@nuvlore/extension-bds 0.1.1

package/vendor/extension-workday-infra-access/agents/workday-infra-access-readonly.yaml

@@ -0,0 +1,183 @@
+name: workday-infra-access-readonly
+description: Read-only Workday infrastructure access specialist. Plans or checks public-cloud SPC login, and checks Boundary bauth auth before bounded SSH diagnostics on explicit private-cloud/DC hosts.
+tools:
+  includes:
+    - aws_cust_federated_readonly_command_pack
+    - gcp_readonly_command_pack
+    - workday_boundary_login
+    - workday_private_cloud_sudo_readonly_command
+    - workday_public_cloud_kubernetes_read
+    - workday_public_cloud_spc_login
+    - workday_spc_argo_readonly_command_pack
+  excludes: []
+permissionMode: dontAsk
+skills:
+  - workday-infra-access
+  - remote-readonly-investigation
+  - devops-log-analysis
+maxTurns: 8
+color: yellow
+instructions: |-
+  You are the Workday infrastructure access specialist for this workspace.
+
+  Use `workday-infra-access` for public-cloud connection planning, Boundary/LDAP
+  preparation, SPC/Argo inspection, and explicit-host read-only diagnostics. Load
+  `references/access-runbook.md` from that skill when path-specific details are
+  needed.
+
+  Route by target:
+
+  - Public cloud environment login: call `workday_public_cloud_spc_login` first.
+  - AWS CUST: call `aws_cust_federated_readonly_command_pack` before evidence reads.
+  - GCP: call `gcp_readonly_command_pack` before evidence reads.
+  - SPC Argo/status inspection after public-cloud login: call `workday_spc_argo_readonly_command_pack`.
+  - Live public-cloud Kubernetes evidence after SPC is ready: call `workday_public_cloud_kubernetes_read` once per resource/read.
+  - Private cloud/DC host or BDS incident: start with `workday_boundary_login`
+    status and the explicit host or resolvable target supplied by the requester.
+    Private cloud uses `bauth init` and ordinary SSH; it does not use SPC.
+  - Private cloud sudo read: use `workday_private_cloud_sudo_readonly_command`.
+
+  Hard boundaries:
+
+  - Never ask for or print LDAP passwords, Keychain JSON, kubeconfig, cloud
+    credentials, tokens, keytabs, or sudo stdin.
+  - Confirm the operator has an active Workday Security Network session before
+    public-cloud SPC login or private-cloud Boundary `bauth init`.
+  - Only the three dedicated login/sudo tools may read LDAP PROD password from
+    Keychain; do not call Keychain directly from command packs, shell snippets, or
+    agent instructions.
+  - Do not run login/federation, config mutation, Argo/Kubernetes writes, HDFS
+    writes, service restarts, Airflow state changes, migration retry/cancel, or
+    cloud object writes unless an explicit login tool action has structured HITL
+    approval for its local auth-state change.
+  - Treat `spc connect` as connectivity only. It does not prove Kubernetes write
+    permission; before any user-approved remediation, verify `kubectl auth whoami`
+    and `kubectl auth can-i`.
+  - Inspect only explicit targets. If no host, cluster, account, project, or
+    namespace can be resolved, report the blocker instead of inventing one.
+  - Use sudo only for bounded read-only evidence that requires it, and only
+    through the approved saved-credential path described in the runbook.
+
+  For BDS and Argo dependency incidents, compare requested selectors and desired
+  state with live read-only evidence. If namespace RBAC denies pod, service,
+  endpoint, deployment, or log reads, report that as an evidence gap and continue
+  only with reachable evidence.
+
+  Final answers should state the target, identity/readiness checks performed,
+  evidence collected, denied or missing evidence, and any manual remediation plan.
+runtime:
+  profile: deep-agent
+  autonomy: medium
+  reasoningDepth: high
+  description: Coordinates a graph whose nodes are only agents or tools; skills attach to agent nodes.
+orchestration:
+  nodes:
+    - id: agent-workday-infra-access-readonly
+      ref: workday-infra-access-readonly
+      description: Receive and classify work inside this agent boundary.
+      kind: agent
+      skills:
+        - workday-infra-access
+        - remote-readonly-investigation
+        - devops-log-analysis
+    - id: tool-aws-cust-federated-readonly-command-pack
+      ref: aws_cust_federated_readonly_command_pack
+      description: Use aws_cust_federated_readonly_command_pack for package-owned evidence or prepared actions.
+      kind: tool
+    - id: tool-gcp-readonly-command-pack
+      ref: gcp_readonly_command_pack
+      description: Use gcp_readonly_command_pack for package-owned evidence or prepared actions.
+      kind: tool
