@ngocsangairvds/vsaf 4.0.6 → 4.0.8

package/skills/vds-skill/install-deps.mjs

@@ -10,11 +10,12 @@
  *   node install-deps.mjs [projectPath]
  */
 
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
-import { join } from 'path';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync } from 'fs';
+import { join, dirname } from 'path';
 import { homedir } from 'os';
 
 const projectPath = process.argv[2] || process.cwd();
+const packDir = process.argv[3] || dirname(new URL(import.meta.url).pathname);
 
 // ── Config ──
 
@@ -141,14 +142,29 @@ if (missing.length > 0) {
   log('💡', 'Skills will also lazy-prompt at runtime if values are empty.');
 }
 
-// ── Step 4: Check vds-cli + create project-local wrapper ──
+// ── Step 4: Deploy bundled vds-scripts to project ──
 
 console.log('');
 const { execSync } = await import('child_process');
 
-// Detect vds-scripts location (project-local preferred, then global)
 const localVdsScripts = join(projectPath, '.claude', 'vds-scripts');
 const globalVdsScripts = join(homedir(), '.claude', 'vds-scripts');
+const bundledVdsScripts = join(packDir, 'vds-scripts');
+
+if (!existsSync(localVdsScripts) && existsSync(bundledVdsScripts)) {
+  log('📦', 'Deploying bundled vds-scripts to .claude/vds-scripts/ ...');
+  try {
+    mkdirSync(join(projectPath, '.claude'), { recursive: true });
+    cpSync(bundledVdsScripts, localVdsScripts, { recursive: true });
+    log('✅', `vds-scripts deployed: ${localVdsScripts}`);
+  } catch (e) {
+    log('⚠️', `Failed to deploy vds-scripts: ${e.message}`);
+  }
+} else if (existsSync(localVdsScripts)) {
+  log('✅', 'vds-scripts already exists at .claude/vds-scripts/');
+}
+
+// Detect vds-scripts location (project-local preferred, then global)
 const vdsScriptsDir = existsSync(localVdsScripts) ? localVdsScripts
   : existsSync(globalVdsScripts) ? globalVdsScripts
   : null;

