ma-agents 3.4.7 → 3.4.9

package/.opencode/skills/cyber-vault-secrets/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: cyber-vault-secrets
+description: Manage secrets, policies, and authentication in HashiCorp Vault
+type: skill
+triggers:
+  - "vault secrets"
+  - "manage vault"
+---
+
+# workflow-vault-secrets.md
+# HashiCorp Vault Secret Management Workflow
+
+This workflow guides the agent through managing secrets, policies, and authentication in HashiCorp Vault.
+
+## Instructions
+1.  **Check Connection**: Verify `vault status` and authentication.
+2.  **Secret Creation/Update**:
+    - `vault kv put secret/{path} {key}={value}`
+    - Ensure secrets are never logged or echoed in plain text.
+3.  **Policy Management**:
+    - Define HCL policies for restricted access.
+    - `vault policy write {name} {policy_file}`
+4.  **Integration**:
+    - Manage Kubernetes auth method: `vault auth enable kubernetes`
+    - Setup Vault Agent injector configurations.
+5.  **Audit**:
+    - Check for expired tokens or orphaned secrets.
+    - Review access logs if available.

package/.opencode/skills/cyber-vault-secrets/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: cyber-vault-secrets
+module: ma-skills

package/.opencode/skills/cyber-verify-docker-users/SKILL.md

@@ -0,0 +1,23 @@
+---
+name: cyber-verify-docker-users
+description: Audit Docker images for proper user management and least privilege
+type: skill
+triggers:
+  - "verify docker users"
+  - "docker user audit"
+---
+
+# verify-docker-users.md
+# Docker User & Hardening Verification Workflow
+
+This workflow guides the Cyber agent through auditing Docker images for proper user management and least privilege.
+
+## Instructions
+1.  **Inspect Metadata**:
+    - Use the `docker-hardening-verification` skill.
+    - Run: `bash skills/docker-hardening-verification/scripts/verify-hardening.sh {image_name}`.
+2.  **Audit Result Analysis**:
+    - **UID Check**: Confirm the defined user is non-zero.
+    - **Permissive Files**: Scan for world-writable files in common paths (/tmp, /etc, /var).
+3.  **Governance Check**: Ensure the image follows OpenShift/hardened cluster requirements (no root, arbitrary UID support).
+4.  **Reporting**: provide a high-level summary of hardening quality and mandatory fixes.

package/.opencode/skills/cyber-verify-docker-users/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: cyber-verify-docker-users
+module: ma-skills

package/.opencode/skills/cyber-verify-image-signature/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: cyber-verify-image-signature
+description: Verify Docker image signatures for supply chain security
+type: skill
+triggers:
+  - "verify image signature"
+  - "check image signature"
+---
+
+# verify-image-signature.md
+# Docker Image Signature Verification Workflow
+
+This workflow guides the Cyber agent through verifying that a Docker image has been properly signed.
+
+## Instructions
+1.  **Identify Image**: Get the image name and digest.
+2.  **Locate Public Key**: Obtain the public key or certificate used for signing.
+3.  **Execute Verification**:
+    - Use `cosign verify --key {public_key} {image_digest}`.
+    - Check the output for valid signatures.
+4.  **Policy Compliance**: Verify if the signing entity (certificate CN) matches the expected trusted authorities.
+5.  **Report**: Alert the user if the image is unsigned or the signature is invalid.

package/.opencode/skills/cyber-verify-image-signature/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: cyber-verify-image-signature
+module: ma-skills

package/.opencode/skills/cyber-vulnerability-scan/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: cyber-vulnerability-scan
+description: Orchestrate comprehensive vulnerability scanning across tech stacks
+type: skill
+triggers:
+  - "vulnerability scan"
+  - "run vulnerability scan"
+---
+
+# workflow-vulnerability-scan.md
+# ma-agents Vulnerability Scan Orchestration
+
+Orchestrates multiple security-focused skills from the `ma-agents` package to provide a comprehensive security scan.
+
+## Instructions
+1.  **Select Scanners**: Based on project tech stack, trigger:
+    - **JS/TS**: `js-ts-security-skill`
+    - **Python**: `python-security-skill`
+    - **Docker**: `verify-hardened-docker-skill`
+2.  **Run Tools**:
+    - Execute `npm audit` or `yarn audit`.
+    - Run `pip-audit` for Python environments.
+    - Run `trivy image {image}` for containers.
+3.  **Aggregate Results**: Collect all findings into a unified report.
+4.  **Prioritization**: Rank vulnerabilities by CVSS score and exploitability.
+5.  **Remediation**:
+    - Propose version upgrades.
+    - Propose configuration hardening steps.

