@jetrabbits/agentic 0.0.1

package/areas/devops/infrastructure/rules/secret-hygiene.md

@@ -0,0 +1,53 @@
+# Rule: Secret Hygiene in IaC
+
+**Priority**: P0 — Secrets in IaC code or state are treated as compromised immediately.
+
+## Forbidden Patterns
+
+1. **No secrets in `.tf` files or `tfvars`**
+   ```hcl
+   # ❌ NEVER
+   resource "aws_db_instance" "this" {
+     password = "mypassword123"
+   }
+
+   # ✅ Read from Secrets Manager at plan/apply time
+   data "aws_secretsmanager_secret_value" "db_password" {
+     secret_id = "/${var.environment}/postgres/password"
+   }
+   resource "aws_db_instance" "this" {
+     password = data.aws_secretsmanager_secret_value.db_password.secret_string
+   }
+   ```
+
+2. **No secrets in Ansible vars, inventory, or group_vars without vault encryption**
+   ```yaml
+   # ❌ NEVER in plain-text
+   db_password: supersecret
+
+   # ✅ Ansible Vault encrypted
+   db_password: !vault |
+     $ANSIBLE_VAULT;1.1;AES256
+     ...
+   ```
+
+3. **No `sensitive = false` overrides** — sensitive Terraform outputs stay sensitive.
+
+## Required Patterns
+
+4. **Secret injection at runtime, not provision time**
+   - Preferred: External Secrets Operator pulls from Vault/SM into K8s Secrets at pod start.
+   - Acceptable: `terraform apply` reads from SM/Vault, writes to K8s secret as part of bootstrap.
+   - Never: secrets in container environment variables set from Terraform string literals.
+
+5. **State file protection** — state may contain sensitive values; always encrypt (see state-management.md).
+
+6. **Pre-commit secret scanning** — `git-secrets` or `trufflehog` pre-commit hook required on infra repos.
+
+## Incident Response
+
+If a secret is found in Git history:
+1. Rotate the secret immediately (before anything else).
+2. Remove from history: `git filter-repo` + force push.
+3. Audit access logs for the exposed secret.
+4. File security incident report.

package/areas/devops/infrastructure/rules/state-management.md

@@ -0,0 +1,47 @@
+# Rule: State Management
+
+**Priority**: P0 — State corruption or conflicts can cause catastrophic resource deletion.
+
+## Remote State (mandatory for all non-local environments)
+
+1. **Backend configuration**
+   ```hcl
+   # AWS
+   terraform {
+     backend "s3" {
+       bucket         = "${project}-terraform-state"
+       key            = "${environment}/${component}/terraform.tfstate"
+       region         = "us-east-1"
+       encrypt        = true
+       kms_key_id     = "arn:aws:kms:..."
+       dynamodb_table = "terraform-state-lock"
+     }
+   }
+
+   # GCS (GCP)
+   terraform {
+     backend "gcs" {
+       bucket = "${project}-terraform-state"
+       prefix = "${environment}/${component}"
+     }
+   }
+   ```
+
+2. **State isolation by environment AND component**
+   - One state file per `environment/component` (not one global state).
+   - Staging and production MUST use separate backends (separate buckets/prefix).
+   - Never share state between environments.
+
+3. **State locking** — DynamoDB (AWS) or GCS built-in locking must be enabled. Never disable locking.
+
+4. **No `terraform_remote_state` across environment boundaries**
+   - Cross-stack values shared via SSM Parameter Store, Consul KV, or environment-specific outputs file.
+
+## State File Security
+
+5. **State contains secrets** — treat state files with the same security as production secrets:
+   - S3 bucket: versioning enabled, public access blocked, KMS encryption.
+   - GCS: uniform bucket-level access, CMEK encryption.
+   - Access: only CI/CD pipeline roles and on-call engineers (MFA required for humans).
+
+6. **State file backup** — versioned storage satisfies this; never manually delete old versions.

