everything-gemini 1.9.0 → 2.0.0

package/skills/opa-gatekeeper-policy/SKILL.md

@@ -0,0 +1,200 @@
+---
+name: opa-gatekeeper-policy
+description: Authors and validates Open Policy Agent (OPA) Gatekeeper ConstraintTemplates and Rego admission policies for Kubernetes governance and security compliance.
+---
+
+# OPA Gatekeeper Policy
+
+Defines declarative policy enforcement for Kubernetes clusters using Open Policy Agent (OPA) Gatekeeper ConstraintTemplates, Rego logic, and shift-left CLI testing.
+
+---
+
+## 1. Admission Control Flow
+
+```
+ kubectl apply -f resource.yaml
+            │
+            ▼
+┌────────────────────────┐
+│ Kubernetes API Server  │
+└───────────┬────────────┘
+            │ ValidatingWebhookConfiguration
+            ▼
+┌────────────────────────┐      Matches Rules?
+│   Gatekeeper Pod       │────────────────────────┐
+│  (Admission Webhook)   │                        │
+└───────────┬────────────┘                        ▼
+            │ Rego Evaluation          ┌────────────────────┐
+            ▼                          │ Reject (403)       │
+ ┌──────────────────────┐              │ Error & Remediation│
+ │ Constraint Templates │              └────────────────────┘
+ └──────────┬───────────┘
+            │ Passed
+            ▼
+ ┌──────────────────────┐
+ │ Persist to etcd      │
+ └──────────────────────┘
+```
+
+---
+
+## 2. ConstraintTemplate (Rego Engine)
+
+Defines the reusable policy schema and Rego execution logic:
+
+```yaml
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: k8srequiredlabels
+  annotations:
+    description: "Requires all namespaces and workloads to specify standard governance labels."
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sRequiredLabels
+      validation:
+        openAPIV3Schema:
+          type: object
+          properties:
+            labels:
+              type: array
+              items:
+                type: string
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package k8srequiredlabels
+
+        violation[{"msg": msg, "details": {"missing_labels": missing}}] {
+          provided := {label | input.review.object.metadata.labels[label]}
+          required := {label | label := input.parameters.labels[_]}
+          missing := required - provided
+          count(missing) > 0
+          msg := sprintf("Resource %v '%v' violates policy: missing required labels: %v", [
+            input.review.object.kind,
+            input.review.object.metadata.name,
+            missing
+          ])
+        }
+```
+
+---
+
+## 3. Instantiating the Constraint
+
+Applies the template to specific resource kinds and namespaces:
+
+```yaml
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sRequiredLabels
+metadata:
+  name: require-team-and-cost-center
+spec:
+  enforcementAction: deny # Options: deny, dryrun, warn
+  match:
+    kinds:
+      - apiGroups: ["apps"]
+        kinds: ["Deployment", "StatefulSet"]
+      - apiGroups: [""]
+        kinds: ["Namespace"]
+    excludedNamespaces:
+      - kube-system
+      - gatekeeper-system
+  parameters:
+    labels:
+      - "app.kubernetes.io/managed-by"
+      - "cost-center"
+      - "owner-team"
+```
+
+---
+
+## 4. Container Security Constraint (Disallow Privileged)
+
+Enforces zero-trust rootless containers:
+
+```yaml
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: k8sdisallowprivileged
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sDisallowPrivileged
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package k8sdisallowprivileged
+
+        violation[{"msg": msg}] {
+          c := input_containers[_]
+          c.securityContext.privileged == true
+          msg := sprintf("Privileged container '%v' is prohibited in namespace '%v'.", [
+            c.name,
+            input.review.object.metadata.namespace
+          ])
+        }
+
+        input_containers[c] {
+          c := input.review.object.spec.template.spec.containers[_]
+        }
+        input_containers[c] {
+          c := input.review.object.spec.template.spec.initContainers[_]
+        }
+```
+
+---
+
+## 5. Shift-Left CI Validation with `gator` CLI
+
+Validates Kubernetes manifests against Gatekeeper templates inside CI pipelines before merge:
+
+```bash
+# Test manifests directly without a live Kubernetes cluster
+gator test \
+  --image-template=./templates/ \
+  --constraint=./constraints/ \
+  --manifests=./deploy/production/
+
+# Run unit tests on Rego source files
+gator verify ./policies/...
+```
+
+```yaml
+# Gator test suite definition (suite.yaml)
+kind: Suite
+apiVersion: test.gatekeeper.sh/v1alpha1
+metadata:
+  name: deployment-label-suite
+tests:
+  - name: test-missing-labels-denied
+    template: template.yaml
+    constraint: constraint.yaml
+    cases:
+      - name: deployment-without-cost-center
+        object: bad-deployment.yaml
+        assertions:
+          - violations: yes
+            message: "missing required labels: {\"cost-center\"}"
+      - name: compliant-deployment
+        object: good-deployment.yaml
+        assertions:
+          - violations: no
+```
+
+---
+
+## 6. Audit Cluster Violations
+
+```bash
+# Inspect non-compliant resources identified during continuous background audit
+kubectl get constraints -A
+
+# Detailed violation listing
+kubectl get k8srequiredlabels.constraints.gatekeeper.sh require-team-and-cost-center -o yaml \
+  | yq '.status.violations[] | {resource: .name, kind: .kind, message: .message}'
+```

