ai-playbook 1.0.0

package/roles/devops/security/README.md

@@ -0,0 +1,126 @@
+# Infrastructure Security Guidance
+
+This folder provides guidance for securing cloud infrastructure, hardening systems, and meeting compliance requirements.
+
+## Scope
+
+Use this guidance when:
+
+- Designing secure infrastructure architecture
+- Implementing access controls (IAM, RBAC)
+- Configuring firewalls and network security
+- Managing secrets and credentials
+- Implementing encryption (at rest and in transit)
+- Meeting compliance requirements (SOC2, HIPAA, GDPR, PCI-DSS)
+- Conducting security audits
+
+## Core Principles
+
+1. **Least Privilege** – Grant minimum necessary permissions
+2. **Defense in Depth** – Multiple layers of security controls
+3. **Assume Breach** – Design for compromise and recovery
+4. **Automation** – Automate security controls and enforcement
+5. **Auditability** – Log and track security-relevant actions
+6. **Compliance** – Meet regulatory requirements
+
+## Access Control
+
+### Identity Management
+- Users provisioned with appropriate roles
+- Unused accounts disabled
+- Multi-factor authentication enabled
+- Regular access reviews
+
+### Role-Based Access Control (RBAC)
+- Roles defined for specific responsibilities
+- Principle of least privilege applied
+- Roles reviewed and updated regularly
+
+### Service Accounts
+- Service accounts used for automation
+- Permissions limited to specific resource
+- Credentials rotated regularly
+- Audit logging enabled
+
+## Network Security
+
+### Network Segmentation
+- Public, private, and isolated subnets
+- Security groups/NSGs restrict traffic
+- Default deny inbound, allow specific
+- VPCs/vNets for isolation
+
+### Data in Transit
+- TLS/SSL for all external communication
+- Encryption for inter-service communication
+- Certificate management automated
+- Weak ciphers disabled
+
+### DDoS Protection
+- DDoS mitigation service enabled
+- Rate limiting configured
+- Geographic restrictions if applicable
+
+## Data Protection
+
+### Data at Rest
+- Encryption enabled for storage
+- Customer-managed keys (where appropriate)
+- Key rotation policy implemented
+
+### Data Classification
+- Data classified by sensitivity
+- Encryption policy per classification
+- Access controls per classification
+
+## Secrets Management
+
+- Secrets never hardcoded or committed
+- External secret management (Vault, Secrets Manager)
+- Secrets encrypted at rest
+- Secret rotation policy implemented
+- Secret access audited
+
+## Vulnerability Management
+
+- Regular security scanning
+- Patch management process
+- Penetration testing (annual or per change)
+- Vulnerability disclosure program
+
+## Compliance
+
+### SOC2 Type II
+- Security, availability, integrity, confidentiality controls
+- Annual audit required
+- Evidence collection and documentation
+
+### HIPAA
+- PHI encryption and access controls
+- Audit logging required
+- Business Associate Agreements
+- Breach notification procedures
+
+### GDPR
+- Data privacy by design
+- Data retention policies
+- Right to be forgotten
+- Data breach notification
+
+### PCI-DSS
+- Cardholder data protection
+- Network segmentation
+- Access control and monitoring
+
+## Incident Response
+
+- Incident detection automated
+- Response procedures documented
+- On-call escalation configured
+- Post-incident reviews conducted
+
+## Files in This Folder
+
+- `README.md` – This file
+- `checklists.md` – Security hardening checklist
+- `examples.md` – Security configuration examples

package/roles/devops/skill-map.md

@@ -0,0 +1,162 @@
+# Skill Map
+
+This document maps DevOps tasks to the skills and resources that inform how to execute them.
+When working on a particular task, load the relevant skills in this order.
+
+---
+
+## Core Skills (load for most work)
+
+1. **Engineering Context**
+   - `context/engineering.md` – Global engineering standards, tooling, culture, and infrastructure norms.
+   - Load when starting any infrastructure work.
+
+2. **DevOps Fundamentals**
+   - `skills/devops/` – Core DevOps practices, CI/CD principles, infrastructure patterns.
+   - Load for any infrastructure design, deployment, or automation work.
