code-ai-installer 3.0.0 → 4.0.0

package/domains/development/locales/en/.agents/skills/handoff/SKILL.md

@@ -1,8 +1,60 @@
 ---
 name: handoff
-description: Forming a Context Pack and assigning a task to an agent — goals, constraints, artifacts, decisions, questions, Definition of Done. Requires a standard reply format.
+description: "Forming a Context Pack and assigning a task to an agent — goals, constraints, artifacts, decisions, questions, Definition of Done. Requires a standard reply format."
+type: mandatory
+domain: development
+owners:
+  - conductor
+gates:
+  - PM
+  - UX
+  - ARCH
+  - DEV
+  - REV
+  - OPS
+  - TEST
+  - RG
+tech: []
+topic:
+  - orchestration
+triggers:
+  - hand off task
+  - Context Pack
+  - agent briefing
+  - handoff format
+  - goals and constraints
+  - Definition of Done
+  - task for agent
+related:
+  - ux-discovery
+  - ux-spec
+  - ui-inventory
+  - a11y-baseline
+  - architecture-doc
+  - adr-log
+  - api-contracts
+  - data-model
+  - tdd-workflow
+  - testing-strategy-js
+  - code-review-checklist
+  - security-review
+  - performance-review-baseline
+  - deployment-ci-plan
+  - deployment-ci-plan-reference
+  - qa-test-plan
+  - qa-manual-run
+  - qa-api-contract-tests
+  - qa-security-smoke-tests
+  - release-gate
+  - release-gate-checklist-template
+  - gates
+  - board
+  - memory
+budget_lines: 280
+schema_version: 1
 ---
 
+
 # Skill: Context Pack Handoff
 
 Transferring tasks between gates with full context.
@@ -206,6 +258,18 @@ Every agent must return their deliverable in this structure:
 
 ---
 
+## Common handoff-document rules (cross-domain)
+
+> Applies to **any** handoff document written to hand the session over to a fresh agent (session-handoff / conversation summary). Supplements, does not replace, the inter-gate handoff sections above.
+
+1. **Where to save.** The handoff document goes to the **OS temp directory** (`%TEMP%` / `/tmp` / `os.tmpdir()`), **not** the working repository. Workspace stays clean; the path to the temp file is cited in the next session's chat.
+2. **"Suggested skills" section.** The document MUST include a section listing the skills the fresh agent should invoke first (`$skill-1`, `$skill-2`, ...). This shortens context warm-up.
+3. **Do not duplicate artifacts.** If the data is already in a PRD / plan / ADR / commit / diff / issue — link to it by **path or URL**, do not copy the content. Duplication causes drift between sources.
+4. **Redact sensitive data.** Before saving, strip API keys, passwords, tokens, PII (email, phone, real customer names). The temp directory is also a potential leak vector.
+5. **User arguments = next-session focus.** If `/handoff` is called with an argument string, treat it as a description of the next session's task; tailor the summary and suggested-skills list to that focus.
+
+---
+
 ## See also
 - `$gates` — gate definitions and DoD
 - `$board` — project board tracking

package/domains/development/locales/en/.agents/skills/handoff/agents/kimi.yaml

@@ -1,12 +1,12 @@
-name: "handoff"
-display_name: "Handoff Envelope"
-description: "Forming a Context Pack and assigning a task to an agent — goals, constraints, artifacts, decisions, questions, Definition of Done. Requires a standard reply format."
-default_prompt: "Use $handoff when the task matches the \"Handoff Envelope\" skill."
-triggers:
-  - "handoff"
-  - "Handoff Envelope"
-  - "Forming a Context Pack and assigning a task to an agent — goals, constraints, artifacts, decisions, questions, Definition of Done"
-capabilities:
-  - "handoff"
-tools: []
-implicit_invocation: true
+name: "handoff"
+display_name: "Handoff Envelope"
+description: "Forming a Context Pack and assigning a task to an agent — goals, constraints, artifacts, decisions, questions, Definition of Done. Requires a standard reply format."
+default_prompt: "Use $handoff when the task matches the \"Handoff Envelope\" skill."
+triggers:
+  - "handoff"
+  - "Handoff Envelope"
+  - "Forming a Context Pack and assigning a task to an agent — goals, constraints, artifacts, decisions, questions, Definition of Done"
+capabilities:
+  - "handoff"
+tools: []
+implicit_invocation: true

package/domains/development/locales/en/.agents/skills/k8s-manifests-conventions/SKILL.md

