jumpstart-mode 1.1.13 → 1.1.14

package/.jumpstart/skills/integration-surface-mapper/evals/evals.json

@@ -0,0 +1,30 @@
+{
+  "skill_name": "integration-surface-mapper",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "We are scoping an AI agent that drafts customer responses for a B2B SaaS support team. It needs to read Zendesk tickets, look up account context in Salesforce, fetch product status from an internal Postgres DB, and post a draft back to Zendesk. The customer uses Entra ID. We have not actually tested any of these APIs yet. Map the integration surface and rank risk.",
+      "expected_output": "An integration surface map with per-system pattern, auth model, rate limits, risk register, and explicit validation steps before SOW freeze.",
+      "files": [],
+      "assertions": [
+        {"text": "Each system (Zendesk, Salesforce, Postgres) has an integration pattern and auth model called out"},
+        {"text": "Untested integrations are explicitly labeled Assumed, not Confirmed"},
+        {"text": "Auth model differentiates user identity from agent / workload identity"},
+        {"text": "Output includes a Mermaid integration flow diagram"},
+        {"text": "Output includes a risk-ranked dependency register"},
+        {"text": "Output includes concrete validation steps (test calls, sandbox access) before SOW freeze"}
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "The client wants the agent to also write to their billing system (NetSuite) but the platform team says NetSuite has tight rate limits and limited write APIs. How do you reflect that in the integration surface, and what do you recommend?",
+      "expected_output": "Treats NetSuite write as high integration risk; recommends pattern alternatives (queue + retry, async event, batch) and explicit throughput / failure-path design; flags rate limit and quota as scope risks.",
+      "files": [],
+      "assertions": [
+        {"text": "Rate limit is treated as a first-class risk, not a footnote"},
+        {"text": "At least one alternative pattern is proposed for the NetSuite write path"},
+        {"text": "Output names the auth path with concrete identity and scope"}
+      ]
+    }
+  ]
+}

package/.jumpstart/skills/integration-surface-mapper/references/integration-pattern-catalog.md

@@ -0,0 +1,74 @@
+# Integration Pattern Catalog
+
+Use this catalog to pick the right integration pattern for each step that touches a system. Default to the lightest pattern that meets the step's needs.
+
+## Patterns
+
+### 1. Synchronous REST / GraphQL API
+- Best for: low-latency reads and writes the agent or workflow needs in-line.
+- Watch: rate limits, p99 latency, idempotency on writes, error semantics.
+- Auth: OAuth client credentials or on-behalf-of for user-scoped data.
+
+### 2. Asynchronous event / webhook
+- Best for: reacting to system changes (case created, ticket updated, doc uploaded).
+- Watch: delivery guarantees, replay, ordering, signature verification.
+- Auth: signed webhooks, mutual TLS, or HMAC.
+
+### 3. Message queue / event bus (Service Bus, Kafka, EventGrid, SQS)
+- Best for: decoupled fan-out, retry, ordering, peak smoothing.
+- Watch: poison-message handling, DLQ, schema evolution.
+
+### 4. Scheduled batch / ETL
+- Best for: large reads from analytics or warehouse stores; non-real-time recall.
+- Watch: freshness vs. use case tolerance, cost, lineage.
+
+### 5. File drop / SFTP / blob ingest
+- Best for: legacy or third-party integrations with no API.
+- Watch: schema drift, encoding, PII in filenames, retention.
+
+### 6. Database direct / change data capture
+- Best for: high-volume read of structured data with stable schema.
+- Watch: coupling to internal schema; treat as anti-pattern unless owner agrees.
+
+### 7. RPA / UI automation
+- Best for: legacy systems with no API and no foreseeable one.
+- Watch: brittleness, credential handling, audit, scaling.
+
+### 8. MCP / tool-call wrapper
+- Best for: exposing system capability to an agent with typed inputs / outputs.
+- Watch: tool surface design, idempotency, side effects, permissioning.
+
+### 9. SaaS connector platform (Power Platform, Logic Apps, Workato, MuleSoft)
+- Best for: rapid integration via pre-built connectors during Jump Start.
+- Watch: licensing, run-time costs, ownership at handoff to Pod.
+
+## Auth pattern picks
+
+| Need | Pattern |
+|---|---|
+| Agent acts as itself, reads non-user data | Workload identity / client credentials |
+| Agent acts on behalf of a user | OAuth on-behalf-of with scoped consent |
+| Step requires ambient SSO (Entra) | Entra workload identity federation |
+| Legacy system, no modern auth | Service account with vaulted secret + audit |
+| Third-party SaaS API | API key with rotation, scoped to integration |
+
+## Risk scoring per integration
+
+Score each integration on six axes (1 poor, 5 strong):
+
+1. Maturity — does the API exist, is it documented, has anyone called it.
+2. Throughput vs. need — rate limit and latency vs. the workflow's demand.
+3. Auth fit — does the auth model match the agent's identity needs.
+4. Ownership clarity — is there a named owner who answers tickets.
+5. Contractual fit — does the contract permit this use, including AI use.
+6. Blast radius — what breaks if it fails or returns wrong data.
+
+A 5/5 on five axes with a 1 on blast radius is still a top risk.
+
+## Common failure modes
+
+- Assuming a published API exists without testing it.
+- Confusing "user has access" with "the agent's identity has access."
+- Designing for happy path; ignoring rate-limit, retry, and partial-failure paths.
+- Pulling sensitive fields the use case does not need.
+- Hidden RPA dependencies that nobody owns post-handoff.