package/.opencode/skills/cyber-vulnerability-scan/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: cyber-vulnerability-scan
+module: ma-skills

package/.opencode/skills/devops-configure-infrastructure/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: devops-configure-infrastructure
+description: Define and configure core infrastructure components in Kubernetes
+type: skill
+triggers:
+  - "configure infrastructure"
+  - "infrastructure configuration"
+---
+
+# workflow-configure-infrastructure.md
+# Infrastructure Configuration Workflow
+
+This workflow focuses on defining and configuring core infrastructure components in a Kubernetes environment.
+
+## Instructions
+1.  **Storage Definition**:
+    - Define `PersistentVolume` (PV) with appropriate access modes and storage classes.
+    - Define `PersistentVolumeClaim` (PVC) for application workloads.
+2.  **Networking**:
+    - Configure `Service` type `LoadBalancer` or `Ingress` controllers.
+    - Define `NetworkPolicies` for secure communication.
+3.  **Disconnected Environments**:
+    - Provide templates for local storage provisioners (e.g., hostPath, Local Persistent Volumes).
+    - Configure static IP assignments for on-prem load balancers.
+4.  **Validation**:
+    - Verify binding status: `kubectl get pv,pvc`
+    - Verify endpoint availability: `kubectl get endpoints`

package/.opencode/skills/devops-configure-infrastructure/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: devops-configure-infrastructure
+module: ma-skills

package/.opencode/skills/devops-disconnected-deployment/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: devops-disconnected-deployment
+description: Deploy applications in air-gapped or restricted on-prem environments
+type: skill
+triggers:
+  - "disconnected deployment"
+  - "air-gapped deployment"
+---
+
+# workflow-disconnected-deployment.md
+# Disconnected Environment Deployment Workflow
+
+Strategies and actions for deploying applications in air-gapped or restricted on-prem environments.
+
+## Instructions
+1.  **Dependency Gathering**:
+    - Identify all required container images.
+    - Export images: `docker save {image_list} | gzip > images.tar.gz`
+    - Package Helm charts: `helm package {chart_path}`
+2.  **Target Readiness**:
+    - Verify local registry availability.
+    - Import images: `docker load < images.tar.gz`
+3.  **Deployment**:
+    - Use `--set image.repository={local_registry}/{repo}` for Helm.
+    - Verify offline connectivity between components.
+4.  **Troubleshooting**:
+    - Check for 'ImagePullBackOff' due to incorrect registry paths.

package/.opencode/skills/devops-disconnected-deployment/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: devops-disconnected-deployment
+module: ma-skills

package/.opencode/skills/devops-docker-compose-setup/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: devops-docker-compose-setup
+description: Multi-container orchestration using Docker Compose for development and on-prem
+type: skill
+triggers:
+  - "docker compose setup"
+  - "docker compose"
+---
+
+# workflow-docker-compose-setup.md
+# Docker Compose Management Workflow
+
+This workflow handles multi-container orchestration using Docker Compose, optimized for development and on-prem deployments.
+
+## Instructions
+1.  **Define Services**: Map application components to Docker services.
+2.  **Environment Sync**: Setup `.env` file management for different environments (on-prem, dev).
+3.  **Disconnected Operations**:
+    - Build images with `--pull=false` if registry is unavailable.
+    - Use local image tags.
+4.  **Orchestration**:
+    - Setup dependencies with `depends_on` and health checks.
+    - Configure volumes for persistence.
+5.  **Execution**:
+    - `docker-compose up -d`
+    - `docker-compose ps`

package/.opencode/skills/devops-docker-compose-setup/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: devops-docker-compose-setup
+module: ma-skills

package/.opencode/skills/devops-manage-helm/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: devops-manage-helm
+description: Create and manage Helm charts and Helm umbrellas for complex systems
+type: skill
+triggers:
+  - "manage helm"
+  - "helm chart"
+---
+
+# workflow-manage-helm.md
+# Helm Management Workflow
+
+This workflow handles the creation and management of Helm charts and Helm umbrellas for complex systems.
+
+## Instructions
+1.  **Analyze System**: Determine if a single chart or an umbrella chart (multiple sub-charts) is needed.
+2.  **Chart Creation**: 
+    - `helm create {chart_name}`
+    - Structure for disconnected environments: Ensure all chart dependencies are bundled (vendorized).
+3.  **Helm Umbrella Setup**:
+    - Configure `Chart.yaml` with sub-chart dependencies.
+    - Setup `values.yaml` to override sub-chart values.
+4.  **On-prem Optimization**:
+    - Prepare `chart-save` and `chart-load` routines for air-gapped systems.
+    - Configure local registry mirrors.
+5.  **Validation**:
+    - `helm lint {chart_path}`
+    - `helm template {chart_path}`