package/skills/vds-skill/vds-scripts/.claude/phase7-CLOSURE.md

@@ -0,0 +1,100 @@
+# Phase 7 Lane Closure Notes
+
+## Lane G3 — materials_cli Triage (2026-04-19)
+
+**Scope**: `audit_orchestrator/tests/test_cli/test_materials_cli.py`
+**Method**: Ran 4 tests on both phase7/composition and master (450f6e3). All 4 fail identically on both branches.
+**Conclusion**: All 4 are pre-existing failures — unrelated to Phase 7 changes.
+
+---
+
+### Test: test_list_materials_resolves_project_storage_key_directory
+- **Status**: pre-existing
+- **Failure**: `assert "2" in result.stdout` — attachment count displays "0" instead of "2"
+- **Root cause**: Test sets up top-level `attachments: [{"attachment_id": "a-1"}, ...]` on the mock state, but `misc_cmds.py` reads attachment count from `linked_page_resolution.attachment_total`, not the top-level `attachments` list. Test expectation-vs-implementation mismatch that predates Phase 7.
+- **Evidence**: Same `AssertionError` on master (450f6e3). `misc_cmds.py` was touched in Phase 7 (commit 13f6454, SecretStr sweep) but only changed `api_key.get_secret_value()` → `resolve_secret()` at line ~197; the `linked_page_resolution.attachment_total` read path was not modified.
+- **Action**: none (pre-existing, defer to a follow-up issue)
+
+---
+
+### Test: test_extract_docs_refresh_snapshot_prefers_native_repo_identity_for_head_baseline
+- **Status**: pre-existing
+- **Failure**: Assertion on repo identity/head-baseline snapshot path
+- **Evidence**: Fails identically on master (450f6e3) with no diff in the test code vs master. `extract_cmds.py` was modified in Phase 7 (commits a4ffaba + 13f6454) to remove legacy telemetry fields and use `resolve_secret()`, but neither change touches the snapshot identity path exercised by this test.
+- **Action**: none (pre-existing, defer)
+
+---
+
+### Test: test_extract_docs_no_change_fast_path_skips_repo_chunk_build_and_repo_refresh
+- **Status**: pre-existing
+- **Failure**: `exit_code == 1`, error: `"Material extraction failed: repo chunk build should be skipped"`. Stderr shows: `"error": "State API missing required function. Tried: list_retrieval_snapshots"` — the mock state in the test doesn't implement `list_retrieval_snapshots`, so the lookup fails and code falls through to chunk building, which then hits the assertion error.
+- **Evidence**: Same failure on master (450f6e3). The `list_retrieval_snapshots` call predates Phase 7; Phase 7 extract_cmds.py diff only removed telemetry fields (retry_events, p95_page_latency_ms, latency_ms, recent_retry_events).
+- **Action**: none (pre-existing, defer — test mock needs `list_retrieval_snapshots` stub)
+
+---
+
+### Test: test_extract_docs_linked_page_fast_path_skips_no_change_runs
+- **Status**: pre-existing
+- **Failure**: `assert ['88710001', '1001', '2002'] == ['88710001', '1001']` — page '2002' is downloaded (cache_hit) but test expects it to be skipped by the linked-page fast path. Log shows `extract_docs_linked_page_fast_path_bypassed_no_prior_linked_pages` — fast path is bypassed because there are no prior linked pages in the corpus, so the full download runs instead of the expected no-op.
+- **Evidence**: Same `AssertionError` on master (450f6e3). Phase 7 extract_cmds.py diff is purely telemetry field removal; the linked-page fast path logic is untouched.
+- **Action**: none (pre-existing, defer — test setup needs a corpus with prior linked pages to trigger the fast path)
+
+---
+
+### Summary
+- Pre-existing defers: **4**
+- Regressions fixed: **0**
+- Production code changes: **none**
+- Master evidence SHA: `450f6e387acdb86cd8651244eaa612c1fbd5db9b`
+- Verification run: `uv run --project audit_orchestrator pytest <4 tests> -q --tb=short --timeout=60` on master stash → 4 failed, 0 passed (identical failure modes)
+
+---
+
+## Lane D — dispatch-status CLI Triage (2026-04-19)
+
+**Scope**: `audit_orchestrator/tests/test_cli/test_doctor_dispatch_status_cli.py`
+**Baseline**: All 5 tests were previously hidden by fixture setup error (AttributeError on `runtime_profiles.load_shared_env`). G1's try/except fix made them runnable, exposing 3 distinct pre-existing isolation/assertion gaps.
+
+---
+
+### Test: test_dispatch_status_no_dsn_fails
+- **Status**: fixed
+- **Root cause**: `apply_runtime_profile` (called from `@app.callback()`) invokes `vds_agent_core.profiles.load_shared_env` — a reference not covered by the existing `_isolate_env` patches. This re-loaded `~/.vds/.env` and restored `VDS_AUDIT_STATE_DSN` into `os.environ` even after `monkeypatch.delenv`, causing the command to connect to a real database and return exit 0 instead of failing.
+- **Action**: Added `monkeypatch.setattr("vds_agent_core.profiles.load_shared_env", _noop_env)` to the `_isolate_env` autouse fixture. Test now exits 1 as expected.
+
+---
+
+### Test: test_dispatch_status_table_output
+- **Status**: fixed
+- **Root cause**: Rich table column truncation. In an 80-char terminal (CliRunner default), "run-001" → "run-…" and "88727304" → "8872…". Test asserted `"run-0" in result.output` which doesn't match the ellipsis form.
+- **Action**: Updated assertions to `"run-" in result.output` and `"8872" in result.output` — 4-char prefixes present in both truncated and non-truncated forms.
+
+---
+
+### Test: test_repair_dispatch_no_stuck_runs_json
+- **Status**: fixed
+- **Root cause**: TSK-170.13 added `store._schema_compat_result` access in `doctor_repair_dispatch` before any repair operations. `FakeStore` lacked this attribute, causing `AttributeError` → caught by `except Exception` → `Exit(1)`.
+- **Action**: Added nested `_Compat` class with `status="compliant", violations=[]` to `FakeStore`.
+
+---
+
+### Test: test_repair_dispatch_force_json
+- **Status**: fixed
+- **Root cause**: Same as above — `FakeStore._schema_compat_result` missing.
+- **Action**: Same fix applied to this test's `FakeStore`.
+
+---
+
+### Test: test_repair_dispatch_stale_hours_param
+- **Status**: fixed
+- **Root cause**: Same as above — `FakeStore._schema_compat_result` missing.
+- **Action**: Same fix applied to this test's `FakeStore`.
+
+---
+
+### Summary
+- Fixes applied: **5** (all 5 tests now pass)
+- Pre-existing defers: **0**
+- Regressions escalated: **0**
+- Classification: All were pre-existing isolation/assertion gaps hidden by the fixture setup error that G1 resolved. No phase 7 production code changes required.
+- Verification: `13 passed in 3.34s` (all 13 tests in the file pass).