+    - id: tool-workday-boundary-login
+      ref: workday_boundary_login
+      description: Use workday_boundary_login for package-owned evidence or prepared actions.
+      kind: tool
+    - id: tool-workday-private-cloud-sudo-readonly-command
+      ref: workday_private_cloud_sudo_readonly_command
+      description: Use workday_private_cloud_sudo_readonly_command for package-owned evidence or prepared actions.
+      kind: tool
+    - id: tool-workday-public-cloud-kubernetes-read
+      ref: workday_public_cloud_kubernetes_read
+      description: Use workday_public_cloud_kubernetes_read for one atomic read-only kubectl operation after SPC is ready.
+      kind: tool
+    - id: tool-workday-public-cloud-spc-login
+      ref: workday_public_cloud_spc_login
+      description: Use workday_public_cloud_spc_login for package-owned evidence or prepared actions.
+      kind: tool
+    - id: tool-workday-spc-argo-readonly-command-pack
+      ref: workday_spc_argo_readonly_command_pack
+      description: Use workday_spc_argo_readonly_command_pack for package-owned evidence or prepared actions.
+      kind: tool
+    - id: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      description: Decide whether to continue read-only work, ask approval, delegate to another agent, or report.
+      kind: agent
+      ref: workday-infra-access-readonly
+      skills:
+        - workday-infra-access
+        - remote-readonly-investigation
+        - devops-log-analysis
+    - id: human-approval
+      ref: human-approval
+      description: The agent prepares evidence and plans but must not cross approval or ownership boundaries on its own.
+      kind: tool
+      requiresHumanApproval: true
+    - id: agent-workday-infra-access-readonly-2
+      ref: workday-infra-access-readonly
+      description: Report findings, evidence, approval needs, and next action.
+      kind: agent
+      skills:
+        - workday-infra-access
+        - remote-readonly-investigation
+        - devops-log-analysis
+  edges:
+    - from: agent-workday-infra-access-readonly
+      to: tool-aws-cust-federated-readonly-command-pack
+      condition: SOP context is needed
+    - from: agent-workday-infra-access-readonly
+      to: tool-gcp-readonly-command-pack
+      condition: SOP context is needed
+    - from: agent-workday-infra-access-readonly
+      to: tool-workday-boundary-login
+      condition: SOP context is needed
+    - from: agent-workday-infra-access-readonly
+      to: tool-workday-private-cloud-sudo-readonly-command
+      condition: SOP context is needed
+    - from: agent-workday-infra-access-readonly
+      to: tool-workday-public-cloud-kubernetes-read
+      condition: live Kubernetes read evidence is needed after SPC is ready
+    - from: agent-workday-infra-access-readonly
+      to: tool-workday-public-cloud-spc-login
+      condition: SOP context is needed
+    - from: agent-workday-infra-access-readonly
+      to: tool-workday-spc-argo-readonly-command-pack
+      condition: SOP context is needed
+    - from: tool-aws-cust-federated-readonly-command-pack
+      to: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      condition: tool result is available
+    - from: tool-gcp-readonly-command-pack
+      to: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      condition: tool result is available
+    - from: tool-workday-boundary-login
+      to: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      condition: tool result is available
+    - from: tool-workday-private-cloud-sudo-readonly-command
+      to: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      condition: tool result is available
+    - from: tool-workday-public-cloud-kubernetes-read
+      to: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      condition: tool result is available
+    - from: tool-workday-public-cloud-spc-login
+      to: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      condition: tool result is available
+    - from: tool-workday-spc-argo-readonly-command-pack
+      to: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      condition: tool result is available
+    - from: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      to: human-approval
+      condition: The request requires external action, mutation, credentials, spending, approval, or work outside this agent scope.
+    - from: decision-decide-whether-to-continue-read-only-work-ask-approval-delegate-to-another-agent-or-report
+      to: agent-workday-infra-access-readonly-2
+      condition: no handoff is needed
+    - from: human-approval
+      to: agent-workday-infra-access-readonly-2
+      condition: handoff result is available

