code-ai-installer 3.0.0 → 4.0.1-a

package/domains/development/locales/en/.agents/skills/k8s-manifests-conventions-reference/SKILL.md

@@ -0,0 +1,398 @@
+---
+name: k8s-manifests-conventions-reference
+description: Canonical reference of K8s manifest templates — Kustomize base/overlay, Helm chart values, ConfigMap, Ingress with rate-limit, securityContext PSS-Restricted, CI validation pipeline. Growing library of reference templates for ARCH+OPS gates.
+type: reference
+domain: development
+owners:
+  - architect
+  - devops
+gates:
+  - ARCH
+  - OPS
+tech:
+  - k8s
+topic:
+  - architecture
+  - ops
+triggers:
+  - Kustomize base overlay example
+  - Helm chart values.yaml
+  - ConfigMap template
+  - Ingress with rate-limit
+  - securityContext PSS Restricted
+  - kubeconform pipeline
+related:
+  - k8s-manifests-conventions
+  - docker-kubernetes-architecture
+  - docker-kubernetes-architecture-reference
+  - deployment-ci-plan
+  - deployment-ci-plan-reference
+  - security-baseline-dev
+  - observability-plan
+  - threat-model-baseline
+budget_lines: 500
+schema_version: 1
+---
+
+
+# Skill: K8s Manifests Conventions — Reference
+
+Canonical templates: Kustomize, Helm, ConfigMap, Ingress, securityContext, CI validation. Workflow rules + tables → `$k8s-manifests-conventions`.
+
+**Sections:**
+1. [Kustomize layout](#1-kustomize-layout)
+2. [Helm layout](#2-helm-layout)
+3. [ConfigMap template](#3-configmap-template)
+4. [Ingress (rate-limit + headers)](#4-ingress-rate-limit--headers)
+5. [securityContext PSS-Restricted](#5-securitycontext-pss-restricted)
+6. [CI Validation pipeline (GHA)](#6-ci-validation-pipeline-gha)
+7. [Growing library](#7-growing-library)
+
+---
+
+## 1. Kustomize layout
+
+### Layout tree
+
+```
+k8s/
+├── base/
+│   ├── kustomization.yaml
+│   ├── namespace.yaml
+│   ├── deployment-api.yaml
+│   ├── deployment-dashboard.yaml
+│   ├── service-api.yaml
+│   ├── service-dashboard.yaml
+│   ├── ingress.yaml
+│   ├── configmap.yaml
+│   ├── hpa.yaml
+│   └── pdb.yaml
+└── overlays/
+    ├── dev/
+    │   ├── kustomization.yaml
+    │   ├── patch-deployment.yaml
+    │   └── patch-ingress.yaml
+    ├── staging/
+    │   ├── kustomization.yaml
+    │   └── patch-deployment.yaml
+    └── prod/
+        ├── kustomization.yaml
+        ├── patch-deployment.yaml
+        ├── patch-ingress.yaml
+        └── patch-hpa.yaml
+```
+
+### kustomization.yaml (base)
+
+```yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: smart-cart
+
+resources:
+  - namespace.yaml
+  - deployment-api.yaml
+  - deployment-dashboard.yaml
+  - service-api.yaml
+  - service-dashboard.yaml
+  - ingress.yaml
+  - configmap.yaml
+  - hpa.yaml
+  - pdb.yaml
+
+commonLabels:
+  app.kubernetes.io/part-of: smart-cart-rescue
+  app.kubernetes.io/managed-by: kustomize
+```
+
+### kustomization.yaml (overlay — prod)
+
+```yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+
+namePrefix: prod-
+
+patches:
+  - path: patch-deployment.yaml
+    target:
+      kind: Deployment
+      name: api
+  - path: patch-ingress.yaml
+    target:
+      kind: Ingress
+      name: api-ingress
+  - path: patch-hpa.yaml
+    target:
+      kind: HorizontalPodAutoscaler
+      name: api-hpa
+
+configMapGenerator:
+  - name: api-config
+    behavior: merge
+    literals:
+      - NODE_ENV=production
+      - LOG_LEVEL=info
+```
+
+### patch-deployment.yaml (prod overlay)
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: api
+spec:
+  replicas: 3
+  template:
+    spec:
+      containers:
+        - name: api
+          resources:
+            requests:
+              cpu: 200m
+              memory: 256Mi
+            limits:
+              cpu: 1000m
+              memory: 1Gi
+```
+
+---
+
+## 2. Helm layout
+
+### Layout tree
+
+```
+k8s/
+├── charts/
+│   └── smart-cart/
+│       ├── Chart.yaml
+│       ├── values.yaml
+│       └── templates/
+│           ├── _helpers.tpl
+│           ├── deployment.yaml
+│           ├── service.yaml
+│           ├── ingress.yaml
+│           ├── configmap.yaml
+│           ├── hpa.yaml
+│           └── pdb.yaml
+└── env/
+    ├── dev.yaml
+    ├── staging.yaml
+    └── prod.yaml
+```
+
+### values.yaml (defaults)
+
+```yaml
+replicaCount: 2
+
+image:
+  repository: registry.example.com/smart-cart/api
+  tag: latest
+  pullPolicy: IfNotPresent
+
+service:
+  type: ClusterIP