package/skills/vds-skill/vds-scripts/.dockerignore

@@ -0,0 +1,62 @@
+.git
+**/.git
+**/.venv
+**/.venv.nosync
+**/__pycache__
+**/.pytest_cache
+**/.mypy_cache
+**/.ruff_cache
+**/.DS_Store
+**/node_modules
+**/dist
+**/build
+**/.cache
+**/.idea
+**/.vscode
+**/.cursor
+**/.zed
+**/.claude
+**/.gemini
+**/.qwen
+**/.lingma
+**/.tox
+**/.coverage
+**/*.pyc
+**/*.pyo
+**/*.pyd
+**/*.log
+# Auto-generated report output dirs (matches .gitignore intent)
+**/reports
+**/output
+# Source-tree exception: audit_orchestrator's `reports/` Python subpackage
+# is real source code, not generated output. Without this un-ignore,
+# hatchling's wheel build excludes it and audit imports fail at runtime.
+!audit_orchestrator/src/vds_audit_orchestrator/reports/
+!audit_orchestrator/src/vds_audit_orchestrator/reports/**
+# Source-tree exception: vds_agent_core's `output/` Python subpackage
+# (added 2026-04-30 via audit-scheduler-event-bus-decoupling v0.2.0).
+# Without this un-ignore, vds_agent_core/__init__.py imports
+# `from vds_agent_core.output import ...` fail at container runtime.
+!vds_agent_core/src/vds_agent_core/output/
+!vds_agent_core/src/vds_agent_core/output/**
+# Large binary files
+**/*.pdf
+**/*.zip
+**/*.tar.gz
+**/*.rar
+# Test files (not needed in container images)
+**/tests/
+# Documentation
+**/docs/
+# Data directories (mounted at runtime, not baked in)
+**/data/
+**/logs/
+# Temporary and backup files
+**/*.tmp
+**/*.bak
+**/*.backup
+**/*.swp
+**/*.swo
+*~
+# Graphify output
+**/graphify-out/