+
+---
+
+## Specialized Skills (load based on task)
+
+### Cloud Infrastructure & Platforms
+
+| Task | Primary Skill | Secondary Skills |
+| --- | --- | --- |
+| Design AWS infrastructure | `skills/cloud/aws/` | `skills/devops/`, `skills/security/` |
+| Design GCP infrastructure | `skills/cloud/gcp/` | `skills/devops/`, `skills/security/` |
+| Design Azure infrastructure | `skills/cloud/azure/` | `skills/devops/`, `skills/security/` |
+| Multi-region or hybrid setup | `roles/devops/cloud-platforms/` | `skills/disaster-recovery/` |
+
+### CI/CD & Deployment
+
+| Task | Primary Skill | Secondary Skills |
+| --- | --- | --- |
+| GitHub Actions pipeline | `roles/devops/ci-cd/`, GitHub Actions docs | `skills/devops/`, `skills/security/` |
+| GitLab CI pipeline | `roles/devops/ci-cd/`, GitLab CI docs | `skills/devops/`, `skills/security/` |
+| Jenkins pipeline | `roles/devops/ci-cd/`, Jenkins docs | `skills/devops/`, `skills/security/` |
+| Deployment strategy (blue-green, canary) | `roles/devops/ci-cd/` | `skills/devops/` |
+| Container registry & image management | `roles/devops/ci-cd/` | `skills/devops/` |
+
+### Kubernetes & Orchestration
+
+| Task | Primary Skill | Secondary Skills |
+| --- | --- | --- |
+| Kubernetes cluster setup (EKS, GKE, AKS) | `roles/devops/kubernetes/` | `roles/devops/cloud-platforms/`, `skills/security/` |
+| Kubernetes workload deployment | `roles/devops/kubernetes/` | `roles/devops/infrastructure-as-code/` |
+| Helm chart design & implementation | `roles/devops/kubernetes/`, `roles/devops/infrastructure-as-code/` | `skills/devops/` |
+| Service mesh (Istio, Linkerd) | `roles/devops/kubernetes/` | `roles/devops/networking/` |
+| Kubernetes security (RBAC, network policies) | `roles/devops/security/`, `roles/devops/kubernetes/` | `skills/security/` |
+
+### Monitoring, Logging & Observability
+
+| Task | Primary Skill | Secondary Skills |
+| --- | --- | --- |
+| Prometheus metrics setup | `roles/devops/monitoring/` | `skills/observability/` |
+| Grafana dashboards | `roles/devops/monitoring/` | `skills/observability/` |
+| ELK stack (Elasticsearch, Logstash, Kibana) | `roles/devops/monitoring/` | `skills/observability/` |
+| Centralized logging (CloudLogging, Splunk) | `roles/devops/monitoring/` | `skills/observability/` |
+| SLO definition & error budgets | `skills/observability/`, `roles/devops/monitoring/` | `skills/devops/` |
+| Alerting & notification rules | `roles/devops/monitoring/` | `skills/observability/` |
+
+### Infrastructure-as-Code
+
+| Task | Primary Skill | Secondary Skills |
+| --- | --- | --- |
+| Terraform module design | `roles/devops/infrastructure-as-code/` | `skills/devops/` |
+| Terraform state management | `roles/devops/infrastructure-as-code/` | `skills/security/` |
+| CloudFormation templates | `roles/devops/infrastructure-as-code/` | `roles/devops/cloud-platforms/` |
+| Helm charts | `roles/devops/infrastructure-as-code/`, `roles/devops/kubernetes/` | `skills/devops/` |
+| IaC testing & validation | `roles/devops/infrastructure-as-code/` | `skills/testing/` |
+
+### Networking & Security
+
+| Task | Primary Skill | Secondary Skills |
+| --- | --- | --- |
+| VPC & subnet design | `roles/devops/networking/` | `roles/devops/cloud-platforms/` |
+| Load balancer configuration | `roles/devops/networking/` | `skills/performance/` |
+| DNS & CDN setup | `roles/devops/networking/` | `roles/devops/cloud-platforms/` |
+| Firewall & security group rules | `roles/devops/security/`, `roles/devops/networking/` | `skills/security/` |
+| Secrets management (Vault, Secrets Manager) | `roles/devops/security/` | `skills/security/` |
+| TLS/SSL certificate management | `roles/devops/security/` | `skills/security/` |
+| Infrastructure security hardening | `roles/devops/security/` | `skills/security/` |
+
+### Disaster Recovery & High Availability
+
+| Task | Primary Skill | Secondary Skills |
+| --- | --- | --- |
+| Backup strategy design | `roles/devops/disaster-recovery/` | `skills/devops/` |
+| RTO/RPO planning | `roles/devops/disaster-recovery/` | `roles/devops/monitoring/` |