+  port: 80
+  targetPort: 3000
+
+ingress:
+  enabled: true
+  className: nginx
+  host: api.example.com
+  tls: true
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
+
+autoscaling:
+  enabled: true
+  minReplicas: 2
+  maxReplicas: 10
+  targetCPUUtilization: 70
+
+env:
+  NODE_ENV: production
+  LOG_LEVEL: info
+```
+
+### prod.yaml (override)
+
+```yaml
+replicaCount: 3
+
+image:
+  tag: "1.0.0"
+  pullPolicy: Always
+
+resources:
+  requests:
+    cpu: 200m
+    memory: 256Mi
+  limits:
+    cpu: 1000m
+    memory: 1Gi
+
+autoscaling:
+  minReplicas: 3
+  maxReplicas: 20
+
+ingress:
+  host: api.smart-cart.com
+```
+
+---
+
+## 3. ConfigMap template
+
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: api-config
+  namespace: smart-cart
+data:
+  NODE_ENV: "production"
+  LOG_LEVEL: "info"
+  PORT: "3000"
+```
+
+---
+
+## 4. Ingress (rate-limit + headers)
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: api-ingress
+  namespace: smart-cart
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/rate-limit: "100"
+    nginx.ingress.kubernetes.io/rate-limit-window: "1m"
+    nginx.ingress.kubernetes.io/server-snippet: |
+      add_header X-Content-Type-Options "nosniff" always;
+      add_header X-Frame-Options "SAMEORIGIN" always;
+      add_header Strict-Transport-Security "max-age=31536000" always;
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts: [api.example.com]
+      secretName: api-tls
+  rules:
+    - host: api.example.com
+      http:
+        paths:
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: api
+                port: { number: 80 }
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: dashboard
+                port: { number: 80 }
+```
+
+---
+
+## 5. securityContext PSS-Restricted
+
+```yaml
+spec:
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 1001
+    runAsGroup: 1001
+    fsGroup: 1001
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+    - name: api
+      securityContext:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        capabilities:
+          drop: [ALL]
+      volumeMounts:
+        - name: tmp
+          mountPath: /tmp
+  volumes:
+    - name: tmp
+      emptyDir: {}
+```
+
+---
+
+## 6. CI Validation pipeline (GHA)
+
+```yaml
+# GitHub Actions example
+validate-k8s:
+  runs-on: ubuntu-latest
+  steps:
+    - uses: actions/checkout@v4
+
+    # Build manifests
+    - name: Kustomize build
+      run: kubectl kustomize k8s/overlays/prod > /tmp/manifests.yaml
+
+    # Schema validation
+    - name: Kubeconform
+      uses: yannh/kubeconform-action@v0.6
+      with:
+        files: /tmp/manifests.yaml
+        kubernetes-version: "1.29.0"
+
+    # Dry-run
+    - name: Dry run
+      run: kubectl apply --dry-run=server -f /tmp/manifests.yaml
+
+    # Policy check (optional)
+    - name: Conftest
+      run: conftest test /tmp/manifests.yaml -p policy/
+```
+
+---
+
+## 7. Growing library
+
+Canonical templates are added via `update_skill` MCP tool as needs emerge. Extension candidates:
+
+- **Conftest / OPA policy** — Rego rules: no-root, resource-limits-required, labels-required
+- **kyverno ClusterPolicy** — admission-time enforcement (mutate + validate)
+- **ArgoCD Application + AppProject** — declarative CD, RBAC, sync waves
+- **Flux GitRepository + Kustomization** — git-native CD, image automation
+- **Sealed Secrets** — `kubeseal` workflow, kustomize/helm integration
+- **NetworkPolicy variants** — deny-all baseline, namespace-isolation, egress to managed services
+- **RBAC bundle** — ServiceAccount + Role + RoleBinding for prod app
+- **Sidecar injection patterns** — log shipper, metrics exporter, init container
+- **helm `_helpers.tpl`** — common labels, naming helpers, image full reference
+- **ArgoCD AppProject** — multi-team/multi-env governance
+
+---
+
+## See also
+- `$k8s-manifests-conventions` — workflow rules + tables + Output Template
+- `$docker-kubernetes-architecture` — containerization + K8s architecture
+- `$docker-kubernetes-architecture-reference` — Dockerfile + baseline K8s manifests
+- `$deployment-ci-plan` — CI pipeline rules
+- `$deployment-ci-plan-reference` — Dockerfile/CI templates (different angle)
+- `$security-baseline-dev` — security baseline for development
+- `$observability-plan` — detailed logging/metrics plan
+- `$threat-model-baseline` — security requirements

