sdtk-ops-kit 0.2.0

package/assets/toolkit/toolkit/skills/ops-security-infra/references/security-headers.md

@@ -0,0 +1,24 @@
+<!-- Based on agency-agents by AgentLand Contributors (MIT License, 2025). Adapted for SDTK-OPS. -->
+
+# Security Headers
+
+```nginx
+server {
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
+
+    server_tokens off;
+}
+```
+
+## Pattern Notes
+
+- tune CSP to the actual application surface before enforcing it
+- keep headers consistent across edge and app-serving paths
+- remove unnecessary server disclosure where the platform permits it
+

package/assets/toolkit/toolkit/skills/ops-verify/SKILL.md

@@ -0,0 +1,180 @@
+<!-- Based on superpowers by Jesse Vincent (MIT License, 2025). Adapted for SDTK-OPS. -->
+---
+name: ops-verify
+description: Verification before completion. Use before claiming any infrastructure change, deployment, or operational task is done -- run verification commands and confirm output, evidence before assertions.
+---
+
+# Ops Verify
+
+## Overview
+
+Claiming work is complete without verification is dishonesty, not efficiency.
+
+**Core principle:** Evidence before claims, always.
+
+**Violating the letter of this rule is violating the spirit of this rule.**
+
+## The Iron Law
+
+```
+NO COMPLETION CLAIMS WITHOUT FRESH VERIFICATION EVIDENCE
+```
+
+If you have not run the verification command in this message, you cannot claim it passes.
+
+## The Gate Function
+
+```
+BEFORE claiming any status or expressing satisfaction:
+
+1. IDENTIFY: What command proves this claim?
+2. RUN: Execute the FULL command (fresh, complete)
+3. READ: Full output, check exit code, count failures
+4. VERIFY: Does output confirm the claim?
+   - If NO: State actual status with evidence
+   - If YES: State claim WITH evidence
+5. ONLY THEN: Make the claim
+
+Skip any step = lying, not verifying
+```
+
+## Common Failures
+
+| Claim | Requires | Not Sufficient |
+|-------|----------|----------------|
+| Tests pass | Test command output: 0 failures | Previous run, "should pass" |
+| Linter clean | Linter output: 0 errors | Partial check, extrapolation |
+| Build succeeds | Build command: exit 0 | Linter passing, logs look good |
+| Bug fixed | Test original symptom: passes | Code changed, assumed fixed |
+| Regression test works | Red-green cycle verified | Test passes once |
+| Agent completed | VCS diff shows changes | Agent reports "success" |
+| Requirements met | Line-by-line checklist | Tests passing |
+
+## Common Mistakes
+
+| Mistake | Why it fails |
+|---------|--------------|
+| Claim success from expectation instead of output | You report intent, not evidence |
+| Reuse old command output | State may have changed since the earlier run |
+| Verify only one layer of a multi-step change | Hidden failure survives past the claim |
+| Trust a delegated agent without independent checks | Reported completion may not match the actual result |
+
+## Red Flags - STOP
+
+- Using "should", "probably", "seems to"
+- Expressing satisfaction before verification ("Great!", "Perfect!", "Done!", etc.)
+- About to commit, push, or close a task without verification
+- Trusting agent success reports
+- Relying on partial verification
+- Thinking "just this once"
+- Tired and wanting work over
+- **ANY wording implying success without having run verification**
+
+## Rationalization Prevention
+
+| Excuse | Reality |
+|--------|---------|
+| "Should work now" | RUN the verification |
+| "I'm confident" | Confidence is not evidence |
+| "Just this once" | No exceptions |
+| "Linter passed" | Linter is not compiler |
+| "Agent said success" | Verify independently |
+| "I'm tired" | Exhaustion is not an excuse |
+| "Partial check is enough" | Partial proves nothing |
+| "Different words so rule doesn't apply" | Spirit over letter |
+
+## Key Patterns
+
+**Tests:**
+```
+[Run test command] [See: 34/34 pass] "All tests pass"
+"Should pass now" / "Looks correct"
+```
+
+**Regression tests (TDD Red-Green):**
+```
+Write -> Run (pass) -> Revert fix -> Run (MUST FAIL) -> Restore -> Run (pass)
+"I've written a regression test" (without red-green verification)
+```
+
+**Build:**
+```
+[Run build] [See: exit 0] "Build passes"
+"Linter passed" (linter does not check compilation)
+```
+
+**Requirements:**
+```
+Re-read plan -> Create checklist -> Verify each -> Report gaps or completion
+"Tests pass, phase complete"
+```
+
+**Agent delegation:**
+```
+Agent reports success -> Check VCS diff -> Verify changes -> Report actual state
+Trust agent report
+```
+
+## Infrastructure Verification Patterns
+
+**Health check:**
+```
+[Run: curl -s https://service.example/health]
+[See: {"status":"healthy"}]
+"Service healthy"
+```
+
+**DNS:**
+```
+[Run: dig +short api.example.com]
+[See: correct IP or CNAME]
+"DNS propagated"
+```
+
+**Container:**
+```
+[Run: kubectl get pods -n production]
+[See: Running, Ready 1/1]
+"Pods healthy"
+```
+
+**Cloud resource:**
+```
+[Run: provider CLI state check]
+[See: active or available]
+"Resource provisioned"
+```
+
+## Why This Matters
+
+From repeated operational failures:
+- the user stops trusting status claims that are not backed by evidence
+- undefined or unhealthy runtime states can ship into production
+- missing requirements or skipped rollback checks lead to incomplete releases
+- time gets wasted on false completion -> redirect -> rework
+- operational honesty matters as much as implementation honesty
+
+## When To Apply
+
+**ALWAYS before:**
+- ANY variation of success or completion claims
+- ANY expression of satisfaction
+- ANY positive statement about operational state
+- Deployment completion
+- Incident closure
+- Moving to the next task
+- Delegating to agents
+
+**Rule applies to:**
+- Exact phrases
+- Paraphrases and synonyms
+- Implications of success
+- ANY communication suggesting completion or correctness
+
+## The Bottom Line
+
+**No shortcuts for verification.**
+
+Run the command. Read the output. THEN claim the result.
+
+This is non-negotiable.