package/.jumpstart/skills/integration-surface-mapper/templates/integration-surface-template.md

@@ -0,0 +1,66 @@
+# Integration Surface Map: <Use Case>
+
+**Owner:** <name>
+**Date:** <YYYY-MM-DD>
+**Confidence legend:** Confirmed / Assumed / Unknown
+
+## Executive summary
+
+- Use case: <one sentence>
+- Number of systems touched: <N>
+- Top three integration risks: <list>
+- Validation actions before SOW / PRD freeze: <list>
+
+## Workflow → system → action mapping
+
+| Step | Action by agent / workflow | System | R/W/Event/Tool | Confidence |
+|---|---|---|---|---|
+| | | | | |
+
+## System and integration inventory
+
+| System | Owner | Integration pattern | API / endpoint | Auth model | Identity scope | Rate limit | Latency target | Throughput need | Contractual fit | Confidence |
+|---|---|---|---|---|---|---|---|---|---|---|
+| | | sync / event / batch / file / DB / RPA / MCP / connector | | | | | | | | |
+
+## Auth and identity model
+
+- User identity: <IdP, SSO, MFA>
+- Agent identity: <workload identity, federation, service account, vaulted secret>
+- Per-system scope: <table of scopes / claims required>
+- Consent flow: <on-behalf-of, admin consent, user consent>
+- Rotation: <how secrets rotate, by whom, how often>
+
+## Rate limit, quota, throughput
+
+| System | Documented limit | Expected peak from this use case | Headroom | Mitigation if breached |
+|---|---|---|---|---|
+| | | | | |
+
+## Integration flow diagram
+
+```mermaid
+flowchart LR
+    User --> Agent
+    Agent -->|read| SystemA[(System A)]
+    Agent -->|tool call| SystemB[(System B)]
+    SystemB -->|webhook| Bus[(Event bus)]
+    Bus --> Agent
+```
+
+## Risk-ranked dependency register
+
+| # | System / integration | Risk | Severity | Likelihood | Owner | Mitigation | Validation step |
+|---|---|---|---|---|---|---|---|
+| 1 | | | H/M/L | H/M/L | | | |
+
+## Validation actions before SOW / PRD freeze
+
+- Test calls: <which APIs in which environment>
+- Sandbox access: <what to request, from whom>
+- IT / security tickets: <list>
+- Contract checks: <which DPAs / SaaS T&Cs cover this use>
+
+## Open questions
+
+- <question> — <owner> — <by date>