+| Multi-region failover | `roles/devops/disaster-recovery/`, `roles/devops/cloud-platforms/` | `roles/devops/networking/` |
+| Disaster recovery testing | `roles/devops/disaster-recovery/` | `skills/testing/` |
+| Business continuity planning | `roles/devops/disaster-recovery/` | `skills/devops/` |
+
+### Performance & Cost Optimization
+
+| Task | Primary Skill | Secondary Skills |
+| --- | --- | --- |
+| Capacity planning | `roles/devops/performance/` | `skills/performance/` |
+| Infrastructure performance tuning | `roles/devops/performance/` | `skills/performance/` |
+| Auto-scaling configuration | `roles/devops/performance/` | `roles/devops/kubernetes/` |
+| Cost analysis & optimization | `roles/devops/cost-optimization/` | `roles/devops/cloud-platforms/` |
+| Reserved capacity planning | `roles/devops/cost-optimization/` | `skills/devops/` |
+
+### Compliance & Auditing
+
+| Task | Primary Skill | Secondary Skills |
+| --- | --- | --- |
+| SOC2 compliance | `roles/devops/security/` | `skills/security/` |
+| HIPAA compliance | `roles/devops/security/` | `skills/security/` |
+| GDPR data protection | `roles/devops/security/` | `skills/security/` |
+| Compliance auditing | `roles/devops/security/` | `roles/devops/monitoring/` |
+
+---
+
+## Cross-Cutting Skills
+
+These skills apply across multiple DevOps tasks:
+
+| Skill | When to Load |
+| --- | --- |
+| `skills/security/` | Any infrastructure work involving access control, secrets, or compliance. |
+| `skills/observability/` | Any monitoring, logging, alerting, or incident response work. |
+| `skills/testing/` | Infrastructure testing, validation, and quality assurance. |
+| `skills/performance/` | Performance optimization, scaling, and capacity planning. |
+| `context/communication.md` | When communicating architecture decisions or incident reports. |
+
+---
+
+## Project-Specific Skills
+
+For project-specific infrastructure work:
+
+- Load `projects/<project>/context.md` for project-specific constraints and infrastructure standards.
+- Load project-specific infrastructure documentation if it exists.
+- Reference project-specific cloud platform or service choices.
+
+---
+
+## Skill Loading Strategy
+
+### Quick Task (< 1 hour)
+Load only:
+1. `context/engineering.md`
+2. Relevant specialized skill from the table above
+
+### Medium Task (1-8 hours)
+Load:
+1. `context/engineering.md`
+2. Core skill + 1-2 specialized skills from the table
+3. `roles/devops/` topic folder (e.g., `kubernetes/`, `monitoring/`)
+
+### Complex Task (> 8 hours, architectural work)
+Load:
+1. `context/engineering.md`
+2. `roles/devops/role.md` & `responsibilities.md`
+3. `roles/devops/workflow.md` for the relevant phase
+4. 2-3 specialized skills covering the architecture scope
+5. Multiple topic folders (e.g., `kubernetes/`, `monitoring/`, `security/`)
+6. `skills/security/` for compliance and hardening
+
+### When Unsure
+Start with `context/engineering.md` and `roles/devops/triggers.md` to identify which skills are most relevant.

package/roles/devops/terraform/README.md

@@ -0,0 +1,6 @@
+# Terraform
+
+Use this folder for DevOps role guidance related to Terraform.
+
+Add module structure, state management, plan review, policy checks, and migration
+guidance when this packet becomes active.

package/roles/devops/triggers.md

@@ -0,0 +1,241 @@
+# Triggers
+
+This document identifies situations that activate the DevOps Engineer role and the
+immediate response patterns for each.
+
+---
+
+## Infrastructure Design Request
+
+**Trigger:** "Design infrastructure for..." or "Build infrastructure that..."
+
+**Immediate Response:**
+1. Load `role.md` and `responsibilities.md` to understand DevOps context.
+2. Load `workflow.md` and navigate to "Requirement & Discovery" phase.
+3. Ask clarifying questions about:
+   - Business SLOs (availability target, latency requirements, RTO/RPO)
+   - Constraints (compliance, budget, organizational policies)
+   - Expected scale (users, data volume, regions)
+   - Dependencies (applications, databases, external services)
+4. Load `skill-map.md` to identify relevant skills.