package/vendor/extension-workday-infra-access/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@nuvlore/extension-workday-infra-access",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Workday infrastructure read-only access tools, workflows, skills, and agents.",
+  "license": "Apache-2.0",
+  "files": [
+    "package.json",
+    "agents",
+    "src",
+    "tools",
+    "skills",
+    "workflows",
+    "LICENSE",
+    "README.md",
+    "vendor/extension-read-only-toolkit/LICENSE",
+    "vendor/extension-read-only-toolkit/README.md",
+    "vendor/extension-read-only-toolkit/package.json",
+    "vendor/extension-read-only-toolkit/src"
+  ],
+  "keywords": [
+    "agent-runtime-extension"
+  ],
+  "agentRuntimeDistribution": {
+    "visibility": "private",
+    "group": "workday-infra-access",
+    "serviceGrouping": "multi-capability",
+    "publicService": false,
+    "rationale": "Workday infrastructure access domain package for read-only Boundary, public cloud, and Kubernetes workflows."
+  },
+  "agentRuntimeTools": {
+    "service": "workday"
+  },
+  "scripts": {
+    "test": "npm run test:unit && npm run test:integration",
+    "test:unit": "node --test test/node-unit/*.test.js && vitest run test/unit",
+    "test:integration": "node --test test/node-integration/*.test.js"
+  },
+  "dependencies": {
+    "@nuvlore/extension-read-only-toolkit": "file:vendor/extension-read-only-toolkit",
+    "zod": "^4.1.12"
+  },
+  "devDependencies": {
+    "vitest": "^3.1.3"
+  },
+  "publishConfig": {
+    "access": "restricted"
+  }
+}

package/vendor/extension-workday-infra-access/skills/workday-infra-access/SKILL.md