package/.opencode/skills/devops-manage-helm/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: devops-manage-helm
+module: ma-skills

package/.opencode/skills/devops-sign-docker-image/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: devops-sign-docker-image
+description: Cryptographically sign Docker images using certificates and Cosign
+type: skill
+triggers:
+  - "sign docker image"
+  - "docker image signing"
+---
+
+# sign-docker-image.md
+# Docker Image Signing Workflow
+
+This workflow guides the DevOps agent through the process of cryptographically signing a Docker image.
+
+## Instructions
+1.  **Select Image**: Identify the image to sign.
+2.  **Get Digest**: Retrieve the immutable digest: `docker inspect --format='{{index .RepoDigests 0}}' {image_name}`.
+3.  **Prepare Certificate**: Locate the certificate file provided by the user.
+4.  **Execute Signing**:
+    - Use the `docker-image-signing` skill.
+    - Path: `skills/docker-image-signing/scripts/sign-image.sh`
+    - Run: `bash skills/docker-image-signing/scripts/sign-image.sh {image_digest} {cert_file} {key_file}`
+5.  **Verify**: Confirm the signature using `cosign verify`.
+6.  **Report**: provide the signed image reference to the user.

package/.opencode/skills/devops-sign-docker-image/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: devops-sign-docker-image
+module: ma-skills

package/.opencode/skills/mil498-ocd/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: mil498-ocd
+description: Generate MIL-STD-498 Operational Concept Description (OCD)
+type: complex-workflow
+triggers:
+  - "generate OCD"
+  - "create operational concept description"
+---
+
+# MIL-498: Operational Concept Description (OCD)
+
+> MIL-STD-498 Data Item Description: DI-IPSC-81430
+
+## Workflow
+
+This workflow generates a MIL-STD-498 OCD document through progressive steps.
+The OCD describes the system from the user's and stakeholder's perspective, extracting operational concepts from existing project artifacts.
+
+### Steps
+
+1. [Discover Project Artifacts](prompts/01-discover-project-artifacts.md)
+2. [Load Template](prompts/02-load-template.md)
+3. [Generate Document](prompts/03-generate-document.md)
+4. [Validate](prompts/04-validate.md)
+5. [Review](prompts/05-review.md)
+6. [Save](prompts/06-save.md)
+
+### Template
+
+Output template: [template.md](template.md)

package/.opencode/skills/mil498-ocd/bmad-skill-manifest.yaml

@@ -0,0 +1,5 @@
+type: skill
+name: mil498-ocd
+module: ma-skills
+description: Generate MIL-STD-498 Operational Concept Description (OCD)
+version: "1.0.0"

package/.opencode/skills/mil498-ocd/prompts/01-discover-project-artifacts.md

@@ -0,0 +1,26 @@
+# Step 1 — Discover Project Artifacts
+
+Search the project for the following artifacts. Communicate in {communication_language}. Inform {user_name} which artifacts were found and which are missing.
+
+| Priority | Artifact | Search Pattern |
+|----------|----------|----------------|
+| Required | PRD | `**/prd.md`, `**/prd-*.md` |
+| Recommended | Architecture | `**/architecture.md`, `**/architecture-*.md` |
+| Recommended | UX Designs | `**/ux-design*.md`, `**/ux-*.md` |
+| Optional | Product Brief | `**/product-brief*.md` |
+| Optional | Epics & Stories | `**/epics*.md`, `**/stories/*.md` |
+
+If the **PRD** is missing, warn the user and ask whether to proceed with available data or stop.
+
+## Document Dependencies
+
+The OCD is the **first document** in the MIL-STD-498 generation chain. It has no MIL-STD-498 predecessor documents — it draws from project artifacts (PRD, Product Brief, UX Designs) only.
+
+**Note**: The OCD feeds into the SSS and other downstream documents. Ensure the operational scenarios and user descriptions are thorough, as they will be referenced by:
+- **SSS** — for deriving system requirements from operational needs
+- **SSDD** — for understanding operational context behind design decisions
+- **SDP** — for understanding the operational environment
+
+---
+
+**CONFIRMATION GATE**: Present the list of discovered artifacts to the user. Wait for the user to confirm before proceeding to the next step.