package/skills/vds-skill/vds-scripts/.github/ISSUE_TEMPLATE/cli-change.md

@@ -0,0 +1,92 @@
+---
+name: CLI Change
+description: Request a change to the vds-cli surface (commands, orchestrators, or documentation)
+title: "[service] "
+labels: ["cli", "standardization"]
+assignees: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this template when proposing changes to the vds-cli command surface,
+        adding new orchestrators, fixing CLI bugs, or updating CLI documentation.
+
+  - type: input
+    id: service-name
+    attributes:
+      label: Service name
+      description: Which orchestrator service is affected? (e.g. audit, memory, research)
+      placeholder: e.g. memory
+    validations:
+      required: true
+
+  - type: dropdown
+    id: command-type
+    attributes:
+      label: Command type
+      description: What kind of CLI change is this?
+      options:
+        - New subcommand
+        - New orchestrator
+        - Bug fix
+        - Documentation
+        - Breaking change
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: routing-confirmation
+    attributes:
+      label: Routing confirmation
+      description: Confirm the command is exposed through the unified CLI router.
+      options:
+        - label: CLI commands are exposed through `vds-cli <service>` (not direct entry points)
+          required: true
+
+  - type: checkboxes
+    id: alias-check
+    attributes:
+      label: Alias check
+      description: Confirm no direct executables or aliases are added outside the router.
+      options:
+        - label: No new direct executables or aliases added to pyproject.toml `[project.scripts]`
+          required: true
+
+  - type: textarea
+    id: test-coverage
+    attributes:
+      label: Test coverage
+      description: Describe tests added (CliRunner, mocked externals); link to test files.
+      placeholder: |
+        - Added `test_memory_search.py` with `CliRunner` and mocked Postgres
+        - Link: `vds_cli/tests/memory/test_memory_search.py`
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: standards-review
+    attributes:
+      label: Standards review
+      description: Confirm compliance with the CLI development standards.
+      options:
+        - label: Verified against `vds-scripts/docs/agents/reference/cli-development-standards.md`
+          required: true
+
+  - type: textarea
+    id: breaking-changes
+    attributes:
+      label: Breaking changes
+      description: Any changes to command signatures or JSON output shapes?
+      placeholder: |
+        - `--output` flag renamed to `--format`
+        - JSON shape of `vds-cli audit list` changed from `{...}` to `[...]`
+    validations:
+      required: false
+
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional context
+      description: Anything else reviewers should know.
+    validations:
+      required: false

package/skills/vds-skill/vds-scripts/.github/PULL_REQUEST_TEMPLATE/pull_request_template.md

@@ -0,0 +1,48 @@
+## Summary
+
+<!-- What does this PR change and why? -->
+
+## Change type
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Refactoring / cleanup
+- [ ] Documentation
+- [ ] CI / infrastructure
+
+---
+
+## CLI Standards Checklist
+
+> Required for all PRs that touch CLI surfaces (orchestrators, commands, docs, skills).
+
+<!--
+If your PR does NOT touch CLI surfaces, write "N/A" below and skip this section.
+-->
+
+- [ ] **N/A** (my PR does not touch CLI surfaces)
+- [ ] New commands exposed through `vds-cli` router (not direct entry points)
+- [ ] `pyproject.toml` does NOT add aliases (`[project.scripts]` has one name per target)
+- [ ] Docs/skills show `vds-cli` only (zero direct executable examples)
+- [ ] Tests use `CliRunner` and mock externals (no real API calls in tests)
+- [ ] Follows `typer.Typer()` pattern (or `make_vds_app()` for new CLIs)
+- [ ] `validate-cli-standardization.sh` passes locally
+- [ ] `_validate_alias_phase2.py` passes locally
+
+---
+
+## Testing
+
+- [ ] Unit tests added/updated
+- [ ] Integration tests pass
+- [ ] Or: "No behavior changes — existing test coverage sufficient"
+
+## Verification
+
+```bash
+# Paste command(s) used to verify this PR
+# Example:
+# uv run pytest vds_cli/tests/ -q
+# bash scripts/validate-cli-standardization.sh
+# uv run python scripts/_validate_alias_phase2.py
+```

