@nuvlore/extension-bds 0.1.1

package/vendor/extension-workday-infra-access/tools/workday_spc_argo_readonly_command_pack.mjs

@@ -0,0 +1,215 @@
+export const description = "Create a local-only, read-only Workday SPC + Argo UI access command pack using saved Keychain LDAP credentials; does not authenticate, port-forward, or mutate Argo/Kubernetes.";
+
+import { z } from "zod";
+import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+
+const DEFAULT_TIER = "dev";
+const DEFAULT_KEYCHAIN_SERVICE = "eldwin";
+const DEFAULT_KEYCHAIN_ACCOUNT = "eldwin.workday_prod_ldap";
+const DEFAULT_KUBECONFIG = "$HOME/.kube/spc-config";
+const DEFAULT_ARGO_NAMESPACE = "argocdapp";
+const DEFAULT_ARGO_SERVICE = "argocdapp-server";
+const DEFAULT_LOCAL_PORT = 8080;
+
+function normalizeText(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", "'\\''")}'`;
+}
+
+function spcCommand(input) {
+  const developerFlag = input.developerAccess ? " -d" : "";
+  return `spc${developerFlag} connect ${shellQuote(input.tier)} ${shellQuote(input.cluster)}`;
+}
+
+function spcTtyCommand(input) {
+  return `/usr/bin/script -q /tmp/spc-${input.cluster}.out ${spcCommand(input)}`;
+}
+
+function portForwardCommand(input) {
+  return [
+    "kubectl",
+    `--kubeconfig=${input.kubeconfig}`,
+    "-n",
+    shellQuote(input.argoNamespace),
+    "port-forward",
+    `svc/${shellQuote(input.argoService)}`,
+    `${input.localPort}:443`
+  ].join(" ");
+}
+
+function argocdStatusCommands(input) {
+  const appNames = input.appNames.length ? input.appNames.map(shellQuote).join(" ") : "";
+  const appSelector = appNames || "-A";
+  const kubeconfig = `--kubeconfig=${input.kubeconfig}`;
+  return [
+    `kubectl ${kubeconfig} get app -n ${shellQuote(input.argoNamespace)} ${appSelector}`,
+    `kubectl ${kubeconfig} get app -n ${shellQuote(input.argoNamespace)} ${appSelector} -o json | jq '.items[]? // .'`,
+    `kubectl ${kubeconfig} get componentrelease -n ${shellQuote(input.workloadNamespace)} ${appNames || ""} -o wide`,
+    `kubectl ${kubeconfig} get componentrelease -n ${shellQuote(input.workloadNamespace)} ${appNames || ""} -o json | jq '.items[]? // . | {name:.metadata.name, chartVersion:.spec.chartVersion, replicas:.spec.chartValues.component.replicas, conditions:.status.conditions}'`,
+    `kubectl ${kubeconfig} get helmrelease -n ${shellQuote(input.workloadNamespace)} ${appNames || ""} -o json | jq '.items[]? // . | {name:.metadata.name, ownerReferences:.metadata.ownerReferences, driftDetection:.spec.driftDetection, replicas:.spec.values.component.replicas, conditions:.status.conditions}'`,
+    `kubectl ${kubeconfig} get deploy,statefulset -n ${shellQuote(input.workloadNamespace)} -o wide`,
+    `kubectl ${kubeconfig} get pods -n ${shellQuote(input.workloadNamespace)} -o wide`,
+    `kubectl ${kubeconfig} get svc,endpoints -n ${shellQuote(input.workloadNamespace)} -o wide`,
+    `kubectl ${kubeconfig} get pods -n ${shellQuote(input.workloadNamespace)} --show-labels`,
+    `kubectl ${kubeconfig} get hpa,vpa,scaledobject -n ${shellQuote(input.workloadNamespace)} 2>/dev/null || true`,
+    `kubectl ${kubeconfig} get events -n ${shellQuote(input.workloadNamespace)} --sort-by=.lastTimestamp`
+  ].filter((command) => !command.endsWith("  -o wide"));
+}
+
+function rbacProbeCommands(input) {
+  const kubeconfig = `--kubeconfig=${input.kubeconfig}`;
+  const namespace = shellQuote(input.workloadNamespace);
+  return [
+    `kubectl ${kubeconfig} auth whoami 2>&1 || true`,
+    `kubectl ${kubeconfig} auth can-i patch deployments/scale -n ${namespace}`,
+    `kubectl ${kubeconfig} auth can-i patch deployments -n ${namespace}`,
+    `kubectl ${kubeconfig} auth can-i patch componentreleases.component.workday.com -n ${namespace}`,
+    `kubectl ${kubeconfig} auth can-i patch helmreleases.helm.toolkit.fluxcd.io -n ${namespace}`
+  ];
+}
+
+function smokeDependencyCommands(input) {
+  const kubeconfig = `--kubeconfig=${input.kubeconfig}`;
