everything-gemini 1.8.0 → 2.0.0

package/skills/triton-inference-server/SKILL.md

@@ -0,0 +1,221 @@
+---
+name: triton-inference-server
+description: Deploys, configures, and tunes NVIDIA Triton Inference Server for high-throughput, low-latency multi-model serving with dynamic batching and GPU acceleration.
+---
+
+# Triton Inference Server
+
+Provides production architecture and configuration patterns for serving deep learning and LLM models at enterprise scale with NVIDIA Triton Inference Server.
+
+---
+
+## 1. Architecture & Execution Model
+
+```
+ Client Application (gRPC / HTTP KServe v2)
+                  │
+                  ▼
+┌──────────────────────────────────────────────┐
+│       NVIDIA Triton Inference Server         │
+│                                              │
+│  ┌──────────────────┐  ┌──────────────────┐  │
+│  │ Dynamic Batching │  │ Model Concurrency│  │
+│  │ Scheduler        │  │ & GPU Instances  │  │
+│  └─────────┬────────┘  └────────┬─────────┘  │
+│            │                    │            │
+│            ▼                    ▼            │
+│  ┌────────────────────────────────────────┐  │
+│  │  Backend Engines                       │  │
+│  │  - TensorRT-LLM (High-speed generative)│  │
+│  │  - vLLM Engine (PagedAttention serving)│  │
+│  │  - ONNX Runtime (Embedding & classifier│  │
+│  │  - Python Backend (Custom preprocessing│  │
+│  └────────────────────────────────────────┘  │
+└──────────────────────┬───────────────────────┘
+                       │
+                       ▼
+          NVIDIA Tensor Core GPUs (H100/A100/L4)
+```
+
+---
+
+## 2. Model Repository Layout
+
+Triton requires a strict directory layout with versioned subdirectories and `config.pbtxt`:
+
+```text
+model_repository/
+├── embedding_model/
+│   ├── 1/
+│   │   └── model.onnx
+│   └── config.pbtxt
+└── llm_generator/
+    ├── 1/
+    │   └── model.py
+    └── config.pbtxt
+```
+
+---
+
+## 3. High-Throughput `config.pbtxt` Configuration
+
+Configures dynamic batching, GPU instance groups, and TensorRT acceleration:
+
+```protobuf
+name: "embedding_model"
+platform: "onnxruntime_onnx"
+max_batch_size: 128
+
+input [
+  {
+    name: "input_ids"
+    data_type: TYPE_INT64
+    dims: [ -1 ]
+  },
+  {
+    name: "attention_mask"
+    data_type: TYPE_INT64
+    dims: [ -1 ]
+  }
+]
+
+output [
+  {
+    name: "sentence_embedding"
+    data_type: TYPE_FP32
+    dims: [ 768 ]
+  }
+]
+
+# Maximize GPU utilization via dynamic queue batching
+dynamic_batching {
+  max_queue_delay_microseconds: 5000 # 5ms SLA window
+  preferred_batch_size: [ 16, 32, 64, 128 ]
+}
+
+# Run 2 concurrent model instances on GPU 0
+instance_group [
+  {
+    count: 2
+    kind: KIND_GPU
+    gpus: [ 0 ]
+  }
+]
+
+optimization {
+  execution_accelerators {
+    gpu_execution_accelerator : [ {
+      name : "tensorrt"
+      parameters { key: "precision_mode" value: "FP16" }
+      parameters { key: "max_workspace_size_bytes" value: "4294967296" }
+    }]
+  }
+}
+```
+
+---
+
+## 4. High-Performance gRPC Client (Python)
+
+Uses binary gRPC streaming with zero-copy serialization:
+
+```python
+import numpy as np
+import tritonclient.grpc as grpcclient
+from tritonclient.grpc import InferInput, InferRequestedOutput
+
+def query_triton_embeddings(
+    texts_token_ids: np.ndarray,
+    attention_masks: np.ndarray,
+    server_url: str = "localhost:8001"
+) -> np.ndarray:
+    """Queries Triton via low-latency gRPC channel."""
+    with grpcclient.InferenceServerClient(url=server_url) as client:
+        # Check server readiness
+        if not client.is_server_ready():
+            raise RuntimeError("Triton server is not healthy.")
+
+        inputs = [
+            InferInput("input_ids", texts_token_ids.shape, "INT64"),
+            InferInput("attention_mask", attention_masks.shape, "INT64")
+        ]
+        inputs[0].set_data_from_numpy(texts_token_ids)
+        inputs[1].set_data_from_numpy(attention_masks)
+
+        outputs = [InferRequestedOutput("sentence_embedding")]
+
+        response = client.infer(
+            model_name="embedding_model",
+            inputs=inputs,
+            outputs=outputs,
+            timeout=10.0
+        )
+
+        return response.as_numpy("sentence_embedding")
+```
+
+---
+
+## 5. Production Docker & Kubernetes Deployment
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: triton-inference-server
+  namespace: mlops
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: triton
+  template:
+    metadata:
+      labels:
+        app: triton
+    spec:
+      containers:
+        - name: triton
+          image: nvcr.io/nvidia/tritonserver:24.08-py3
+          args: ["tritonserver", "--model-repository=/models", "--strict-model-config=true"]
+          resources:
+            limits:
+              nvidia.com/gpu: 1
+              memory: 16Gi
+              cpu: "8"
+          ports:
+            - containerPort: 8000 # HTTP
+            - containerPort: 8001 # gRPC
+            - containerPort: 8002 # Metrics (Prometheus)
+          livenessProbe:
+            httpGet:
+              path: /v2/health/live
+              port: 8000
+            initialDelaySeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /v2/health/ready
+              port: 8000
+            initialDelaySeconds: 15
+```
+
+---
+
+## 6. Performance Benchmarking & Profiling
+
+```bash
+# Verify health and loaded models via v2 API
+curl -s http://localhost:8000/v2/health/ready
+curl -s http://localhost:8000/v2/models/embedding_model/ready
+
+# Profile throughput and P99 latency with Perf Analyzer
+perf_analyzer -m embedding_model \
+  -u localhost:8001 -i gRPC \
+  --concurrency-range 1:16 \
+  --shape input_ids:128 \
+  --shape attention_mask:128 \
+  --percentile 99
+
+# Query Prometheus metrics
+curl -s http://localhost:8002/metrics | grep nv_inference_
+```