@@ -1,30 +1,63 @@
 ---
 name: k8s-manifests-conventions
-description: Kubernetes manifests conventions — repo structure, Helm/Kustomize, overlays per env, naming/labels, secrets/config, policy, validation, GitOps.
+description: Kubernetes manifest conventions — repo structure, Helm/Kustomize, overlays per env, naming/labels, secrets/config, policy, validation, GitOps.
+type: discretionary
+domain: development
+owners:
+  - architect
+  - devops
+gates:
+  - ARCH
+  - OPS
+tech:
+  - k8s
+topic:
+  - architecture
+  - ops
+triggers:
+  - Helm Kustomize
+  - overlays per env
+  - k8s labels
+  - manifest naming
+  - GitOps
+  - k8s secrets
+related:
+  - docker-kubernetes-architecture
+  - docker-kubernetes-architecture-reference
+  - deployment-ci-plan
+  - deployment-ci-plan-reference
+  - k8s-manifests-conventions-reference
+  - security-baseline-dev
+  - observability-plan
+  - threat-model-baseline
+  - architecture-doc-reference
+budget_lines: 350
+schema_version: 1
 ---
 
+
 # Skill: K8s Manifests Conventions
 
-Standards for Kubernetes manifests: naming, structure, overlays, validation.
+Standards for Kubernetes manifests: naming, structure, secrets policy, GitOps + Output Template. Full templates for Kustomize/Helm/ConfigMap/Ingress/securityContext/CI → `$k8s-manifests-conventions-reference`.
 
 **Sections:**
 1. [Tooling Decision](#1-tooling-decision)
-2. [Repo Structure](#2-repo-structure)
-3. [Naming & Labels](#3-naming--labels)
-4. [Config & Secrets](#4-config--secrets)
-5. [Ingress & Gateway](#5-ingress--gateway)
-6. [Probes & Resources](#6-probes--resources)
-7. [Security Policy](#7-security-policy)
-8. [CI Validation](#8-ci-validation)
-9. [GitOps](#9-gitops)
-10. [Red Flags](#10-red-flags)
-11. [Output Template](#11-output-template)
+2. [Naming & Labels](#2-naming--labels)
+3. [Config & Secrets](#3-config--secrets)
+4. [Ingress & Gateway](#4-ingress--gateway)
+5. [Probes & Resources](#5-probes--resources)
+6. [Security Policy](#6-security-policy)
+7. [CI Validation](#7-ci-validation)
+8. [GitOps](#8-gitops)
+9. [Red Flags](#9-red-flags)
+10. [Output Template](#10-output-template)
+11. [DoD](#11-dod)
 
 ---
 
 ## 1. Tooling Decision
 
-Choose one approach and record an ADR:
+Pick one approach and record an ADR:
 
 | Approach | Best for | Pros | Cons |
 |----------|---------|------|------|
@@ -32,211 +65,11 @@ Choose one approach and record an ADR:
 | **Helm** | Complex, many services, shared charts | Powerful templating, reusable charts | Template debugging, chart maintenance |
 | **Raw manifests** | Tiny projects (1-2 services) | No learning curve | Doesn't scale, env duplication |
 