+  const namespace = shellQuote(input.workloadNamespace);
+  return [
+    `kubectl ${kubeconfig} get pods -n ${namespace} -l name=prism -o wide`,
+    `kubectl ${kubeconfig} get deploy -n ${namespace} -l name=prism -o wide`,
+    `kubectl ${kubeconfig} get svc,endpoints -n ${namespace} | grep -E 'prism|NAME' || true`
+  ];
+}
+
+function componentControllerCommands(input) {
+  const kubeconfig = `--kubeconfig=${input.kubeconfig}`;
+  return [
+    `kubectl ${kubeconfig} get crd componentreleases.component.workday.com -o json | jq '.spec.versions[]? | select(.served==true) | .schema.openAPIV3Schema.properties.spec.properties | keys'`,
+    `kubectl ${kubeconfig} -n isd-component-controller get deploy isd-component-controller-controller-manager -o json | jq '{image:.spec.template.spec.containers[0].image,args:.spec.template.spec.containers[0].args,labels:.metadata.labels}'`,
+    `kubectl ${kubeconfig} -n isd-component-controller get configmap isd-component-controller-component-controller-config -o json | jq -r '.data | to_entries[] | .value'`
+  ];
+}
+
+function normalizeInput(input = {}) {
+  const appNames = Array.isArray(input.appNames)
+    ? input.appNames.map(normalizeText).filter(Boolean)
+    : [];
+  const tier = normalizeText(input.tier ?? input.domain) || DEFAULT_TIER;
+  const developerAccess = typeof input.developerAccess === "boolean"
+    ? input.developerAccess
+    : ["dev", "eng"].includes(tier);
+  return {
+    cluster: normalizeText(input.cluster),
+    tier,
+    developerAccess,
+    workloadNamespace: normalizeText(input.workloadNamespace) || "bds",
+    argoNamespace: normalizeText(input.argoNamespace) || DEFAULT_ARGO_NAMESPACE,
+    argoService: normalizeText(input.argoService) || DEFAULT_ARGO_SERVICE,
+    keychainService: DEFAULT_KEYCHAIN_SERVICE,
+    keychainAccount: DEFAULT_KEYCHAIN_ACCOUNT,
+    kubeconfig: normalizeText(input.kubeconfig) || DEFAULT_KUBECONFIG,
+    localPort: Number.isInteger(input.localPort) ? input.localPort : DEFAULT_LOCAL_PORT,
+    appNames
+  };
+}
+
+export class WorkdaySpcArgoReadonlyPlanService {
+  invoke(input) {
+    const normalized = normalizeInput(input);
+    if (!normalized.cluster) {
+      throw new Error("cluster is required, for example proteusaws00020.");
+    }
+
+    return JSON.stringify({
+      mode: "atomic-helper",
+      target: {
+        cluster: normalized.cluster,
+        tier: normalized.tier,
+        developerAccess: normalized.developerAccess,
+        workloadNamespace: normalized.workloadNamespace,
+        argoNamespace: normalized.argoNamespace,
+        argoService: normalized.argoService,
+        appNames: normalized.appNames
+      },
+      credentialSource: {
+        keychainService: normalized.keychainService,
+        keychainAccount: normalized.keychainAccount,
+        secretHandling: "do not read PROD password in this command pack; use workday_public_cloud_spc_login for SPC login"
+      },
+      localStateChanges: [
+        "spc may open a local session and update local kubeconfig/context state",
+        "spc connectivity does not grant Kubernetes RBAC; verify the resulting identity with kubectl auth whoami and can-i",
+        "kubectl port-forward opens a localhost listener only"
+      ],
+      commands: {
+        publicCloudLoginTool: `mcp__devops-tool__workday_public_cloud_spc_login ${JSON.stringify({ action: "login", tier: normalized.tier, cluster: normalized.cluster, namespace: normalized.workloadNamespace, humanApprovedLocalWrite: true })}`,
+        spcConnect: spcCommand(normalized),
+        spcConnectTty: spcTtyCommand(normalized),
+        argoPortForward: portForwardCommand(normalized),
+        argoUiUrl: `https://localhost:${normalized.localPort}/`,
+        readOnlyStatus: argocdStatusCommands(normalized),
+        smokeDependencies: smokeDependencyCommands(normalized),
+        rbacProbes: rbacProbeCommands(normalized),
+        componentControllerStatus: componentControllerCommands(normalized)