package/skills/triton-inference-server/SKILL.md

@@ -0,0 +1,221 @@
+---
+name: triton-inference-server
+description: Deploys, configures, and tunes NVIDIA Triton Inference Server for high-throughput, low-latency multi-model serving with dynamic batching and GPU acceleration.
+---
+
+# Triton Inference Server
+
+Provides production architecture and configuration patterns for serving deep learning and LLM models at enterprise scale with NVIDIA Triton Inference Server.
+
+---
+
+## 1. Architecture & Execution Model
+
+```
+ Client Application (gRPC / HTTP KServe v2)
+                  │
+                  ▼
+┌──────────────────────────────────────────────┐
+│       NVIDIA Triton Inference Server         │
+│                                              │
+│  ┌──────────────────┐  ┌──────────────────┐  │
+│  │ Dynamic Batching │  │ Model Concurrency│  │
+│  │ Scheduler        │  │ & GPU Instances  │  │
+│  └─────────┬────────┘  └────────┬─────────┘  │
+│            │                    │            │
+│            ▼                    ▼            │
+│  ┌────────────────────────────────────────┐  │
+│  │  Backend Engines                       │  │
+│  │  - TensorRT-LLM (High-speed generative)│  │
+│  │  - vLLM Engine (PagedAttention serving)│  │
+│  │  - ONNX Runtime (Embedding & classifier│  │
+│  │  - Python Backend (Custom preprocessing│  │
+│  └────────────────────────────────────────┘  │
+└──────────────────────┬───────────────────────┘
+                       │
+                       ▼
+          NVIDIA Tensor Core GPUs (H100/A100/L4)
+```
+
+---
+
+## 2. Model Repository Layout
+
+Triton requires a strict directory layout with versioned subdirectories and `config.pbtxt`:
+
+```text
+model_repository/
+├── embedding_model/
+│   ├── 1/
+│   │   └── model.onnx
+│   └── config.pbtxt
+└── llm_generator/
+    ├── 1/
+    │   └── model.py
+    └── config.pbtxt
+```
+
+---
+
+## 3. High-Throughput `config.pbtxt` Configuration
+
+Configures dynamic batching, GPU instance groups, and TensorRT acceleration:
+
+```protobuf
+name: "embedding_model"
+platform: "onnxruntime_onnx"
+max_batch_size: 128
+
+input [
+  {
+    name: "input_ids"
+    data_type: TYPE_INT64
+    dims: [ -1 ]
+  },
+  {
+    name: "attention_mask"
+    data_type: TYPE_INT64
+    dims: [ -1 ]
+  }
+]
+
+output [
+  {
+    name: "sentence_embedding"
+    data_type: TYPE_FP32
+    dims: [ 768 ]
+  }
+]
+
+# Maximize GPU utilization via dynamic queue batching
+dynamic_batching {
+  max_queue_delay_microseconds: 5000 # 5ms SLA window
+  preferred_batch_size: [ 16, 32, 64, 128 ]
+}
+
+# Run 2 concurrent model instances on GPU 0
+instance_group [
+  {
+    count: 2
+    kind: KIND_GPU
+    gpus: [ 0 ]
+  }
+]
+
+optimization {
+  execution_accelerators {
+    gpu_execution_accelerator : [ {
+      name : "tensorrt"
+      parameters { key: "precision_mode" value: "FP16" }
+      parameters { key: "max_workspace_size_bytes" value: "4294967296" }
+    }]
+  }
+}
+```
+
+---
+
+## 4. High-Performance gRPC Client (Python)
+
+Uses binary gRPC streaming with zero-copy serialization:
+
+```python
+import numpy as np
+import tritonclient.grpc as grpcclient
+from tritonclient.grpc import InferInput, InferRequestedOutput
+
+def query_triton_embeddings(
+    texts_token_ids: np.ndarray,
+    attention_masks: np.ndarray,
+    server_url: str = "localhost:8001"
+) -> np.ndarray:
+    """Queries Triton via low-latency gRPC channel."""
+    with grpcclient.InferenceServerClient(url=server_url) as client:
+        # Check server readiness
+        if not client.is_server_ready():
+            raise RuntimeError("Triton server is not healthy.")
+
+        inputs = [
+            InferInput("input_ids", texts_token_ids.shape, "INT64"),
+            InferInput("attention_mask", attention_masks.shape, "INT64")
+        ]
+        inputs[0].set_data_from_numpy(texts_token_ids)
+        inputs[1].set_data_from_numpy(attention_masks)
+
+        outputs = [InferRequestedOutput("sentence_embedding")]
+
+        response = client.infer(
+            model_name="embedding_model",
+            inputs=inputs,
+            outputs=outputs,
+            timeout=10.0
+        )
+
+        return response.as_numpy("sentence_embedding")
+```
+
+---
+
+## 5. Production Docker & Kubernetes Deployment
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: triton-inference-server
+  namespace: mlops
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: triton
+  template:
+    metadata:
+      labels:
+        app: triton
+    spec:
+      containers:
+        - name: triton
+          image: nvcr.io/nvidia/tritonserver:24.08-py3
+          args: ["tritonserver", "--model-repository=/models", "--strict-model-config=true"]
+          resources:
+            limits:
+              nvidia.com/gpu: 1
+              memory: 16Gi
+              cpu: "8"
+          ports:
+            - containerPort: 8000 # HTTP
+            - containerPort: 8001 # gRPC
+            - containerPort: 8002 # Metrics (Prometheus)
+          livenessProbe:
+            httpGet:
+              path: /v2/health/live
+              port: 8000
+            initialDelaySeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /v2/health/ready
+              port: 8000
+            initialDelaySeconds: 15
+```
+
+---
+
+## 6. Performance Benchmarking & Profiling
+
+```bash
+# Verify health and loaded models via v2 API
+curl -s http://localhost:8000/v2/health/ready
+curl -s http://localhost:8000/v2/models/embedding_model/ready
+
+# Profile throughput and P99 latency with Perf Analyzer
+perf_analyzer -m embedding_model \
+  -u localhost:8001 -i gRPC \
+  --concurrency-range 1:16 \
+  --shape input_ids:128 \
+  --shape attention_mask:128 \
+  --percentile 99
+
+# Query Prometheus metrics
+curl -s http://localhost:8002/metrics | grep nv_inference_
+```