package/areas/devops/infrastructure/skills/ansible-playbooks/SKILL.md

@@ -0,0 +1,174 @@
+---
+name: ansible-playbooks
+type: skill
+description: Write idempotent Ansible playbooks and roles for server configuration, K8s node provisioning, and application bootstrap.
+related-rules:
+  - iac-standards.md
+  - secret-hygiene.md
+allowed-tools: Read, Write, Edit, Bash
+---
+
+# Skill: Ansible Playbooks
+
+> **Expertise:** Idempotent roles, inventory patterns, Vault integration, molecule testing, bare-metal K8s node prep.
+
+## When to load
+
+When configuring bare-metal servers, provisioning K8s nodes, managing OS-level config, or rotating OS credentials.
+
+## Role Structure (Standard)
+
+```
+roles/base-server/
+├── tasks/
+│   ├── main.yml         ← imports sub-task files
+│   ├── packages.yml
+│   ├── sysctl.yml
+│   └── users.yml
+├── defaults/
+│   └── main.yml         ← all variables with sensible defaults
+├── vars/
+│   └── main.yml         ← internal constants (not overridable)
+├── templates/
+│   └── sysctl.conf.j2
+├── handlers/
+│   └── main.yml         ← restart services on change
+└── meta/
+    └── main.yml         ← role dependencies
+```
+
+## Idempotency Patterns
+
+```yaml
+# ✅ Package install — idempotent
+- name: Install required packages
+  ansible.builtin.apt:
+    name:
+      - containerd
+      - curl
+      - jq
+    state: present
+    update_cache: true
+  when: ansible_os_family == "Debian"
+
+# ✅ File with checksum validation — only copies if changed
+- name: Configure containerd
+  ansible.builtin.template:
+    src: containerd-config.toml.j2
+    dest: /etc/containerd/config.toml
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart containerd     # handler only fires if file changed
+
+# ✅ Service management
+- name: Enable and start containerd
+  ansible.builtin.systemd:
+    name: containerd
+    enabled: true
+    state: started
+    daemon_reload: true
+```
+
+## Handlers Pattern
+
+```yaml
+# handlers/main.yml
+- name: Restart containerd
+  ansible.builtin.systemd:
+    name: containerd
+    state: restarted
+
+- name: Reload sysctl
+  ansible.builtin.command: sysctl --system
+  changed_when: false
+```
+
+## Inventory Structure
+
+```ini
+# inventory/production/hosts.ini
+[control_plane]
+cp-01 ansible_host=192.168.10.10
+cp-02 ansible_host=192.168.10.11
+cp-03 ansible_host=192.168.10.12
+
+[workers]
+worker-01 ansible_host=192.168.10.20
+worker-02 ansible_host=192.168.10.21
+
+[k8s_cluster:children]
+control_plane
+workers
+
+[k8s_cluster:vars]
+ansible_user=ubuntu
+ansible_ssh_private_key_file=~/.ssh/infra-key
+ansible_python_interpreter=/usr/bin/python3
+```
+
+## Vault for Secrets
+
+```bash
+# Encrypt a vars file
+ansible-vault encrypt group_vars/all/vault.yml
+
+# Inline encrypted variable
+ansible-vault encrypt_string 'supersecretpassword' --name 'db_password'
+```
+
+```yaml
+# group_vars/all/vault.yml (encrypted)
+vault_db_password: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  ...
+
+# group_vars/all/vars.yml (plain, references vault vars)
+db_password: "{{ vault_db_password }}"
+```
+
+## K8s Node Prep Playbook (bare-metal)
+
+```yaml
+# playbooks/k8s-node-prep.yml
+---
+- name: Prepare K8s nodes
+  hosts: k8s_cluster
+  become: true
+  roles:
+    - role: base-server          # OS hardening, packages
+    - role: k8s-prereqs          # swap off, kernel modules, sysctl
+    - role: containerd           # install + configure containerd
+    - role: kubeadm-install      # install kubeadm, kubelet, kubectl (pinned)
+```
+
+## Running Playbooks
+
+```bash
+# Dry run (check mode)
+ansible-playbook -i inventory/production/hosts.ini \
+  playbooks/k8s-node-prep.yml --check --diff
+
+# Run with vault password
+ansible-playbook -i inventory/production/hosts.ini \
+  playbooks/k8s-node-prep.yml \
+  --vault-password-file ~/.ansible-vault-password
+
+# Limit to specific hosts
+ansible-playbook -i inventory/production/hosts.ini \
+  playbooks/k8s-node-prep.yml \
+  --limit "worker-01,worker-02"
+
+# Tags for partial runs
+ansible-playbook ... --tags "packages,sysctl" --skip-tags "users"
+```
+
+## Lint & Test
+
+```bash
+# Lint (enforce best practices)
+ansible-lint playbooks/k8s-node-prep.yml
+
+# Molecule test (spins container, runs playbook, verifies)
+cd roles/base-server && molecule test
+```