+      },
+      forbiddenActions: [
+        "Argo Sync",
+        "Argo Hard Refresh",
+        "Argo Delete",
+        "Argo Rollback",
+        "Kubernetes Scale",
+        "Kubernetes Patch",
+        "Kubernetes Restart"
+      ],
+      remoteWrite: "not_executed"
+    }, null, 2);
+  }
+}
+
+const defaultService = new WorkdaySpcArgoReadonlyPlanService();
+
+function workdaySpcArgoReadonlyPlan(input) {
+  return defaultService.invoke(input);
+}
+
+export default defineReadOnlyTool({
+  name: "workday_spc_argo_readonly_command_pack",
+  description: "Create a local-only, read-only Workday SPC + Argo UI access command pack using saved Keychain LDAP credentials; does not authenticate, port-forward, or mutate Argo/Kubernetes.",
+  meta: {
+    permissions: { rule: "ask" },
+    secret_provider: "keychain"
+  },
+  inputSchema: {
+    cluster: z.string().trim().min(1).max(253),
+    domain: z.string().trim().min(1).max(64).optional().describe("Deprecated alias for tier. Use tier for the current SPC CLI shape."),
+    tier: z.string().trim().min(1).max(64).default(DEFAULT_TIER),
+    developerAccess: z.boolean().optional(),
+    workloadNamespace: z.string().trim().min(1).max(253).default("bds"),
+    argoNamespace: z.string().trim().min(1).max(253).default(DEFAULT_ARGO_NAMESPACE),
+    argoService: z.string().trim().min(1).max(253).default(DEFAULT_ARGO_SERVICE),
+    appNames: z.array(z.string().trim().min(1).max(253)).max(32).default([]),
+    kubeconfig: z.string().trim().min(1).max(2048).default(DEFAULT_KUBECONFIG),
+    localPort: z.number().int().min(1024).max(65535).default(DEFAULT_LOCAL_PORT)
+  },
+  async handler(input) {
+    try {
+      return ok(workdaySpcArgoReadonlyPlan(input));
+    } catch (error) {
+      return fail(error);
+    }
+  }
+});
+
+export const __test = {
+  WorkdaySpcArgoReadonlyPlanService,
+  normalizeInput,
+  shellQuote,
+  spcCommand,
+  spcTtyCommand,
+  portForwardCommand,
+  argocdStatusCommands,
+  smokeDependencyCommands,
+  rbacProbeCommands,
+  componentControllerCommands,
+  workdaySpcArgoReadonlyPlan
+};

package/vendor/extension-workday-infra-access/workflows/public-cloud-readonly-investigation.js

@@ -0,0 +1,99 @@
+export const meta = {
+  name: "public-cloud-readonly-investigation",
+  description: "Investigate AWS CUST or GCP cloud state through approved federation/local identity and read-only evidence commands only.",
+  whenToUse: "Use when an incident, Bamboo result, Slack thread, or operator request requires AWS CUST or GCP resource inspection without cloud mutation.",
+  phases: ["Plan", "Identity", "Evidence", "Reply"],
+};
+
+phase("Plan");
+const plan = await agent(
+  [
+    "Extract platform, account/account alias or GCP project, region/zone, service, resource, and incident evidence.",
+    "For AWS CUST federated access, call only mcp__devops_tool__aws_cust_federated_readonly_command_pack.",
+    "For GCP, call only mcp__devops_tool__gcp_readonly_command_pack.",
+    "If the platform is ambiguous, report that blocker and do not guess.",
+    "Do not authenticate, open browser federation, read credential files, use Bash, or call cloud APIs in this phase.",
+  ].join("\n"),
+  {
+    label: "public-cloud-plan",
+    phase: "Plan",
+    tools: "mcp__devops_tool__aws_cust_federated_readonly_command_pack,mcp__devops_tool__gcp_readonly_command_pack",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Identity");
+const identity = await agent(
+  [
+    "Verify identity only after approved local federation/login outside this workflow.",
+    "For AWS, run the plan's aws sts get-caller-identity via permitted local read-only execution.",
+    "For GCP, run the plan's gcloud auth list and gcloud config list via permitted local read-only execution.",
+    "If local execution is unavailable or denied, return the exact identity command that must be run manually and mark identity as unverified.",
+    "Never run aws configure, gcloud auth login, gcloud config set, or read ~/.aws, ADC, or credential files.",
