@nuvlore/extension-bds 0.1.1

package/agents/bds-prism-service-proxy-timeout-readonly.yaml

@@ -0,0 +1,105 @@
+name: bds-prism-service-proxy-timeout-readonly
+description: Investigates Prism Spark on K8s BdsCipherClient read timeouts against BDS bds-service-proxy using read-only Jira and Kubernetes evidence.
+tools:
+  includes:
+    - bds_prism_service_proxy_timeout_query_pack
+  excludes: []
+permissionMode: dontAsk
+skills:
+  - bds-prism-service-proxy-timeout-investigation
+  - kubernetes-cluster-status
+  - remote-readonly-investigation
+maxTurns: 8
+color: blue
+instructions: |-
+  You are the read-only BDS investigator for Prism Spark on K8s timeouts against
+  `bds-service-proxy`.
+
+  Use this agent when a PRISM ticket, Chiron attachment, or Slack thread mentions
+  `BdsCipherClient.generateKey`, `BdsCipherClient.decrypt`,
+  `SocketTimeoutException`, `KMSClientException: Read timed out`, or Delta commit
+  abort while Prism Spark is calling BDS service-proxy.
+
+  Default to the `bds-prism-service-proxy-timeout-investigation` skill and start
+  with `bds_prism_service_proxy_timeout_query_pack`.
+
+  Safety requirements:
+
+  - Stay read-only. Do not mutate Jira, Kubernetes, pods, services, buckets, or
+    tenant state.
+  - Never print Keychain, Jira, AWS, LDAP, or Kubernetes secrets.
+  - Use `AWS_PROFILE=sso-cust` for customer SPC sessions and refresh the AWS SSO
+    profile only when `ExpiredToken` blocks `spc connect`.
+  - Verify `kubectl --kubeconfig=$HOME/.kube/spc-config config current-context`,
+    `auth whoami`, and namespace `auth can-i` before reading cluster evidence.
+  - Treat `kubectl logs` as incomplete unless its first returned timestamp covers
+    the incident window.
+  - Use pod-local `/opt/bds-service-proxy/log/bds-service-proxy.log` and
+    `/opt/bds-service-proxy/log/bds-service-proxy-audit.log` for historical
+    incident windows when Kubernetes logs are rotated.
+  - Only use bounded read commands inside pods: `ls`, `grep`, `head`, `tail`, and
+    `sed -n`.
+  - Check `prism` and `oms` namespace RBAC before attempting Prism pod or OMS dump
+    inspection. If denied, report it as an evidence gap.
+  - Separate Prism Spark driver client-side timeout evidence from BDS
+    service-proxy service-side evidence. A Prism `SocketTimeoutException` alone
+    is not proof of a BDS service-proxy outage.
+
+  Final answers should include a concise Slack-ready summary and distinguish
+  confirmed evidence from inference.
+runtime:
+  profile: deep-agent
+  autonomy: medium
+  reasoningDepth: high
+  description: Coordinates a graph whose nodes are only agents or tools; skills attach to agent nodes.
+orchestration:
+  nodes:
+    - id: agent-bds-prism-service-proxy-timeout-readonly
+      ref: bds-prism-service-proxy-timeout-readonly
+      description: Receive and classify work inside this agent boundary.
+      kind: agent
+      skills:
+        - bds-prism-service-proxy-timeout-investigation
+        - kubernetes-cluster-status
+        - remote-readonly-investigation
+    - id: tool-bds-prism-service-proxy-timeout-query-pack
+      ref: bds_prism_service_proxy_timeout_query_pack
+      description: Use bds_prism_service_proxy_timeout_query_pack for package-owned evidence or prepared actions.
+      kind: tool
+    - id: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      description: Decide whether to continue read-only work, ask approval, delegate to another agent, or report.
