@dsalazardev/ai-hub-cli 0.0.0-stage → 0.2.0

package/skills/shared/django/references/security.md

@@ -0,0 +1,81 @@
+# Django security checklist
+
+The baseline is `SecurityMiddleware` + the right `SECURE_*` settings, proven by
+`python manage.py check --deploy`. Run that in CI; treat its warnings as failures.
+
+## The must-set settings (prod.py)
+
+```python
+import os
+
+DEBUG = False
+SECRET_KEY = os.environ["SECRET_KEY"]          # KeyError on boot beats a silent default
+ALLOWED_HOSTS = ["example.com", "www.example.com"]
+
+SECURE_SSL_REDIRECT = True
+SECURE_HSTS_SECONDS = 31_536_000               # 1 year; the check --deploy nag is this at 0
+SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+SECURE_HSTS_PRELOAD = True
+SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")  # only behind a trusted proxy
+
+SESSION_COOKIE_SECURE = True
+CSRF_COOKIE_SECURE = True
+SECURE_CONTENT_TYPE_NOSNIFF = True
+X_FRAME_OPTIONS = "DENY"
+CSRF_TRUSTED_ORIGINS = ["https://example.com"]
+```
+
+- `SECURE_HSTS_SECONDS` is the most common `check --deploy` warning: it defaults to 0. Set it,
+  but only once you are sure every subdomain is HTTPS — HSTS is sticky in browsers.
+- `SECURE_PROXY_SSL_HEADER` is safe **only** when a proxy you control sets the header; trusting
+  a client-settable header lets attackers spoof HTTPS.
+
+## CSP — native in Django 6.0
+
+```python
+# 6.0+: ContentSecurityPolicyMiddleware reads these
+from django.utils.csp import CSP
+
+SECURE_CSP = {
+    "default-src": [CSP.SELF],
+    "script-src": [CSP.SELF, CSP.NONCE],   # nonce per response, no 'unsafe-inline'
+    "img-src": [CSP.SELF, "data:"],
+}
+# SECURE_CSP_REPORT_ONLY = {...}  # roll out in report-only first, then enforce
+```
+
+```html
+<script nonce="{{ request.csp_nonce }}">/* trusted inline */</script>
+```
+
+- Add `django.middleware.csp.ContentSecurityPolicyMiddleware` to `MIDDLEWARE`.
+- Pre-6.0: the third-party `django-csp` package provides the same shape.
+- Roll out with `SECURE_CSP_REPORT_ONLY` first; flip to `SECURE_CSP` once reports are clean.
+
+## CSRF & sessions
+
+- Keep `CsrfViewMiddleware`. Never blanket `@csrf_exempt`; for a DRF JSON API, auth via token/
+  session is the boundary, and DRF enforces CSRF for `SessionAuthentication`.
+- Set `SESSION_COOKIE_SAMESITE = "Lax"` (or `"Strict"` for sensitive apps).
+
+## ORM injection — the only way in
+
+The ORM parameterizes everything. You can only reintroduce injection by hand:
+
+```python
+# Bad: f-string interpolation — injectable
+User.objects.raw(f"SELECT * FROM users WHERE email = '{email}'")
+cursor.execute("SELECT * FROM logs WHERE id = %s" % user_id)
+
+# Good: parameters, never interpolation
+User.objects.raw("SELECT * FROM users WHERE email = %s", [email])
+cursor.execute("SELECT * FROM logs WHERE id = %s", [user_id])
+```
+
+Avoid `.extra()` (deprecated, injection-prone). Prefer the ORM or `Func`/`RawSQL` with params.
+
+## File uploads & SSRF
+
+- Validate uploaded content type and size; store outside the web root; never trust the filename.
+- Any server-side fetch of a user-supplied URL is SSRF-prone — allowlist hosts, block internal
+  ranges. Cross-stack SSRF/threat-modeling depth is `secure-coding`.