package/templates/full-power/mcp_config.json

@@ -57,6 +57,13 @@
     "puppeteer": {
       "command": "npx",
       "args": ["-y", "@modelcontextprotocol/server-puppeteer"]
+    },
+    "brave-search": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-brave-search"],
+      "env": {
+        "BRAVE_API_KEY": "${BRAVE_API_KEY}"
+      }
     }
   }
 }

package/tests/cli.test.js

@@ -90,9 +90,9 @@ it('should benchmark ecosystem components and output valid JSON with --json', ()
   const res = runCli('benchmark --json');
   assert.strictEqual(res.status, 0);
   const data = JSON.parse(res.stdout);
-  assert.strictEqual(data.totalComponents, 75);
-  assert.strictEqual(data.progressiveSkillsCount, 56);
-  assert.strictEqual(data.scopedAgentsCount, 12);
+  assert.strictEqual(data.totalComponents, 80);
+  assert.strictEqual(data.progressiveSkillsCount, 60);
+  assert.strictEqual(data.scopedAgentsCount, 13);
   assert.strictEqual(data.lifecycleHooksCount, 7);
   assert(data.totalRunbookTokens > 15000, 'Expected >15,000 runbook tokens');
   assert(data.estimatedTokensSavedPerTurn > 8000, 'Expected significant token savings');
@@ -316,7 +316,7 @@ try {
     const dryRes = runCli(`bundle --output "${bundleTarget}" --dry-run`);
     assert.strictEqual(dryRes.status, 0);
     assert.match(dryRes.stdout, /DRY RUN MODE ACTIVATED/);
-    assert.match(dryRes.stdout, /Skills to bundle: 56/);
+    assert.match(dryRes.stdout, /Skills to bundle: 60/);
     assert.strictEqual(fs.existsSync(bundleTarget), false, 'Dry run should not create destination directory');
 