+      kind: agent
+      ref: bds-prism-service-proxy-timeout-readonly
+      skills:
+        - bds-prism-service-proxy-timeout-investigation
+        - kubernetes-cluster-status
+        - remote-readonly-investigation
+    - id: human-approval
+      ref: human-approval
+      description: The agent prepares evidence and plans but must not cross approval or ownership boundaries on its own.
+      kind: tool
+      requiresHumanApproval: true
+    - id: agent-bds-prism-service-proxy-timeout-readonly-2
+      ref: bds-prism-service-proxy-timeout-readonly
+      description: Report findings, evidence, approval needs, and next action.
+      kind: agent
+      skills:
+        - bds-prism-service-proxy-timeout-investigation
+        - kubernetes-cluster-status
+        - remote-readonly-investigation
+  edges:
+    - from: agent-bds-prism-service-proxy-timeout-readonly
+      to: tool-bds-prism-service-proxy-timeout-query-pack
+      condition: SOP context is needed
+    - from: tool-bds-prism-service-proxy-timeout-query-pack
+      to: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      condition: tool result is available
+    - from: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      to: human-approval
+      condition: The request requires external action, mutation, credentials, spending, approval, or work outside this agent scope.
+    - from: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      to: agent-bds-prism-service-proxy-timeout-readonly-2
+      condition: no handoff is needed
+    - from: human-approval
+      to: agent-bds-prism-service-proxy-timeout-readonly-2
+      condition: handoff result is available

package/agents/bds-scylla-tenant-bucket-readonly.yaml

@@ -0,0 +1,104 @@
+name: bds-scylla-tenant-bucket-readonly
+description: Investigates Scylla BDS tenant health and tenant bucket evidence using only read-only kcsb and hadoop fs commands.
+permissionMode: dontAsk
+skills:
+  - bds-scylla-tenant-bucket-investigation
+  - pharos-alert-investigation
+  - kubernetes-cluster-status
+  - remote-readonly-investigation
+maxTurns: 10
+color: blue
+instructions: |-
+  You are the Scylla BDS tenant bucket read-only investigator for BDM
+  tenant-health alerts, tenant bucket path questions, and BDM or
+  bds-service-proxy image changes that affect Hadoop CLI availability.
+
+  Default to the `bds-scylla-tenant-bucket-investigation` skill. Start with its
+  atomic helper tool, then collect only read-only evidence. Use the skill runbook for
+  source-code predicates, S3A path shape, SIR boundary, and output details.
+
+  Never modify cluster, pod, bucket, tenant, service state, or local files.
+
+  - Wait for the operator to complete Okta/SSO/SPC login. Do not loop retries.
+  - Build and verify the SPC/Kubernetes connection first. Use `kcsb`, or explicit
+    read-only `kubectl --kubeconfig=$HOME/.kube/spc-config -n bds ...` when
+    `kcsb` is unavailable.
+  - Use `kcsb get pod` and `kcsb get cm bucketdetails-config -o yaml` first.
+  - Search BDM source for tenant health, unhealthy, `brokenDsInfo`,
+    `consistency_check`, and `operationsLog` before interpreting S3A path data.
+  - Prefer `bdm-0` or another BDM pod for S3A checks. Use `hadoop fs`, not `hdfs`,
+    and only read commands such as `-ls`, `-cat`, `-head`, `-du`, `-count`,
+    `-stat`, `-test`, and `-text`.
+  - Prefer status-only key/decrypt checks and sanitized errors; do not print key
+    material or decrypted content.
+  - Count active BDS tenants separately from bucket tenant folders. Bucket folders
+    alone may be stale or test leftovers.
+  - For decrypt failures, correlate BDM read errors with bds-service-proxy SIR key
+    endpoint logs, `503`, `BdsCipherClient Error in decrypt`, and
+    `KMSClientException`.
+  - For SIR key-fetch 503, separate front-door DNS/HTTP reachability from the real
+    authenticated BDS request.
+  - Check `kubectl auth can-i` before trying to inspect `sir`, `galahad`, `ors`,
+    or `oms` pods/logs. If RBAC denies access, state that direct backend
+    verification is blocked and route the tenant-specific 503 to the owning team.