package/skills/shared/django/references/testing.md

@@ -0,0 +1,86 @@
+# Testing Django with pytest-django
+
+Use `pytest-django`. It gives you DB fixtures, the `@pytest.mark.django_db` gate, and
+`--reuse-db`. The stdlib `TestCase` still works; the patterns below apply to both.
+
+## Setup
+
+```toml
+# pyproject.toml
+[tool.pytest.ini_options]
+DJANGO_SETTINGS_MODULE = "config.settings.test"
+addopts = "--reuse-db --strict-markers"
+```
+
+- `--reuse-db` skips schema rebuild between runs locally; CI drops it (or runs `--create-db`).
+- A dedicated `settings/test.py` uses a fast hasher and an in-memory or disposable DB.
+
+## DB access & transactions
+
+```python
+import pytest
+
+@pytest.mark.django_db                 # this test may touch the DB
+def test_publish(article):
+    article.publish()
+    article.refresh_from_db()
+    assert article.status == "published"
+```
+
+- `TestCase` (and `django_db`) wraps each test in a transaction that rolls back — fast, isolated.
+- Use `TransactionTestCase` / `@pytest.mark.django_db(transaction=True)` **only** when you assert
+  `transaction.on_commit` callbacks or genuine multi-connection commit behavior; it truncates
+  tables and is slower.
+
+## Factories over hand-built rows
+
+```python
+import factory
+from catalog.models import Product
+
+class ProductFactory(factory.django.DjangoModelFactory):
+    class Meta:
+        model = Product
+    name = factory.Sequence(lambda n: f"product-{n}")
+    price = 9.99
+    owner = factory.SubFactory("tests.factories.UserFactory")
+```
+
+`ProductFactory.create_batch(20)` beats 20 hand-written `objects.create(...)` calls and stays
+correct as the model grows.
+
+## Locking in N+1 fixes
+
+```python
+from django.test import TestCase
+
+class ListQueryTests(TestCase):
+    def test_list_is_constant_queries(self):
+        ProductFactory.create_batch(10)
+        with self.assertNumQueries(2):          # list + one prefetch, regardless of N
+            list(Product.objects.select_related("owner"))
+```
+
+`assertNumQueries` turns a silent N+1 regression into a red build. Add one to every list/detail
+endpoint that walks a relation.
+
+## API tests
+
+```python
+from rest_framework.test import APIClient
+
+@pytest.mark.django_db
+def test_owner_only(product, owner):
+    client = APIClient()
+    assert client.get(f"/api/products/{product.pk}/").status_code == 403   # anon
+    client.force_authenticate(owner)
+    assert client.get(f"/api/products/{product.pk}/").status_code == 200
+```
+
+- `force_authenticate(user)` bypasses the login round-trip; test the permission, not the auth UI.
+- Test the boundary cases: anonymous, wrong owner, correct owner, and invalid payload (400).
+
+## Coverage
+
+Run `pytest --cov` and set `--cov-fail-under` in `pyproject.toml`. Cover model methods,
+managers, permissions and serializers validators — the logic, not the framework.

package/skills/shared/django/scripts/verify.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+#
+# verify.sh — read-only foot-gun lint for a Django project.
+#
+# Usage:
+#   ./scripts/verify.sh [TARGET_PATH]      # default: current directory
+#
+# Greps tracked Django source for high-signal mistakes. It NEVER edits anything and
+# NEVER runs the project; it only reads files. This is a lint, not a replacement for
+# `python manage.py check --deploy` or the test suite.
+#
+# Exit codes:
+#   0  clean, empty target, or warnings only
+#   2  at least one FAIL-level finding
+#
+# FAIL  literal SECRET_KEY in source; ALLOWED_HOSTS = ['*']; f-string/%-built SQL
+#       passed to .raw()/.extra()/cursor.execute
+# WARN  DEBUG = True outside a *dev*/*local* settings file; ModelViewSet/APIView with
+#       no permission_classes nearby
+#
+# Compatible with stock macOS bash 3.2: no mapfile, no associative arrays, find-based
+# file discovery, every array access guarded so `set -u` never trips.