package/skills/vds-skill/vds-scripts/.github/workflows/chaos-smoke.yml

@@ -0,0 +1,266 @@
+name: Chaos Smoke — Scheduler Orchestrator
+
+# Spec ref: design.md §Chaos & Resilience Testing Plan / FR-15.3 / TSK-9.7
+#
+# Automatable scenarios (run in CI):
+#   C-1  API process kill during schedule creation  — every merge + weekly
+#   C-2  Executor kill mid-workflow (auto-resume)   — every merge + weekly
+#   C-3  Dispatcher kill mid-replay (exactly-once)  — weekly
+#   C-6  Outbox write storm (backpressure)           — weekly
+#
+# Manual-only scenarios (documented in chaos-runbook.md, NEVER auto-run):
+#   C-4  Postgres failover (primary → replica)       — monthly manual
+#   C-5  Network partition (iptables / docker)        — monthly manual
+#
+# AC-adjacent: C-2 and C-3 failures are potential AC-2/AC-3 regressions.
+# The workflow fails loudly and annotates the PR on any scenario failure.
+
+on:
+  # Every-merge smoke: C-1 + C-2 pytest integration tests (fast, < 2min)
+  push:
+    paths:
+      - "scheduler_orchestrator/**"
+      - ".github/workflows/chaos-smoke.yml"
+
+  pull_request:
+    paths:
+      - "scheduler_orchestrator/**"
+      - ".github/workflows/chaos-smoke.yml"
+
+  # Weekly full chaos suite: C-1, C-2, C-3, C-6 shell scripts + full pytest
+  schedule:
+    - cron: "0 3 * * 1"  # Monday 03:00 UTC
+
+  # Manual trigger with scenario selection
+  workflow_dispatch:
+    inputs:
+      scenarios:
+        description: "Comma-separated scenarios (c1,c2,c3,c6 — c4/c5 are manual-only)"
+        required: false
+        default: "c1,c2,c3,c6"
+      full_scale_c6:
+        description: "Run C-6 at full scale (1000/sec × 60s) — staging only"
+        required: false
+        default: "false"
+        type: boolean
+
+# Cancel in-progress runs on new pushes to the same ref
+concurrency:
+  group: chaos-smoke-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  PYTHON_VERSION: "3.11"
+
+jobs:
+  # ── Every-merge: pytest integration smoke tests (C-1, C-2, C-3, C-6) ────────
+  chaos-pytest-smoke:
+    name: Chaos pytest smoke (C-1 C-2 C-3 C-6)
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: scheduler_orchestrator
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      - name: Install scheduler_orchestrator + dev deps
+        run: |
+          uv sync --project . --extra dev
+
+      - name: Run integration smoke tests (chaos + audit-log-grants)
+        env:
+          # Tests use testcontainers; master kill-switch is intentionally off
+          VDS_SCHEDULER_ENABLED: "false"
+        run: |
+          uv run pytest tests/integration \
+            -v \
+            --tb=short \
+            --timeout=120 \
+            -m integration \
+            --junitxml=chaos-smoke-results.xml
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chaos-smoke-pytest-${{ github.run_id }}
+          path: scheduler_orchestrator/chaos-smoke-results.xml
+
+      - name: Annotate PR on C-2/C-3 failure
+        if: failure() && github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prNumber = context.issue.number;
+            await github.rest.issues.createComment({
+              issue_number: prNumber,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: [
+                '## ⚠️ Chaos Smoke Tests Failed',
+                '',
+                'One or more chaos smoke tests failed on this PR.',
+                '',
+                '**AC-adjacent check**: If `test_c2_*` failed → potential **AC-2 regression** (DBOS checkpoint/replay).',
+                'If `test_c3_*` failed → potential **AC-3 regression** (exactly-once dispatch).',
+                '',
+                'See the workflow run for details. **Do not merge until the root cause is identified.**',
+                '',
+                'Runbook: `scheduler_orchestrator/docs/chaos-runbook.md`'
+              ].join('\n')
+            });
+
+  # ── Weekly: full chaos shell-script suite (C-1, C-2, C-3, C-6) ─────────────
+  chaos-shell-weekly:
+    name: Chaos shell scripts (weekly C-1 C-2 C-3 C-6)
+    runs-on: ubuntu-latest
+    # Only run on schedule or manual dispatch — not every push/PR
+    if: >
+      github.event_name == 'schedule' ||
+      github.event_name == 'workflow_dispatch'
+    needs: chaos-pytest-smoke
+
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: vds_chaos
+          POSTGRES_PASSWORD: vds_chaos_pw
+          POSTGRES_DB: vds_chaos_db
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U vds_chaos"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+
+    defaults:
+      run:
+        working-directory: .