package/skills/vault-secrets-management/SKILL.md

@@ -0,0 +1,129 @@
+---
+name: vault-secrets-management
+description: >-
+  Architects and automates HashiCorp Vault secrets management, AppRole machine authentication, dynamic ephemeral database credentials, and PKI mTLS certificate rotation.
+---
+
+# HashiCorp Vault Secrets Management & Ephemeral Credentials
+
+This skill guides the design, automation, and operational patterns for HashiCorp Vault enterprise secrets orchestration, dynamic credential generation, and PKI certificate authority workflows.
+
+---
+
+## ⚡ Secret Engine Capabilities Matrix
+
+| Secret Engine | Purpose | Lifecycle Behavior |
+| :--- | :--- | :--- |
+| **`kv-v2`** | Static credentials & API keys | Versioned key-value store with soft delete and rollback. |
+| **`database`** | Ephemeral DB access (Postgres, MySQL) | Generates short-lived user credentials and revokes upon lease expiry. |
+| **`pki`** | Internal mTLS & TLS certificates | Acts as CA/sub-CA; dynamically issues certificates in milliseconds. |
+| **`transit`** | Cryptography as a service | Encrypts/decrypts data without exposing raw encryption keys. |
+
+---
+
+## 🔐 AppRole Machine Authentication Workflow
+
+Applications authenticate using decoupled `role_id` and short-lived `secret_id`:
+
+```bash
+# 1. Enable AppRole auth method
+vault auth enable approle
+
+# 2. Configure service role with strict CIDR and token policies
+vault write auth/approle/role/api-service \
+    secret_id_ttl=60m \
+    token_ttl=30m \
+    token_max_ttl=4h \
+    secret_id_num_uses=10 \
+    token_policies="api-service-policy" \
+    bind_secret_id=true
+
+# 3. Retrieve Role ID (stored in deployment manifest)
+vault read auth/approle/role/api-service/role-id
+
+# 4. Generate Secret ID (delivered securely via CI/CD or orchestrator)
+vault write -f auth/approle/role/api-service/secret-id
+```
+
+Node.js / Python authentication client:
+
+```typescript
+import axios from 'axios';
+
+export async function loginWithAppRole(vaultAddr: string, roleId: string, secretId: string) {
+  const response = await axios.post(`${vaultAddr}/v1/auth/approle/login`, {
+    role_id: roleId,
+    secret_id: secretId,
+  });
+  
+  const clientToken = response.data.auth.client_token;
+  const leaseDuration = response.data.auth.lease_duration;
+  return { clientToken, leaseDuration };
+}
+```
+
+---
+
+## ⏳ Dynamic Ephemeral Database Credentials
+
+Configure Vault to create temporary, unique PostgreSQL roles for each application instance:
+
+```bash
+# 1. Mount database engine
+vault secrets enable database
+
+# 2. Configure connection to PostgreSQL
+vault write database/config/production-postgres \
+    plugin_name=postgresql-database-plugin \
+    allowed_roles="readwrite-service" \
+    connection_url="postgresql://{{username}}:{{password}}@postgres:5432/production?sslmode=verify-full" \
+    username="vaultadmin" \
+    password="supersecretadminpassword"
+
+# 3. Define role template with automated role creation SQL
+vault write database/roles/readwrite-service \
+    db_name=production-postgres \
+    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
+        GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