+    "",
+    "Plan:",
+    plan,
+  ].join("\n"),
+  {
+    label: "public-cloud-identity",
+    phase: "Identity",
+    tools: "",
+    disallowedTools: "Agent,Task,TaskCreate,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Evidence");
+const evidence = await agent(
+  [
+    "Collect read-only cloud evidence using commands emitted by the plan.",
+    "Allowed action families are describe, list, get metadata, head, read logs, and get-iam-policy.",
+    "For AWS S3, never run cp, mv, rm, sync, put-object, delete-object, or get-object for secrets/private material.",
+    "For GCP Storage, never run cp, mv, rm, update, compose, or rewrite.",
+    "For IAM/KMS/Secrets Manager, read metadata only; never request secret values, private keys, or key material.",
+    "If a command is denied by the read-only runtime or cloud IAM, preserve the denied action as an evidence gap.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Identity:",
+    identity,
+  ].join("\n"),
+  {
+    label: "public-cloud-evidence",
+    phase: "Evidence",
+    tools: "",
+    disallowedTools: "Agent,Task,TaskCreate,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Reply");
+const reply = await agent(
+  [
+    "Draft a concise answer from collected cloud evidence only.",
+    "State platform, account/project, identity state, commands run/blocked, observations, and evidence gaps.",
+    "Distinguish IAM/access denial from resource absence.",
+    "State remediation only as a human-reviewed manual recommendation; do not execute writes.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Identity:",
+    identity,
+    "",
+    "Evidence:",
+    evidence,
+  ].join("\n"),
+  {
+    label: "public-cloud-reply",
+    phase: "Reply",
+    tools: "",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+return {
+  plan,
+  identity,
+  evidence,
+  reply,
+};

package/workflows/bds-airflow-job-status-investigation.js

@@ -0,0 +1,168 @@
+export const meta = {
+  name: "bds-airflow-job-status-investigation",
+  description: "Investigate BDS datacenter Airflow job status with read-only Kubernetes control-plane and airflow namespace evidence.",
+  whenToUse: "Use when BDS jobs run through Airflow and the requester provides or implies an environment JSON with Kubernetes control-plane hosts.",
+  phases: ["Plan", "ResolveHost", "Access", "Kubernetes", "Airflow", "Reply"],
+};
+
+phase("Plan");
+const plan = await agent(
+  [
+    "Extract environment/config path, airflow namespace, DAG/run ids, tenant, timestamps, Jira/Slack links, and incident type.",
+    "Before local BDS config or Airflow code reads, run git pull --ff-only; if dirty, report the gap without stash/reset/overwrite.",
+    "Use the skill flow as the procedure; call bds_airflow_job_status_command_pack so kubernetes.kube_control_planes and the current BDS_ATL_CUST_AZ1 hosts are normalized into read-only command inputs.",
+    "For migration-service Slack incidents, also call bds_migration_service_operation_command_pack for migration records, Jira/cutover state, and recovery validation.",
+    "For bas_dr_sla_miss, snapshot cleanup, or PRISM timeout, plan only bounded read-only evidence: affected tenants, worker/runtime hints, cookbook_bitbucket schedule, top Airflow delete durations, NameNode long write-lock stack, and hourly hdfs-audit.log correlation.",
+    "Do not run mutating kubectl, helm, Airflow, host, or HDFS commands.",
+    "Return parsed fields, missing fields, and command-pack output.",
+  ].join("\n"),
+  {
+    label: "bds-airflow-plan",
+    phase: "Plan",
+    tools: "mcp__devops_tool__bds_airflow_job_status_command_pack,mcp__devops_tool__bds_migration_service_operation_command_pack",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("ResolveHost");
+const resolvedHost = await agent(
+  [
+    "Resolve the concrete BDS Kubernetes control-plane host before Boundary login or remote commands.",