package/.opencode/skills/mil498-ocd/prompts/02-load-template.md

@@ -0,0 +1,10 @@
+# Step 2 — Load Template
+
+Read the OCD template from:
+[template.md](../template.md)
+
+This defines the required DID sections and content expectations for each paragraph.
+
+---
+
+**CONFIRMATION GATE**: Confirm to the user that the template has been loaded and summarize the major sections. Wait for the user to confirm before proceeding to document generation.

package/.opencode/skills/mil498-ocd/prompts/03-generate-document.md

@@ -0,0 +1,90 @@
+# Step 3 — Generate Document
+
+Write the document in {document_output_language}, populating each template section. The OCD should be written in language accessible to users and stakeholders, minimizing technical jargon.
+
+## Revision History
+
+Before writing any content, add a **Revision History table** immediately after the document title. If this is a new document, create the table with version `1.0`. If updating an existing document, read the existing revision history and add a new row with an incremented version number and a summary of all changes made in this session. See the `document-revision-history` skill for full formatting rules.
+
+```markdown
+| Version | Date | Author | Changes |
+|---------|------|--------|---------|
+| 1.0 | {date} | Agent ({model}) | Initial document generation |
+```
+
+## Section 1: Scope
+- **1.1 Identification**: Extract system name, version, identifiers from PRD
+- **1.2 System overview**: Summarize the system purpose from the user's perspective
+- **1.3 Document overview**: Describe this OCD document's purpose and contents
+
+## Section 2: Referenced documents
+- List all project artifacts used as input sources, with number, title, revision, and date
+
+## Section 3: Current system or situation
+- **3.1 Background, objectives, and scope**: Describe the problem domain, mission/objectives, and scope from the PRD
+- **3.2 Operational policies and constraints**: Current business rules, operational policies, and constraints
+- **3.3 Description of current system or situation**: How things work today. Describe differences associated with different states or modes of operation. Include all of the following (items a through h per the DID):
+  - **a.** The operational environment and its characteristics
+  - **b.** Major system components and the interconnections among them
+  - **c.** Interfaces to external systems or procedures
+  - **d.** Capabilities/functions of the current system
+  - **e.** Charts and descriptions depicting inputs, outputs, data flow, and manual/automated processes sufficient to understand the current system from the user's point of view
+  - **f.** Performance characteristics: speed, throughput, volume, frequency
+  - **g.** Quality attributes: reliability, maintainability, availability, flexibility, portability, usability, efficiency
+  - **h.** Provisions for safety, security, privacy, and continuity of operations in emergencies
+- **3.4 Users or involved personnel**: Identify all user types and stakeholders. Include organizational structures, training/skills, responsibilities, activities, and interactions
+- **3.5 Support concept**: Current support and maintenance approach — support agencies, facilities, equipment, support software, repair/replacement criteria, maintenance levels and cycles
+
+## Section 4: Justification for and nature of changes
+- **4.1 Justification for change**:
+  - **a.** New or modified aspects of user needs, threats, missions, objectives, environments, interfaces, personnel, or other factors requiring a new/modified system
+  - **b.** Deficiencies or limitations in the current system that make it unable to respond to these factors
+- **4.2 Description of needed changes**: New or modified capabilities, functions, processes, interfaces, or other changes needed
+- **4.3 Priorities among the changes**: Identify each change as essential, desirable, or optional. Prioritize the desirable and optional changes
+- **4.4 Changes considered but not included**: Identify changes that were considered but excluded, with rationale for not including them
+- **4.5 Assumptions and constraints**: Any assumptions and constraints applicable to the changes identified
+
+## Section 5: Concept for the new or modified system
+- **5.1 Background, objectives, and scope**: Vision, mission/objectives, and scope for the new system from Product Brief/PRD
+- **5.2 Operational policies and constraints**: New or changed operational policies and constraints
+- **5.3 Description of the new or modified system**: How the new system will work. Describe differences associated with different states or modes. Include all of the following (items a through h, mirroring Section 3.3):
+  - **a.** The operational environment and its characteristics
+  - **b.** Major system components and the interconnections among them
+  - **c.** Interfaces to external systems or procedures
+  - **d.** Capabilities/functions of the new or modified system
+  - **e.** Charts and descriptions depicting inputs, outputs, data flow, and manual/automated processes from the user's point of view
+  - **f.** Performance characteristics: speed, throughput, volume, frequency
+  - **g.** Quality attributes: reliability, maintainability, availability, flexibility, portability, usability, efficiency
+  - **h.** Provisions for safety, security, privacy, and continuity of operations in emergencies
+- **5.4 Users/affected personnel**: How user roles change with the new system — organizational structures, training/skills, responsibilities, and interactions
+- **5.5 Support concept**: Planned support approach — support agencies, facilities, equipment, support software, repair/replacement criteria, maintenance levels and cycles
+
+## Section 6: Operational scenarios
+- Document one or more operational scenarios that illustrate the role of the new/modified system
+- Each scenario should include: the system's interaction with users, interfaces with other systems, and all states/modes identified
+- Include: events, actions, stimuli, information, interactions
+- Cover both normal operation and exception/error scenarios
+- Reference may be made to other media (e.g., videos, mockups) to provide part of this information
+
+## Section 7: Summary of impacts
+- **7.1 Operational impacts**: Anticipated operational impacts on user, acquirer, developer, and support agencies. Include: changes in interfaces with operating centers, procedure changes, use of new data sources, changes in data input quantity/type/timing, changes in data retention, new modes of operation
+- **7.2 Organizational impacts**: Anticipated organizational impacts. Include: modification of responsibilities, addition/elimination of positions, training/retraining needs, changes in number/skill levels/locations of personnel
+- **7.3 Impacts during development**: Anticipated impacts during the development effort. Include: meetings/discussions, database development/modification, training, parallel operation of new and existing systems, testing impacts, monitoring activities
+
+## Section 8: Analysis of the proposed system
+- **8.1 Summary of advantages**: Qualitative and quantitative summary of advantages — new capabilities, enhanced capabilities, improved performance, and their relationship to deficiencies identified in 4.1
+- **8.2 Summary of disadvantages/limitations**: Qualitative and quantitative summary of disadvantages — degraded/missing capabilities, less-than-desired performance, excessive resource use, undesirable operational impacts, conflicts with user assumptions
+- **8.3 Alternatives and trade-offs considered**: Major alternatives considered, trade-offs among them, and rationale for the decisions reached
+
+## Section 9: Notes
+- Alphabetical listing of all acronyms, abbreviations, and their meanings
+- Glossary of terms and definitions
+- Background information to aid understanding
+
+## Appendix A
+- Include any supplementary material (charts, detailed data, classified information) that supports the main body
+- Reference each appendix from the main body where the data would normally appear
+
+---
+
+**CONFIRMATION GATE**: Present the generated document to the user for initial review. Wait for the user to confirm the content before proceeding to validation.