+    default_ttl="1h" \
+    max_ttl="24h"
+```
+
+Application requests credentials on demand:
+
+```bash
+vault read database/creds/readwrite-service
+# Returns: username: v-approle-readwrite-abc123, password: xyz..., lease_id: database/creds/readwrite-service/xyz...
+```
+
+---
+
+## 📜 PKI Dynamic mTLS Certificate Issuance
+
+Automate TLS certificate issuance without manual CSR handling:
+
+```bash
+# Mount PKI engine and configure Root/Intermediate CA
+vault secrets enable pki
+vault secrets tune -max-lease-ttl=87600h pki
+
+# Configure role for cluster services
+vault write pki/roles/internal-mesh \
+    allowed_domains="internal.cluster.local" \
+    allow_subdomains=true \
+    max_ttl="72h"
+
+# Generate certificate on demand
+vault write pki/issue/internal-mesh \
+    common_name="billing-service.internal.cluster.local" \
+    ttl="24h"
+```
+
+---
+
+## 📋 Architectural Rules & Best Practices
+
+1. **Never Hardcode Secrets**: Eliminate long-lived static DB passwords; adopt dynamic ephemeral database roles with short TTLs (< 2 hours).
+2. **Strict Secret ID Binding**: Bind AppRole `secret_id` to expected subnet CIDRs (`secret_id_bound_cidrs`) to stop credential theft across VPCs.
+3. **Lease Renewal & Heartbeats**: Background workers must periodically renew active leases (`vault write sys/leases/renew lease_id=...`) before expiry.
+4. **Audit Logging**: Enable Vault audit devices (`vault audit enable file file_path=/var/log/vault/audit.log`) with hashed payload sanitization.

package/templates/full-power/mcp_config.json

@@ -53,6 +53,17 @@
         "SLACK_BOT_TOKEN": "${SLACK_BOT_TOKEN}",
         "SLACK_TEAM_ID": "${SLACK_TEAM_ID}"
       }
+    },
+    "puppeteer": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-puppeteer"]
+    },
+    "brave-search": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-brave-search"],
+      "env": {
+        "BRAVE_API_KEY": "${BRAVE_API_KEY}"
+      }
     }
   }
 }

package/tests/cli.test.js

@@ -90,9 +90,9 @@ it('should benchmark ecosystem components and output valid JSON with --json', ()
   const res = runCli('benchmark --json');
   assert.strictEqual(res.status, 0);
   const data = JSON.parse(res.stdout);
-  assert.strictEqual(data.totalComponents, 70);
-  assert.strictEqual(data.progressiveSkillsCount, 52);
-  assert.strictEqual(data.scopedAgentsCount, 11);
+  assert.strictEqual(data.totalComponents, 80);
+  assert.strictEqual(data.progressiveSkillsCount, 60);
+  assert.strictEqual(data.scopedAgentsCount, 13);
   assert.strictEqual(data.lifecycleHooksCount, 7);
   assert(data.totalRunbookTokens > 15000, 'Expected >15,000 runbook tokens');
   assert(data.estimatedTokensSavedPerTurn > 8000, 'Expected significant token savings');
@@ -316,7 +316,7 @@ try {
     const dryRes = runCli(`bundle --output "${bundleTarget}" --dry-run`);
     assert.strictEqual(dryRes.status, 0);
     assert.match(dryRes.stdout, /DRY RUN MODE ACTIVATED/);
-    assert.match(dryRes.stdout, /Skills to bundle: 52/);
+    assert.match(dryRes.stdout, /Skills to bundle: 60/);
     assert.strictEqual(fs.existsSync(bundleTarget), false, 'Dry run should not create destination directory');
 