+5. Create architecture design following the "Design & Architecture" phase.
+
+**Relevant Sections:**
+- `role.md` → "Decision Making"
+- `workflow.md` → "Requirement & Discovery" & "Design & Architecture"
+- `checklists.md` → "Infrastructure Design Checklist"
+
+---
+
+## CI/CD Pipeline Development
+
+**Trigger:** "Build CI/CD pipeline for..." or "Improve deployment process..."
+
+**Immediate Response:**
+1. Load `role.md` and `responsibilities.md`.
+2. Load `workflow.md` → "CI/CD Pipeline Development" guidance.
+3. Clarify:
+   - Current deployment process and pain points
+   - Required stages (build, test, security scanning, deploy)
+   - Target environments (staging, production, multiple regions)
+   - Rollout strategy (blue-green, canary, rolling, feature flags)
+   - Team needs (speed, reliability, debugging capability)
+4. Load `ci-cd/README.md` for platform-specific guidance.
+5. Design pipeline architecture following best practices.
+
+**Relevant Sections:**
+- `workflow.md` → "Infrastructure-as-Code Implementation"
+- `ci-cd/` → Platform-specific guidance
+- `checklists.md` → "CI/CD Pipeline Checklist"
+
+---
+
+## Kubernetes Deployment
+
+**Trigger:** "Deploy to Kubernetes..." or "Manage Kubernetes cluster..."
+
+**Immediate Response:**
+1. Load `role.md` and `responsibilities.md`.
+2. Load `workflow.md` → "Infrastructure-as-Code Implementation".
+3. Clarify:
+   - Current Kubernetes environment (EKS, GKE, AKS, self-managed)
+   - Workload requirements (replicas, resource limits, persistent storage)
+   - Networking needs (service mesh, network policies, ingress)
+   - Security requirements (RBAC, pod security policies, secrets management)
+4. Load `kubernetes/README.md` for Kubernetes-specific guidance.
+5. Design Kubernetes deployment and configuration.
+
+**Relevant Sections:**
+- `kubernetes/` → Deployment and configuration guidance
+- `infrastructure-as-code/` → Helm charts and IaC patterns
+- `checklists.md` → "Kubernetes Deployment Checklist"
+
+---
+
+## Monitoring & Observability Setup
+
+**Trigger:** "Set up monitoring..." or "Improve observability for..."
+
+**Immediate Response:**
+1. Load `role.md` and `responsibilities.md`.
+2. Load `workflow.md` → "Monitoring & Observability Setup" phase.
+3. Clarify:
+   - Current observability stack (or gaps)
+   - Key metrics to track (application, infrastructure, business)
+   - SLOs and alerting thresholds
+   - Logging requirements (centralized, retention, compliance)
+   - Dashboard and reporting needs
+4. Load `monitoring/README.md` for platform-specific guidance.
+5. Design monitoring, logging, and alerting architecture.
+
+**Relevant Sections:**
+- `monitoring/` → Metrics, logging, and alerting guidance
+- `checklists.md` → "Monitoring & Observability Checklist"
+
+---
+
+## Production Incident Response
+
+**Trigger:** "Production outage..." or "Incident: [service] is down"
+
+**Immediate Response:**
+1. Load `role.md` → "Mindset" (prioritize reliability and quick recovery).
+2. Load `workflow.md` → "Incident Response & Troubleshooting".
+3. Immediately:
+   - Acknowledge incident and start communication.
+   - Gather logs, metrics, and recent changes.
+   - Identify affected services and blast radius.
+   - Execute relevant runbook or troubleshooting procedure.
+   - Coordinate with application teams as needed.
+   - Implement temporary mitigation if necessary.
+   - Plan full resolution after incident is stabilized.
+4. After resolution:
+   - Conduct post-incident review.
+   - Document root cause and preventive actions.
+   - Update runbooks and alerting as needed.
+
+**Relevant Sections:**
+- `role.md` → "Mindset" & "Constraints"
+- `monitoring/` → Troubleshooting and diagnostic guidance
+- `checklists.md` → "Incident Response Checklist"
+
+---
+
+## Security Hardening or Compliance Work
+
+**Trigger:** "Harden infrastructure..." or "Meet compliance requirement [HIPAA/SOC2/GDPR]..."