+
+set -euo pipefail
+
+TARGET="${1:-.}"
+
+if [ -t 1 ]; then
+  RED=$'\033[0;31m'; GREEN=$'\033[0;32m'; YELLOW=$'\033[0;33m'; RESET=$'\033[0m'
+else
+  RED=''; GREEN=''; YELLOW=''; RESET=''
+fi
+warn() { printf '%sWARN%s %s\n' "$YELLOW" "$RESET" "$*"; }
+fail() { printf '%sFAIL%s %s\n' "$RED" "$RESET" "$*"; }
+ok()   { printf '%s%s%s\n' "$GREEN" "$*" "$RESET"; }
+
+FAILS=0
+WARNS=0
+
+# A Django project is present if there is a manage.py, a settings file, or any *.py.
+# With none of those there is nothing to lint, so exit 0 (no false failure on empty).
+django_present() {
+  if [ -f "$TARGET/manage.py" ]; then return 0; fi
+  if [ -n "$(find "$TARGET" -type f -name 'settings*.py' -print -quit 2>/dev/null)" ]; then return 0; fi
+  if [ -n "$(find "$TARGET" -type f -name '*.py' -print -quit 2>/dev/null)" ]; then return 0; fi
+  return 1
+}
+
+if ! django_present; then
+  ok "verify.sh: ok (no Django/Python source under '${TARGET}', nothing to lint)"
+  exit 0
+fi
+
+# grep helpers: -E extended regex, -r recursive, -n line numbers, -I skip binary.
+# Restrict to .py for code checks. Suppress grep's exit status (it is informational).
+gpy() { grep -REnI --include='*.py' "$1" "$TARGET" 2>/dev/null || true; }
+
+# --- FAIL: literal SECRET_KEY assignment to a string literal ---
+HITS="$(gpy '^[[:space:]]*SECRET_KEY[[:space:]]*=[[:space:]]*["'\'']' | grep -v 'os\.environ\|getenv\|config(\|env(' || true)"
+if [ -n "$HITS" ]; then
+  fail "SECRET_KEY assigned a literal string (read it from os.environ instead):"
+  printf '%s\n' "$HITS"
+  FAILS=$((FAILS + 1))
+fi
+
+# --- FAIL: ALLOWED_HOSTS = ['*'] (any quote/spacing) ---
+HITS="$(gpy 'ALLOWED_HOSTS[[:space:]]*=[[:space:]]*\[[[:space:]]*["'\'']\*["'\'']' || true)"
+if [ -n "$HITS" ]; then
+  fail "ALLOWED_HOSTS allows every host ('*') — list explicit domains:"
+  printf '%s\n' "$HITS"
+  FAILS=$((FAILS + 1))
+fi
+
+# --- FAIL: f-string / %-built SQL into .raw()/.extra()/cursor.execute ---
+HITS="$(gpy '(\.raw|\.extra|cursor\.execute)\([[:space:]]*(f["'\'']|["'\''].*%[^s])' || true)"
+if [ -n "$HITS" ]; then
+  fail "SQL string interpolation into .raw()/.extra()/cursor.execute (use params, not f-strings/%):"
+  printf '%s\n' "$HITS"
+  FAILS=$((FAILS + 1))
+fi
+
+# --- WARN: DEBUG = True outside a dev/local settings file ---
+DEBUG_HITS="$(gpy '^[[:space:]]*DEBUG[[:space:]]*=[[:space:]]*True' || true)"
+if [ -n "$DEBUG_HITS" ]; then
+  # Drop lines whose file path looks like a dev/local/test settings module.
+  NONDEV="$(printf '%s\n' "$DEBUG_HITS" | grep -vEi '(dev|local|test)' || true)"
+  if [ -n "$NONDEV" ]; then
+    warn "DEBUG = True outside a dev/local settings file (must be False in prod):"
+    printf '%s\n' "$NONDEV"
+    WARNS=$((WARNS + 1))
+  fi
+fi
+
+# --- WARN: ModelViewSet / APIView subclasses with no permission_classes nearby ---
+# Heuristic: a file that defines such a class but never mentions permission_classes.