package/.opencode/skills/mil498-ocd/prompts/04-validate.md

@@ -0,0 +1,14 @@
+# Step 4 — Validate
+
+Before presenting to the user, verify:
+- All template sections (1-9 and Appendix A) are populated or marked "Not applicable" with justification
+- Document is written from the user/stakeholder perspective, not the developer perspective
+- Sections 3.3 and 5.3 cover all eight items (a through h)
+- Section 4 includes all five subsections (4.1-4.5)
+- Section 7 (impacts) and Section 8 (analysis) are present and substantive
+- Operational scenarios are complete and realistic
+- Document is written in {document_output_language}
+
+---
+
+**CONFIRMATION GATE**: Present the validation results to the user. List any issues found and corrections made. Wait for the user to confirm before proceeding to the review step.

package/.opencode/skills/mil498-ocd/prompts/05-review.md

@@ -0,0 +1,15 @@
+# Step 5 — Review
+
+Present the complete document to {user_name} for review.
+Highlight any sections where information was inferred or assumptions were made.
+Specifically ask about:
+- Are the current system descriptions (Section 3) accurate?
+- Are the operational scenarios (Section 6) complete?
+- Are there additional impacts (Section 7) not captured?
+- Does the analysis (Section 8) accurately represent advantages and disadvantages?
+
+Offer to refine any section based on feedback.
+
+---
+
+**CONFIRMATION GATE**: Wait for the user to approve the document or request changes. If changes are requested, apply them and re-present for approval. Do not proceed to save until the user explicitly approves.

package/.opencode/skills/mil498-ocd/prompts/06-save.md

@@ -0,0 +1,15 @@
+# Step 6 — Save
+
+Write the final document to:
+`{output_folder}/planning-artifacts/OCD.md`
+
+Confirm the file was saved and display a summary of:
+- Number of user roles identified
+- Number of operational scenarios documented
+- Number of changes justified (Section 4)
+- Number of impacts identified (Section 7)
+- Any sections marked "Not applicable"
+
+---
+
+**CONFIRMATION GATE**: Confirm to the user that the document has been saved successfully and present the summary. The workflow is now complete.