@@ -0,0 +1,102 @@
+---
+name: workday-infra-access
+description: Use when the user needs Workday infrastructure access planning, including DC/Boundary connectivity with LDAP credentials or public-cloud connection planning.
+allowed-tools:
+  - mcp__devops_tool__workday_boundary_login
+  - mcp__devops_tool__workday_public_cloud_environment_map
+  - mcp__devops_tool__workday_public_cloud_spc_login
+  - mcp__devops_tool__workday_private_cloud_sudo_readonly_command
+  - mcp__devops_tool__workday_spc_argo_readonly_command_pack
+  - mcp__devops_tool__public_cloud_access_status
+  - mcp__devops_tool__aws_cust_federated_readonly_command_pack
+  - mcp__devops_tool__gcp_readonly_command_pack
+  - mcp__devops_tool__remote_readonly_command
+  - mcp__devops_tool__remote_log_pattern_summary
+---
+
+# Workday Infrastructure Access
+
+Use this skill for Workday DC/Boundary access planning, saved LDAP
+credential-backed `bauth init`, explicit-host ordinary SSH checks, SPC + Argo UI
+inspection, AWS CUST federated access planning, and GCP read-only access
+planning.
+
+Shared access conventions for DC login, Scylla BDM access, and sudo stdin live
+in `workday-access-profiles`; package tools should reuse those profiles instead
+of copying Boundary, Keychain, SSH, or BDM command templates.
+
+Load `references/access-runbook.md` as the router, then load only the matching
+access-path reference: `references/access-boundary-runbook.md`,
+`references/access-spc-argo-runbook.md`, or
+`references/access-scylla-cloud-runbook.md`.
+
+## Routing
+
+- Boundary/DC host access: start with `workday_boundary_login` action `status`.
+  If login preparation is required, use action `login` only after explicit
+  human approval with `humanApprovedLocalWrite: true` and a complete structured
+  `hitlApproval` object.
+- Public cloud environment mapping: when the user gives a logical environment
+  such as CP2, call `workday_public_cloud_environment_map` first to resolve the
+  concrete SPC cluster and platform-specific follow-up reads.
+- Public cloud environment login: after mapping, call
+  `workday_public_cloud_spc_login`.
+  For customer SPC clusters, the tool must refresh `sso-cust` with
+  `sso-cli aws --force --profile sso-cust`, then run SPC with
+  `AWS_PROFILE=sso-cust` only. Do not pass `AWS_REGION` into `sso-cli aws`,
+  `spc connect`, or the follow-up kubectl environment unless the operator
+  explicitly requests a region override.
+- Workday SPC + Argo UI inspection after public-cloud login: call `workday_spc_argo_readonly_command_pack`.
+- Generic public cloud access planning: call `public_cloud_access_status`.
+- AWS CUST federated access: call `aws_cust_federated_readonly_command_pack` first.
+- GCP project access: call `gcp_readonly_command_pack` first.
+- Private cloud sudo evidence collection: for an explicit private cloud/DC
+  host, use only `workday_private_cloud_sudo_readonly_command` for commands
+  that need sudo. The tool itself runs `bauth init` with LDAP PROD, then uses
+  ordinary `ssh <host>`.
+- Non-sudo remote evidence collection: after Boundary login is ready and the
+  target host is explicit, use only `remote_readonly_command` or
+  `remote_log_pattern_summary` with ordinary SSH. Private cloud/DC does not use
+  SPC.
+
+## Guardrails
+
+- Never ask the user to paste LDAP passwords into chat.
+- Never print, summarize, or store LDAP passwords, Keychain JSON, tokens,
+  private keys, kubeconfig, ADC, AWS credential files, or cloud session
+  material.
+- Login preparation can update local auth state; keep it separate from remote
+  inspection evidence and require explicit approval. Public cloud uses SPC;
+  private cloud/DC uses Boundary through `bauth init`.
+- Both public cloud SPC login and private cloud Boundary login require an
+  already-active Workday Security Network session first.
+- Only `workday_boundary_login`, `workday_public_cloud_spc_login`, and
+  `workday_private_cloud_sudo_readonly_command` may read the LDAP PROD password
+  from Keychain. Other tools and agents must not call Keychain directly.
+- Do not authenticate, port-forward, mutate Argo/Kubernetes, call cloud APIs, or
+  run cloud login/config commands from a tool unless the operator is actively
+  doing that approved local setup in an interactive session.
+- Do not invent hostnames. If no host or resolvable target is provided, ask for
+  the host or state the blocker.
+- Treat permission/RBAC/IAM denials as evidence gaps, not proof that a resource,
+  service, pod, or log is absent.
+
+## Evidence Order
+
+1. Classify the request as Boundary/DC, SPC/Argo, AWS CUST, GCP, generic public
+   cloud, or explicit remote read-only inspection.
+2. Generate the relevant atomic helper tool output before using local or remote access.
+3. Verify cloud/session identity and authorization before evidence reads:
+   for public-cloud SPC, check `AWS_PROFILE=sso-cust aws sts get-caller-identity`
+   before `kubectl auth whoami` and `kubectl auth can-i`; for other paths use
+   `aws sts get-caller-identity`,
+   `gcloud auth list`, or `gcloud config list` as applicable.
+4. Collect only bounded read-only evidence from explicit hosts, namespaces,
+   projects, accounts, or services.
+5. Report exact status, evidence, blockers, and next read-only checks.
+
+## Output
+
+Return Boundary/SPC/cloud readiness, target checked, identity or authorization
+evidence, read-only command result summary, blockers such as missing Keychain
+credential or unavailable `bauth`, and the next safe read-only check.

package/vendor/extension-workday-infra-access/skills/workday-infra-access/references/access-boundary-runbook.md