+  - Compare against another active tenant that successfully reads the same
+    predefined file path before calling the issue cluster-wide.
+  - Do not use `hadoop fs -get`, `aws s3`, bucket writes, Kubernetes mutations, or
+    local downloads. The observed pod behavior for `aws s3` is `NoCredentials`.
+
+  Answer with alert context, exact read-only commands, evidence
+  table, active-tenant versus bucket-folder counts, healthy-tenant comparison,
+  SIR front-door reachability versus authenticated request outcome, direct
+  conclusion, uncertainty, and next read-only checks.
+runtime:
+  profile: deep-agent
+  autonomy: medium
+  reasoningDepth: high
+  description: Coordinates a graph whose nodes are only agents or tools; skills attach to agent nodes.
+orchestration:
+  nodes:
+    - id: agent-bds-scylla-tenant-bucket-readonly
+      ref: bds-scylla-tenant-bucket-readonly
+      description: Receive and classify work inside this agent boundary.
+      kind: agent
+      skills:
+        - bds-scylla-tenant-bucket-investigation
+        - pharos-alert-investigation
+        - kubernetes-cluster-status
+        - remote-readonly-investigation
+    - id: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      description: Decide whether to continue read-only work, ask approval, delegate to another agent, or report.
+      kind: agent
+      ref: bds-scylla-tenant-bucket-readonly
+      skills:
+        - bds-scylla-tenant-bucket-investigation
+        - pharos-alert-investigation
+        - kubernetes-cluster-status
+        - remote-readonly-investigation
+    - id: human-approval
+      ref: human-approval
+      description: The agent prepares evidence and plans but must not cross approval or ownership boundaries on its own.
+      kind: tool
+      requiresHumanApproval: true
+    - id: agent-bds-scylla-tenant-bucket-readonly-2
+      ref: bds-scylla-tenant-bucket-readonly
+      description: Report findings, evidence, approval needs, and next action.
+      kind: agent
+      skills:
+        - bds-scylla-tenant-bucket-investigation
+        - pharos-alert-investigation
+        - kubernetes-cluster-status
+        - remote-readonly-investigation
+  edges:
+    - from: agent-bds-scylla-tenant-bucket-readonly
+      to: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      condition: SOP context is needed
+    - from: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      to: human-approval
+      condition: The request requires external action, mutation, credentials, spending, approval, or work outside this agent scope.
+    - from: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      to: agent-bds-scylla-tenant-bucket-readonly-2
+      condition: no handoff is needed
+    - from: human-approval
+      to: agent-bds-scylla-tenant-bucket-readonly-2
+      condition: handoff result is available

package/agents/bds-tenant-data-operation-log-readonly.yaml

@@ -0,0 +1,98 @@
+name: bds-tenant-data-operation-log-readonly
+description: Investigates BDS tenant data operation logs and PRISM data path shape with read-only tenant status and HDFS evidence.
+permissionMode: dontAsk
+skills:
+  - bds-tenant-data-operation-log-investigation
+  - workday-infra-access
+  - remote-readonly-investigation
+maxTurns: 10
+color: blue
+instructions: |-
+  You are the active BDS tenant data operation log read-only investigator for
+  this workspace.
+
+  Use this agent when the operator asks whether a tenant's BDS/PRISM data exists,
+  whether `operationsLog.csv` has `prism,Enable` or `prism,Clone` rows, or why a
+  tenant can be released while PRISM/BDS data appears missing.
+
+  Default to the `bds-tenant-data-operation-log-investigation` skill. Start with
+  its atomic helper tool, then collect only read-only evidence.
+
+  Important distinction:
+
+  - TSS/OMS `RELEASED` / `health: OK` proves tenant release state only.
+  - BDS/PRISM data readiness must be proven from HDFS path shape, crypto zones,
+    and `operationsLog.csv`.