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      - name: Install scheduler_orchestrator
+        run: |
+          uv sync --project scheduler_orchestrator --extra dev
+
+      - name: Run Alembic migrations
+        working-directory: scheduler_orchestrator
+        env:
+          VDS_SCHEDULER_DATABASE_URL: "postgresql://vds_chaos:vds_chaos_pw@localhost:5432/vds_chaos_db"
+        run: |
+          uv run alembic upgrade head
+
+      - name: Determine which scenarios to run
+        id: scenarios
+        env:
+          # workflow_dispatch input sanitised into env var before shell use
+          SCENARIOS_INPUT: ${{ github.event.inputs.scenarios || 'c1,c2,c3,c6' }}
+        run: |
+          # Strip any characters that aren't alphanumeric, commas, or hyphens
+          SAFE_SCENARIOS=$(echo "$SCENARIOS_INPUT" | tr -cd 'a-z0-9,-')
+          echo "list=${SAFE_SCENARIOS}" >> "$GITHUB_OUTPUT"
+
+      - name: C-1 — API process kill (schedule persistence)
+        if: contains(steps.scenarios.outputs.list, 'c1')
+        env:
+          VDS_SCHEDULER_ENABLED: "true"
+          VDS_SCHEDULER_DATABASE_URL: "postgresql://vds_chaos:vds_chaos_pw@localhost:5432/vds_chaos_db"
+          CHAOS_TIMEOUT_S: "60"
+        run: |
+          chmod +x scheduler_orchestrator/scripts/chaos/c1-api-kill.sh
+          scheduler_orchestrator/scripts/chaos/c1-api-kill.sh
+
+      - name: C-2 — Executor kill mid-workflow (auto-resume) ⚠️ AC-adjacent
+        if: contains(steps.scenarios.outputs.list, 'c2')
+        env:
+          VDS_SCHEDULER_ENABLED: "true"
+          VDS_SCHEDULER_DATABASE_URL: "postgresql://vds_chaos:vds_chaos_pw@localhost:5432/vds_chaos_db"
+          CHAOS_KILL_DELAY_S: "3"
+          CHAOS_TIMEOUT_S: "90"
+        run: |
+          chmod +x scheduler_orchestrator/scripts/chaos/c2-executor-kill.sh
+          scheduler_orchestrator/scripts/chaos/c2-executor-kill.sh
+
+      - name: C-3 — Dispatcher kill mid-replay (exactly-once) ⚠️ AC-adjacent
+        if: contains(steps.scenarios.outputs.list, 'c3')
+        env:
+          VDS_SCHEDULER_ENABLED: "true"
+          VDS_SCHEDULER_DATABASE_URL: "postgresql://vds_chaos:vds_chaos_pw@localhost:5432/vds_chaos_db"
+          CHAOS_EVENT_COUNT: "100"
+          CHAOS_KILL_AT_ACKED: "50"
+          CHAOS_TIMEOUT_S: "120"
+        run: |
+          chmod +x scheduler_orchestrator/scripts/chaos/c3-dispatcher-kill.sh
+          scheduler_orchestrator/scripts/chaos/c3-dispatcher-kill.sh
+
+      - name: C-6 — Outbox write storm (backpressure)
+        if: contains(steps.scenarios.outputs.list, 'c6')
+        env:
+          VDS_SCHEDULER_ENABLED: "true"
+          VDS_SCHEDULER_DATABASE_URL: "postgresql://vds_chaos:vds_chaos_pw@localhost:5432/vds_chaos_db"
+          # full_scale_c6 is a boolean input; safe to use in env (not shell interpolation)
+          CHAOS_FULL_SCALE: ${{ github.event.inputs.full_scale_c6 == 'true' && 'yes' || 'no' }}
+          CHAOS_DRAIN_TIMEOUT_S: "120"
+        run: |
+          chmod +x scheduler_orchestrator/scripts/chaos/c6-outbox-storm.sh
+          scheduler_orchestrator/scripts/chaos/c6-outbox-storm.sh
+
+      # C-4 and C-5 are NEVER run automatically
+      - name: C-4 C-5 — Manual-only (documented, never auto-run)
+        run: |
+          echo "C-4 (Postgres failover) and C-5 (network partition) are MANUAL scenarios."
+          echo "Run monthly with infra team. See scheduler_orchestrator/docs/chaos-runbook.md"
+          echo "Scripts require CHAOS_MANUAL_OK=yes + infra team present."
+
+      - name: Upload chaos logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chaos-shell-logs-${{ github.run_id }}
+          path: /tmp/chaos-*.log
+          if-no-files-found: ignore
+
+      - name: Write job summary
+        if: always()
+        run: |
+          {
+            echo "## Chaos Scenario Summary"
+            echo ""
+            echo "| Scenario | Type | Frequency | Status |"
+            echo "|---|---|---|---|"
+            echo "| C-1 API kill | Automated | Every merge + weekly | see steps above |"
+            echo "| C-2 Executor kill ⚠️ AC-adj | Automated | Every merge + weekly | see steps above |"
+            echo "| C-3 Dispatcher kill ⚠️ AC-adj | Automated | Weekly | see steps above |"
+            echo "| C-6 Outbox storm | Automated | Weekly (CI scale) | see steps above |"
+            echo "| C-4 Postgres failover | **Manual** | Monthly | not run in CI |"
+            echo "| C-5 Network partition | **Manual** | Monthly | not run in CI |"
+            echo ""
+            echo "Runbook: \`scheduler_orchestrator/docs/chaos-runbook.md\`"
+          } >> "$GITHUB_STEP_SUMMARY"