@@ -0,0 +1,43 @@
+# Boundary And BDS DC Access Runbook
+
+Use for private cloud/DC `bauth init`, explicit BDS DC hosts, ordinary SSH,
+sudo stdin, root-owned read-only state, and remote command examples. Owner:
+`workday-infra-access/SKILL.md`.
+
+## Shared Profiles
+
+- Reuse shared profiles for DC SSH and `SudoEnvironmentProfile` for routing
+  sudo reads to the dedicated sudo tool.
+
+## Boundary Access
+
+- Check Boundary status with `workday_boundary_login` using `action: "status"`.
+- If Boundary is not ready and the user explicitly approves local auth-state
+  changes, call `workday_boundary_login` with `action: "login"`,
+  `humanApprovedLocalWrite: true`, and a complete `hitlApproval` object with
+  `approved`, `approvedBy`, `action`, `target`, `reason`, `expectedImpact`, and
+  `risk`.
+- The tool consumes the saved macOS Keychain LDAP credential in place for
+  approved `bauth init`; do not ask the user to paste LDAP passwords into chat.
+- For BDS customer DC hosts, use the explicit hostname from incident or
+  environment evidence unchanged. After `bauth init`, connect with ordinary
+  `ssh <host>`; do not use SPC for private cloud and do not invent `.bnd`
+  aliases.
+- Start remote work as the normal SSH user. Use `sudo` only for root-owned
+  read-only state such as root kubeconfig, bounded `journalctl`, or service
+  status.
+- When sudo needs a password, use `workday_private_cloud_sudo_readonly_command`.
+  The tool reads the LDAP PROD password from Keychain, runs `bauth init`, then
+  passes the same secret only to remote sudo stdin. Agents and command packs
+  must not call Keychain directly.
+
+## Read-Only Command Boundary
+
+- Read-only examples: `hostname -f`, `date -u`, `whoami`,
+  `kubectl get/describe/logs`, `hdfs dfs -ls/-du/-cat/-tail`, `yarn logs`,
+  `getent hosts`, `ip route get`, bounded `curl` connect probes, `journalctl`
+  reads, and `systemctl status`.
+- Mutating examples forbidden in read-only investigations: service restarts,
+  `kubectl apply/delete/patch/scale/rollout restart`, Airflow `clear`,
+  `backfill`, `trigger`, `mark_success`, HDFS writes/removals, migration
+  cancel/retry, and `aws s3 cp` object writes.

package/vendor/extension-workday-infra-access/skills/workday-infra-access/references/access-runbook.md

@@ -0,0 +1,15 @@
+# Workday Infrastructure Access Runbook Router
+
+This file is only a router for `workday-infra-access/SKILL.md`. Load the
+smallest access-path reference that matches the request.
+
+Both public-cloud SPC and private-cloud Boundary paths require an active Workday
+Security Network session before starting environment login.
+
+- Private cloud/DC `bauth init`, BDS DC ordinary SSH, sudo stdin, and
+  read-only remote commands:
+  `access-boundary-runbook.md`.
+- Public cloud SPC login, Argo UI, ComponentRelease, Flux HelmRelease,
+  smoke-test dependency namespace checks: `access-spc-argo-runbook.md`.
+- Scylla BDM, AWS CUST, and GCP public-cloud read-only access after SPC login:
+  `access-scylla-cloud-runbook.md`.

package/vendor/extension-workday-infra-access/skills/workday-infra-access/references/access-scylla-cloud-runbook.md