package/areas/devops/infrastructure/skills/cost-optimization/SKILL.md

@@ -0,0 +1,177 @@
+---
+name: cost-optimization
+type: skill
+description: Identify and reduce cloud infrastructure costs — right-sizing, reserved capacity, waste detection, tagging for cost attribution.
+related-rules:
+  - iac-standards.md
+allowed-tools: Read, Write, Edit, Bash
+---
+
+# Skill: Cost Optimization
+
+> **Expertise:** Cloud cost analysis, right-sizing recommendations, reserved/spot instances, tagging strategy, cost alerting.
+
+## When to load
+
+When investigating unexpectedly high cloud bills, right-sizing instances, or setting up cost attribution by team/environment.
+
+## Mandatory Cost Tags (every resource)
+
+```hcl
+locals {
+  cost_tags = {
+    Project     = var.project      # e.g. "checkout"
+    Environment = var.environment  # prod / staging / dev
+    Team        = var.team         # e.g. "backend-team"
+    CostCenter  = var.cost_center  # e.g. "eng-platform"
+    ManagedBy   = "terraform"
+  }
+}
+# Apply to every resource via merge(local.cost_tags, {...})
+```
+
+## AWS Cost Discovery
+
+```bash
+# Top 10 most expensive services this month
+aws ce get-cost-and-usage \
+  --time-period Start=$(date +%Y-%m-01),End=$(date +%Y-%m-%d) \
+  --granularity MONTHLY \
+  --metrics BlendedCost \
+  --group-by Type=DIMENSION,Key=SERVICE \
+  --query 'ResultsByTime[0].Groups | sort_by(@, &Metrics.BlendedCost.Amount) | reverse(@) | [:10]' \
+  --output table
+
+# Cost by tag (Team)
+aws ce get-cost-and-usage \
+  --time-period Start=$(date +%Y-%m-01),End=$(date +%Y-%m-%d) \
+  --granularity MONTHLY \
+  --metrics BlendedCost \
+  --group-by Type=TAG,Key=Team
+
+# Idle EC2 instances (< 5% CPU, last 2 weeks)
+aws cloudwatch get-metric-statistics \
+  --namespace AWS/EC2 \
+  --metric-name CPUUtilization \
+  --dimensions Name=InstanceId,Value=<instance-id> \
+  --start-time $(date -d '-14 days' --iso-8601) \
+  --end-time $(date --iso-8601) \
+  --period 1209600 --statistics Average
+```
+
+## Right-Sizing Workflow
+
+```bash
+# Step 1: Get actual utilisation (Prometheus, last 7 days)
+# CPU: avg and p99
+avg(avg_over_time(instance:node_cpu_utilisation:rate5m[7d])) by (instance)
+quantile_over_time(0.99, instance:node_cpu_utilisation:rate5m[7d])
+
+# Memory: peak working set
+max_over_time(node_memory_MemUsed_bytes[7d]) / node_memory_MemTotal_bytes
+
+# Step 2: Recommendation formula
+# New CPU = p99_cpu × 1.3 (30% headroom)
+# New memory = peak_mem × 1.2 (20% headroom)
+
+# Step 3: Find next smaller instance type
+# AWS: use ec2-instance-selector
+ec2-instance-selector --vcpus-min 2 --vcpus-max 4 \
+  --memory-min 4 --memory-max 8 \
+  --region eu-west-1 \
+  --output table-wide
+```
+
+## Reserved / Spot Instances
+
+```hcl