package/domains/development/locales/en/.agents/skills/k8s-manifests-conventions-reference/agents/claude.json

@@ -0,0 +1,19 @@
+{
+  "name": "k8s-manifests-conventions-reference",
+  "display_name": "K8s Manifests Conventions Reference (Templates)",
+  "description": "Canonical reference of K8s manifest templates — Kustomize base/overlay, Helm chart values, ConfigMap, Ingress with rate-limit, securityContext PSS-Restricted, CI validation pipeline. Growing library of reference templates for ARCH+OPS gates.",
+  "default_prompt": "Use $k8s-manifests-conventions-reference when the task matches the \"K8s Manifests Conventions Reference (Templates)\" skill.",
+  "triggers": [
+    "k8s-manifests-conventions-reference",
+    "k8s manifests conventions reference",
+    "Kubernetes manifests conventions — repo structure, Helm/Kustomize, overlays per env, naming/labels, secrets/config, policy, validation, GitOps"
+  ],
+  "capabilities": [
+    "k8s",
+    "manifests",
+    "conventions",
+    "reference"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/k8s-manifests-conventions-reference/agents/copilot.json

@@ -0,0 +1,19 @@
+{
+  "name": "k8s-manifests-conventions-reference",
+  "display_name": "K8s Manifests Conventions Reference (Templates)",
+  "description": "Canonical reference of K8s manifest templates — Kustomize base/overlay, Helm chart values, ConfigMap, Ingress with rate-limit, securityContext PSS-Restricted, CI validation pipeline. Growing library of reference templates for ARCH+OPS gates.",
+  "default_prompt": "Use $k8s-manifests-conventions-reference when the task matches the \"K8s Manifests Conventions Reference (Templates)\" skill.",
+  "triggers": [
+    "k8s-manifests-conventions-reference",
+    "k8s manifests conventions reference",
+    "Kubernetes manifests conventions — repo structure, Helm/Kustomize, overlays per env, naming/labels, secrets/config, policy, validation, GitOps"
+  ],
+  "capabilities": [
+    "k8s",
+    "manifests",
+    "conventions",
+    "reference"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/k8s-manifests-conventions-reference/agents/gemini.json

@@ -0,0 +1,19 @@
+{
+  "name": "k8s-manifests-conventions-reference",
+  "display_name": "K8s Manifests Conventions Reference (Templates)",
+  "description": "Canonical reference of K8s manifest templates — Kustomize base/overlay, Helm chart values, ConfigMap, Ingress with rate-limit, securityContext PSS-Restricted, CI validation pipeline. Growing library of reference templates for ARCH+OPS gates.",
+  "default_prompt": "Use $k8s-manifests-conventions-reference when the task matches the \"K8s Manifests Conventions Reference (Templates)\" skill.",
+  "triggers": [
+    "k8s-manifests-conventions-reference",
+    "k8s manifests conventions reference",
+    "Kubernetes manifests conventions — repo structure, Helm/Kustomize, overlays per env, naming/labels, secrets/config, policy, validation, GitOps"
+  ],
+  "capabilities": [
+    "k8s",
+    "manifests",
+    "conventions",
+    "reference"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/k8s-manifests-conventions-reference/agents/kimi.yaml

