@ngxtm/devkit 3.6.1 → 3.8.0

package/merged-commands/mtls-configuration.md

@@ -0,0 +1,359 @@
+---
+name: mtls-configuration
+description: Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.
+---
+
+# mTLS Configuration
+
+Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.
+
+## Do not use this skill when
+
+- The task is unrelated to mtls configuration
+- You need a different domain or tool outside this scope
+
+## Instructions
+
+- Clarify goals, constraints, and required inputs.
+- Apply relevant best practices and validate outcomes.
+- Provide actionable steps and verification.
+- If detailed examples are required, open `resources/implementation-playbook.md`.
+
+## Use this skill when
+
+- Implementing zero-trust networking
+- Securing service-to-service communication
+- Certificate rotation and management
+- Debugging TLS handshake issues
+- Compliance requirements (PCI-DSS, HIPAA)
+- Multi-cluster secure communication
+
+## Core Concepts
+
+### 1. mTLS Flow
+
+```
+┌─────────┐                              ┌─────────┐
+│ Service │                              │ Service │
+│    A    │                              │    B    │
+└────┬────┘                              └────┬────┘
+     │                                        │
+┌────┴────┐      TLS Handshake          ┌────┴────┐
+│  Proxy  │◄───────────────────────────►│  Proxy  │
+│(Sidecar)│  1. ClientHello             │(Sidecar)│
+│         │  2. ServerHello + Cert      │         │
+│         │  3. Client Cert             │         │
+│         │  4. Verify Both Certs       │         │
+│         │  5. Encrypted Channel       │         │
+└─────────┘                              └─────────┘
+```
+
+### 2. Certificate Hierarchy
+
+```
+Root CA (Self-signed, long-lived)
+    │
+    ├── Intermediate CA (Cluster-level)
+    │       │
+    │       ├── Workload Cert (Service A)
+    │       └── Workload Cert (Service B)
+    │
+    └── Intermediate CA (Multi-cluster)
+            │
+            └── Cross-cluster certs
+```
+
+## Templates
+
+### Template 1: Istio mTLS (Strict Mode)
+
+```yaml
+# Enable strict mTLS mesh-wide
+apiVersion: security.istio.io/v1beta1
+kind: PeerAuthentication
+metadata:
+  name: default
+  namespace: istio-system
+spec:
+  mtls:
+    mode: STRICT
+---
+# Namespace-level override (permissive for migration)
+apiVersion: security.istio.io/v1beta1
+kind: PeerAuthentication
+metadata:
+  name: default
+  namespace: legacy-namespace
+spec:
+  mtls:
+    mode: PERMISSIVE
+---
+# Workload-specific policy
+apiVersion: security.istio.io/v1beta1
+kind: PeerAuthentication
+metadata:
+  name: payment-service
+  namespace: production
+spec:
+  selector:
+    matchLabels:
+      app: payment-service
+  mtls:
+    mode: STRICT
+  portLevelMtls:
+    8080:
+      mode: STRICT
+    9090:
+      mode: DISABLE  # Metrics port, no mTLS
+```
+
+### Template 2: Istio Destination Rule for mTLS
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: default
+  namespace: istio-system
+spec:
+  host: "*.local"
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL
+---
+# TLS to external service
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: external-api
+spec:
+  host: api.external.com
+  trafficPolicy:
+    tls:
+      mode: SIMPLE
+      caCertificates: /etc/certs/external-ca.pem
+---
+# Mutual TLS to external service
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: partner-api
+spec:
+  host: api.partner.com
+  trafficPolicy:
+    tls:
+      mode: MUTUAL
+      clientCertificate: /etc/certs/client.pem
+      privateKey: /etc/certs/client-key.pem
+      caCertificates: /etc/certs/partner-ca.pem
+```
+
+### Template 3: Cert-Manager with Istio
+
+```yaml
+# Install cert-manager issuer for Istio
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: istio-ca
+spec:
+  ca:
+    secretName: istio-ca-secret
+---
+# Create Istio CA secret
+apiVersion: v1
+kind: Secret
+metadata:
+  name: istio-ca-secret
+  namespace: cert-manager
+type: kubernetes.io/tls
+data:
+  tls.crt: <base64-encoded-ca-cert>
+  tls.key: <base64-encoded-ca-key>
+---
+# Certificate for workload
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: my-service-cert
+  namespace: my-namespace
+spec:
+  secretName: my-service-tls
+  duration: 24h
+  renewBefore: 8h
+  issuerRef:
+    name: istio-ca
+    kind: ClusterIssuer
+  commonName: my-service.my-namespace.svc.cluster.local
+  dnsNames:
+    - my-service
+    - my-service.my-namespace
+    - my-service.my-namespace.svc
+    - my-service.my-namespace.svc.cluster.local
+  usages:
+    - server auth
+    - client auth
+```
+
+### Template 4: SPIFFE/SPIRE Integration
+
+```yaml
+# SPIRE Server configuration
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: spire-server
+  namespace: spire
+data:
+  server.conf: |
+    server {
