dsh-env-manager-plugin 0.1.0 → 0.1.2

package/docs/00-project/project-brief.md

@@ -1,114 +1,114 @@
-# Project Brief
-
-## Project Name
-
-DSH Environment Manager (`dsh-env-manager`)
-
-## Positioning
-
-A DSH (DeepSeek Harness) plugin that gives every session a shared, queryable context of enterprise environments, services, deployments, rules and operation-to-Skill bindings.
-
-It is the "where do I work, what am I touching, which rules apply, which Skill runs it, what have we learned" layer for operational Agents.
-
-## Core Value
-
-The project turns:
-
-```text
-scattered environment facts + ad-hoc SSH notes + tribal deployment knowledge
-```
-
-into:
-
-```text
-structured environment registry + service catalog + deployment bindings
-+ resolvable rules with provenance + deterministic Skill routing
-+ scoped memory references
-```
-
-## Primary Users
-
-- Platform and DevOps engineers
-- SREs and operations staff
-- Backend developers deploying to shared environments
-- AI-assisted development users running DSH sessions
-
-## Main Workflows
-
-### Workflow 1: Resolve Environment Context
-
-```text
-Agent asks: "Where does aicoservice run in test-a?"
-→ look up environment and service
-→ match the deployment binding
-→ resolve layered rules
-→ return a Service Context with provenance
-```
-
-### Workflow 2: Route an Operation to a Skill
-
-```text
-Agent asks: "Redeploy aicoservice in test-a"
-→ resolve the Service Context
-→ match operation bindings by scope
-→ detect conflicts
-→ check Skill availability
-→ return the Skill reference and mapped parameters with policy
-```
-
-### Workflow 3: Configure the Registry
-
-```text
-Engineer adds environment, hosts, clusters and roles
-→ adds services with Git URLs and artifacts
-→ adds deployment bindings
-→ adds rule profiles and overrides
-→ previews resolved paths and bindings
-```
-
-### Workflow 4: Accumulate Experience (P1)
-
-```text
-Operation completes
-→ emit a redacted operation record
-→ query prior observations for the same scope
-→ propose a rule or Skill change for review
-→ never auto-apply
-```
-
-## Core Principles
-
-- File-based registry is the source of truth.
-- Credentials are references; values live elsewhere.
-- Skill routing is explicit, deterministic and conflict-aware.
-- Derived values are labelled as derived; only checks can mark them verified.
-- Conflicting or missing data fails loudly.
-- Memory stores the lesson; this plugin stores the context.
-
-## V1 Scope
-
-Delivered:
-
-1. DSH bundle with Host and Client halves.
-2. File-based registry for environments, services, deployments, rules and operation bindings.
-3. Manual configuration through tools and a minimal Web/Desktop UI.
-4. Layered rule resolution with provenance.
-5. Deterministic operation-to-Skill routing with availability and policy checks.
-6. Read-only tools usable from every session.
-7. Session-scoped default environment.
-
-Deferred:
-
-- Remote execution adapters (SSH, Docker, Kubernetes).
-- Automatic deployment or rollback.
-- Automatic fact extraction from repositories or manifests.
-- Memory bridge implementation (contract only in V1).
-- Automatic rule or Skill evolution.
-
-## Non-goals
-
-- Not a CMDB replacement.
-- Not a secret vault.
-- Not a remote execution engine.
-- Not an unsupervised self-modifying rule system.
-- Not a database-backed platform.
+# Project Brief
+
+## Project Name
+
+DSH Environment Manager (`dsh-env-manager`)
+
+## Positioning
+
+A DSH (DeepSeek Harness) plugin that gives every session a shared, queryable context of enterprise environments, services, deployments, rules and operation-to-Skill bindings.
+
+It is the "where do I work, what am I touching, which rules apply, which Skill runs it, what have we learned" layer for operational Agents.
+
+## Core Value
+
+The project turns:
+
+```text
+scattered environment facts + ad-hoc SSH notes + tribal deployment knowledge
+```
+
+into:
+
+```text
+structured environment registry + service catalog + deployment bindings
++ resolvable rules with provenance + deterministic Skill routing
++ scoped memory references
+```
+
+## Primary Users
+
+- Platform and DevOps engineers
+- SREs and operations staff
+- Backend developers deploying to shared environments
+- AI-assisted development users running DSH sessions
+
+## Main Workflows
+
+### Workflow 1: Resolve Environment Context
+
+```text
+Agent asks: "Where does aicoservice run in test-a?"
+→ look up environment and service
+→ match the deployment binding
+→ resolve layered rules
+→ return a Service Context with provenance
+```
+
+### Workflow 2: Route an Operation to a Skill
+
+```text
+Agent asks: "Redeploy aicoservice in test-a"
+→ resolve the Service Context
+→ match operation bindings by scope
+→ detect conflicts
+→ check Skill availability
+→ return the Skill reference and mapped parameters with policy
+```
+
+### Workflow 3: Configure the Registry
+
+```text
+Engineer adds environment, hosts, clusters and roles
+→ adds services with Git URLs and artifacts
+→ adds deployment bindings
+→ adds rule profiles and overrides
+→ previews resolved paths and bindings
+```
+
+### Workflow 4: Accumulate Experience (P1)
+
+```text
+Operation completes
+→ emit a redacted operation record
+→ query prior observations for the same scope
+→ propose a rule or Skill change for review
+→ never auto-apply
+```
+
+## Core Principles
+
+- File-based registry is the source of truth.