     // JSON Dry-run mode
@@ -324,7 +324,7 @@ try {
     assert.strictEqual(jsonRes.status, 0);
     const dryData = JSON.parse(jsonRes.stdout);
     assert.strictEqual(dryData.dryRun, true);
-    assert.strictEqual(dryData.manifest.components.totalCount, 70);
+    assert.strictEqual(dryData.manifest.components.totalCount, 80);
 
     // Live mode
     const liveRes = runCli(`bundle --output "${bundleTarget}"`);
@@ -332,8 +332,49 @@ try {
     assert.match(liveRes.stdout, /Offline Distribution Bundle Created/);
     assert.strictEqual(fs.existsSync(path.join(bundleTarget, 'bundle-manifest.json')), true);
     assert.strictEqual(fs.existsSync(path.join(bundleTarget, 'offline-install.sh')), true);
-    assert.strictEqual(fs.existsSync(path.join(bundleTarget, 'skills', 'vllm-inference')), true);
-    assert.strictEqual(fs.existsSync(path.join(bundleTarget, 'agents', 'incident-responder.md')), true);
+    assert.strictEqual(fs.existsSync(path.join(bundleTarget, 'skills', 'milvus-vector-clustering')), true);
+    assert.strictEqual(fs.existsSync(path.join(bundleTarget, 'agents', 'platform-engineer.md')), true);
+  });
+
+  // Scaffold Command
+  it('should scaffold skill, agent, and hook in dry-run and live modes', () => {
+    const scaffoldWorkspace = path.join(tempWorkspace, 'scaffold-ws');
+
+    // Skill Dry-run
+    const drySkill = runCli(`scaffold skill demo-test-skill --workspace "${scaffoldWorkspace}" --dry-run --json`);
+    assert.strictEqual(drySkill.status, 0);
+    const drySkillData = JSON.parse(drySkill.stdout);
+    assert.strictEqual(drySkillData.isDryRun, true);
+    assert.strictEqual(drySkillData.type, 'skill');
+
+    // Live Agent Scaffold
+    const liveAgent = runCli(`scaffold agent demo-qa-agent --workspace "${scaffoldWorkspace}"`);
+    assert.strictEqual(liveAgent.status, 0);
+    assert.match(liveAgent.stdout, /Created subagent profile/);
+    assert.strictEqual(fs.existsSync(path.join(scaffoldWorkspace, 'agents', 'demo-qa-agent.md')), true);
+
+    // Live Hook Scaffold
+    const liveHook = runCli(`scaffold hook demo-safety --workspace "${scaffoldWorkspace}"`);
+    assert.strictEqual(liveHook.status, 0);
+    assert.match(liveHook.stdout, /Created lifecycle hook/);
+    assert.strictEqual(fs.existsSync(path.join(scaffoldWorkspace, 'hooks', 'demo-safety', 'hooks.json')), true);
+    assert.strictEqual(fs.existsSync(path.join(scaffoldWorkspace, 'hooks', 'demo-safety', 'scripts', 'demo-safety-gate.sh')), true);
+  });
+
+  // Sync Command
+  it('should synchronize workspace with sync command in dry-run and live modes', () => {
+    // Dry-run
+    const drySync = runCli(`sync --workspace "${tempWorkspace}" --dry-run`);
+    assert.strictEqual(drySync.status, 0);
+    assert.match(drySync.stdout, /DRY RUN MODE ACTIVATED/);
+    assert.match(drySync.stdout, /Synchronizing Workspace with Catalog/);
+
+    // JSON Dry-run
+    const jsonSync = runCli(`sync --workspace "${tempWorkspace}" --dry-run --json`);
+    assert.strictEqual(jsonSync.status, 0);
+    const syncData = JSON.parse(jsonSync.stdout);
+    assert.strictEqual(syncData.isDryRun, true);
+    assert.strictEqual(syncData.success, true);
   });
 
   // Info for incident-responder and v1.8.0 skills
@@ -359,14 +400,80 @@ try {
     assert.match(resLite.stdout, /LiteLLM/);
   });
 
