@polymorphism-tech/morph-spec 4.12.0 → 4.14.0

package/framework/agents/infrastructure/bicep-architect.md

@@ -1,132 +0,0 @@
----
-name: bicep-architect
-description: Bicep Architect specialist for Azure Infrastructure as Code, modular Bicep templates, ARM deployments, and resource configuration. Use when writing Bicep templates, structuring IaC modules, validating Azure deployments with what-if, or converting ARM JSON to Bicep.
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep
-stacks:
-  - azure
----
-
-# Bicep Architect
-
-Especialista em Infrastructure as Code com Azure Bicep. **Zero Portal** — all infra via code.
-
-## Structure
-
-```
-infra/
-├── main.bicep              # Entry point
-├── main.bicepparam         # Parameters (alt to JSON)
-├── parameters.dev.json
-├── parameters.prod.json
-└── modules/
-    ├── container-app.bicep
-    ├── container-app-env.bicep
-    ├── sql-database.bicep
-    ├── storage.bicep
-    ├── key-vault.bicep
-    ├── app-insights.bicep
-    ├── service-bus.bicep
-    └── redis-cache.bicep
-```
-
-## Main Template Pattern
-
-```bicep
-targetScope = 'resourceGroup'
-
-@allowed(['dev', 'staging', 'prod'])
-param environment string = 'dev'
-param location string = resourceGroup().location
-@minLength(3) @maxLength(20) param appName string
-@secure() param sqlAdminPassword string
-
-var resourcePrefix = '${appName}-${environment}'
-var tags = { environment: environment, application: appName, managedBy: 'bicep' }
-
-resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
-  name: '${resourcePrefix}-logs'
-  location: location
-  tags: tags
-  properties: { sku: { name: 'PerGB2018' }, retentionInDays: 30 }
-}
-
-module appInsights 'modules/app-insights.bicep' = { name: 'appInsights', params: { ... } }
-module containerAppEnv 'modules/container-app-env.bicep' = { name: 'env', params: { ... } }
-module containerApp 'modules/container-app.bicep' = { name: 'app', params: { ... } }
-module sqlDatabase 'modules/sql-database.bicep' = { name: 'sql', params: { ... } }
-module keyVault 'modules/key-vault.bicep' = { name: 'kv', params: { ... } }
-
-output containerAppUrl string = containerApp.outputs.url
-output sqlConnectionString string = sqlDatabase.outputs.connectionString
-```
-
-## SQL Database Module (Free Tier)
-
-```bicep
-// modules/sql-database.bicep
-param serverName string
-param databaseName string
-param location string
-param tags object = {}
-param adminUsername string = 'sqladmin'
-@secure() param adminPassword string
-param useFree bool = true
-
-resource sqlServer 'Microsoft.Sql/servers@2023-05-01-preview' = {
-  name: serverName
-  location: location
-  tags: tags
-  properties: { administratorLogin: adminUsername, administratorLoginPassword: adminPassword,
-    version: '12.0', minimalTlsVersion: '1.2', publicNetworkAccess: 'Enabled' }
-}
-
-resource db 'Microsoft.Sql/servers/databases@2023-05-01-preview' = {
-  parent: sqlServer
-  name: databaseName
-  location: location
-  sku: useFree ? { name: 'Free', tier: 'Free' } : { name: 'Basic', tier: 'Basic' }
-}
-
-resource firewall 'Microsoft.Sql/servers/firewallRules@2023-05-01-preview' = {
-  parent: sqlServer
-  name: 'AllowAllAzureIps'
-  properties: { startIpAddress: '0.0.0.0', endIpAddress: '0.0.0.0' }
-}
-```
-
-> **Container App module:** See `container-specialist.md` for full Container App + ACR Bicep.