----
-
-## 2. Repo Structure
-
-### Kustomize layout
-
-```
-k8s/
-├── base/
-│   ├── kustomization.yaml
-│   ├── namespace.yaml
-│   ├── deployment-api.yaml
-│   ├── deployment-dashboard.yaml
-│   ├── service-api.yaml
-│   ├── service-dashboard.yaml
-│   ├── ingress.yaml
-│   ├── configmap.yaml
-│   ├── hpa.yaml
-│   └── pdb.yaml
-└── overlays/
-    ├── dev/
-    │   ├── kustomization.yaml
-    │   ├── patch-deployment.yaml
-    │   └── patch-ingress.yaml
-    ├── staging/
-    │   ├── kustomization.yaml
-    │   └── patch-deployment.yaml
-    └── prod/
-        ├── kustomization.yaml
-        ├── patch-deployment.yaml
-        ├── patch-ingress.yaml
-        └── patch-hpa.yaml
-```
-
-### kustomization.yaml (base)
-
-```yaml
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: smart-cart
-
-resources:
-  - namespace.yaml
-  - deployment-api.yaml
-  - deployment-dashboard.yaml
-  - service-api.yaml
-  - service-dashboard.yaml
-  - ingress.yaml
-  - configmap.yaml
-  - hpa.yaml
-  - pdb.yaml
-
-commonLabels:
-  app.kubernetes.io/part-of: smart-cart-rescue
-  app.kubernetes.io/managed-by: kustomize
-```
-
-### kustomization.yaml (overlay — prod)
-
-```yaml
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../base
-
-namePrefix: prod-
-
-patches:
-  - path: patch-deployment.yaml
-    target:
-      kind: Deployment
-      name: api
-  - path: patch-ingress.yaml
-    target:
-      kind: Ingress
-      name: api-ingress
-  - path: patch-hpa.yaml
-    target:
-      kind: HorizontalPodAutoscaler
-      name: api-hpa
-
-configMapGenerator:
-  - name: api-config
-    behavior: merge
-    literals:
-      - NODE_ENV=production
-      - LOG_LEVEL=info
-```
-
-### patch-deployment.yaml (prod overlay)
-
-```yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: api
-spec:
-  replicas: 3
-  template:
-    spec:
-      containers:
-        - name: api
-          resources:
-            requests:
-              cpu: 200m
-              memory: 256Mi
-            limits:
-              cpu: 1000m
-              memory: 1Gi
-```
+**Factors for choosing:** team size + Helm experience + number of services + need for reusable charts. Small team without Helm history → Kustomize. Many services with shared logic → Helm. Repo-structure and kustomization.yaml / values.yaml templates → `$k8s-manifests-conventions-reference` §1-§2.
 
 ---
 
-### Helm layout
-
-```
-k8s/
-├── charts/
-│   └── smart-cart/
-│       ├── Chart.yaml
-│       ├── values.yaml
-│       └── templates/
-│           ├── _helpers.tpl
-│           ├── deployment.yaml
-│           ├── service.yaml
-│           ├── ingress.yaml
-│           ├── configmap.yaml
-│           ├── hpa.yaml
-│           └── pdb.yaml
-└── env/
-    ├── dev.yaml
-    ├── staging.yaml
-    └── prod.yaml
-```
-
-### values.yaml (defaults)
-
-```yaml
-replicaCount: 2
-
-image:
-  repository: registry.example.com/smart-cart/api
-  tag: latest
-  pullPolicy: IfNotPresent
-
-service:
-  type: ClusterIP
-  port: 80
-  targetPort: 3000
-
-ingress:
-  enabled: true
-  className: nginx
-  host: api.example.com
-  tls: true
-
-resources:
-  requests:
-    cpu: 100m
-    memory: 128Mi
-  limits:
-    cpu: 500m
-    memory: 512Mi
-
-autoscaling:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 10
-  targetCPUUtilization: 70
-
-env:
-  NODE_ENV: production
-  LOG_LEVEL: info
-```
-
-### prod.yaml (override)
-
-```yaml
-replicaCount: 3
-
-image:
-  tag: "1.0.0"
-  pullPolicy: Always
-
-resources:
-  requests:
-    cpu: 200m
-    memory: 256Mi
-  limits:
-    cpu: 1000m
-    memory: 1Gi
-
-autoscaling:
-  minReplicas: 3
-  maxReplicas: 20
-
-ingress:
-  host: api.smart-cart.com
-```
-
----
-
-## 3. Naming & Labels
+## 2. Naming & Labels
 
 ### Recommended labels (K8s standard)
 
@@ -266,21 +99,7 @@ ingress:
 
 ---
 
-## 4. Config & Secrets
-
-### ConfigMap
-
-```yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: api-config
-  namespace: smart-cart
-data:
-  NODE_ENV: "production"
-  LOG_LEVEL: "info"
-  PORT: "3000"
-```
+## 3. Config & Secrets
 
 ### Secrets strategy
 
@@ -301,9 +120,13 @@ data:
 | RBAC restrict secret access | Let all pods read all secrets |
 | Mount as volume if file-based | Expose in container logs |
 
+**Rotation cadence:** prod secrets — every 90 days (or on compromise); staging — every 180; dev — ad-hoc. Record cadence in an ADR.
+
+ConfigMap template → `$k8s-manifests-conventions-reference` §3.
+
 ---
 