+# Spot instances for non-critical worker nodes (60-80% savings)
+resource "aws_launch_template" "workers" {
+  instance_market_options {
+    market_type = "spot"
+    spot_options {
+      max_price           = "0.10"      # cap to avoid surprise costs
+      spot_instance_type  = "persistent"
+      interruption_behavior = "terminate"
+    }
+  }
+}
+
+# Mixed: 70% spot, 30% on-demand for K8s node groups
+resource "aws_autoscaling_group" "workers" {
+  mixed_instances_policy {
+    instances_distribution {
+      on_demand_base_capacity                  = 2    # always 2 on-demand
+      on_demand_percentage_above_base_capacity = 30   # 30% on-demand, 70% spot
+      spot_allocation_strategy                 = "capacity-optimized"
+    }
+  }
+}
+```
+
+## Waste Detection Checklist
+
+```bash
+# Unattached EBS volumes
+aws ec2 describe-volumes \
+  --filters Name=status,Values=available \
+  --query 'Volumes[*].{ID:VolumeId,Size:Size,Created:CreateTime}' \
+  --output table
+
+# Unused Elastic IPs
+aws ec2 describe-addresses \
+  --query 'Addresses[?AssociationId==null].{IP:PublicIp,AllocationId:AllocationId}'
+
+# Old snapshots (> 90 days, no associated AMI)
+aws ec2 describe-snapshots --owner-ids self \
+  --query 'Snapshots[?StartTime<`2024-08-01`].{ID:SnapshotId,Size:VolumeSize,Date:StartTime}' \
+  --output table
+
+# Unused load balancers (0 healthy targets)
+aws elbv2 describe-target-health \
+  --target-group-arn <arn> \
+  --query 'TargetHealthDescriptions[?TargetHealth.State==`unused`]'
+```
+
+## Cost Alerting (AWS Budgets)
+
+```hcl
+resource "aws_budgets_budget" "monthly_limit" {
+  name         = "${var.project}-${var.environment}-monthly"
+  budget_type  = "COST"
+  limit_amount = var.monthly_budget_usd
+  limit_unit   = "USD"
+  time_unit    = "MONTHLY"
+
+  notification {
+    comparison_operator        = "GREATER_THAN"
+    threshold                  = 80
+    threshold_type             = "PERCENTAGE"
+    notification_type          = "ACTUAL"
+    subscriber_email_addresses = [var.billing_alert_email]
+  }
+
+  notification {
+    comparison_operator        = "GREATER_THAN"
+    threshold                  = 100
+    threshold_type             = "FORECASTED"
+    notification_type          = "FORECASTED"
+    subscriber_email_addresses = [var.billing_alert_email]
+  }
+}
+```
+
+## K8s Cost Visibility (Kubecost / OpenCost)
+
+```bash
+# Install OpenCost (open-source K8s cost allocation)
+helm install opencost opencost/opencost -n opencost --create-namespace
+
+# Query cost by namespace
+curl http://localhost:9003/allocation \
+  '?window=7d&aggregate=namespace&accumulate=true' | jq '.data[0]'
+
+# Cost by label (team)
+curl http://localhost:9003/allocation \
+  '?window=7d&aggregate=label:team&accumulate=true'
+```