@@ -0,0 +1,15 @@
+name: "k8s-manifests-conventions-reference"
+display_name: "K8s Manifests Conventions Reference (Templates)"
+description: "Canonical reference of K8s manifest templates — Kustomize base/overlay, Helm chart values, ConfigMap, Ingress with rate-limit, securityContext PSS-Restricted, CI validation pipeline. Growing library of reference templates for ARCH+OPS gates."
+default_prompt: "Use $k8s-manifests-conventions-reference when the task matches the \"K8s Manifests Conventions Reference (Templates)\" skill."
+triggers:
+  - "k8s-manifests-conventions-reference"
+  - "k8s manifests conventions reference"
+  - "Kubernetes manifests conventions — repo structure, Helm/Kustomize, overlays per env, naming/labels, secrets/config, policy, validation, GitOps"
+capabilities:
+  - "k8s"
+  - "manifests"
+  - "conventions"
+  - "reference"
+tools: []
+implicit_invocation: true

package/domains/development/locales/en/.agents/skills/k8s-manifests-conventions-reference/agents/openai.yaml

@@ -0,0 +1,8 @@
+interface:
+  display_name: "K8s Manifests Conventions Reference (Templates)"
+  short_description: "Canonical reference of K8s manifest templates — Kustomize base/overlay, Helm chart values, ConfigMap, Ingress with rate-limit, securityContext PSS-Restricted, CI validation pipeline. Growing library of reference templates for ARCH+OPS gates."
+  default_prompt: "Use $k8s-manifests-conventions-reference when the task matches the \"K8s Manifests Conventions Reference (Templates)\" skill."
+dependencies:
+  tools: []
+policy:
+  allow_implicit_invocation: true

package/domains/development/locales/en/.agents/skills/k8s-manifests-conventions-reference/agents/qwen.json

@@ -0,0 +1,19 @@
+{
+  "name": "k8s-manifests-conventions-reference",
+  "display_name": "K8s Manifests Conventions Reference (Templates)",
+  "description": "Canonical reference of K8s manifest templates — Kustomize base/overlay, Helm chart values, ConfigMap, Ingress with rate-limit, securityContext PSS-Restricted, CI validation pipeline. Growing library of reference templates for ARCH+OPS gates.",
+  "default_prompt": "Use $k8s-manifests-conventions-reference when the task matches the \"K8s Manifests Conventions Reference (Templates)\" skill.",
+  "triggers": [
+    "k8s-manifests-conventions-reference",
+    "k8s manifests conventions reference",
+    "Kubernetes manifests conventions — repo structure, Helm/Kustomize, overlays per env, naming/labels, secrets/config, policy, validation, GitOps"
+  ],
+  "capabilities": [
+    "k8s",
+    "manifests",
+    "conventions",
+    "reference"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/k8s-manifests-conventions-reference/agents/skill.yaml

@@ -0,0 +1,23 @@
+version: 1
+name: "k8s-manifests-conventions-reference"
+display_name: "K8s Manifests Conventions Reference (Templates)"
+description: "Canonical reference of K8s manifest templates — Kustomize base/overlay, Helm chart values, ConfigMap, Ingress with rate-limit, securityContext PSS-Restricted, CI validation pipeline. Growing library of reference templates for ARCH+OPS gates."
+default_prompt: "Use $k8s-manifests-conventions-reference when the task matches the \"K8s Manifests Conventions Reference (Templates)\" skill."
+triggers:
+  - "k8s-manifests-conventions-reference"
+  - "k8s manifests conventions reference"
+  - "Kubernetes manifests conventions — repo structure, Helm/Kustomize, overlays per env, naming/labels, secrets/config, policy, validation, GitOps"
+capabilities:
+  - "k8s"
+  - "manifests"
+  - "conventions"
+  - "reference"
+tools: []
+invocation:
+  explicit: true
+  implicit: true
+localization:
+  default_locale: "en"
+  available_locales:
+    - "ru"
+    - "en"

package/domains/development/locales/en/.agents/skills/karpathy-guidelines/SKILL.md