+  // Info for platform-engineer and v1.9.0 skills
+  it('should display info for platform-engineer subagent and v1.9.0 skills', () => {
+    const resPlat = runCli('info platform-engineer');
+    assert.strictEqual(resPlat.status, 0);
+    assert.match(resPlat.stdout, /Platform Engineer/);
+
+    const resMilvus = runCli('info milvus-vector-clustering');
+    assert.strictEqual(resMilvus.status, 0);
+    assert.match(resMilvus.stdout, /Milvus/);
+
+    const resR2 = runCli('info cloudflare-r2-object-storage');
+    assert.strictEqual(resR2.status, 0);
+    assert.match(resR2.stdout, /Cloudflare R2/);
+
+    const resVault = runCli('info vault-secrets-management');
+    assert.strictEqual(resVault.status, 0);
+    assert.match(resVault.stdout, /Vault/);
+
+    const resRate = runCli('info distributed-rate-limiting');
+    assert.strictEqual(resRate.status, 0);
+    assert.match(resRate.stdout, /Distributed Rate Limiting/);
+  });
+
+  // Info for mlops-engineer and v2.0.0 skills
+  it('should display info for mlops-engineer subagent and v2.0.0 skills', () => {
+    const resMl = runCli('info mlops-engineer');
+    assert.strictEqual(resMl.status, 0);
+    assert.match(resMl.stdout, /MLOps Engineer/);
+
+    const resKeda = runCli('info keda-event-autoscaling');
+    assert.strictEqual(resKeda.status, 0);
+    assert.match(resKeda.stdout, /KEDA/);
+
+    const resChroma = runCli('info chromadb-vector-store');
+    assert.strictEqual(resChroma.status, 0);
+    assert.match(resChroma.stdout, /ChromaDB/);
+
+    const resOpa = runCli('info opa-gatekeeper-policy');
+    assert.strictEqual(resOpa.status, 0);
+    assert.match(resOpa.stdout, /Gatekeeper/);
+
+    const resTriton = runCli('info triton-inference-server');
+    assert.strictEqual(resTriton.status, 0);
+    assert.match(resTriton.stdout, /Triton/);
+  });
+
+  // Graph command verification
+  it('should render interaction graph in terminal, mermaid, and JSON formats', () => {
+    const resTerm = runCli('graph');
+    assert.strictEqual(resTerm.status, 0);
+    assert.match(resTerm.stdout, /Multi-Agent Topology & Dependency Graph/);
+    assert.match(resTerm.stdout, /MLOPS-ENGINEER/);
+
+    const resMermaid = runCli('graph --mermaid');
+    assert.strictEqual(resMermaid.status, 0);
+    assert.match(resMermaid.stdout, /graph TD/);
+    assert.match(resMermaid.stdout, /A_mlops_engineer/);
+
+    const resJson = runCli('graph --json');
+    assert.strictEqual(resJson.status, 0);
+    const data = JSON.parse(resJson.stdout);
+    assert.ok(data.totalNodes > 50, 'Graph should contain > 50 nodes');
+    assert.ok(data.totalEdges > 50, 'Graph should contain > 50 edges');
+    assert.ok(data.nodes.find(n => n.id === 'agent:mlops-engineer'));
+  });
+
   // Benchmark Components Verification
-  it('should report 70 components, 52 skills, and 11 subagents in benchmark --json', () => {
+  it('should report 80 components, 60 skills, and 13 subagents in benchmark --json', () => {
     const res = runCli('benchmark --json');
     assert.strictEqual(res.status, 0);
     const data = JSON.parse(res.stdout);
-    assert.strictEqual(data.totalComponents, 70, 'Total components should be 70');
-    assert.strictEqual(data.progressiveSkillsCount, 52, 'Progressive skills should be 52');
-    assert.strictEqual(data.scopedAgentsCount, 11, 'Scoped agents should be 11');
+    assert.strictEqual(data.totalComponents, 80, 'Total components should be 80');
+    assert.strictEqual(data.progressiveSkillsCount, 60, 'Progressive skills should be 60');
+    assert.strictEqual(data.scopedAgentsCount, 13, 'Scoped agents should be 13');
     assert.strictEqual(data.lifecycleHooksCount, 7, 'Lifecycle hooks should be 7');
   });