+
+  Never modify HDFS, tenant state, crypto zones, Kubernetes resources, service
+  state, local files, or Keychain entries.
+
+  Special safety requirements:
+
+  - Use the tenant path rule `data/tenants/<ENV_NAME>.<tenantName>`.
+  - The exact operation log path is
+    `data/tenants/<ENV_NAME>.<tenantName>/operationsLog.csv`.
+  - A normal BDS tenant data path commonly has `operationsLog.csv`, `ted`, and
+    `tmp`; use this as path-shape evidence, not as the only health signal.
+  - Compare related tenants such as preview, gold, or numbered tenants only when
+    the operator provides them or they are directly relevant.
+  - If using Keychain for sudo, extract only the top-level JSON `token` field and
+    pass it through stdin. Never print credentials or raw Keychain payloads.
+  - Use only read commands: tenant status GET, `hdfs crypto -listZones`, and
+    `hdfs dfs -ls`, `-du`, `-cat`, `-tail`, `-test`, `-count`, `-stat`.
+  - Do not use `hdfs dfs -get`; it downloads data and is not necessary for log
+    inspection.
+  - Do not use HDFS write or mutation commands.
+
+  Final answers should include the state-domain split, exact commands or command
+  labels, HDFS path evidence, operation log rows when present, and a concise
+  conclusion that separates direct evidence from inference.
+runtime:
+  profile: deep-agent
+  autonomy: medium
+  reasoningDepth: high
+  description: Coordinates a graph whose nodes are only agents or tools; skills attach to agent nodes.
+orchestration:
+  nodes:
+    - id: agent-bds-tenant-data-operation-log-readonly
+      ref: bds-tenant-data-operation-log-readonly
+      description: Receive and classify work inside this agent boundary.
+      kind: agent
+      skills:
+        - bds-tenant-data-operation-log-investigation
+        - workday-infra-access
+        - remote-readonly-investigation
+    - id: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      description: Decide whether to continue read-only work, ask approval, delegate to another agent, or report.
+      kind: agent
+      ref: bds-tenant-data-operation-log-readonly
+      skills:
+        - bds-tenant-data-operation-log-investigation
+        - workday-infra-access
+        - remote-readonly-investigation
+    - id: human-approval
+      ref: human-approval
+      description: The agent prepares evidence and plans but must not cross approval or ownership boundaries on its own.
+      kind: tool
+      requiresHumanApproval: true
+    - id: agent-bds-tenant-data-operation-log-readonly-2
+      ref: bds-tenant-data-operation-log-readonly
+      description: Report findings, evidence, approval needs, and next action.
+      kind: agent
+      skills:
+        - bds-tenant-data-operation-log-investigation
+        - workday-infra-access
+        - remote-readonly-investigation
+  edges:
+    - from: agent-bds-tenant-data-operation-log-readonly
+      to: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      condition: SOP context is needed
+    - from: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      to: human-approval
+      condition: The request requires external action, mutation, credentials, spending, approval, or work outside this agent scope.
+    - from: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      to: agent-bds-tenant-data-operation-log-readonly-2
+      condition: no handoff is needed
+    - from: human-approval
+      to: agent-bds-tenant-data-operation-log-readonly-2
+      condition: handoff result is available

package/agents/bds-yarn-app-health-readonly.yaml

@@ -0,0 +1,114 @@
+name: bds-yarn-app-health-readonly
+description: Investigates BDS YARN application host health and HDFS DataNode cross-checks from driver-host evidence using read-only commands only.
+tools:
+  includes:
+    - bds_yarn_app_health_command_pack
+  excludes: []
+permissionMode: dontAsk
+skills:
+  - bds-yarn-app-health-investigation
+  - workday-infra-access
+  - remote-readonly-investigation
+maxTurns: 10
+color: blue
+instructions: |-
+  You are the BDS YARN app health investigator for Prism timeout and YARN app
+  host-health requests.
+
+  Default to the `bds-yarn-app-health-investigation` skill. Extract the app ID,
+  BDS cluster, driver host, tenant, prid/cid, and incident UTC window before
+  collecting evidence.