package/.jumpstart/skills/istio-traffic-management/SKILL.md

@@ -0,0 +1,327 @@
+---
+name: istio-traffic-management
+description: Configure Istio traffic management including routing, load balancing, circuit breakers, and canary deployments. Use when implementing service mesh traffic policies, progressive delivery, or resilience patterns.
+---
+
+# Istio Traffic Management
+
+Comprehensive guide to Istio traffic management for production service mesh deployments.
+
+## When to Use This Skill
+
+- Configuring service-to-service routing
+- Implementing canary or blue-green deployments
+- Setting up circuit breakers and retries
+- Load balancing configuration
+- Traffic mirroring for testing
+- Fault injection for chaos engineering
+
+## Core Concepts
+
+### 1. Traffic Management Resources
+
+| Resource            | Purpose                       | Scope         |
+| ------------------- | ----------------------------- | ------------- |
+| **VirtualService**  | Route traffic to destinations | Host-based    |
+| **DestinationRule** | Define policies after routing | Service-based |
+| **Gateway**         | Configure ingress/egress      | Cluster edge  |
+| **ServiceEntry**    | Add external services         | Mesh-wide     |
+
+### 2. Traffic Flow
+
+```
+Client → Gateway → VirtualService → DestinationRule → Service
+                   (routing)        (policies)        (pods)
+```
+
+## Templates
+
+### Template 1: Basic Routing
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: reviews-route
+  namespace: bookinfo
+spec:
+  hosts:
+    - reviews
+  http:
+    - match:
+        - headers:
+            end-user:
+              exact: jason
+      route:
+        - destination:
+            host: reviews
+            subset: v2
+    - route:
+        - destination:
+            host: reviews
+            subset: v1
+---
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: reviews-destination
+  namespace: bookinfo
+spec:
+  host: reviews
+  subsets:
+    - name: v1
+      labels:
+        version: v1
+    - name: v2
+      labels:
+        version: v2
+    - name: v3
+      labels:
+        version: v3
+```
+
+### Template 2: Canary Deployment
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: my-service-canary
+spec:
+  hosts:
+    - my-service
+  http:
+    - route:
+        - destination:
+            host: my-service
+            subset: stable
+          weight: 90
+        - destination:
+            host: my-service
+            subset: canary
+          weight: 10
+---
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: my-service-dr
+spec:
+  host: my-service
+  trafficPolicy:
+    connectionPool:
+      tcp:
+        maxConnections: 100
+      http:
+        h2UpgradePolicy: UPGRADE
+        http1MaxPendingRequests: 100
+        http2MaxRequests: 1000
+  subsets:
+    - name: stable
+      labels:
+        version: stable
+    - name: canary
+      labels:
+        version: canary
+```
+
+### Template 3: Circuit Breaker
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: circuit-breaker
+spec:
+  host: my-service
+  trafficPolicy:
+    connectionPool:
+      tcp:
+        maxConnections: 100
+      http:
+        http1MaxPendingRequests: 100
+        http2MaxRequests: 1000
+        maxRequestsPerConnection: 10
+        maxRetries: 3
+    outlierDetection:
+      consecutive5xxErrors: 5
+      interval: 30s
+      baseEjectionTime: 30s
+      maxEjectionPercent: 50
+      minHealthPercent: 30
+```
+
+### Template 4: Retry and Timeout
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: ratings-retry
+spec:
+  hosts:
+    - ratings
+  http:
+    - route:
+        - destination:
+            host: ratings
+      timeout: 10s
+      retries:
+        attempts: 3
+        perTryTimeout: 3s
+        retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-4xx,503
+        retryRemoteLocalities: true
+```
+
+### Template 5: Traffic Mirroring
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: mirror-traffic
+spec:
+  hosts:
+    - my-service
+  http:
+    - route:
+        - destination:
+            host: my-service