@@ -0,0 +1,39 @@
+# Scylla BDM And Public Cloud Access Runbook
+
+Use for Scylla BDM bucket checks, AWS CUST read-only access, and GCP read-only
+access. Owner: `workday-infra-access/SKILL.md`.
+
+## Scylla BDM Access
+
+- Reuse `ScyllaAccessProfile` for BDM `kcsb`, `bucketdetails-config`, and RBAC.
+- Connect to the target Scylla environment, read `bucketdetails-config`, then use
+  BDM `kcsb exec <bdm-pod> -- sh -lc 'hadoop fs ...'` and bounded BDM logs.
+- Before claiming SIR, Galahad, OMS, or ORS pods/logs are absent, run namespace
+  `kubectl auth can-i` checks through the SPC kubeconfig.
+
+## AWS CUST
+
+- Use `aws_cust_federated_readonly_command_pack` first. The operator must complete AWS
+  federated access using the approved CCOE guide
+  `AWS - Federated Access to CUST Accounts - User Guide`; tools must not open
+  browser federation, run `aws configure`, read `~/.aws`, or store cloud session
+  material.
+- Always run `aws sts get-caller-identity` before AWS evidence reads. Verify
+  account ID, role ARN, region, and profile against incident evidence before
+  reading service metadata.
+- AWS read-only commands are limited to `describe-*`, `list-*`, `get-*`,
+  `head-*`, `aws s3 ls`, and `aws sts get-caller-identity`.
+- Treat `aws s3 cp`, `mv`, `rm`, `sync`, `s3api put-object`,
+  `s3api delete-object`, `secretsmanager get-secret-value`, and IAM/KMS mutation
+  as forbidden.
+
+## GCP
+
+- Use `gcp_readonly_command_pack` first. Use an already-approved local `gcloud`
+  identity only; do not run `gcloud auth login`, `gcloud config set`, read ADC
+  credentials, or change active project/impersonation from a tool.
+- Always verify `gcloud auth list` and `gcloud config list` before GCP evidence
+  reads.
+- GCP read-only commands are limited to project/IAM policy inspection,
+  list/describe/read operations, and Cloud Storage bucket/object listing.
+- A cloud IAM denial is an evidence gap, not proof that the resource is absent.

package/vendor/extension-workday-infra-access/skills/workday-infra-access/references/access-spc-argo-runbook.md