package/areas/devops/infrastructure/skills/drift-detection/SKILL.md

@@ -0,0 +1,178 @@
+---
+name: drift-detection
+type: skill
+description: Detect, classify, and automate Terraform drift detection in CI — scheduled plans, drift metrics, cloud-native audit log correlation.
+related-rules:
+  - immutability.md
+  - iac-standards.md
+allowed-tools: Read, Write, Edit, Bash
+---
+
+# Skill: Drift Detection
+
+> **Expertise:** Terraform plan-based drift detection, CI scheduling, cloud audit log correlation, drift classification.
+
+## When to load
+
+When setting up scheduled drift detection, investigating detected drift, or correlating drift with cloud audit events.
+
+## Scheduled Drift Detection (GitHub Actions)
+
+```yaml
+# .github/workflows/drift-detection.yml
+name: Drift Detection
+
+on:
+  schedule:
+    - cron: '0 */6 * * *'   # every 6 hours
+  workflow_dispatch:          # manual trigger
+
+jobs:
+  detect-drift:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        component: [network, k8s-cluster, databases, iam-roles]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.DRIFT_DETECTOR_ROLE_ARN }}
+          aws-region: eu-west-1
+
+      - name: Terraform init
+        working-directory: terraform/environments/production/${{ matrix.component }}
+        run: terraform init -backend-config=backend.hcl
+
+      - name: Terraform plan (drift check)
+        id: plan
+        working-directory: terraform/environments/production/${{ matrix.component }}
+        run: |
+          terraform plan \
+            -var-file=terraform.tfvars \
+            -detailed-exitcode \
+            -out=drift-check.plan \
+            2>&1 | tee drift-output.txt
+          echo "exit_code=$?" >> $GITHUB_OUTPUT
+        continue-on-error: true    # exit 2 = changes, don't fail job
+
+      - name: Classify drift
+        if: steps.plan.outputs.exit_code == '2'
+        run: |
+          # Check for security-sensitive resource changes
+          if grep -E "aws_iam|aws_security_group|aws_kms|encryption" drift-output.txt; then
+            echo "SEVERITY=INVESTIGATE" >> $GITHUB_ENV
+          else
+            echo "SEVERITY=REMEDIATE" >> $GITHUB_ENV
+          fi
+
+      - name: Create GitHub Issue on drift
+        if: steps.plan.outputs.exit_code == '2'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const plan = fs.readFileSync('terraform/environments/production/${{ matrix.component }}/drift-output.txt', 'utf8');
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: `[DRIFT] ${{ matrix.component }} — ${process.env.SEVERITY}`,
+              body: `## Drift detected in \`${{ matrix.component }}\`\n\n**Severity:** ${process.env.SEVERITY}\n\n\`\`\`\n${plan.slice(0, 3000)}\n\`\`\``,
+              labels: ['infrastructure', 'drift', process.env.SEVERITY.toLowerCase()]
+            });
+
+      - name: Alert on INVESTIGATE drift
+        if: env.SEVERITY == 'INVESTIGATE'
+        uses: slackapi/slack-github-action@v1
+        with:
+          payload: |
+            {"text": "🚨 *INVESTIGATE drift* in `${{ matrix.component }}` — may indicate unauthorized change. <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View>"}
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_ONCALL_WEBHOOK }}
+```
+
+## GitLab CI Scheduled Drift
+
+```yaml
+# .gitlab-ci.yml — drift detection job (triggered by schedule)
+drift-detect:
+  stage: audit
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "schedule"
+  script:
+    - cd terraform/environments/production/${COMPONENT}
+    - terraform init -backend-config=backend.hcl
+    - terraform plan -var-file=terraform.tfvars -detailed-exitcode
+      -out=drift.plan 2>&1 | tee drift-output.txt || EXITCODE=$?
+    - |
+      if [ "${EXITCODE}" == "2" ]; then
+        echo "DRIFT DETECTED in ${COMPONENT}"
+        # Post to Slack, create MR, or alert via API
+        curl -X POST "$SLACK_WEBHOOK" \
+          -H 'Content-type: application/json' \
+          --data "{\"text\":\"Drift in ${COMPONENT}\"}"
+        exit 1
+      fi
+  parallel:
+    matrix:
+      - COMPONENT: [network, k8s-cluster, databases]
+```
+
+## Drift Classification Logic
+
+```bash
+# Parse terraform plan output for drift classification
+classify_drift() {
+  local plan_output="$1"
+
+  # INVESTIGATE: security-sensitive resources changed
+  if echo "$plan_output" | grep -qE \
+    "aws_iam_policy|aws_security_group|kms_key|aws_s3_bucket_server_side_encryption|encryption_at_rest"; then
+    echo "INVESTIGATE"
+    return
+  fi
+
+  # INVESTIGATE: resources deleted unexpectedly
+  if echo "$plan_output" | grep -q "# .* will be destroyed"; then
+    echo "INVESTIGATE"
+    return
+  fi
+
+  # REMEDIATE: configuration drift (non-security)
+  echo "REMEDIATE"
+}
+```
+
+## Correlating Drift with Cloud Audit Logs
+
+```bash
+# AWS CloudTrail: who changed the drifted resource?
+aws cloudtrail lookup-events \
+  --lookup-attributes AttributeKey=ResourceName,AttributeValue=<resource-id> \
+  --start-time $(date -d '-24 hours' --iso-8601) \
+  --query 'Events[*].{User: Username, Time: EventTime, Event: EventName}' \
+  --output table
+
+# GCP Audit Logs
+gcloud logging read \
+  'resource.type="gce_instance" AND protoPayload.methodName:"compute.instances"' \
+  --freshness=24h \
+  --format='table(timestamp, protoPayload.authenticationInfo.principalEmail, protoPayload.methodName)'
+```
+
+## Drift Suppression (accepted exceptions)
+
+```hcl
+# lifecycle ignore_changes for intentionally managed-outside-TF fields
+resource "aws_autoscaling_group" "workers" {
+  # ...
+  lifecycle {
+    ignore_changes = [
+      desired_capacity,    # managed by cluster autoscaler, not TF
+      min_size,
+    ]
+  }
+}
+```