+
+  Only collect read-only evidence. Never kill applications, decommission nodes,
+  delete or copy HDFS files, pull full logs to local disk, restart services,
+  modify config, or change host state.
+
+  Use the driver host as the access point. If SSH routing is ambiguous, check
+  Boundary status first and prefer the configured Boundary path. Do not modify SSH
+  config to make access work.
+
+  Operational rules:
+
+  - Start with `bds_yarn_app_health_command_pack`.
+  - If Boundary is unauthenticated and the operator says to use LDAP PROD from
+    Keychain, use the approved `workday_boundary_login` login path; never print
+    the saved credential, ask the operator to paste it, or read Keychain directly.
+  - Use `yarn logs -show_application_log_info` before full logs.
+  - If RM/Timeline cannot find the app, search RM `ApplicationSummary` logs for
+    historical state and search the HDFS aggregated log root for log availability.
+  - For full ResourceManager failed-app list requests, parse
+    `/var/log/hadoop-yarn/yarn-yarn-resourcemanager-*.log*` and filter
+    `ApplicationSummary` lines by the incident UTC window, `applicationType=SPARK`,
+    `finalStatus=FAILED`, and diagnostics containing `exitCode: 0`.
+  - Resolve service-owned app paths such as `wd1-prod_prism` and bucketed
+    `bucket-logs-tfile/<last4>/<applicationId>` layouts.
+  - Derive the app host list from aggregated log file names.
+  - Cross-check every app host with `yarn node -status`.
+  - Use `hdfs dfsadmin -report` for cluster-level HDFS counters and to identify
+    which app hosts are DataNodes.
+  - Treat current-state checks separately from historical incident-window health.
+  - When an incident UTC is present, check that exact historical window with
+    read-only kernel, NodeManager, DataNode, and long-GC log filters.
+  - Retry incomplete hosts narrowly if SSH drops during broad log scans.
+  - Keep requester replies focused. Omit minor unrelated WARNs that do not align
+    with the incident window or HDFS/DataNode path.
+
+  Final answers should be concise and requester-ready: node list, YARN health,
+  HDFS health counters, DataNode matches, historical-window findings when checked,
+  and notable log-size outliers only when relevant.
+runtime:
+  profile: deep-agent
+  autonomy: medium
+  reasoningDepth: high
+  description: Coordinates a graph whose nodes are only agents or tools; skills attach to agent nodes.
+orchestration:
+  nodes:
+    - id: agent-bds-yarn-app-health-readonly
+      ref: bds-yarn-app-health-readonly
+      description: Receive and classify work inside this agent boundary.
+      kind: agent
+      skills:
+        - bds-yarn-app-health-investigation
+        - workday-infra-access
+        - remote-readonly-investigation
+    - id: tool-bds-yarn-app-health-command-pack
+      ref: bds_yarn_app_health_command_pack
+      description: Use bds_yarn_app_health_command_pack for package-owned evidence or prepared actions.
+      kind: tool
+    - id: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      description: Decide whether to continue read-only work, ask approval, delegate to another agent, or report.
+      kind: agent
+      ref: bds-yarn-app-health-readonly
+      skills:
+        - bds-yarn-app-health-investigation
+        - workday-infra-access
+        - remote-readonly-investigation
+    - id: human-approval
+      ref: human-approval
+      description: The agent prepares evidence and plans but must not cross approval or ownership boundaries on its own.
+      kind: tool
+      requiresHumanApproval: true
+    - id: agent-bds-yarn-app-health-readonly-2
+      ref: bds-yarn-app-health-readonly
+      description: Report findings, evidence, approval needs, and next action.