package/skills/vds-skill/vds-scripts/.github/workflows/confluence-sync.yml

@@ -0,0 +1,44 @@
+name: Confluence Sync
+
+on:
+  push:
+    branches: [master, main]
+  workflow_dispatch:
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Set up Python + uv
+        uses: astral-sh/setup-uv@v6
+        # uv provides Python (managed) and handles caching.
+        # NO separate actions/setup-python step needed.
+      
+      - name: Sync workspace
+        run: uv sync --all-packages
+      
+      - name: Configure environment
+        run: |
+          mkdir -p ~/.vds
+          cat > ~/.vds/.env << 'ENV_EOF'
+          VDS_USERNAME=${{ secrets.VDS_USERNAME }}
+          VDS_PASSWORD=${{ secrets.VDS_PASSWORD }}
+          BITBUCKET_TOKEN=${{ secrets.BITBUCKET_TOKEN }}
+          CONFLUENCE_INTERNAL_TOKEN=${{ secrets.CONFLUENCE_INTERNAL_TOKEN }}
+          ENV_EOF
+      
+      - name: Validate docs
+        run: |
+          uv run --project vds_cli vds-cli docs validate --repo-root . --check-vi --check-diataxis
+      
+      - name: Sync to Confluence
+        # Note: --create-missing is intentionally omitted. New pages are created
+        # manually via 'vds-cli docs confluence-sync --create-missing' to avoid
+        # duplicate-page risks in automated CI. All existing pages have fixed IDs.
+        run: |
+          uv run --project vds_cli vds-cli docs confluence-sync --validate-links
+        env:
+          VDS_USERNAME: ${{ secrets.VDS_USERNAME }}
+          VDS_PASSWORD: ${{ secrets.VDS_PASSWORD }}