+VS_FILES="$(grep -rlEI --include='*.py' '(ModelViewSet|ReadOnlyModelViewSet|viewsets\.GenericViewSet|APIView)' "$TARGET" 2>/dev/null || true)"
+if [ -n "$VS_FILES" ]; then
+  while IFS= read -r f; do
+    [ -z "$f" ] && continue
+    if ! grep -qE 'permission_classes' "$f" 2>/dev/null; then
+      warn "no permission_classes in a viewset/APIView file (endpoint may be open): $f"
+      WARNS=$((WARNS + 1))
+    fi
+  done <<EOF
+$VS_FILES
+EOF
+fi
+
+printf '\n%d fail, %d warn\n' "$FAILS" "$WARNS"
+if [ "$FAILS" -gt 0 ]; then
+  fail "verify.sh: foot-guns detected"
+  exit 2
+fi
+ok "verify.sh: ok"
+exit 0

package/skills/shared/docker/SKILL.md

@@ -0,0 +1,251 @@
+---
+name: docker
+description: "Use when authoring or auditing a Dockerfile, shrinking a bloated image, hardening a container that runs as root, picking a base image, or wiring a Compose dev loop with hot reload. NOT CI builds or deploy-to-host (that is `deployment`), NOT k8s autoscaling (that is `scaling`), NOT app-level injection or secrets-in-code (that is `secure-coding`)."
+tags: [docker, containers, dockerfile, compose, image-security]
+recommends: [deployment, secure-coding, scaling, github-actions]
+origin: ai-hub
+---
+
+# docker — container-craft
+
+You own one question, deeply: **how do I turn this app into a small, secure, fast-building
+image — and run a frictionless local stack with Compose?** Your artifacts are the `Dockerfile`,
+the `.dockerignore`, and the `compose.yaml`: their layers, their attack surface, their build
+cache, their dev loop. You do not touch what happens after the image is built.
+
+```text
+source  →  Dockerfile (multi-stage, cache mounts)  →  small + scanned image  +  compose.yaml (dev loop)
+                                                            └──────────────┬──────────────┘
+                                                    hand off to ../deployment/SKILL.md
+```
+
+The hand-off is sharp: **the moment you have a green, scanned image and a working
+`compose.yaml`, you are done.** Everything downstream is `../deployment/SKILL.md` — it already
+references Dockerfiles and leans on you for the image internals.
+
+## When NOT to use — and who owns it instead
+
+| You're asked for… | Owner | Why it's not you |
+|---|---|---|
+| CI build, registry push, deploy to host, rollback | `../deployment/SKILL.md` | You build + harden the image; it moves the image through CI to prod |
+| k8s manifests, HPA autoscaling, ingress | `scaling` | Orchestration above a single image |
+| App SQL injection, secrets in source, dep CVE triage | `../secure-coding/SKILL.md` | You cover only *image/container* hardening |
+| Install/operate a self-hosted PaaS | `../coolify/SKILL.md` | Host operation, not the image |
+| Containerless PaaS deploy mechanics | `../railway/SKILL.md`, `../fly-io/SKILL.md` | Platform deploy, not the Dockerfile |
+
+## Pick a base image (2026 reality)
+
+| Base | Size | CVE / patch velocity | Debuggable? | Wins when |
+|---|---|---|---|---|
+| `*-slim` (e.g. `bookworm-slim`) | ~30–80 MB | moderate, glibc | yes (shell, apt) | pragmatic default, native deps / Python wheels |
+| `distroless` (`gcr.io/distroless/*`) | ~2–25 MB | convenient but **patches slower** | no shell | static/compiled runtimes, want minimal surface |
+| **Chainguard / Wolfi** | tiny, glibc | **lowest live CVE count**, SLSA L3 attestations | minimal | security-first; real scans found high-sev CVEs where the Chainguard equivalent had zero |
+| `alpine` | ~5 MB, musl | small surface | yes (apk) | tiny static services — **but musl breaks many Python wheels / native deps** |
+| `scratch` | 0 | nothing to patch | no | a fully static binary (Go), nothing else |
+
+Rule of thumb: glibc app with native deps → `*-slim` or Wolfi. Static Go binary → `scratch` or
+`distroless/static`. Security mandate → Chainguard. Reach for `alpine` only when you've confirmed
+your wheels/native libs build against musl. Per-language tag maps, multi-stage templates for the
+stacks not shown below (Rust, JVM `jlink`, static SPA → nginx) and multi-arch buildx live in
+[references/base-images-and-stages.md](references/base-images-and-stages.md).