package/bin/sdtk-ops.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const { run } = require("../src/index");
+
+run(process.argv.slice(2))
+  .then((exitCode) => {
+    process.exitCode = Number.isInteger(exitCode) ? exitCode : 0;
+  })
+  .catch((error) => {
+    console.error(`sdtk-ops: ${error.message}`);
+    process.exitCode = typeof error.exitCode === "number" ? error.exitCode : 4;
+  });

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "sdtk-ops-kit",
+  "version": "0.2.0",
+  "description": "Skill-driven operations toolkit for deployment, verification, monitoring, incident response, backup, security, compliance, and cost discipline.",
+  "bin": {
+    "sdtk-ops": "./bin/sdtk-ops.js"
+  },
+  "main": "src/index.js",
+  "type": "commonjs",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/codexsdtk/sdtk-toolkit.git",
+    "directory": "products/sdtk-ops/distribution/sdtk-ops-kit"
+  },
+  "homepage": "https://github.com/codexsdtk/sdtk-toolkit/tree/main/products/sdtk-ops/distribution/sdtk-ops-kit",
+  "bugs": {
+    "url": "https://github.com/codexsdtk/sdtk-toolkit/issues"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "assets/"
+  ],
+  "scripts": {
+    "test": "powershell -ExecutionPolicy Bypass -Command \"$ErrorActionPreference = 'Stop'; Set-Location '..\\..\\..\\..'; python -m unittest -v tests.test_sdtk_ops_cli\"",
+    "build:payload": "powershell -ExecutionPolicy Bypass -Command \"$ErrorActionPreference = 'Stop'; & 'scripts/sync-toolkit-assets.ps1'; & 'scripts/build-toolkit-manifest.ps1'\"",
+    "verify:payload": "node -e \"require('./src/lib/toolkit-payload').verify()\"",
+    "pack:smoke": "powershell -ExecutionPolicy Bypass -File scripts/pack-smoke.ps1",
+    "prepublishOnly": "npm run build:payload && npm run verify:payload"
+  },
+  "engines": {
+    "node": ">=18.13.0"
+  },
+  "keywords": [
+    "sdtk-ops",
+    "cli",
+    "toolkit",
+    "operations",
+    "claude",
+    "codex"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/commands/generate.js