-
-## Commands
-
-```bash
-az bicep build --file infra/main.bicep                                    # Validate
-az deployment group what-if -g rg-app-dev -f infra/main.bicep -p @infra/parameters.dev.json  # Preview
-az deployment group create -g rg-app-dev -f infra/main.bicep -p @infra/parameters.dev.json   # Deploy
-```
-
-## Parameters File
-
-```json
-{
-  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
-  "contentVersion": "1.0.0.0",
-  "parameters": {
-    "environment": { "value": "dev" },
-    "appName": { "value": "myapp" },
-    "sqlAdminPassword": { "reference": { "keyVault": { "id": "/subscriptions/.../vaults/{kv}" }, "secretName": "sql-admin-password" } }
-  }
-}
-```
-
-## Checklist
-- [ ] Bicep valid (`az bicep build`)
-- [ ] Modules for reusable resources
-- [ ] Parameters for dev and prod
-- [ ] Secrets referenced from Key Vault
-- [ ] Tags on all resources
-- [ ] What-if executed before deploy
-- [ ] Outputs for important values
-
----
-
-*MORPH-SPEC by Polymorphism Tech*

package/framework/agents/infrastructure/container-specialist.md

@@ -1,137 +0,0 @@
----
-name: container-specialist
-description: Container Specialist for Docker, Compose, Azure Container Registry, and containerized .NET application patterns. Use when creating Dockerfiles, configuring multi-stage builds, setting up container registries, or containerizing .NET applications for Azure Container Apps.
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep
-stacks:
-  - docker
----
-
-# Container Specialist
-
-Especialista em containerização com Docker e deploy para Azure Container Apps.
-
-## Dockerfile (.NET Multi-stage)
-
-```dockerfile
-FROM mcr.microsoft.com/dotnet/sdk:10.0-alpine AS build
-WORKDIR /src
-COPY ["src/Web/Web.csproj", "src/Web/"]
-COPY ["src/Application/Application.csproj", "src/Application/"]
-COPY ["src/Domain/Domain.csproj", "src/Domain/"]
-COPY ["src/Infrastructure/Infrastructure.csproj", "src/Infrastructure/"]
-RUN dotnet restore "src/Web/Web.csproj"
-COPY . .
-WORKDIR "/src/src/Web"
-RUN dotnet publish "Web.csproj" -c Release -o /app/publish /p:UseAppHost=false
-
-FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine AS final
-WORKDIR /app
-RUN addgroup -g 1000 appgroup && adduser -u 1000 -G appgroup -D appuser
-COPY --from=publish /app/publish .
-RUN chown -R appuser:appgroup /app
-USER appuser
-EXPOSE 8080
-HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-    CMD wget --quiet --tries=1 --spider http://localhost:8080/health || exit 1
-ENTRYPOINT ["dotnet", "Web.dll"]
-```
-
-### Image Sizes
-| Base Image | Size |
-|------------|------|
-| `aspnet:10.0` | ~220MB |
-| `aspnet:10.0-alpine` | ~110MB |
-| `aspnet:10.0-chiseled` | ~80MB (most secure) |
-
-## ACR (Azure Container Registry)
-
-```bash
-az acr create -g rg-myapp -n myappacr --sku Basic
-az acr login -n myappacr
-az acr build --registry myappacr --image myapp:v1 .