+
+## Multi-stage skeletons
+
+**Node — `npm ci` with a cache mount → distroless nonroot.** Bad: single-stage `node:20` ≈ 1.1 GB.
+Good: this ≈ 180 MB. Tags track Node 24 (the active LTS as of mid-2026); Node 22 is in Maintenance
+LTS, so swap `24`→`22` only when you deliberately want the conservative maintenance line.
+
+```dockerfile
+# syntax=docker/dockerfile:1
+FROM node:24-bookworm-slim AS build
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN --mount=type=cache,target=/root/.npm npm ci
+COPY . .
+RUN npm run build && npm prune --omit=dev
+
+FROM gcr.io/distroless/nodejs24-debian13:nonroot
+WORKDIR /app
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/dist ./dist
+USER nonroot
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=3s CMD ["node", "dist/healthcheck.js"]
+CMD ["dist/server.js"]
+```
+
+**Python — `uv` into a venv → slim, non-root.** Bad: `python:3.12` + `pip` ≈ 1 GB. Good: ≈ 130 MB.
+
+```dockerfile
+# syntax=docker/dockerfile:1
+FROM python:3.13-slim-bookworm AS build
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+WORKDIR /app
+ENV UV_PROJECT_ENVIRONMENT=/opt/venv
+COPY pyproject.toml uv.lock ./
+RUN --mount=type=cache,target=/root/.cache/uv uv sync --frozen --no-dev
+
+FROM python:3.13-slim-bookworm
+RUN useradd --create-home --uid 10001 app
+COPY --from=build --chown=app:app /opt/venv /opt/venv
+COPY --chown=app:app . /app
+WORKDIR /app
+ENV PATH="/opt/venv/bin:$PATH"
+USER app
+EXPOSE 8000
+HEALTHCHECK CMD ["python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8000/health').status==200 else 1)"]
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
+```
+
+**Go — static binary → `scratch`.** Bad: `golang:1.26` ≈ 900 MB. Good: ≈ 12 MB. Pin a
+supported toolchain: Go maintains only the latest two minors (1.26/1.25 as of mid-2026), so a
+`golang:1.23` build image is two minors past EOL and no longer gets security patches.
+
+```dockerfile
+# syntax=docker/dockerfile:1
+FROM golang:1.26-bookworm AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY . .
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /app ./cmd/server
+
+FROM scratch
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=build /app /app
+USER 10001:10001
+EXPOSE 8080
+ENTRYPOINT ["/app"]
+```
+
+The cache-mount `target` differs per ecosystem: `/root/.npm`, `/root/.cache/uv` (or
+`/root/.cache/pip`), `/go/pkg/mod`. The cache persists across builds without bloating any layer.
+
+## `.dockerignore` — load-bearing, not optional
+
+Without it the entire context (including `.git`, `node_modules`, `.env`) ships to the daemon: it
+slows the build and can bake secrets into a layer via `COPY .`.
+
+```gitignore
+.git
+.gitignore
+node_modules
+dist
+.env
+.env.*
+*.log
+.venv
+__pycache__
+Dockerfile
+.dockerignore
+README.md
+```
+
+Mirror `.gitignore`, then add build outputs and the Dockerfile itself.
+
+## Harden the runtime
+
+Non-root in the image (already shown above): create a user, `COPY --chown`, `USER`. Then lock the
+runtime down where the container actually runs:
+
+```bash
+docker run \
+  --read-only --tmpfs /tmp \
+  --security-opt=no-new-privileges \
+  --cap-drop=ALL \
+  myimage:1.4.0
+```
+
+`--read-only` rootfs + `--tmpfs /tmp` for scratch space; `no-new-privileges` blocks setuid
+escalation; `--cap-drop=ALL` then add back only what you truly need (`--cap-add=NET_BIND_SERVICE`
+to bind port < 1024).