+- Credentials are references; values live elsewhere.
+- Skill routing is explicit, deterministic and conflict-aware.
+- Derived values are labelled as derived; only checks can mark them verified.
+- Conflicting or missing data fails loudly.
+- Memory stores the lesson; this plugin stores the context.
+
+## V1 Scope
+
+Delivered:
+
+1. DSH bundle with Host and Client halves.
+2. File-based registry for environments, services, deployments, rules and operation bindings.
+3. Manual configuration through tools and a minimal Web/Desktop UI.
+4. Layered rule resolution with provenance.
+5. Deterministic operation-to-Skill routing with availability and policy checks.
+6. Read-only tools usable from every session.
+7. Session-scoped default environment.
+
+Deferred:
+
+- Remote execution adapters (SSH, Docker, Kubernetes).
+- Automatic deployment or rollback.
+- Automatic fact extraction from repositories or manifests.
+- Memory bridge implementation (contract only in V1).
+- Automatic rule or Skill evolution.
+
+## Non-goals
+
+- Not a CMDB replacement.
+- Not a secret vault.
+- Not a remote execution engine.
+- Not an unsupervised self-modifying rule system.
+- Not a database-backed platform.

package/docs/00-project/roadmap.md

@@ -1,89 +1,89 @@
-# Roadmap
-
-Aligned with the brainstorm (§9) and V1 design.
-
-## V0 — Design (complete)
-
-- [x] Brainstorm captured
-- [x] Repository and docs hub initialized
-- [x] V1 design suite written
-- [x] DSH runtime APIs verified (probes V1–V8 remain, tracked in `api-verification.md`)
-
-## V1 = P0: Registry and Context Resolution (complete; Phase 1 + 1.1 plane/K8s model live)
-
-Goal: a working plugin that any session can query, with deterministic routing.
-
-Implemented: Host modules, ten tools, HTTP API, panel, 48 tests, profile install. Phase 1
-adds the environment/plane model (ADR-0010): shell-only environment creation, role-filtered
-plane tabs, multi-role node add/edit, batch import, search and mandatory roles. Phase 1.1
-adds K8s/Pod node classification and command surfaces (ADR-0011): `Host.kind`,
-`Host.access`, `Host.clusterRef`, `Cluster.topology` and a Kubernetes/clusters tab. Account
-web login URLs and password-to-credential account editing are also implemented.
-Remaining: probes V4/V6, light-theme QA, row-level delete and private-key rotation.
-
-Scope:
-
-1. TypeScript Host scaffold and build.
-2. Local shared persistence (YAML files).
-3. Manual configuration of environments, hosts, clusters, roles and co-location.
-4. Manual service catalog with Git URLs and artifacts.
-5. Deployment bindings for native, Docker and Kubernetes.
-6. Rule profiles with layered overrides and provenance.
-7. Operation bindings with scoped routing, conflict detection and availability checks.
-8. Read-only tools for all sessions.
-9. Session-scoped default environment.
-10. Minimal Web/Desktop configuration UI with context preview.
-
-Acceptance: AC-01 … AC-08 in `docs/01-architecture/design.md` §14.
-
-## Phase 1.1: K8s node and execution model (complete)
-
-- `Host.kind`: `vm`, `physical`, `k8s-all-in-one`, `k8s-worker`, `pod-host`.
-- `Host.access`: `ssh`, `kubectl`, `docker`; metadata only, not authorization.
-- `Host.clusterRef` for Kubernetes and Pod-hosting machines; required for K8s node kinds.
-- `Cluster.topology`: `all-in-one`, `separate`, `external`.
-- Node form kind/cluster/access controls, node badges/search and a Kubernetes/clusters tab.
-- Pods stay in the deployment model; `pod-host` models the machine reached by `docker exec`.
-- Account-level web login URL, password-to-credential bridge and in-place account edit.
-
-## P1: Minimal Experience Loop
-
-Goal: turn operations into reusable, reviewed knowledge.
-
-Scope:
-
-1. Stable contract with the memory plugin.
-2. Memory queries scoped by environment/service/deployment.
-3. Operation Records and sanitized Evidence References.
-4. Candidate knowledge generation.
-5. Rule and Skill improvement proposals in a review queue.
-6. Reliable session-default persistence and recovery.
-
-Acceptance: AC-09, AC-10.
-
-## Phase 2: Topology depth
-
-- Database primary/replica/sharding metadata on top of the `database` role, without
-  duplicating `hosts[]`.