+      bind_address = "0.0.0.0"
+      bind_port = "8081"
+      trust_domain = "example.org"
+      data_dir = "/run/spire/data"
+      log_level = "INFO"
+      ca_ttl = "168h"
+      default_x509_svid_ttl = "1h"
+    }
+
+    plugins {
+      DataStore "sql" {
+        plugin_data {
+          database_type = "sqlite3"
+          connection_string = "/run/spire/data/datastore.sqlite3"
+        }
+      }
+
+      NodeAttestor "k8s_psat" {
+        plugin_data {
+          clusters = {
+            "demo-cluster" = {
+              service_account_allow_list = ["spire:spire-agent"]
+            }
+          }
+        }
+      }
+
+      KeyManager "memory" {
+        plugin_data {}
+      }
+
+      UpstreamAuthority "disk" {
+        plugin_data {
+          key_file_path = "/run/spire/secrets/bootstrap.key"
+          cert_file_path = "/run/spire/secrets/bootstrap.crt"
+        }
+      }
+    }
+---
+# SPIRE Agent DaemonSet (abbreviated)
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: spire-agent
+  namespace: spire
+spec:
+  selector:
+    matchLabels:
+      app: spire-agent
+  template:
+    spec:
+      containers:
+        - name: spire-agent
+          image: ghcr.io/spiffe/spire-agent:1.8.0
+          volumeMounts:
+            - name: spire-agent-socket
+              mountPath: /run/spire/sockets
+      volumes:
+        - name: spire-agent-socket
+          hostPath:
+            path: /run/spire/sockets
+            type: DirectoryOrCreate
+```
+
+### Template 5: Linkerd mTLS (Automatic)
+
+```yaml
+# Linkerd enables mTLS automatically
+# Verify with:
+# linkerd viz edges deployment -n my-namespace
+
+# For external services without mTLS
+apiVersion: policy.linkerd.io/v1beta1
+kind: Server
+metadata:
+  name: external-api
+  namespace: my-namespace
+spec:
+  podSelector:
+    matchLabels:
+      app: my-app
+  port: external-api
+  proxyProtocol: HTTP/1  # or TLS for passthrough
+---
+# Skip TLS for specific port
+apiVersion: v1
+kind: Service
+metadata:
+  name: my-service
+  annotations:
+    config.linkerd.io/skip-outbound-ports: "3306"  # MySQL
+```
+
+## Certificate Rotation
+
+```bash
+# Istio - Check certificate expiry
+istioctl proxy-config secret deploy/my-app -o json | \
+  jq '.dynamicActiveSecrets[0].secret.tlsCertificate.certificateChain.inlineBytes' | \
+  tr -d '"' | base64 -d | openssl x509 -text -noout
+
+# Force certificate rotation
+kubectl rollout restart deployment/my-app
+
+# Check Linkerd identity
+linkerd identity -n my-namespace
+```
+
+## Debugging mTLS Issues
+
+```bash
+# Istio - Check if mTLS is enabled
+istioctl authn tls-check my-service.my-namespace.svc.cluster.local
+
+# Verify peer authentication
+kubectl get peerauthentication --all-namespaces
+
+# Check destination rules
+kubectl get destinationrule --all-namespaces
+
+# Debug TLS handshake
+istioctl proxy-config log deploy/my-app --level debug
+kubectl logs deploy/my-app -c istio-proxy | grep -i tls
+
+# Linkerd - Check mTLS status
+linkerd viz edges deployment -n my-namespace
+linkerd viz tap deploy/my-app --to deploy/my-backend
+```
+
+## Best Practices
+
+### Do's
+- **Start with PERMISSIVE** - Migrate gradually to STRICT
+- **Monitor certificate expiry** - Set up alerts
+- **Use short-lived certs** - 24h or less for workloads
+- **Rotate CA periodically** - Plan for CA rotation
+- **Log TLS errors** - For debugging and audit
+
+### Don'ts
+- **Don't disable mTLS** - For convenience in production
+- **Don't ignore cert expiry** - Automate rotation
+- **Don't use self-signed certs** - Use proper CA hierarchy
+- **Don't skip verification** - Verify the full chain
+
+## Resources
+
+- [Istio Security](https://istio.io/latest/docs/concepts/security/)
+- [SPIFFE/SPIRE](https://spiffe.io/)
+- [cert-manager](https://cert-manager.io/)
+- [Zero Trust Architecture (NIST)](https://www.nist.gov/publications/zero-trust-architecture)

package/merged-commands/multi-agent-brainstorming.md

@@ -0,0 +1,256 @@
+---
+name: multi-agent-brainstorming
+description: >
+  Use this skill when a design or idea requires higher confidence,
+  risk reduction, or formal review. This skill orchestrates a
+  structured, sequential multi-agent design review where each agent
+  has a strict, non-overlapping role. It prevents blind spots,
+  false confidence, and premature convergence.
+---
+
+# Multi-Agent Brainstorming (Structured Design Review)
+
+## Purpose
+
+Transform a single-agent design into a **robust, review-validated design**
+by simulating a formal peer-review process using multiple constrained agents.
+
+This skill exists to:
+- surface hidden assumptions
+- identify failure modes early
+- validate non-functional constraints
+- stress-test designs before implementation
+- prevent idea swarm chaos
+
+This is **not parallel brainstorming**.