@@ -0,0 +1,99 @@
+# SPC, Argo, And ComponentRelease Access Runbook
+
+Use for public cloud SPC connection, Argo UI inspection,
+ComponentRelease/HelmRelease drift, and smoke-test dependency namespace checks.
+Private cloud/DC login uses Boundary through `bauth init` instead. Owner:
+`workday-infra-access/SKILL.md`.
+
+## SPC And Argo UI
+
+- Confirm Workday Security Network login/session is active before SPC login.
+- If the user gives a logical environment name instead of an SPC cluster, map it
+  first with `workday_public_cloud_environment_map`. Do not treat logical names
+  like `CP2` as SPC cluster names.
+- Preserve the operator-provided tier and cluster mapping. Current SPC CLI shape
+  is `spc [-d] connect <tier> <cluster>`; `-d` means developer access for
+  DEV/ENG, not the tier argument. Examples:
+  `spc -d connect dev proteusaws00020` and `spc connect cust s0026`.
+- Use `workday_public_cloud_spc_login` for the reusable public-cloud login
+  step. It may update local SPC kubeconfig/session state only after structured
+  HITL approval.
+- The verified public-cloud login sequence is:
+  1. Confirm Workday Security Network is active.
+  2. Refresh the AWS source credential with
+     `sso-cli aws --force --profile sso-cust`.
+  3. Start SPC with `AWS_PROFILE=sso-cust spc connect cust <cluster>`.
+  4. Verify with
+     `AWS_PROFILE=sso-cust kubectl --kubeconfig=$HOME/.kube/spc-config config current-context`,
+     `auth whoami`, and `auth can-i get pods -n <namespace>`.
+  Do not export `AWS_REGION` or `AWS_DEFAULT_REGION` into the `spc connect` or
+  `kubectl` environment. Do not pass `--region` to `sso-cli aws` unless the
+  operator explicitly requests it; forcing a region into SPC caused DynamoDB
+  `ResourceNotFoundException` during live testing.
+- Use macOS Keychain service `eldwin`, account `eldwin.workday_prod_ldap` for
+  public cloud SPC login across tiers. Legacy `wallee` entries are fallback
+  secret sources only. Some entries are JSON; extract only the top-level
+  `token` and pass it through `expect`/stdin.
+- `spc` requires a TTY password prompt. A plain pipe may fail with
+  `inappropriate ioctl for device`; use an `expect` wrapper. If `spc` exits
+  before a password prompt during debugging, a TTY wrapper such as
+  `/usr/bin/script -q /tmp/spc-<cluster>.out spc connect <tier> <cluster>` can
+  establish the session without exposing the secret.
+- Ensure local `PATH` includes `session-manager-plugin`, `sso-cli`, `kubectl`,
+  and `spc`; missing PATH entries can make `spc connect` or kubeconfig exec auth
+  fail even when binaries are installed.
+- On this workstation the verified binary locations are:
+  `/Users/boqiang.liang/bin/sso-cli`,
+  `/usr/local/bin/spc`,
+  `/usr/local/bin/kubectl`, and
+  `/usr/local/bin/session-manager-plugin`. Non-login shells may not include
+  these paths by default, so tools must set the PATH explicitly.
+- `spc list cust --url` is a useful preflight after AWS refresh. SPC cluster
+  names are values such as `s0026` and `s0109`; names like `wd103perf` can be
+  AWS profile aliases or legacy kube contexts and are not necessarily valid SPC
+  cluster names.
+- CP2 examples:
+  - AWS-backed public cloud: refresh AWS with `sso-cli aws --force --profile
+    sso-cust`, then `AWS_PROFILE=sso-cust spc connect cust s0054`, then use
+    bounded `kcsb get pod` or explicit `kubectl --kubeconfig=$HOME/.kube/spc-config`
+    reads.
+  - GCS-backed public cloud: refresh AWS with `sso-cli aws --force --profile
+    sso-cust`, then `AWS_PROFILE=sso-cust spc connect cust s0029`, then use
+    bounded `kcsb get pod`; if approved read-only pod shell access is needed,
+    `kcsb exec -it bdm-0 -- bash` may be used only for bounded reads such as
+    `gsutil ls gs://scylla-218441665564-bds-tenant-s0020/data/tenants/`.
+- Use `kcsb` or explicit `kubectl` commands so evidence is copyable, bounded,
+  and auditable.
+- Clean up long-running `spc connect` and port-forward processes when done.
+- After `spc` is connected, Argo UI can be inspected through
+  `kubectl --kubeconfig=$HOME/.kube/spc-config -n argocdapp port-forward svc/argocdapp-server 8080:443`
+  and `https://localhost:8080/`.
+- `spc connect` proves connectivity, not Kubernetes authorization. Before any
+  approved remediation such as `kubectl scale`, `patch`, or `rollout restart`,
+  verify identity with `kubectl auth whoami` and the target verb with
+  `kubectl auth can-i ... -n <namespace>`.
+- Argo UI inspection is read-only only if you avoid state-changing controls:
+  `Sync`, `Hard Refresh`, `Delete`, `Rollback`, `Scale`, `Patch`, and `Restart`.
+- Prefer CLI reads where possible:
+  `kubectl --kubeconfig=$HOME/.kube/spc-config get app -n argocdapp ... -o json`,
+  `kubectl get componentrelease -n <namespace> ...`, and
+  `kubectl get deploy,statefulset,pods -n <namespace> -o wide`.
+- Before claiming a service, pod, or log is absent, check namespace RBAC with
+  `kubectl --kubeconfig=$HOME/.kube/spc-config auth can-i get pods -n <namespace>`,
+  plus equivalent service, endpoints, deployment, and logs checks.
+
+## ComponentRelease And Smoke-Test Dependencies
+
+- For BDS/Proteus ComponentRelease investigations, verify all five layers:
+  scylla `component-config` source of truth, Argo Application sync/health,
+  ComponentRelease desired/deployed status, Flux HelmRelease desired status and
+  `spec.driftDetection`, and live Deployment/StatefulSet/pod replicas.
+- Treat `HelmRelease.spec.driftDetection` as a Flux Helm Controller setting. If
+  it is null/disabled and live workloads drift from non-zero desired replicas,
+  the deeper platform question is whether `isd-component-controller` and the
+  ComponentRelease CRD/default HelmRelease spec expose or set drift detection.
+- When a Bamboo smoke test waits on a dependency selector such as `name=prism`,
+  inspect that dependency namespace directly. Compare ComponentRelease and
+  HelmRelease desired state with live deployments, pods selected by the exact
+  label, and service endpoints; do not assume a successful ComponentRelease
+  means dependency pods are running.