+```
+
+## Variables and Environments
+
+### Base Manifest + Vars
+
+```yaml
+---
+applications:
+  - name: ((app_name))
+    memory: ((memory))
+    instances: ((instances))
+    env:
+      DATABASE_URL: ((database_url))
+```
+
+```yaml
+app_name: my-app
+memory: 1G
+instances: 3
+database_url: postgres://...
+```
+
+Deploy:
+
+```bash
+cf push -f manifest.yml --vars-file vars-prod.yml
+```
+
+## References
+
+- https://docs.cloudfoundry.org/devguide/deploy-apps/manifest.html
+- https://docs.cloudfoundry.org/devguide/deploy-apps/manifest-attributes.html

package/deployments/cloud-gov/overview.md

@@ -0,0 +1,58 @@
+# Cloud.gov Development Instructions (Deft)
+
+These instructions define cloud.gov conventions and deployment expectations.
+Use them when working with cloud.gov projects.
+
+## Platform Overview
+
+cloud.gov is a FedRAMP-authorized PaaS built on Cloud Foundry. It provides:
+
+- FedRAMP Moderate authorization (shared responsibility)
+- Self-service deployment via `cf` CLI
+- Managed services (databases, object storage, cache)
+- Isolated org/space environments (dev, staging, prod)
+
+## Key Concepts
+
+### Organizations and Spaces
+
+- **Organization (org)**: top-level container
+- **Space**: environment inside org (dev/staging/prod)
+- **Target**: active org/space via `cf target -o <ORG> -s <SPACE>`
+
+### Application Model
+
+- Apps are built by buildpacks and run in containers
+- ! Apps MUST be **stateless**
+- ! Apps MUST read config from environment variables
+- ! Apps MUST log to stdout/stderr
+
+## Required Behaviors
+
+- ! No secrets in code or manifests
+- ! Use `VCAP_SERVICES` for bound service credentials
+- ! Implement health endpoints and configure health checks
+- ! Use HTTPS-only access
+- ~ Use 2+ instances in production
+
+## Expected Files
+
+| File | Purpose |
+|------|---------|
+| `manifest.yml` | Deployment configuration |
+| `.cfignore` | Deployment exclusions |
+| `vars*.yml` | Manifest variables |
+| `.profile` | Pre-start script |
+| `Procfile` | Process definitions |
+
+## Security & Compliance
+
+- cloud.gov is FedRAMP Moderate authorized
+- ! Include NIST SP 800-53 control references in security-relevant code
+- ~ Document inherited vs customer controls
+
+## References
+
+- cloud.gov docs: https://docs.cloud.gov/
+- Cloud Foundry docs: https://docs.cloudfoundry.org/
+- Twelve-Factor App: https://12factor.net/

package/deployments/cloud-gov/security.md

@@ -0,0 +1,46 @@
+---
+applyTo: "**/*.py,**/*.js,**/*.ts,**/*.rb,**/*.java,**/*.go,**/manifest*.yml,**/.github/workflows/*.yml"
+---
+
+# Cloud.gov Security Instructions (Deft)
+
+Guidance for application security and FedRAMP compliance on cloud.gov.
+
+## Shared Responsibility
+
+- cloud.gov manages platform controls
+- you manage application-level controls
+
+## Core Rules
+
+- ! No secrets in code
+- ! Use environment variables or `VCAP_SERVICES`
+- ! Include NIST SP 800-53 control references in security-relevant code
+- ~ Document inherited vs customer controls
+
+## NIST Control References
+
+Use this format in comments and docs:
+
+```
+NIST 800-53: <CONTROL-ID> - <CONTROL-NAME>
+```
+
+Common families:
+
+- AC (Access Control)
+- AU (Audit & Accountability)
+- IA (Identification & Authentication)
+- SC (System & Communications Protection)
+- SI (System & Information Integrity)
+- CM (Configuration Management)
+
+## Egress Rules
+
+- ~ Verify egress configuration for external APIs
+- ~ Use trusted-local egress for platform services
+
+## References
+
+- https://docs.cloud.gov/platform/overview/compliance-overview/
+- https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final