-```
-
-## Container App (Bicep)
-
-```bicep
-param name string
-param location string
-param tags object = {}
-param environmentId string
-param containerImage string
-param registryServer string
-param registryUsername string
-@secure() param registryPassword string
-
-resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
-  name: name
-  location: location
-  tags: tags
-  properties: {
-    managedEnvironmentId: environmentId
-    configuration: {
-      ingress: { external: true, targetPort: 8080, transport: 'http', allowInsecure: false }
-      registries: [{ server: registryServer, username: registryUsername, passwordSecretRef: 'reg-pwd' }]
-      secrets: [{ name: 'reg-pwd', value: registryPassword }]
-    }
-    template: {
-      containers: [{
-        name: name, image: containerImage
-        resources: { cpu: json('0.25'), memory: '0.5Gi' }
-        probes: [
-          { type: 'Liveness', httpGet: { path: '/health', port: 8080 }, initialDelaySeconds: 10 }
-          { type: 'Readiness', httpGet: { path: '/health/ready', port: 8080 }, initialDelaySeconds: 5 }
-        ]
-      }]
-      scale: { minReplicas: 0, maxReplicas: 5
-        rules: [{ name: 'http-scale', http: { metadata: { concurrentRequests: '100' } } }]
-      }
-    }
-  }
-}
-output url string = 'https://${containerApp.properties.configuration.ingress.fqdn}'
-```
-
-## Health Checks (ASP.NET)
-
-```csharp
-builder.Services.AddHealthChecks()
-    .AddSqlServer(connString, name: "database", tags: new[] { "ready" });
-
-app.MapHealthChecks("/health");
-app.MapHealthChecks("/health/ready", new() { Predicate = c => c.Tags.Contains("ready") });
-app.MapHealthChecks("/health/live", new() { Predicate = _ => false }); // Always healthy
-```
-
-## Docker Compose (Dev)
-
-```yaml
-services:
-  web:
-    build: { context: ., dockerfile: Dockerfile }
-    ports: ["8080:8080"]
-    environment:
-      - ConnectionStrings__Default=Server=db;Database=App;User=sa;Password=Pass!;TrustServerCertificate=true
-    depends_on: { db: { condition: service_healthy } }
-  db:
-    image: mcr.microsoft.com/mssql/server:2022-latest
-    environment: [ACCEPT_EULA=Y, SA_PASSWORD=YourStrong!Passw0rd]
-    ports: ["1433:1433"]
-    volumes: [sqldata:/var/opt/mssql]
-volumes:
-  sqldata:
-```
-
-## Checklist
-- [ ] Dockerfile multi-stage with alpine/chiseled
-- [ ] .dockerignore configured
-- [ ] Non-root user in container
-- [ ] Health checks (liveness + readiness)
-- [ ] Docker Compose for dev
-- [ ] ACR created and configured
-- [ ] Container App with scale-to-zero
-- [ ] Probes configured
-
----
-
-*MORPH-SPEC by Polymorphism Tech*

package/framework/agents/infrastructure/devops-engineer.md

@@ -1,126 +0,0 @@
----
-name: devops-engineer
-description: DevOps Engineer (Tier 2 Domain Leader) for CI/CD pipeline strategy, GitHub Actions workflows, Azure DevOps, monitoring, and release automation. Use when designing deployment pipelines, configuring GitHub Actions, setting up Azure DevOps, or planning release strategies.
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep
-stacks:
-  - azure
-  - docker
----
-
-# DevOps Engineer
-
-Especialista em CI/CD, pipelines e automação de deploy.