-## 5. Ingress & Gateway
+## 4. Ingress & Gateway
 
 ### Convention
 
@@ -314,48 +137,11 @@ data:
 | Rate limiting | Enable on public endpoints |
 | Security headers | `X-Content-Type-Options`, `X-Frame-Options`, `Strict-Transport-Security` |
 
-### Ingress example
-
-```yaml
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: api-ingress
-  namespace: smart-cart
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/rate-limit: "100"
-    nginx.ingress.kubernetes.io/rate-limit-window: "1m"
-    nginx.ingress.kubernetes.io/server-snippet: |
-      add_header X-Content-Type-Options "nosniff" always;
-      add_header X-Frame-Options "SAMEORIGIN" always;
-      add_header Strict-Transport-Security "max-age=31536000" always;
-spec:
-  ingressClassName: nginx
-  tls:
-    - hosts: [api.example.com]
-      secretName: api-tls
-  rules:
-    - host: api.example.com
-      http:
-        paths:
-          - path: /api
-            pathType: Prefix
-            backend:
-              service:
-                name: api
-                port: { number: 80 }
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: dashboard
-                port: { number: 80 }
-```
+Full Ingress example with rate-limit and security headers → `$k8s-manifests-conventions-reference` §4.
 
 ---
 
-## 6. Probes & Resources
+## 5. Probes & Resources
 
 ### Probes convention
 
@@ -365,6 +151,8 @@ spec:
 | `livenessProbe` | `/health/live` | App is alive (not deadlocked) | initialDelay: 15s, period: 20s |
 | `startupProbe` | `/health/live` | Slow-starting apps | failureThreshold: 10, period: 5s |
 
+**When to use `startupProbe`:** app boots in > 30 seconds (heavy DB migrations on boot, model loading, warm cache). Without startupProbe, livenessProbe will kill the pod before full start.
+
 ### Resources guideline
 
 | Env | requests.cpu | requests.memory | limits.cpu | limits.memory |
@@ -377,7 +165,7 @@ spec:
 
 ---
 
-## 7. Security Policy
+## 6. Security Policy
 
 ### Pod Security Standards
 
@@ -387,66 +175,11 @@ spec:
 | **Baseline** | No known privilege escalations | Staging |
 | **Privileged** | No restrictions | Never in production |
 
-### Security context template
-
-```yaml
-spec:
-  securityContext:
-    runAsNonRoot: true
-    runAsUser: 1001
-    runAsGroup: 1001
-    fsGroup: 1001
-    seccompProfile:
-      type: RuntimeDefault
-  containers:
-    - name: api
-      securityContext:
-        allowPrivilegeEscalation: false
-        readOnlyRootFilesystem: true
-        capabilities:
-          drop: [ALL]
-        volumeMounts:
-          - name: tmp
-            mountPath: /tmp
-  volumes:
-    - name: tmp
-      emptyDir: {}
-```
+Full securityContext PSS-Restricted template (with volumes) → `$k8s-manifests-conventions-reference` §5.
 
 ---
 
-## 8. CI Validation
-
-### Pipeline checks
-
-```yaml
-# GitHub Actions example
-validate-k8s:
-  runs-on: ubuntu-latest
-  steps:
-    - uses: actions/checkout@v4
-
-    # Build manifests
-    - name: Kustomize build
-      run: kubectl kustomize k8s/overlays/prod > /tmp/manifests.yaml
-
-    # Schema validation
-    - name: Kubeconform
-      uses: yannh/kubeconform-action@v0.6
-      with:
-        files: /tmp/manifests.yaml
-        kubernetes-version: "1.29.0"
-
-    # Dry-run
-    - name: Dry run
-      run: kubectl apply --dry-run=server -f /tmp/manifests.yaml
-
-    # Policy check (optional)
-    - name: Conftest
-      run: conftest test /tmp/manifests.yaml -p policy/
-```
-
-### Validation checks summary
+## 7. CI Validation
 
 | Check | Tool | What it catches |
 |-------|------|-----------------|
@@ -456,9 +189,11 @@ validate-k8s:
 | Lint (Helm) | `helm lint` | Template errors, missing values |
 | Policy | `conftest` / `kyverno` / OPA | No root, resource limits, labels |
 