+    "Use the exact host lookup tool mcp__devops_tool__bds_environment_host_lookup with the BDS cluster/environment and roles=[\"airflow\",\"kube_control_planes\",\"tenant_data_operation\"].",
+    "Prefer refreshed environment inventory over stale Slack/Jira hostnames; keep configJsonPath, cluster, namespace, controlPlaneHost, worker hints, and any alert Source label separate.",
+    "If the command pack already returned controlPlaneHosts, confirm them against host lookup instead of assuming they are current.",
+    "Do not invent host tools such as workday_host_info, host_info, host_query, or bds_enterprise_host_lookup.",
+    "Do not use grep, ls, Read, Glob, repository search, local /hadoop paths, or local kubectl as a substitute for host lookup.",
+    "If the exact host lookup MCP tool is unavailable or fails, stop and report the exact tool error as a tooling/access gap.",
+    "Return controlPlaneHost, cluster/environment, namespace, lookup evidence, stale host exclusions, and ambiguity.",
+    "",
+    "Plan:",
+    plan,
+  ].join("\n"),
+  {
+    label: "bds-airflow-resolve-host",
+    phase: "ResolveHost",
+    tools: "mcp__devops_tool__bds_environment_host_lookup,mcp__devops_tool__bds_machine_inventory",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion,mcp__devops_tool__workday_boundary_login,mcp__devops_tool__remote_readonly_command",
+  },
+);
+
+phase("Access");
+const access = await agent(
+  [
+    "Use the resolved controlPlaneHost only; for ATL trust the refreshed BDS_ATL_CUST_AZ1 config host over stale names.",
+    "Private cloud uses bauth init and ordinary ssh to the explicit host. On banner timeout, retry with the explicit proxy jump host proxy-jump.atl.bnd; do not invent .bnd service-host aliases.",
+    "Confirm hostname, UTC clock, user, and kubeconfig behavior with remote_readonly_command.",
+    "If normal-user kubectl hits localhost:8080, record it and continue only with approved root read-only checks.",
+    "If sudo needs stdin, use only mcp__devops_tool__workday_private_cloud_sudo_readonly_command; agents and command packs must not read Keychain directly.",
+    "Never print LDAP passwords, Keychain JSON, tokens, kubeconfig, or sudo stdin.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "ResolvedHost:",
+    resolvedHost,
+  ].join("\n"),
+  {
+    label: "bds-airflow-access",
+    phase: "Access",
+    tools: "mcp__devops_tool__workday_boundary_login,mcp__devops_tool__remote_readonly_command",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Kubernetes");
+const kubernetes = await agent(
+  [
+    "Collect read-only Kubernetes evidence from the airflow namespace: pods -o wide, workloads, describe summaries, and recent events.",
+    "For bas_dr_sla_miss, capture DR pod node placement, deletionTimestamp/finalizers/events, and whether any Running pod is actively progressing before remediation guidance.",
+    "Do not infer job health from default namespace output.",
+    "Do not use kubectl delete/apply/patch/scale/rollout restart/exec mutations or helm writes. Do not stop host processes, restart kubelet/containerd, or uncordon nodes.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "ResolvedHost:",
+    resolvedHost,
+    "",
+    "Access:",
+    access,
+  ].join("\n"),
+  {
+    label: "bds-airflow-kubernetes",
+    phase: "Kubernetes",
+    tools: "mcp__devops_tool__remote_readonly_command",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Airflow");
+const airflow = await agent(
+  [
+    "Collect bounded Airflow scheduler/web logs and read-only metadata only.",
+    "Separate healthy components from DAG/config risk: Running/Ready pods, zero restarts, Events:<none>, and /airflow/health HTTP 200 do not clear DagBag Failed to import or FileNotFoundError config issues.",
+    "Treat Prometheus response.WriteHeader and sensu read-only filesystem chown lines as noise unless restarts/readiness/container errors also appear.",