-- Row-level delete for nodes, accounts and login records.
-- Credential rotation and optional key/passphrase input.
-- Optional JumpServer/PAM import for accounts and login observations.
-
-## V1.1 / V2: Continuous Evolution
-
-- SSH/SFTP adapter.
-- Docker and Kubernetes remote adapters.
-- Log and evidence collection helpers.
-- Automatic operation event capture and log redaction.
-- Fact extraction from Git, Maven, Dockerfile and Helm.
-- Proposal impact analysis, regression checks, publish and rollback.
-- Automatic asset discovery and multi-instance sync.
-- Multi-user collaboration and richer authorization.
-
-## Explicitly Not Committed
-
-- Fully automatic deployment or self-healing.
-- Unreviewed production rule or Skill changes.
-- Audit coverage of every external SSH/browser action.
-- Configuration inference replacing real checks.
-- Building a bastion host, CMDB or scheduling platform.
+# Roadmap
+
+Aligned with the brainstorm (§9) and V1 design.
+
+## V0 — Design (complete)
+
+- [x] Brainstorm captured
+- [x] Repository and docs hub initialized
+- [x] V1 design suite written
+- [x] DSH runtime APIs verified (probes V1–V8 remain, tracked in `api-verification.md`)
+
+## V1 = P0: Registry and Context Resolution (complete; Phase 1 + 1.1 plane/K8s model live)
+
+Goal: a working plugin that any session can query, with deterministic routing.
+
+Implemented: Host modules, ten tools, HTTP API, panel, 48 tests, profile install. Phase 1
+adds the environment/plane model (ADR-0010): shell-only environment creation, role-filtered
+plane tabs, multi-role node add/edit, batch import, search and mandatory roles. Phase 1.1
+adds K8s/Pod node classification and command surfaces (ADR-0011): `Host.kind`,
+`Host.access`, `Host.clusterRef`, `Cluster.topology` and a Kubernetes/clusters tab. Account
+web login URLs and password-to-credential account editing are also implemented.
+Remaining: probes V4/V6, light-theme QA, row-level delete and private-key rotation.
+
+Scope:
+
+1. TypeScript Host scaffold and build.
+2. Local shared persistence (YAML files).
+3. Manual configuration of environments, hosts, clusters, roles and co-location.
+4. Manual service catalog with Git URLs and artifacts.
+5. Deployment bindings for native, Docker and Kubernetes.
+6. Rule profiles with layered overrides and provenance.
+7. Operation bindings with scoped routing, conflict detection and availability checks.
+8. Read-only tools for all sessions.
+9. Session-scoped default environment.
+10. Minimal Web/Desktop configuration UI with context preview.
+
+Acceptance: AC-01 … AC-08 in `docs/01-architecture/design.md` §14.
+
+## Phase 1.1: K8s node and execution model (complete)
+
+- `Host.kind`: `vm`, `physical`, `k8s-all-in-one`, `k8s-worker`, `pod-host`.
+- `Host.access`: `ssh`, `kubectl`, `docker`; metadata only, not authorization.
+- `Host.clusterRef` for Kubernetes and Pod-hosting machines; required for K8s node kinds.
+- `Cluster.topology`: `all-in-one`, `separate`, `external`.
+- Node form kind/cluster/access controls, node badges/search and a Kubernetes/clusters tab.
+- Pods stay in the deployment model; `pod-host` models the machine reached by `docker exec`.
+- Account-level web login URL, password-to-credential bridge and in-place account edit.
+
+## P1: Minimal Experience Loop
+
+Goal: turn operations into reusable, reviewed knowledge.
+
+Scope:
+
+1. Stable contract with the memory plugin.
+2. Memory queries scoped by environment/service/deployment.
+3. Operation Records and sanitized Evidence References.
+4. Candidate knowledge generation.
+5. Rule and Skill improvement proposals in a review queue.
+6. Reliable session-default persistence and recovery.
+
+Acceptance: AC-09, AC-10.
+
+## Phase 2: Topology depth
+
+- Database primary/replica/sharding metadata on top of the `database` role, without
+  duplicating `hosts[]`.
+- Row-level delete for nodes, accounts and login records.
+- Credential rotation and optional key/passphrase input.
+- Optional JumpServer/PAM import for accounts and login observations.
+
+## V1.1 / V2: Continuous Evolution
+
+- SSH/SFTP adapter.
+- Docker and Kubernetes remote adapters.
+- Log and evidence collection helpers.
+- Automatic operation event capture and log redaction.
+- Fact extraction from Git, Maven, Dockerfile and Helm.
+- Proposal impact analysis, regression checks, publish and rollback.
+- Automatic asset discovery and multi-instance sync.
+- Multi-user collaboration and richer authorization.
+
+## Explicitly Not Committed
+
+- Fully automatic deployment or self-healing.
+- Unreviewed production rule or Skill changes.
+- Audit coverage of every external SSH/browser action.
+- Configuration inference replacing real checks.
+- Building a bastion host, CMDB or scheduling platform.