+Ready GitHub Actions snippet with kubeconform + dry-run + conftest → `$k8s-manifests-conventions-reference` §6.
+
 ---
 
-## 9. GitOps
+## 8. GitOps
 
 ### Approach (if applicable)
 
@@ -481,7 +216,7 @@ Git branches:
 
 ---
 
-## 10. Red Flags
+## 9. Red Flags
 
 ### 🔴 P0
 
@@ -503,7 +238,7 @@ Git branches:
 
 ---
 
-## 11. Output Template
+## 10. Output Template
 
 ```markdown
 # K8s Manifests Conventions: <project-name>
@@ -512,28 +247,28 @@ Git branches:
 **Approach:** Kustomize / Helm / Raw (ADR-xxx)
 
 ## Repo Structure
-<section 2 tree>
+<tree from reference §1 or §2>
 
 ## Naming & Labels
-<section 3 tables>
+<section 2 tables>
 
 ## Config & Secrets Strategy
-<section 4 approach + rules>
+<section 3 approach + rotation cadence>
 
 ## Ingress
-<section 5 config>
+<section 4 config>
 
 ## Probes & Resources
-<section 6 tables>
+<section 5 tables>
 
 ## Security Policy
-<PSS level + security context>
+<PSS level + securityContext from reference §5>
 
 ## CI Validation
-<pipeline checks>
+<pipeline checks from reference §6>
 
 ## GitOps
-<promotion flow>
+<section 8 promotion flow>
 
 ## Risks
 <red flags>
@@ -541,8 +276,23 @@ Git branches:
 
 ---
 
+## 11. DoD
+
+- [ ] Tooling (Kustomize/Helm/Raw) chosen and recorded in an ADR
+- [ ] All P0 Red Flags resolved or recorded as exceptions
+- [ ] Output Template filled; templates pulled from `$k8s-manifests-conventions-reference`
+- [ ] CI validation pipeline (kubeconform + dry-run) wired
+- [ ] Secrets rotation cadence recorded
+
+---
+
 ## See also
+- `$k8s-manifests-conventions-reference` — all Kustomize/Helm/ConfigMap/Ingress/securityContext/CI templates
 - `$docker-kubernetes-architecture` — containerization + K8s architecture
+- `$docker-kubernetes-architecture-reference` — Dockerfile + baseline K8s manifests
 - `$deployment-ci-plan` — CI pipeline, environments, rollback
+- `$deployment-ci-plan-reference` — Dockerfile/CI templates
 - `$security-baseline-dev` — secrets management patterns
 - `$observability-plan` — logging/metrics in K8s context
+- `$threat-model-baseline` — security requirements
+- `$architecture-doc-reference` — canonical architecture-doc sections

package/domains/development/locales/en/.agents/skills/k8s-manifests-conventions/agents/kimi.yaml

@@ -1,14 +1,14 @@
-name: "k8s-manifests-conventions"
-display_name: "K8s Manifests Conventions"
-description: "Kubernetes manifests conventions — repo structure, Helm/Kustomize, overlays per env, naming/labels, secrets/config, policy, validation, GitOps."
-default_prompt: "Use $k8s-manifests-conventions when the task matches the \"K8s Manifests Conventions\" skill."
-triggers:
-  - "k8s-manifests-conventions"
-  - "k8s manifests conventions"
-  - "Kubernetes manifests conventions — repo structure, Helm/Kustomize, overlays per env, naming/labels, secrets/config, policy, validation, GitOps"
-capabilities:
-  - "k8s"
-  - "manifests"
-  - "conventions"
-tools: []
-implicit_invocation: true
+name: "k8s-manifests-conventions"
+display_name: "K8s Manifests Conventions"
+description: "Kubernetes manifests conventions — repo structure, Helm/Kustomize, overlays per env, naming/labels, secrets/config, policy, validation, GitOps."
+default_prompt: "Use $k8s-manifests-conventions when the task matches the \"K8s Manifests Conventions\" skill."
+triggers:
+  - "k8s-manifests-conventions"
+  - "k8s manifests conventions"
+  - "Kubernetes manifests conventions — repo structure, Helm/Kustomize, overlays per env, naming/labels, secrets/config, policy, validation, GitOps"
+capabilities:
+  - "k8s"
+  - "manifests"
+  - "conventions"
+tools: []
+implicit_invocation: true