+
+**Build secrets — never `ARG`/`ENV`.** An `ARG TOKEN` lands in the image history and any
+`ENV SECRET=...` persists in a layer. Use a BuildKit secret mount; it is never written to a layer:
+
+```dockerfile
+# Bad — leaks into image history:  ARG NPM_TOKEN
+# Good:
+RUN --mount=type=secret,id=npm_token \
+    NPM_TOKEN="$(cat /run/secrets/npm_token)" npm ci
+```
+
+```bash
+docker build --secret id=npm_token,env=NPM_TOKEN .
+```
+
+## Compose for dev
+
+Canonical filename is `compose.yaml`; **omit the obsolete `version:` key**; use `docker compose`
+(v2 subcommand), never the standalone `docker-compose` v1. One concern per container — the app, the
+database and the seed job are separate services. `develop.watch` is GA since Compose 2.22.0 and
+gives you a tight dev loop.
+
+```yaml
+services:
+  api:
+    build: .
+    ports: ["8000:8000"]
+    depends_on:
+      db:
+        condition: service_healthy
+    develop:
+      watch:
+        - action: sync          # hot-reload: copy changed files into the container
+          path: ./src
+          target: /app/src
+        - action: rebuild       # lockfile / compiled langs: rebuild the image
+          path: ./uv.lock
+        - action: sync+restart  # config change: sync then restart the process
+          path: ./config.yaml
+          target: /app/config.yaml
+  db:
+    image: postgres:17-bookworm
+    environment:
+      POSTGRES_PASSWORD: dev
+    volumes: ["pgdata:/var/lib/postgresql/data"]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+  seed:
+    profiles: ["tools"]         # only runs with: docker compose --profile tools up
+    build: .
+    command: ["python", "-m", "app.seed"]
+
+volumes:
+  pgdata:
+```
+
+Run the dev loop with `docker compose watch` (or `docker compose up --watch`). Fuller patterns —
+watch-per-stack, multi-service healthcheck graphs, override files, `env_file` vs `secrets`, and
+when to graduate to `deployment`/`scaling` — are in
+[references/compose-recipes.md](references/compose-recipes.md).
+
+## Verify the image
+
+These are exactly what `scripts/verify.sh` automates (it skips a tool gracefully if absent):
+
+- `hadolint Dockerfile` — static lint of the Dockerfile (no error-level findings).
+- `docker compose config -q` — the `compose.yaml` parses and resolves.
+- `trivy image myimage:1.4.0` — CVE + misconfig + secret scan of the built image.
+- `trivy config .` — scan the Dockerfile/compose for misconfiguration without a build.
+- `dockle myimage:1.4.0` — CIS-style image hygiene.
+- size check — assert the final image is under your threshold (`docker image inspect -f '{{.Size}}'`).