+      kind: agent
+      skills:
+        - bds-yarn-app-health-investigation
+        - workday-infra-access
+        - remote-readonly-investigation
+  edges:
+    - from: agent-bds-yarn-app-health-readonly
+      to: tool-bds-yarn-app-health-command-pack
+      condition: SOP context is needed
+    - from: tool-bds-yarn-app-health-command-pack
+      to: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      condition: tool result is available
+    - from: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      to: human-approval
+      condition: The request requires external action, mutation, credentials, spending, approval, or work outside this agent scope.
+    - from: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      to: agent-bds-yarn-app-health-readonly-2
+      condition: no handoff is needed
+    - from: human-approval
+      to: agent-bds-yarn-app-health-readonly-2
+      condition: handoff result is available

package/agents/pharos-alert-investigator.yaml

@@ -0,0 +1,81 @@
+name: pharos-alert-investigator
+description: Reads Pharos alert state, rules, silences, and BDS observability links using project-owned read-only tools.
+tools:
+  includes:
+    - bds_pharos_query_pack
+  excludes: []
+permissionMode: dontAsk
+skills:
+  - pharos-alert-investigation
+maxTurns: 8
+color: yellow
+instructions: |-
+  You are the Pharos alert investigation specialist for this workspace.
+
+  Use the `pharos-alert-investigation` skill by default. For natural-language BDS
+  Pharos requests, start with `bds_pharos_query_pack`, then gather Pharos alert
+  state, alert rule details, active silence status, Prometheus metric results,
+  and BDS dashboard links through project-owned read-only tools.
+
+  When the alert describes DataNode failed volumes or host storage risk, keep
+  Pharos work limited to alert context and route the actual RCA drill-down to the
+  BDS disk investigator. Do not turn a storage alert into Scylla, Airflow, or
+  generic YARN investigation without storage evidence.
+
+  Do not execute external Pharos scripts, do not mutate silences, routes, or
+  rules, and do not request secrets in chat. Credentials must be resolved by the
+  tool from env or Keychain.
+
+  Final answers should state the interpreted intent, exact PromQL or alert read
+  performed, direct Pharos evidence, inferred operational context, and dashboard
+  or silence links needed for manual follow-up.
+runtime:
+  profile: deep-agent
+  autonomy: medium
+  reasoningDepth: high
+  description: Coordinates a graph whose nodes are only agents or tools; skills attach to agent nodes.
+orchestration:
+  nodes:
+    - id: agent-pharos-alert-investigator
+      ref: pharos-alert-investigator
+      description: Receive and classify work inside this agent boundary.
+      kind: agent
+      skills:
+        - pharos-alert-investigation
+    - id: tool-bds-pharos-query-pack
+      ref: bds_pharos_query_pack
+      description: Use bds_pharos_query_pack for package-owned evidence or prepared actions.
+      kind: tool
+    - id: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      description: Decide whether to continue read-only work, ask approval, delegate to another agent, or report.
+      kind: agent
+      ref: pharos-alert-investigator
+      skills:
+        - pharos-alert-investigation
+    - id: human-approval
+      ref: human-approval
+      description: The agent prepares evidence and plans but must not cross approval or ownership boundaries on its own.
+      kind: tool
+      requiresHumanApproval: true
+    - id: agent-pharos-alert-investigator-2
+      ref: pharos-alert-investigator
+      description: Report findings, evidence, approval needs, and next action.
+      kind: agent
+      skills:
+        - pharos-alert-investigation
+  edges:
+    - from: agent-pharos-alert-investigator
+      to: tool-bds-pharos-query-pack
+      condition: SOP context is needed
+    - from: tool-bds-pharos-query-pack
+      to: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      condition: tool result is available
+    - from: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      to: human-approval
+      condition: The request requires external action, mutation, credentials, spending, approval, or work outside this agent scope.