+    "If a control-panel id like dag_tenant_data_copy_on_demand--1780713387370568 misses metadata, convert epoch microseconds to UTC and read /data/workday-bds-airflow/logs/dag_tenant_data_copy_on_demand/manual__<UTC_ISO>/run_tenant_data_ondemand_restore_copy/1.log.",
+    "For tenant copy, use Running command, src/dst clusters, source snapshot/path, Submitted application, map progress, return code, and Marking task as SUCCESS.",
+    "For bas_dr_sla_miss, read affected DR task logs for success/failure markers, DistCp/YARN ids, snapshots, stale completed pods, and active Running pods.",
+    "For bad worker zombie/runtime evidence, collect read-only uptime/load, D/Z or zombie processes, kubelet/containerd timeout, and stuck runc/mount/cgroup cleanup facts.",
+    "After approved operator cleanup only, verify healthy-worker replacement pods, newer mirror snapshots, task success, and BAS lag below 3600 seconds.",
+    "For current BDS_ASH_CUST_AZ1 bas_dr_sla_miss count, read s-11rdzb3.sys.az1.cust.ash.wd and run sudo /data/pharos_script_exporter/scripts/bas_dr_sla_miss_metric.rb BDS_ASH_CUST_AZ1; report total, missed >3600, max lag/tenant, and top tenants.",
+    "For migration copy/cutover, read migration-service/Airflow callbacks and tenant records for last good/failed snapshot, file counts, state, HDFS authority such as hdfs://bdsatlcustaz11, and Only cutover run allowed state-machine evidence.",
+    "For a long-running task pod, extract tenant/process, src/dst clusters, source snapshot, HDFS paths, YARN app id, and latest DistCp map progress; classify progressing Ready pods as slow copy, not Airflow failure.",
+    "For snapshot cleanup, read cookbook_bitbucket schedule/timeout, top Airflow delete durations, active NameNode FSNamesystem.deleteSnapshot long write-lock stack, and hourly hdfs-audit.log delete/read-RPC correlation.",
+    "Classify backlog or large diff cleanup only when repeated snapshot deletions, elevated durations, matching write locks, and blocked read RPCs align; state direct diff-size evidence gaps unless proven.",
+    "Explain getFileInfo/getfileinfo, listStatus, open, and getBlockLocations as read-lock RPCs queued behind deleteSnapshot write locks.",
+    "Never run airflow clear, backfill, pause/unpause, trigger, mark_success, or any state mutation.",
+    "",
+    "Kubernetes:",
+    kubernetes,
+  ].join("\n"),
+  {
+    label: "bds-airflow-runtime",
+    phase: "Airflow",
+    tools: "mcp__devops_tool__remote_readonly_command",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Reply");
+const reply = await agent(
+  [
+    "Draft a concise requester-ready answer from evidence only.",
+    "Include host, kubeconfig/root context, airflow pods/workloads, events/logs, DAG/run state, and exact gaps.",
+    "For tenant copy, include src/dst clusters and paths, source snapshot, tenant/env, YARN app id, and latest progress.",
+    "For bas_dr_sla_miss, include affected tenants, stale snapshot time, stuck pod/node, log markers, bad worker zombie/runtime evidence, approved-only force-delete/cordon path, replacement pod, mirror snapshot, and live BAS count from s-11rdzb3 versus 3600 seconds.",
+    "For migration-service Slack incidents, include event ids, failed copy record, endpoint comparison, cutover status, file counts, bucket sync, PRISM_READY, and COMPLETED.",
+    "For snapshot cleanup, include cookbook_bitbucket cron/timeout, top deleteSnapshot durations, tenant/snapshot backlog, NameNode write-lock stack, hourly hdfs-audit.log paths, metadata RPCs, direct diff-size evidence gaps, and timeout boundary.",
+    "Separate Airflow component health from DAG/config risks in the conclusion.",
+    "Do not claim job health from the default namespace alone.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "ResolvedHost:",
+    resolvedHost,
+    "",
+    "Kubernetes:",
+    kubernetes,
+    "",
+    "Airflow:",
+    airflow,
+  ].join("\n"),
+  {
+    label: "bds-airflow-reply",
+    phase: "Reply",