+It is **sequential design review with enforced roles**.
+
+---
+
+## Operating Model
+
+- One agent designs.
+- Other agents review.
+- No agent may exceed its mandate.
+- Creativity is centralized; critique is distributed.
+- Decisions are explicit and logged.
+
+The process is **gated** and **terminates by design**.
+
+---
+
+## Agent Roles (Non-Negotiable)
+
+Each agent operates under a **hard scope limit**.
+
+### 1️⃣ Primary Designer (Lead Agent)
+
+**Role:**
+- Owns the design
+- Runs the standard `brainstorming` skill
+- Maintains the Decision Log
+
+**May:**
+- Ask clarification questions
+- Propose designs and alternatives
+- Revise designs based on feedback
+
+**May NOT:**
+- Self-approve the final design
+- Ignore reviewer objections
+- Invent requirements post-lock
+
+---
+
+### 2️⃣ Skeptic / Challenger Agent
+
+**Role:**
+- Assume the design will fail
+- Identify weaknesses and risks
+
+**May:**
+- Question assumptions
+- Identify edge cases
+- Highlight ambiguity or overconfidence
+- Flag YAGNI violations
+
+**May NOT:**
+- Propose new features
+- Redesign the system
+- Offer alternative architectures
+
+Prompting guidance:
+> “Assume this design fails in production. Why?”
+
+---
+
+### 3️⃣ Constraint Guardian Agent
+
+**Role:**
+- Enforce non-functional and real-world constraints
+
+Focus areas:
+- performance
+- scalability
+- reliability
+- security & privacy
+- maintainability
+- operational cost
+
+**May:**
+- Reject designs that violate constraints
+- Request clarification of limits
+
+**May NOT:**
+- Debate product goals
+- Suggest feature changes
+- Optimize beyond stated requirements
+
+---
+
+### 4️⃣ User Advocate Agent
+
+**Role:**
+- Represent the end user
+
+Focus areas:
+- cognitive load
+- usability
+- clarity of flows
+- error handling from user perspective
+- mismatch between intent and experience
+
+**May:**
+- Identify confusing or misleading aspects
+- Flag poor defaults or unclear behavior
+
+**May NOT:**
+- Redesign architecture
+- Add features
+- Override stated user goals
+
+---
+
+### 5️⃣ Integrator / Arbiter Agent
+
+**Role:**
+- Resolve conflicts
+- Finalize decisions
+- Enforce exit criteria
+
+**May:**
+- Accept or reject objections
+- Require design revisions
+- Declare the design complete
+
+**May NOT:**
+- Invent new ideas
+- Add requirements
+- Reopen locked decisions without cause
+
+---
+
+## The Process
+
+### Phase 1 — Single-Agent Design
+
+1. Primary Designer runs the **standard `brainstorming` skill**
+2. Understanding Lock is completed and confirmed
+3. Initial design is produced
+4. Decision Log is started
+
+No other agents participate yet.
+
+---
+
+### Phase 2 — Structured Review Loop
+
+Agents are invoked **one at a time**, in the following order:
+
+1. Skeptic / Challenger
+2. Constraint Guardian
+3. User Advocate
+
+For each reviewer:
+- Feedback must be explicit and scoped
+- Objections must reference assumptions or decisions
+- No new features may be introduced
+
+Primary Designer must:
+- Respond to each objection
+- Revise the design if required
+- Update the Decision Log
+
+---
+
+### Phase 3 — Integration & Arbitration
+
+The Integrator / Arbiter reviews:
+- the final design
+- the Decision Log
+- unresolved objections
+
+The Arbiter must explicitly decide:
+- which objections are accepted
+- which are rejected (with rationale)
+
+---
+
+## Decision Log (Mandatory Artifact)
+
+The Decision Log must record:
+
+- Decision made
+- Alternatives considered
+- Objections raised
+- Resolution and rationale
+
+No design is considered valid without a completed log.
+
+---
+
+## Exit Criteria (Hard Stop)
+
+You may exit multi-agent brainstorming **only when all are true**:
+
+- Understanding Lock was completed
+- All reviewer agents have been invoked
+- All objections are resolved or explicitly rejected
+- Decision Log is complete
+- Arbiter has declared the design acceptable
+- 
+If any criterion is unmet:
+- Continue review
+- Do NOT proceed to implementation
+If this skill was invoked by a routing or orchestration layer, you MUST report the final disposition explicitly as one of: APPROVED, REVISE, or REJECT, with a brief rationale.
+---
+
+## Failure Modes This Skill Prevents
+
+- Idea swarm chaos
+- Hallucinated consensus
+- Overconfident single-agent designs
+- Hidden assumptions
+- Premature implementation
+- Endless debate
+
+---
+
+## Key Principles
+
+- One designer, many reviewers
+- Creativity is centralized
+- Critique is constrained
+- Decisions are explicit
+- Process must terminate
+
+---
+
+## Final Reminder
+
+This skill exists to answer one question with confidence:
+
+> “If this design fails, did we do everything reasonable to catch it early?”
+
+If the answer is unclear, **do not exit this skill**.
+