+    - from: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      to: agent-pharos-alert-investigator-2
+      condition: no handoff is needed
+    - from: human-approval
+      to: agent-pharos-alert-investigator-2
+      condition: handoff result is available

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@nuvlore/extension-bds",
+  "version": "0.1.1",
+  "type": "module",
+  "description": "BDS operational read-only tools, workflows, skills, and agents.",
+  "license": "Apache-2.0",
+  "files": [
+    "package.json",
+    "agents",
+    "src",
+    "skills",
+    "workflows",
+    "tools",
+    "LICENSE",
+    "README.md",
+    "vendor/dashboard/src",
+    "vendor/extension-read-only-toolkit/LICENSE",
+    "vendor/extension-read-only-toolkit/README.md",
+    "vendor/extension-read-only-toolkit/package.json",
+    "vendor/extension-read-only-toolkit/src",
+    "vendor/extension-workday-infra-access/LICENSE",
+    "vendor/extension-workday-infra-access/README.md",
+    "vendor/extension-workday-infra-access/package.json",
+    "vendor/extension-workday-infra-access/src",
+    "vendor/extension-workday-infra-access/tools",
+    "vendor/extension-workday-infra-access/skills",
+    "vendor/extension-workday-infra-access/workflows",
+    "vendor/extension-workday-infra-access/agents"
+  ],
+  "keywords": [
+    "agent-runtime-extension"
+  ],
+  "agentRuntimeDistribution": {
+    "visibility": "private",
+    "group": "bds-ops",
+    "serviceGrouping": "multi-capability",
+    "publicService": false,
+    "rationale": "BDS-specific operational skills, agents, workflows, and read-only tools."
+  },
+  "agentRuntimeTools": {
+    "service": "bds"
+  },
+  "scripts": {
+    "test": "npm run test:unit && npm run test:integration",
+    "test:unit": "node --test test/node-unit/*.test.js && vitest run test/unit",
+    "test:integration": "node --test test/node-integration/*.test.js"
+  },
+  "dependencies": {
+    "@nuvlore/extension-read-only-toolkit": "file:vendor/extension-read-only-toolkit",
+    "@nuvlore/extension-workday-infra-access": "file:vendor/extension-workday-infra-access",
+    "zod": "^4.1.12"
+  },
+  "devDependencies": {
+    "vitest": "^3.1.3"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  }
+}

package/skills/bds-airflow-job-status-investigation/SKILL.md

@@ -0,0 +1,104 @@
+---
+name: bds-airflow-job-status-investigation
+description: Read-only BDS datacenter Airflow job status workflow using environment repo Kubernetes control-plane JSON and airflow namespace kubectl evidence.
+allowed-tools:
+  - Read
+  - Glob
+  - Grep
+  - mcp__devops_tool__bds_airflow_job_status_command_pack
+  - mcp__devops_tool__bds_migration_service_operation_command_pack
+  - mcp__devops_tool__bds_environment_host_lookup
+  - mcp__devops_tool__bds_machine_inventory
+  - mcp__devops_tool__remote_readonly_command
+  - mcp__devops_tool__workday_boundary_login
+---
+
+# BDS Airflow Job Status Investigation
+
+Use this skill when BDS datacenter jobs run through Airflow and the requester
+needs job, DAG, copy, migration, or component status from Kubernetes and bounded
+log evidence.
+
+Load `references/airflow-job-status-runbook.md` as the router, then load only
+the matching scenario reference: `references/airflow-access-runbook.md`,
+`references/airflow-copy-and-migration-runbook.md`,
+`references/airflow-snapshot-runbook.md`,
+`references/airflow-bas-dr-runbook.md`, or
+`references/airflow-output-runbook.md`.
+
+## Hard Rules
+
+- Strictly read-only. Do not mutate Kubernetes, Airflow DAG/task state, hosts,
+  HDFS, Helm releases, CI/CD, secrets, credentials, or local config.
+- This skill defines the investigation flow. Use
+  `bds_airflow_job_status_command_pack` only to normalize environment fields and
+  generate validated read-only Kubernetes/Airflow command inputs. Use
+  `bds_migration_service_operation_command_pack` only for migration-service Slack event
+  facts, tenant record files, cutover interpretation, Jira follow-up, and final
+  recovery-state validation.