@@ -0,0 +1,12 @@
+"use strict";
+
+const { ValidationError } = require("../lib/errors");
+
+async function cmdGenerate(args) {
+  void args;
+  throw new ValidationError(
+    'The "generate" command is not part of the supported SDTK-OPS workflow-entry surface. Use "sdtk-ops help" for supported commands and start with the "ops-discover" skill if the correct journey is unclear.'
+  );
+}
+
+module.exports = { cmdGenerate };

package/src/commands/help.js

@@ -0,0 +1,53 @@
+"use strict";
+
+function cmdHelp() {
+  const text = [
+    "SDTK-OPS CLI -- internal operations discipline toolkit",
+    "",
+    "Usage:",
+    "  sdtk-ops <command> [options]",
+    "",
+    "Commands:",
+    "  init      Initialize SDTK-OPS files in a project",
+    "  runtime   Manage runtime asset installation (install, uninstall, status)",
+    "  help      Show this help message",
+    "",
+    "Current supported surface:",
+    "  Supported now: help, init, runtime install|status|uninstall",
+    "  Not supported: generate",
+    "  Package scope: internal_only",
+    "",
+    "Workflow entry:",
+    "  After init, choose a journey directly if the goal is clear.",
+    "  Canonical journeys: deployment, incident, monitoring, backup/recovery.",
+    "  If the correct path is unclear, start with the ops-discover skill.",
+    "  Close every journey with ops-verify before declaring work complete.",
+    "",
+    "Runtime support:",
+    "  Claude: project + user scope",
+    "  Codex:  user scope only",
+    "  Gate C0: Codex project scope is rejected",
+    "",
+    "Global options:",
+    "  -h, --help      Show this help",
+    "  -v, --version   Show version",
+    "",
+    "Examples:",
+    "  sdtk-ops --help",
+    "  sdtk-ops --version",
+    "  sdtk-ops init --runtime claude --project-path ./my-project",
+    "  sdtk-ops runtime install --runtime claude --scope project --project-path ./my-project",
+    "  # Journey routing after init:",
+    "  # deployment -> ops-plan -> ops-infra-plan -> ops-container -> ops-ci-cd -> ops-deploy -> ops-monitor -> ops-verify",
+    "  # incident   -> ops-incident -> ops-debug -> ops-monitor -> ops-verify",
+    "  # monitoring -> ops-plan -> ops-monitor -> ops-verify",
+    "  # recovery   -> ops-plan -> ops-backup -> ops-verify",
+    "  sdtk-ops runtime status --runtime codex",
+    "  sdtk-ops runtime uninstall --runtime codex --scope user",
+  ];
+
+  console.log(text.join("\n"));
+  return 0;
+}
+
+module.exports = { cmdHelp };