     // JSON Dry-run mode
@@ -324,7 +324,7 @@ try {
     assert.strictEqual(jsonRes.status, 0);
     const dryData = JSON.parse(jsonRes.stdout);
     assert.strictEqual(dryData.dryRun, true);
-    assert.strictEqual(dryData.manifest.components.totalCount, 75);
+    assert.strictEqual(dryData.manifest.components.totalCount, 80);
 
     // Live mode
     const liveRes = runCli(`bundle --output "${bundleTarget}"`);
@@ -423,14 +423,57 @@ try {
     assert.match(resRate.stdout, /Distributed Rate Limiting/);
   });
 
+  // Info for mlops-engineer and v2.0.0 skills
+  it('should display info for mlops-engineer subagent and v2.0.0 skills', () => {
+    const resMl = runCli('info mlops-engineer');
+    assert.strictEqual(resMl.status, 0);
+    assert.match(resMl.stdout, /MLOps Engineer/);
+
+    const resKeda = runCli('info keda-event-autoscaling');
+    assert.strictEqual(resKeda.status, 0);
+    assert.match(resKeda.stdout, /KEDA/);
+
+    const resChroma = runCli('info chromadb-vector-store');
+    assert.strictEqual(resChroma.status, 0);
+    assert.match(resChroma.stdout, /ChromaDB/);
+
+    const resOpa = runCli('info opa-gatekeeper-policy');
+    assert.strictEqual(resOpa.status, 0);
+    assert.match(resOpa.stdout, /Gatekeeper/);
+
+    const resTriton = runCli('info triton-inference-server');
+    assert.strictEqual(resTriton.status, 0);
+    assert.match(resTriton.stdout, /Triton/);
+  });
+
+  // Graph command verification
+  it('should render interaction graph in terminal, mermaid, and JSON formats', () => {
+    const resTerm = runCli('graph');
+    assert.strictEqual(resTerm.status, 0);
+    assert.match(resTerm.stdout, /Multi-Agent Topology & Dependency Graph/);
+    assert.match(resTerm.stdout, /MLOPS-ENGINEER/);
+
+    const resMermaid = runCli('graph --mermaid');
+    assert.strictEqual(resMermaid.status, 0);
+    assert.match(resMermaid.stdout, /graph TD/);
+    assert.match(resMermaid.stdout, /A_mlops_engineer/);
+
+    const resJson = runCli('graph --json');
+    assert.strictEqual(resJson.status, 0);
+    const data = JSON.parse(resJson.stdout);
+    assert.ok(data.totalNodes > 50, 'Graph should contain > 50 nodes');
+    assert.ok(data.totalEdges > 50, 'Graph should contain > 50 edges');
+    assert.ok(data.nodes.find(n => n.id === 'agent:mlops-engineer'));
+  });
+
   // Benchmark Components Verification
-  it('should report 75 components, 56 skills, and 12 subagents in benchmark --json', () => {
+  it('should report 80 components, 60 skills, and 13 subagents in benchmark --json', () => {
     const res = runCli('benchmark --json');
     assert.strictEqual(res.status, 0);
     const data = JSON.parse(res.stdout);
-    assert.strictEqual(data.totalComponents, 75, 'Total components should be 75');
-    assert.strictEqual(data.progressiveSkillsCount, 56, 'Progressive skills should be 56');
-    assert.strictEqual(data.scopedAgentsCount, 12, 'Scoped agents should be 12');
+    assert.strictEqual(data.totalComponents, 80, 'Total components should be 80');
+    assert.strictEqual(data.progressiveSkillsCount, 60, 'Progressive skills should be 60');
+    assert.strictEqual(data.scopedAgentsCount, 13, 'Scoped agents should be 13');
     assert.strictEqual(data.lifecycleHooksCount, 7, 'Lifecycle hooks should be 7');
   });