+            subset: v1
+      mirror:
+        host: my-service
+        subset: v2
+      mirrorPercentage:
+        value: 100.0
+```
+
+### Template 6: Fault Injection
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: fault-injection
+spec:
+  hosts:
+    - ratings
+  http:
+    - fault:
+        delay:
+          percentage:
+            value: 10
+          fixedDelay: 5s
+        abort:
+          percentage:
+            value: 5
+          httpStatus: 503
+      route:
+        - destination:
+            host: ratings
+```
+
+### Template 7: Ingress Gateway
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: Gateway
+metadata:
+  name: my-gateway
+spec:
+  selector:
+    istio: ingressgateway
+  servers:
+    - port:
+        number: 443
+        name: https
+        protocol: HTTPS
+      tls:
+        mode: SIMPLE
+        credentialName: my-tls-secret
+      hosts:
+        - "*.example.com"
+---
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: my-vs
+spec:
+  hosts:
+    - "api.example.com"
+  gateways:
+    - my-gateway
+  http:
+    - match:
+        - uri:
+            prefix: /api/v1
+      route:
+        - destination:
+            host: api-service
+            port:
+              number: 8080
+```
+
+## Load Balancing Strategies
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: load-balancing
+spec:
+  host: my-service
+  trafficPolicy:
+    loadBalancer:
+      simple: ROUND_ROBIN # or LEAST_CONN, RANDOM, PASSTHROUGH
+---
+# Consistent hashing for sticky sessions
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: sticky-sessions
+spec:
+  host: my-service
+  trafficPolicy:
+    loadBalancer:
+      consistentHash:
+        httpHeaderName: x-user-id
+        # or: httpCookie, useSourceIp, httpQueryParameterName
+```
+
+## Best Practices
+
+### Do's
+
+- **Start simple** - Add complexity incrementally
+- **Use subsets** - Version your services clearly
+- **Set timeouts** - Always configure reasonable timeouts
+- **Enable retries** - But with backoff and limits
+- **Monitor** - Use Kiali and Jaeger for visibility
+
+### Don'ts
+
+- **Don't over-retry** - Can cause cascading failures
+- **Don't ignore outlier detection** - Enable circuit breakers
+- **Don't mirror to production** - Mirror to test environments
+- **Don't skip canary** - Test with small traffic percentage first
+
+## Debugging Commands
+
+```bash
+# Check VirtualService configuration
+istioctl analyze
+
+# View effective routes
+istioctl proxy-config routes deploy/my-app -o json
+
+# Check endpoint discovery
+istioctl proxy-config endpoints deploy/my-app
+
+# Debug traffic
+istioctl proxy-config log deploy/my-app --level debug
+```
+
+## Resources
+
+- [Istio Traffic Management](https://istio.io/latest/docs/concepts/traffic-management/)
+- [Virtual Service Reference](https://istio.io/latest/docs/reference/config/networking/virtual-service/)
+- [Destination Rule Reference](https://istio.io/latest/docs/reference/config/networking/destination-rule/)

package/.jumpstart/skills/jira-delivery-builder/README.md

@@ -0,0 +1,28 @@
+# Jira Delivery Builder
+
+This skill turns unstructured delivery input into structured, traceable Jira work for AI Innovation Pod and JumpStart engagements.
+
+## What it includes
+
+- A production-ready `SKILL.md` with workflow and quality gates
+- References for issue typing, decomposition, AI acceptance criteria, dependency mapping, DoR/DoD, CSV, JQL, and reporting
+- Reusable ticket and report templates
+- Python scripts for backlog conversion, validation, split recommendations, dependency register generation, and JQL filter generation
+- Eval cases to verify quality and consistency
+
+## Typical inputs
+
+- Discovery notes and workshop outputs
+- PRDs, BRDs, SOW sections, MVP scopes
+- Architecture notes and technical decisions
+- Meeting transcripts
+- Existing backlog drafts
+
+## Typical outputs
+
+- Epic, story, task, spike, bug, and subtask drafts
+- Acceptance criteria and definition of done language
+- Dependency register
+- Source traceability map
+- Jira CSV import files
+- Sprint readiness and quality reports