package/src/commands/init.js

@@ -0,0 +1,86 @@
+"use strict";
+
+const path = require("path");
+const { parseFlags, validateChoice } = require("../lib/args");
+const { verify, resolvePayloadFile } = require("../lib/toolkit-payload");
+const { runScript } = require("../lib/powershell");
+const { ValidationError } = require("../lib/errors");
+const { VALID_SCOPES, defaultScope, isProjectScopeSupported } = require("../lib/scope");
+
+const FLAG_DEFS = {
+  runtime: { type: "string" },
+  "project-path": { type: "string" },
+  "runtime-scope": { type: "string" },
+  force: { type: "boolean" },
+  "skip-skills": { type: "boolean" },
+  "skip-runtime-assets": { type: "boolean" },
+  verbose: { type: "boolean" },
+};
+
+const VALID_RUNTIMES = ["codex", "claude"];
+
+async function cmdInit(args) {
+  const { flags } = parseFlags(args, FLAG_DEFS);
+
+  const runtime = flags.runtime || "codex";
+  validateChoice(runtime, VALID_RUNTIMES, "runtime");
+
+  const scope = flags["runtime-scope"] || defaultScope(runtime);
+  validateChoice(scope, VALID_SCOPES, "runtime-scope");
+  if (scope === "project" && !isProjectScopeSupported(runtime)) {
+    throw new ValidationError(
+      "Codex does not support project-local skills. Use --runtime-scope user instead."
+    );
+  }
+
+  const skipAssets = flags["skip-runtime-assets"] || flags["skip-skills"];
+  if (flags["skip-skills"] && !flags["skip-runtime-assets"]) {
+    console.warn("Warning: --skip-skills is deprecated. Use --skip-runtime-assets instead.");
+  }
+
+  const projectPath = flags["project-path"] ? path.resolve(flags["project-path"]) : process.cwd();
+
+  verify();
+
+  const installScript = resolvePayloadFile("toolkit/install.ps1");
+  const params = {
+    ProjectPath: projectPath,
+    Runtime: runtime,
+    Scope: scope,
+  };
+  if (flags.force) {
+    params.Force = true;
+  }
+  if (skipAssets) {
+    params.SkipRuntimeAssets = true;
+  }
+  if (!flags.verbose) {
+    params.Quiet = true;
+  }
+
+  console.log("Initializing SDTK-OPS workspace...");
+  console.log(`  Runtime: ${runtime}`);
+  console.log(`  Scope:   ${scope}`);
+  console.log(`  Project: ${projectPath}`);
+  console.log("");
+
+  const result = await runScript(installScript, params, { silent: !flags.verbose });
+  if (result.exitCode !== 0) {
+    if (result.stderr) {
+      console.error(result.stderr);
+    }
+    throw new ValidationError(`Initialization failed (exit code ${result.exitCode}).`);
+  }
+
+  console.log("");
+  console.log("SDTK-OPS workspace initialized successfully.");
+  console.log("");
+  console.log("Next steps:");
+  console.log("  1. Review and customize sdtk-spec.config.json for your operations environment.");
+  console.log("  2. Use the installed ops-* skill set for deployment, monitoring, incident, and recovery workflows.");
+  return 0;
+}
+
+module.exports = {
+  cmdInit,
+};