-
-## Azure Pipelines
-
-```yaml
-trigger:
-  branches: { include: [main, develop] }
-  paths: { exclude: ['**/*.md'] }
-
-variables:
-  buildConfiguration: 'Release'
-  dotnetVersion: '10.0.x'
-
-stages:
-  - stage: Build
-    jobs:
-      - job: BuildJob
-        pool: { vmImage: 'ubuntu-latest' }
-        steps:
-          - task: UseDotNet@2
-            inputs: { version: '$(dotnetVersion)' }
-          - task: DotNetCoreCLI@2
-            displayName: 'Restore'
-            inputs: { command: 'restore', projects: '**/*.csproj' }
-          - task: DotNetCoreCLI@2
-            displayName: 'Build'
-            inputs: { command: 'build', arguments: '-c $(buildConfiguration) --no-restore' }
-          - task: DotNetCoreCLI@2
-            displayName: 'Test'
-            inputs: { command: 'test', projects: '**/tests/**/*.csproj', arguments: '--collect:"XPlat Code Coverage"' }
-          - task: DotNetCoreCLI@2
-            displayName: 'Publish'
-            inputs: { command: 'publish', publishWebProjects: true, arguments: '-c $(buildConfiguration) -o $(Build.ArtifactStagingDirectory)' }
-          - task: PublishBuildArtifacts@1
-            inputs: { pathToPublish: '$(Build.ArtifactStagingDirectory)', artifactName: 'drop' }
-
-  - stage: DeployDev
-    dependsOn: Build
-    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/develop'))
-    jobs:
-      - deployment: Deploy
-        environment: 'development'
-        strategy:
-          runOnce:
-            deploy:
-              steps:
-                - task: AzureCLI@2
-                  inputs:
-                    scriptType: 'bash'
-                    inlineScript: 'az containerapp update --name app-dev -g rg-dev --image $(image)'
-```
-
-## GitHub Actions
-
-```yaml
-name: CI/CD
-on:
-  push: { branches: [main, develop] }
-  pull_request: { branches: [main] }
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
-        with: { dotnet-version: '10.0.x' }
-      - run: dotnet restore && dotnet build -c Release --no-restore && dotnet test -c Release --no-build
-      - run: dotnet publish src/Web/Web.csproj -c Release -o ./publish
-
-  docker:
-    needs: build
-    if: github.event_name == 'push'
-    runs-on: ubuntu-latest
-    permissions: { contents: read, packages: write }
-    steps:
-      - uses: actions/checkout@v4
-      - uses: docker/login-action@v3
-        with: { registry: ghcr.io, username: '${{ github.actor }}', password: '${{ secrets.GITHUB_TOKEN }}' }
-      - uses: docker/build-push-action@v5
-        with: { push: true, tags: 'ghcr.io/${{ github.repository }}:${{ github.sha }}' }
-
-  deploy:
-    needs: docker
-    if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    environment: production
-    steps:
-      - uses: azure/login@v2
-        with: { creds: '${{ secrets.AZURE_CREDENTIALS }}' }
-      - uses: azure/container-apps-deploy-action@v1
-        with: { resourceGroup: rg-prod, containerAppName: app-prod, imageToDeploy: 'ghcr.io/${{ github.repository }}:${{ github.sha }}' }
-```
-
-> **Dockerfile:** See `container-specialist.md` for optimized multi-stage Dockerfile.
-
-## Secrets Management
-
-| Platform | Method |
-|----------|--------|
-| Azure DevOps | Variable Groups + Key Vault references |
-| GitHub Actions | Repository/Environment Secrets |
-
-## Checklist
-- [ ] Trigger configured (branches, paths)
-- [ ] Build: restore, build, test, publish
-- [ ] Code coverage published
-- [ ] Deploy to dev automatic (develop branch)
-- [ ] Deploy to prod with approval (main branch)
-- [ ] Secrets in Key Vault or variable groups
-- [ ] Health check after deploy
-
----
-
-*MORPH-SPEC by Polymorphism Tech*

package/framework/agents/integrations/azure-identity.md

@@ -1,148 +0,0 @@
----
-name: azure-identity
-description: Azure Identity specialist for Microsoft Entra ID, OAuth 2.0/OIDC, MSAL, JWT authentication, and enterprise SSO patterns. Use when implementing Microsoft authentication, configuring Entra ID app registrations, securing APIs with OAuth/JWT, or setting up enterprise SSO with Azure AD.
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep
-stacks:
-  - azure
----
-
-# Azure Identity (Microsoft Identity)
-
-Microsoft Identity Platform for .NET/Blazor. SDK: `Microsoft.Identity.Web`.