+- Before parsing local BDS config or Airflow code, run `git pull --ff-only`. If
+  a repo is dirty, report the pull gap and do not stash, reset, or overwrite.
+- First locate the environment repo JSON and read `kubernetes.kube_control_planes`;
+  also accept `.bds.kubernetes.kube_control_planes`.
+- Before Boundary login or remote commands, resolve and confirm the concrete
+  control-plane host with `mcp__devops_tool__bds_environment_host_lookup` using
+  Airflow/Kubernetes control-plane roles. If the command pack returns hosts,
+  confirm them against lookup evidence rather than assuming they are current.
+- Do not invent host tools such as `workday_host_info`, `host_info`,
+  `host_query`, or `bds_enterprise_host_lookup`. Do not use local `grep`, `ls`,
+  `Read`, `Glob`, repository search, local `/hadoop` paths, or local `kubectl`
+  as a host lookup substitute. If host lookup fails, stop and report the exact
+  tool/access gap.
+- Use `bauth init` plus the explicit private-cloud host unchanged. Use root
+  kubeconfig and saved Keychain sudo only through the dedicated plan/runbook
+  paths when read-only evidence requires them.
+- Always query `-n airflow`; default namespace emptiness is not Airflow health
+  evidence.
+- Bound log scans by request time, DAG run, pod, tenant, snapshot, or worker.
+  State the gap before broader read-only scans.
+- If access, sudo, or evidence is blocked, report the exact evidence gap. Do not
+  infer job health from default namespace output or stale Slack state.
+
+## Evidence Order
+
+1. Parse environment, config JSON path, DAG ID, run ID, namespace, tenant,
+   migration identifiers, and incident class.
+2. Refresh relevant local repos with `git pull --ff-only`; report dirty repos.
+3. Read the environment JSON and extract control-plane hosts.
+4. Generate the validated read-only command pack with
+   `bds_airflow_job_status_command_pack`; preserve host, Keychain, Boundary, and safety
+   guidance.
+5. Resolve and confirm the concrete control-plane host with
+   `bds_environment_host_lookup`.
+6. Run `bauth init`, then SSH to the explicit control-plane host and record
+   hostname, UTC time, and user.
+7. Run normal-user `kubectl get pod` only as a kubeconfig baseline.
+8. Use stdin sudo/root kubeconfig for `kubectl get pod -n airflow -o wide`.
+9. Read `deploy,statefulset,job,cronjob`, events, and bounded scheduler/web logs
+   in the `airflow` namespace.
+10. If DAG/run details are known, query Airflow metadata with read-only
+   list/state commands and read exact task logs when needed.
+11. Follow the smallest routed `references/airflow-*-runbook.md` file for
+    scenario details.
+12. Validate recovery with fresh live evidence, not alert disappearance alone.
+
+## Scenario Routing
+
+- Basic component health: pods, events, scheduler/web logs, and health probes.
+- On-demand tenant copy: control-panel ID, task log, source/destination,
+  snapshot/path, YARN app, and DistCp progress.
+- Snapshot cleanup or PRISM `CreateDataFrame` timeout: schedule, bounded
+  `dag_bulk_snapshot_cleaner` logs, NameNode `deleteSnapshot` write-lock
+  evidence, audit RPCs, diff-size gaps, and application timeout.
+- `bas_dr_sla_miss`: affected tenants, stale snapshots, DR task pod state,
+  bad-worker runtime evidence, and BAS lag verification.
+- Migration-service Slack incidents: event identifiers, tenant records,
+  copy/cutover state, bucket sync, `PRISM_READY`, `COMPLETED`, and Jira follow-up.
+- S3 VPCE copy failures: compare failing and alternate endpoints from the same
+  worker/source IP using DNS, route, and bounded curl probes only.
+
+## Output
+
+Return a requester-ready answer: event ids when relevant, control-plane host,
+kubeconfig baseline, Airflow pod/event/log findings, DAG/run state,
+scenario-specific evidence, recovery status, and evidence gaps.