+
+**Immediate Response:**
+1. Load `role.md` → "Mindset" (security is priority #2).
+2. Load `responsibilities.md` → "Security & Compliance".
+3. Load `workflow.md` → "Security & Compliance Review" phase.
+4. Clarify:
+   - Specific compliance requirements or standards
+   - Current security posture and gaps
+   - Timeline and rollout strategy
+   - Impact on operations and applications
+5. Load `security/README.md` for hardening and compliance guidance.
+6. Conduct security audit and implement improvements.
+
+**Relevant Sections:**
+- `security/` → Hardening and compliance guidance
+- `checklists.md` → "Security Hardening Checklist"
+
+---
+
+## Cost Optimization
+
+**Trigger:** "Reduce infrastructure costs..." or "Optimize cloud spending..."
+
+**Immediate Response:**
+1. Load `role.md` and `responsibilities.md`.
+2. Load `workflow.md` → "Performance & Cost Optimization" phase.
+3. Analyze:
+   - Current cloud spending and cost drivers
+   - Underutilized resources (overprovisioned compute, storage)
+   - Opportunities for reserved capacity or spot instances
+   - Outdated or redundant services
+4. Load `cost-optimization/README.md` for platform-specific guidance.
+5. Recommend and implement cost reductions.
+
+**Relevant Sections:**
+- `cost-optimization/` → Cost analysis and optimization guidance
+- `checklists.md` → "Cost Optimization Checklist"
+
+---
+
+## Disaster Recovery Planning
+
+**Trigger:** "Design disaster recovery..." or "Test recovery procedures..."
+
+**Immediate Response:**
+1. Load `role.md` → "Mindset" (reliability is priority #1).
+2. Load `responsibilities.md` → "Disaster Recovery & Business Continuity".
+3. Load `workflow.md` → "Disaster Recovery & Business Continuity" planning.
+4. Clarify:
+   - RTO (recovery time objective) and RPO (recovery point objective)
+   - Critical systems and data dependencies
+   - Failover regions or infrastructure
+   - Testing and validation procedures
+5. Load `disaster-recovery/README.md` for DR planning guidance.
+6. Design and document disaster recovery procedures.
+
+**Relevant Sections:**
+- `disaster-recovery/` → DR planning and testing guidance
+- `checklists.md` → "Disaster Recovery Checklist"
+
+---
+
+## Infrastructure Code Review
+
+**Trigger:** "Review this Terraform/CloudFormation/Helm code..." or "Audit infrastructure changes..."
+
+**Immediate Response:**
+1. Load `role.md` → "Decision Making" section.
+2. Review infrastructure code for:
+   - Correctness: Does it implement the intended design?
+   - Security: Are secrets, access controls, and security groups properly configured?
+   - Cost: Is resource sizing and provisioning cost-optimized?
+   - Reliability: Does it support the target SLOs and include redundancy?
+   - Maintainability: Is the code clear, modular, and well-documented?
+3. Load `infrastructure-as-code/README.md` for IaC best practices.
+4. Provide detailed review feedback with specific recommendations.
+
+**Relevant Sections:**
+- `infrastructure-as-code/` → IaC best practices and patterns
+- `checklists.md` → "Infrastructure Code Review Checklist"
+
+---
+
+## Questions About Infrastructure Standards
+
+**Trigger:** "What's the best way to..." or "Should we use..."
+
+**Immediate Response:**
+1. Load `role.md` → "Mindset" and "Decision Making".
+2. Load relevant topic section (e.g., `kubernetes/`, `monitoring/`, `security/`).
+3. Explain trade-offs and provide clear recommendation based on:
+   - Organizational constraints and standards
+   - Team expertise and operational burden
+   - Cost and performance implications
+   - Long-term maintainability
+4. Provide working examples or templates when applicable.
+
+**Relevant Sections:**
+- `examples.md` → Working examples and templates
+- Topic-specific folders → Best practices and patterns
+
+---
+
+## When in Doubt
+
+If the trigger doesn't clearly map to one of the above scenarios:
+
+1. Load `role.md` and `responsibilities.md` to understand context.
+2. Load `workflow.md` to identify the relevant phase.
+3. Clarify the specific problem or requirement.
+4. Proceed through the appropriate workflow phase.
+
+Remember: This role is activated when infrastructure design, deployment, automation,
+monitoring, or operational excellence is needed. If the work is primarily about
+application code, load the Software Developer role instead.