+    tools: "",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+return {
+  plan,
+  resolvedHost,
+  access,
+  kubernetes,
+  airflow,
+  reply,
+};

package/workflows/bds-disk-io-alert-investigation.js

@@ -0,0 +1,173 @@
+export const meta = {
+  name: "bds-disk-io-alert-investigation",
+  description: "Investigate BDS storage alerts from the source host with read-only filesystem, kernel, Dell storage, HDFS DataNode failed-volume, and RCA evidence.",
+  whenToUse: "Use when Slack/PagerDuty reports a BDS storage symptom: kernel disk IO errors, medium errors, bad blocks, HDFS DataNode failed volumes, PERC virtual disk issues, or predictive disk failure on a BDS host.",
+  ownershipExamples: [
+    "A DataNode failed-volume alert with a BDS cluster and source host starts here because the first evidence boundary is host storage state.",
+    "A disk alert should not start in Scylla tenant-bucket, Airflow job-status, or generic YARN workflows unless storage evidence points there.",
+    "Resolve the evidence target host before access: active DataNode text, alert Source label, cluster, namespace, and disk path are not always the same signal.",
+    "Private-cloud/DC host access must pass the Workday Boundary login gate before any remote host reads."
+  ],
+  phases: ["Plan", "ResolveHost", "Access", "Host", "Storage", "RCA"],
+};
+
+phase("Plan");
+const plan = await agent(
+  [
+    "Extract alertName, cluster, sourceHost, severity, and alert time.",
+    "Preserve all host-like fields separately: active DataNode, alert Source label, namespace, cluster, and disk path.",
+    "Classify the symptom by operational domain. If it is DataNode failed volumes or host storage risk, keep this disk workflow as the primary path.",
+    "Use the skill flow as the procedure; call only mcp__devops_tool__bds_disk_io_alert_command_pack to normalize inputs and produce the read-only command pack.",
+    "No Bash, browser access, WebFetch, local reproduction, or mutating storage commands.",
+    "Return parsed alert fields, command-pack output, and missing fields.",
+  ].join("\n"),
+  {
+    label: "bds-disk-plan",
+    phase: "Plan",
+    tools: "mcp__devops_tool__bds_disk_io_alert_command_pack",
+    disallowedTools: "Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("ResolveHost");
+const resolvedHost = await agent(
+  [
+    "Resolve the concrete BDS host to inspect before any access or SSH attempt.",
+    "For DataNode failed-volume alerts, prefer the active DataNode host from the alert sentence as the evidenceTargetHost; keep the alert Source label as alertSourceLabel unless lookup evidence proves it is the same host.",
+    "The required first host lookup tool name is exactly mcp__devops_tool__bds_environment_host_lookup. Call it for the BDS cluster with roles=[\"datanodes\"]. Call mcp__devops_tool__bds_machine_inventory only when broader inventory confirmation is needed.",
+    "Do not invent or call non-existent tools such as workday_host_info, host_info, host_query, or bds_enterprise_host_lookup.",
+    "Do not use grep, ls, Read, Glob, or repository searches to discover host tools or host records. The authoritative host lookup path is the MCP tool call above.",
+    "Treat disk paths such as /hadoop/disk5/dfs/dn as remote paths on the resolved DataNode. Never run local execute/Bash/ls against those paths.",
+    "If the exact host lookup MCP tool is unavailable or fails, stop and report the tool error as an access/tooling gap; do not fall back to local filesystem checks.",
+    "Return evidenceTargetHost, alertSourceLabel, cluster, namespace, diskPath, lookup evidence, and any ambiguity. Do not run SSH, Boundary login, Bash, or remote commands in this phase.",
+    "",
+    "Plan:",
+    plan,
+  ].join("\n"),
+  {
+    label: "bds-disk-resolve-host",
+    phase: "ResolveHost",
+    tools: "mcp__devops_tool__bds_environment_host_lookup,mcp__devops_tool__bds_machine_inventory",