package/src/commands/runtime.js

@@ -0,0 +1,201 @@
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const { parseFlags, requireFlag, validateChoice } = require("../lib/args");
+const { verify, resolvePayloadFile } = require("../lib/toolkit-payload");
+const { runScript } = require("../lib/powershell");
+const { ValidationError } = require("../lib/errors");
+const {
+  VALID_SCOPES,
+  defaultScope,
+  isProjectScopeSupported,
+  managedSkillNames,
+  resolveSkillsDir,
+} = require("../lib/scope");
+
+const FLAG_DEFS = {
+  runtime: { type: "string" },
+  scope: { type: "string" },
+  "project-path": { type: "string" },
+  force: { type: "boolean" },
+  all: { type: "boolean" },
+  verbose: { type: "boolean" },
+};
+
+const VALID_RUNTIMES = ["codex", "claude"];
+const SUBCOMMANDS = ["install", "uninstall", "status"];
+
+function validateScopeForRuntime(runtime, scope, label) {
+  if (scope === "project" && !isProjectScopeSupported(runtime)) {
+    throw new ValidationError(
+      `Codex does not support project-local skills. Use --${label} user instead.`
+    );
+  }
+}
+
+async function cmdRuntimeInstall(flags) {
+  const runtime = requireFlag(flags, "runtime", "runtime");
+  validateChoice(runtime, VALID_RUNTIMES, "runtime");
+
+  const scope = flags.scope || defaultScope(runtime);
+  validateChoice(scope, VALID_SCOPES, "scope");
+  validateScopeForRuntime(runtime, scope, "scope");
+
+  const projectPath = flags["project-path"] ? path.resolve(flags["project-path"]) : process.cwd();
+  verify();
+
+  const scriptName =
+    runtime === "claude"
+      ? "toolkit/scripts/install-claude-skills.ps1"
+      : "toolkit/scripts/install-codex-skills.ps1";
+  const script = resolvePayloadFile(scriptName);
+  const params = { Scope: scope };
+  if (runtime === "claude") {
+    params.ProjectPath = projectPath;
+  }
+  if (flags.force) {
+    params.Force = true;
+  }
+  if (!flags.verbose) {
+    params.Quiet = true;
+  }
+
+  console.log(`Installing ${runtime} runtime assets...`);
+  console.log(`  Runtime: ${runtime}`);
+  console.log(`  Scope:   ${scope}`);
+  if (runtime === "claude" && scope === "project") {
+    console.log(`  Project: ${projectPath}`);
+  }
+  console.log("");
+
+  const result = await runScript(script, params, { silent: !flags.verbose });
+  if (result.exitCode !== 0) {
+    if (result.stderr) {
+      console.error(result.stderr);
+    }
+    throw new ValidationError(`Runtime install failed (exit code ${result.exitCode}).`);
+  }
+
+  console.log("");
+  console.log(`${runtime} runtime assets installed successfully.`);
+  return 0;
+}
+
+async function cmdRuntimeUninstall(flags) {
+  const runtime = requireFlag(flags, "runtime", "runtime");
+  validateChoice(runtime, VALID_RUNTIMES, "runtime");
+
+  const scope = flags.scope || defaultScope(runtime);
+  validateChoice(scope, VALID_SCOPES, "scope");
+  validateScopeForRuntime(runtime, scope, "scope");
+
+  const projectPath = flags["project-path"] ? path.resolve(flags["project-path"]) : process.cwd();
+  verify();
+
+  const scriptName =
+    runtime === "claude"
+      ? "toolkit/scripts/uninstall-claude-skills.ps1"
+      : "toolkit/scripts/uninstall-codex-skills.ps1";
+  const script = resolvePayloadFile(scriptName);
+  const params = { All: true };
+  if (runtime === "claude") {
+    params.Scope = scope;
+    params.ProjectPath = projectPath;
+  }
+  if (!flags.verbose) {
+    params.Quiet = true;
+  }
+
+  const result = await runScript(script, params, { silent: !flags.verbose });
+  if (result.exitCode !== 0) {
+    if (result.stderr) {
+      console.error(result.stderr);
+    }
+    throw new ValidationError(`Runtime uninstall failed (exit code ${result.exitCode}).`);
+  }
+
+  console.log(`Uninstalled ${runtime} runtime assets for scope ${scope}.`);
+  return 0;
+}
+
+function cmdRuntimeStatus(flags) {
+  const runtime = requireFlag(flags, "runtime", "runtime");
+  validateChoice(runtime, VALID_RUNTIMES, "runtime");
+
+  const projectPath = flags["project-path"] ? path.resolve(flags["project-path"]) : process.cwd();
+  const scopes = runtime === "claude" ? ["project", "user"] : ["user"];
+
+  console.log(`Runtime: ${runtime}`);
+  console.log("");
+
+  for (const scope of scopes) {
+    const skillsDir = resolveSkillsDir(runtime, scope, projectPath);
+    const managed = managedSkillNames(runtime);
+    const exists = fs.existsSync(skillsDir);
+    let installedNames = [];
+
+    if (exists) {
+      try {
+        const entries = fs.readdirSync(skillsDir, { withFileTypes: true });
+        installedNames = entries
+          .filter((entry) => entry.isDirectory() && managed.includes(entry.name))
+          .map((entry) => entry.name)
+          .sort();
+      } catch {
+        installedNames = [];
+      }
+    }
+
+    const skillCount = installedNames.length;
+    const allInstalled = skillCount === managed.length;
+    const hasManagedSkills = skillCount > 0;
+    const status = !exists || !hasManagedSkills
+      ? "not installed"
+      : allInstalled
+        ? `installed (${skillCount}/${managed.length} SDTK-OPS skills)`
+        : `partial (${skillCount}/${managed.length} SDTK-OPS skills)`;
+
+    console.log(`  Scope: ${scope}`);
+    console.log(`    Path:   ${skillsDir}`);
+    console.log(`    Status: ${status}`);
+    if (exists && hasManagedSkills && skillCount < managed.length) {
+      const missing = managed.filter((name) => !installedNames.includes(name));
+      console.log(`    Missing: ${missing.join(", ")}`);
+    }
+    console.log("");
+  }
+
+  return 0;
+}
+
+async function cmdRuntime(args) {
+  const { flags, positional } = parseFlags(args, FLAG_DEFS);
+  const subcommand = positional[0];
+
+  if (!subcommand) {
+    throw new ValidationError(
+      `Missing subcommand. Usage: sdtk-ops runtime <${SUBCOMMANDS.join("|")}> [options]`
+    );
+  }
+  if (!SUBCOMMANDS.includes(subcommand)) {
+    throw new ValidationError(
+      `Unknown subcommand: "${subcommand}". Must be one of: ${SUBCOMMANDS.join(", ")}`
+    );
+  }
+
+  switch (subcommand) {
+    case "install":
+      return cmdRuntimeInstall(flags);
+    case "uninstall":
+      return cmdRuntimeUninstall(flags);
+    case "status":
+      return cmdRuntimeStatus(flags);
+    default:
+      throw new ValidationError(`Unsupported runtime subcommand: "${subcommand}".`);
+  }
+}
+
+module.exports = {
+  cmdRuntime,
+};