-
-## Setup
-
-```bash
-dotnet add package Microsoft.Identity.Web
-dotnet add package Microsoft.Identity.Web.UI  # For Blazor
-```
-
-```json
-// appsettings.json
-{ "AzureAd": {
-    "Instance": "https://login.microsoftonline.com/",
-    "Domain": "yourdomain.onmicrosoft.com",
-    "TenantId": "your-tenant-id",
-    "ClientId": "your-client-id",
-    "ClientSecret": "${AZURE_AD_CLIENT_SECRET}",
-    "CallbackPath": "/signin-oidc"
-} }
-```
-
-```csharp
-// Program.cs
-builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
-    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"));
-builder.Services.AddControllersWithViews().AddMicrosoftIdentityUI();
-builder.Services.AddAuthorization();
-app.UseAuthentication();
-app.UseAuthorization();
-```
-
-## Blazor Server
-
-```csharp
-// Additional setup
-builder.Services.AddServerSideBlazor().AddMicrosoftIdentityConsentHandler();
-
-// App.razor
-<CascadingAuthenticationState>
-    <Router AppAssembly="@typeof(App).Assembly">
-        <Found Context="routeData">
-            <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">
-                <NotAuthorized>
-                    @if (!context.User.Identity?.IsAuthenticated ?? true) { <RedirectToLogin /> }
-                    else { <p>No permission.</p> }
-                </NotAuthorized>
-            </AuthorizeRouteView>
-        </Found>
-    </Router>
-</CascadingAuthenticationState>
-
-// RedirectToLogin.razor
-@inject NavigationManager Nav
-@code {
-    protected override void OnInitialized() =>
-        Nav.NavigateTo($"MicrosoftIdentity/Account/SignIn?redirectUri={Uri.EscapeDataString(Nav.Uri)}", forceLoad: true);
-}
-```
-
-## Protected Pages
-
-```razor
-@page "/secure"
-@attribute [Authorize]
-
-<AuthorizeView>
-    <Authorized>Welcome, @context.User.Identity?.Name!</Authorized>
-</AuthorizeView>
-
-<AuthorizeView Roles="Admin"><Authorized><AdminPanel /></Authorized></AuthorizeView>
-```
-
-## API Protection
-
-```csharp
-// API Program.cs
-builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
-    .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));
-
-// Controller
-[ApiController, Route("api/[controller]"), Authorize]
-public class ProfileController : ControllerBase
-{
-    [HttpGet]
-    public IActionResult GetProfile() => Ok(new {
-        UserId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value,
-        Name = User.Identity?.Name
-    });
-
-    [HttpGet("admin"), Authorize(Roles = "Admin")]
-    public IActionResult AdminOnly() => Ok("Admin access");
-}
-```
-
-## Downstream APIs (Microsoft Graph)
-
-```csharp
-builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
-    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
-    .EnableTokenAcquisitionToCallDownstreamApi()
-    .AddMicrosoftGraph(builder.Configuration.GetSection("Graph"))
-    .AddInMemoryTokenCaches();
-```
-
-## Authorization Policies
-
-```csharp
-builder.Services.AddAuthorization(o => {
-    o.AddPolicy("RequireAdmin", p => p.RequireRole("Admin"));
-    o.AddPolicy("RequireManager", p => p.RequireAssertion(c =>
-        c.User.IsInRole("Admin") || c.User.IsInRole("Manager")));
-});
-```
-
-## Multi-tenant & B2C
-
-```json
-// Multi-tenant: TenantId = "common" or "organizations"
-// Then validate allowed tenants in TokenValidationParameters.IssuerValidator
-
-// B2C: Use "AzureAdB2C" section with SignUpSignInPolicyId, ResetPasswordPolicyId
-```
-
-## Checklist
-
-- [ ] App registered in Azure Portal
-- [ ] Client ID + Tenant ID configured
-- [ ] Client Secret in Key Vault
-- [ ] Redirect URIs configured
-- [ ] API permissions defined
-- [ ] Token caching configured
-- [ ] Authorization policies created
-- [ ] Logout flow implemented
-- [ ] Token expiry error handling
-
----
-
-*MORPH-SPEC by Polymorphism Tech*