+    disallowedTools: "Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion,mcp__devops_tool__remote_readonly_command,mcp__devops_tool__workday_boundary_login",
+  },
+);
+
+phase("Access");
+const access = await agent(
+  [
+    "Check private-cloud/DC host access before any remote host evidence, using the resolved evidenceTargetHost.",
+    "Use workday_boundary_login action=status first.",
+    "If Boundary/SSHCA is not ready, run workday_boundary_login action=login only when the current operator has explicitly approved local auth-state preparation.",
+    "Private cloud uses bauth init plus ordinary ssh to the explicit host; do not use SPC and do not invent .bnd service-host aliases.",
+    "If login is still not ready, stop host evidence collection and return the exact access gap.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Resolved host:",
+    resolvedHost,
+  ].join("\n"),
+  {
+    label: "bds-disk-access",
+    phase: "Access",
+    tools: "mcp__devops_tool__workday_boundary_login",
+    disallowedTools: "Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion,mcp__devops_tool__remote_readonly_command",
+  },
+);
+
+phase("Host");
+const host = await agent(
+  [
+    "Collect read-only host and filesystem evidence from the resolved evidenceTargetHost, not from an unverified alert Source label.",
+    "Proceed only after the Access phase reports Boundary/SSHCA readiness or an approved successful login.",
+    "Use remote_readonly_command for the remote DataNode path; never run local execute/Bash/ls for /hadoop paths.",
+    "Use remote_readonly_command for host identity, UTC time, boot time, lsblk, df, findmnt, and iostat.",
+    "Do not unmount, repair, format, restart services, stop workloads, write files, or change disk state.",
+    "Return observations, command labels, timestamps, and evidence gaps.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Resolved host:",
+    resolvedHost,
+    "",
+    "Access:",
+    access,
+  ].join("\n"),
+  {
+    label: "bds-disk-host",
+    phase: "Host",
+    tools: "mcp__devops_tool__remote_readonly_command",
+    disallowedTools: "WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Storage");
+const storage = await agent(
+  [
+    "Collect read-only storage evidence from kernel journal and Dell storage tools.",
+    "Prefer non-sudo omreport reads for controller, virtual disk, physical disk, and alert log.",
+    "Use sudo only for bounded read-only journalctl -k if the operator explicitly approved sudo.",
+    "Never clear logs, mark disks offline, start rebuilds, change RAID state, run fsck, or repair filesystems.",
+    "Return only raw observations, UTC timestamps, and command labels.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Resolved host:",
+    resolvedHost,
+    "",
+    "Access:",
+    access,
+    "",
+    "Host:",
+    host,
+  ].join("\n"),
+  {
+    label: "bds-disk-storage",
+    phase: "Storage",
+    tools: "mcp__devops_tool__remote_readonly_command",
+    disallowedTools: "WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("RCA");
+const rca = await agent(
+  [
+    "Draft a concise Markdown RCA from the collected evidence only.",
+    "Include Summary, Evidence table, Timeline, Current State, and Recommendation.",
+    "State root cause with confidence and distinguish direct evidence from inference.",
+    "Include OS device, mount point, virtual disk, RAID layout, bad-block state, physical disk ID, Failure Predicted, serial, and part number when available.",
+    "List follow-ups as manual human-reviewed recommendations only.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Resolved host:",
+    resolvedHost,
+    "",
+    "Access:",
+    access,
+    "",
+    "Host:",
+    host,
+    "",
+    "Storage:",
+    storage,
+  ].join("\n"),
+  {
+    label: "bds-disk-rca",
+    phase: "RCA",
+    tools: "",
+    disallowedTools: "Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+return {
+  plan,
+  resolvedHost,
+  access,
+  host,
+  storage,
+  rca,
+};