package/src/index.js

@@ -0,0 +1,65 @@
+"use strict";
+
+const { cmdHelp } = require("./commands/help");
+const { cmdInit } = require("./commands/init");
+const { cmdRuntime } = require("./commands/runtime");
+const { ValidationError } = require("./lib/errors");
+
+const COMMANDS = new Set(["help", "version", "init", "runtime"]);
+
+function getVersion() {
+  const pkg = require("../package.json");
+  return pkg.version;
+}
+
+function parseCommand(argv) {
+  if (!argv || argv.length === 0) {
+    return { command: "help", args: [] };
+  }
+
+  const [first, ...rest] = argv;
+  if (first === "-h" || first === "--help") {
+    return { command: "help", args: [] };
+  }
+  if (first === "-v" || first === "--version") {
+    return { command: "version", args: [] };
+  }
+
+  return { command: first, args: rest };
+}
+
+async function run(argv) {
+  const { command, args } = parseCommand(argv);
+
+  if (command === "generate") {
+    throw new ValidationError(
+      'The "generate" command is not part of the supported SDTK-OPS workflow-entry surface. Supported commands: help, init, runtime. If the correct journey is unclear, start with the "ops-discover" skill.'
+    );
+  }
+
+  if (!COMMANDS.has(command)) {
+    throw new ValidationError(
+      `Unknown command: "${command}". Run "sdtk-ops --help" for available commands.`
+    );
+  }
+
+  switch (command) {
+    case "help":
+      return cmdHelp();
+    case "version":
+      console.log(`sdtk-ops-kit ${getVersion()}`);
+      return 0;
+    case "init":
+      return cmdInit(args);
+    case "runtime":
+      return cmdRuntime(args);
+    default:
+      throw new ValidationError(`Unsupported command: "${command}".`);
+  }
+}
+
+module.exports = {
+  getVersion,
+  parseCommand,
+  run,
+};