+
+## Anti-patterns
+
+| Bad | Good | Why |
+|---|---|---|
+| `FROM node:latest` | `FROM node:24-bookworm-slim`, or pin a digest | `:latest` drifts under you; builds + scans become non-reproducible |
+| runs as root (no `USER`) | `USER nonroot` / `USER 10001` | PID 1 defaults to root (UID 0), so a container escape == host compromise |
+| `ARG TOKEN` / `ENV SECRET=` | `RUN --mount=type=secret,...` | ARG/ENV persist in image history & layers |
+| `COPY . .` then `RUN npm ci` | copy lockfile → install → copy source | source edits bust the dep cache layer every build |
+| single `FROM`, ship the SDK | multi-stage, copy only the artifact | runtime carries compilers & dev CVE surface |
+| `apt-get install x` | `apt-get install --no-install-recommends x && rm -rf /var/lib/apt/lists/*` | recommends + apt lists bloat the layer |
+| no `.dockerignore` | mirror `.gitignore` + build outputs | whole context ships; `.env`/`.git` can leak |
+| `version: "3.8"` / `docker-compose` v1 | omit `version:`; `docker compose` v2 | the key is obsolete; v1 is EOL |
+| `CMD npm start` (shell form) | `CMD ["node", "server.js"]` (exec) | shell form wraps the process in `/bin/sh -c`, which swallows `SIGTERM` — no graceful shutdown |
+| no `HEALTHCHECK` | `HEALTHCHECK CMD [...]` | nothing for Compose/orchestrators to gate readiness on (`condition: service_healthy`) |

package/skills/shared/docker/evals/README.md

@@ -0,0 +1,10 @@
+# Evals — docker
+
+`cases.yaml` has two kinds of checks. `should_trigger` / `should_not_trigger` are routing cases:
+they validate that this skill's `description` fires on real container/image/Compose phrasings
+(including the size-symptom and Catalan/Spanish ones) and stays quiet for CI-deploy, k8s,
+app-security, and PaaS-host prompts, each routing to a named sibling. The `capability` case is a
+rubric-graded scenario: feed the naive single-stage root Dockerfile to the skill and grade the
+output against `must_include` (multi-stage, cache mount, non-root, pinned base, `.dockerignore`,
+exec-form CMD, healthcheck, compose watch, no ARG/ENV secrets, hadolint/trivy). Run these through
+the repo's eval harness; routing cases are mechanical, the capability case is manual or LLM-graded.

package/skills/shared/docker/evals/cases.yaml

@@ -0,0 +1,44 @@
+skill: docker
+
+should_trigger:
+  - prompt: "Dockerize this FastAPI service so it's ready for prod."
+    why: Core authoring of a Dockerfile for a Python web app — the skill's primary job.
+  - prompt: "Our node image is 1.2GB, shrink it."
+    why: Size symptom with no mention of "Dockerfile" — non-obvious entry that maps to multi-stage + base choice.
+  - prompt: "Set up docker compose with live reload for local dev."
+    why: Compose dev loop via develop.watch, the skill's Compose half.
+  - prompt: "This Dockerfile runs as root and trivy flags it — harden it."
+    why: Image/container hardening (non-root, scan) which is in-scope, not app-level security.
+  - prompt: "El build de docker tarda siglos y la imagen pesa demasiado."
+    why: Catalan/Spanish, non-obvious — slow build + heavy image map to cache mounts, layer order, multi-stage.
+
+should_not_trigger:
+  - prompt: "Write the GitHub Actions workflow to build and push to ghcr."
+    route_to: deployment
+    why: CI pipeline + registry push is downstream of the image; deployment owns it.
+  - prompt: "Add k8s HPA autoscaling for this service."
+    route_to: scaling
+    why: Orchestration/autoscaling above a single image is scaling's domain.
+  - prompt: "Fix the SQL injection in this endpoint."
+    route_to: secure-coding
+    why: App-level vulnerability, not image/container hardening.
+  - prompt: "Install and configure Coolify on my Hetzner box."
+    route_to: coolify
+    why: Self-hosted PaaS host operation, not authoring the image.
+
+capability:
+  - scenario: >
+      Given a naive single-stage Dockerfile that uses FROM node:latest, runs npm install after
+      COPY . ., runs as root, has no .dockerignore and no healthcheck, produce a hardened
+      replacement plus the supporting files.
+    must_include:
+      - Multi-stage build (separate build and runtime FROM stages)
+      - BuildKit cache mount on the dependency install (e.g. --mount=type=cache,target=/root/.npm)
+      - Non-root USER in the final image
+      - Pinned, non-latest base image (tag or digest, not :latest)
+      - A .dockerignore that excludes .git, node_modules, .env
+      - EXEC-form CMD/ENTRYPOINT (JSON array, not shell form)
+      - A HEALTHCHECK instruction
+      - A compose.yaml using develop.watch for the dev loop
+      - No secrets in ARG/ENV (build secrets via --mount=type=secret)
+      - Mentions verifying with hadolint and trivy