@@ -1,10 +1,45 @@
 ---
 name: karpathy-guidelines
-description: Behavioral guidelines to reduce common LLM mistakes — think before coding, simplicity first, surgical changes, goal-driven execution.
+description: "Behavioral guidelines to reduce common LLM mistakes — think before coding, simplicity first, surgical changes, goal-driven execution."
+type: mandatory
+domain: development
+owners:
+  - architect
+  - conductor
+  - devops
+  - product_manager
+  - reviewer
+  - senior_full_stack
+  - tester
+  - ux_ui_designer
+gates:
+  - PM
+  - UX
+  - ARCH
+  - DEV
+  - REV
+  - OPS
+  - TEST
+  - RG
+tech: []
+topic:
+  - general
+triggers:
+  - think first
+  - don't assume silently
+  - targeted edit
+  - minimal change
+  - LLM working rules
+  - check assumptions
+related:
+  - mcp-integration
+budget_lines: 380
+schema_version: 1
 license: MIT
 source: https://x.com/karpathy/status/2015883857489522876
 ---
 
+
 # Karpathy Guidelines
 
 Behavioral guidelines to reduce common LLM mistakes, derived from [Andrej Karpathy's observations](https://x.com/karpathy/status/2015883857489522876).
@@ -294,6 +329,7 @@ def test_sort_with_duplicate_scores():
         {'name': 'Charlie', 'score': 90},
     ]
     result = sort_scores(scores)
+    # Problem: with duplicate scores, the order is unpredictable
     assert result[0]['score'] == 100
     assert result[2]['score'] == 90
     assert result[0]['name'] < result[1]['name']  # stable sort

package/domains/development/locales/en/.agents/skills/karpathy-guidelines/agents/claude.json

@@ -1,22 +1,22 @@
-{
-  "name": "karpathy-guidelines",
-  "display_name": "Karpathy Guidelines",
-  "description": "Behavioral guidelines to reduce common LLM mistakes — think before coding, simplicity first, surgical changes, goal-driven execution.",
-  "default_prompt": "Use $karpathy-guidelines when the task requires quality discipline: writing code, reviewing, refactoring, analysis, or design.",
-  "triggers": [
-    "karpathy-guidelines",
-    "karpathy",
-    "Karpathy Guidelines",
-    "think before coding",
-    "simplicity first",
-    "surgical changes",
-    "goal-driven execution"
-  ],
-  "capabilities": [
-    "quality",
-    "guidelines",
-    "best-practices"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}
+{
+  "name": "karpathy-guidelines",
+  "display_name": "Karpathy Guidelines",
+  "description": "Behavioral guidelines to reduce common LLM mistakes — think before coding, simplicity first, surgical changes, goal-driven execution.",
+  "default_prompt": "Use $karpathy-guidelines when the task requires quality discipline: writing code, reviewing, refactoring, analysis, or design.",
+  "triggers": [
+    "karpathy-guidelines",
+    "karpathy",
+    "Karpathy Guidelines",
+    "think before coding",
+    "simplicity first",
+    "surgical changes",
+    "goal-driven execution"
+  ],
+  "capabilities": [
+    "quality",
+    "guidelines",
+    "best-practices"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/karpathy-guidelines/agents/copilot.json

@@ -1,22 +1,22 @@
-{
-  "name": "karpathy-guidelines",
-  "display_name": "Karpathy Guidelines",
-  "description": "Behavioral guidelines to reduce common LLM mistakes — think before coding, simplicity first, surgical changes, goal-driven execution.",
-  "default_prompt": "Use $karpathy-guidelines when the task requires quality discipline: writing code, reviewing, refactoring, analysis, or design.",
-  "triggers": [
-    "karpathy-guidelines",
-    "karpathy",
-    "Karpathy Guidelines",
-    "think before coding",
-    "simplicity first",
-    "surgical changes",
-    "goal-driven execution"
-  ],
-  "capabilities": [
-    "quality",
-    "guidelines",
-    "best-practices"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}
+{
+  "name": "karpathy-guidelines",
+  "display_name": "Karpathy Guidelines",
+  "description": "Behavioral guidelines to reduce common LLM mistakes — think before coding, simplicity first, surgical changes, goal-driven execution.",
+  "default_prompt": "Use $karpathy-guidelines when the task requires quality discipline: writing code, reviewing, refactoring, analysis, or design.",
+  "triggers": [
+    "karpathy-guidelines",
+    "karpathy",
+    "Karpathy Guidelines",
+    "think before coding",
+    "simplicity first",
+    "surgical changes",
+    "goal-driven execution"
+  ],
+  "capabilities": [
+    "quality",
+    "guidelines",
+    "best-practices"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}