thanh-kit 2.5.0 → 2.5.2

package/templates/skills/debug/references/task-management-debugging.md

@@ -0,0 +1,155 @@
+# Debug Task Management Patterns
+
+Track investigation and debugging pipelines via Claude Native Tasks (TaskCreate, TaskUpdate, TaskList).
+
+## When to Create Tasks
+
+| Debug Scope | Tasks? | Rationale |
+|-------------|--------|-----------|
+| Single bug, one file | No | Systematic debugging handles directly |
+| Multi-component investigation (3+ steps) | Yes | Track assess → collect → analyze → fix → verify |
+| Parallel log/data collection agents | Yes | Coordinate independent evidence gathering |
+| Performance investigation with multiple layers | Yes | Track bottleneck analysis per layer |
+| CI/CD pipeline failure with 3+ possible causes | Yes | Track hypothesis elimination |
+
+**3-Task Rule:** Skip task creation when investigation has <3 meaningful steps.
+
+## Investigation Pipeline as Tasks
+
+```
+TaskCreate: "Assess incident scope"      → pending
+TaskCreate: "Collect logs and evidence"  → pending, blockedBy: [assess]
+TaskCreate: "Analyze root cause"         → pending, blockedBy: [collect]
+TaskCreate: "Implement fix"              → pending, blockedBy: [analyze]
+TaskCreate: "Verify fix resolves issue"  → pending, blockedBy: [fix]
+```
+
+Maps to investigation-methodology.md 5-step process. Auto-unblocks as each step completes.
+
+## Task Schemas
+
+### Assess Task
+
+```
+TaskCreate(
+  subject: "Assess {incident} scope and impact",
+  activeForm: "Assessing incident scope",
+  description: "Gather symptoms, identify affected components, check recent changes. See investigation-methodology.md Step 1",
+  metadata: { debugStage: "assess", incident: "{incident}",
+              severity: "P1", effort: "5m" }
+)
+```
+
+### Collect Task
+
+```
+TaskCreate(
+  subject: "Collect evidence for {incident}",
+  activeForm: "Collecting evidence",
+  description: "Server logs, CI/CD logs, database state, metrics. See log-and-ci-analysis.md",
+  metadata: { debugStage: "collect", incident: "{incident}",
+              sources: "logs,ci,db", priority: "P1", effort: "10m" },
+  addBlockedBy: ["{assess-task-id}"]
+)
+```
+
+### Analyze Task
+
+```
+TaskCreate(
+  subject: "Analyze root cause of {incident}",
+  activeForm: "Analyzing root cause",
+  description: "Correlate evidence, trace execution paths, identify root cause. See systematic-debugging.md Phase 1-3",
+  metadata: { debugStage: "analyze", incident: "{incident}",
+              technique: "systematic", priority: "P1", effort: "15m" },
+  addBlockedBy: ["{collect-task-id}"]
+)
+```
+
+### Fix Task
+
+```
+TaskCreate(
+  subject: "Fix root cause: {root_cause_summary}",
+  activeForm: "Implementing fix",
+  description: "Address root cause, add defense-in-depth validation. See defense-in-depth.md",
+  metadata: { debugStage: "fix", rootCause: "{root_cause}",
+              priority: "P1", effort: "20m" },
+  addBlockedBy: ["{analyze-task-id}"]
+)
+```
+
+### Verify Task
+
+```
+TaskCreate(
+  subject: "Verify fix with fresh evidence",
+  activeForm: "Verifying fix",
+  description: "Run tests, check build, confirm issue resolved. NO CLAIMS WITHOUT EVIDENCE. See verification.md",
+  metadata: { debugStage: "verify", priority: "P1", effort: "5m" },
+  addBlockedBy: ["{fix-task-id}"]
+)
+```
+
+## Parallel Evidence Collection
+
+For multi-source investigations, spawn parallel collection agents:
+
+```
+// Parallel — no blockedBy between them
+TaskCreate(subject: "Collect CI/CD pipeline logs",
+  metadata: { debugStage: "collect", source: "ci",
+              agentIndex: 1, totalAgents: 3, priority: "P1" })
+
+TaskCreate(subject: "Collect application server logs",
+  metadata: { debugStage: "collect", source: "server",
+              agentIndex: 2, totalAgents: 3, priority: "P1" })
+
+TaskCreate(subject: "Query database for anomalies",
+  metadata: { debugStage: "collect", source: "db",
+              agentIndex: 3, totalAgents: 3, priority: "P1" })
+
+// Analyze blocks on ALL collection completing:
+TaskCreate(subject: "Analyze root cause from collected evidence",
+  addBlockedBy: ["{ci-id}", "{server-id}", "{db-id}"])
+```
+
+## Task Lifecycle
+
+```
+Assess:   pending → in_progress → completed (scope + impact identified)
+Collect:  pending → in_progress → completed (evidence gathered)
+Analyze:  pending → in_progress → completed (root cause identified)
+Fix:      pending → in_progress → completed (fix implemented)
+Verify:   pending → in_progress → completed (fresh verification evidence)
+```
+
+### Re-Investigation Cycle
+
+When fix doesn't resolve the issue → new analyze-fix-verify cycle:
+
+```
+TaskCreate(subject: "Re-analyze: fix attempt {N} failed",
+  addBlockedBy: ["{verify-task-id}"],
+  metadata: { debugStage: "analyze", cycle: 2, priority: "P1" })
+```
+
+Limit to 3 cycles. After cycle 3 → question architecture (systematic-debugging.md Phase 4.5).
+
+## Integration with Cook/Planning
+
+Debug tasks are **separate from** cook/planning phase tasks.
+
+**When cook spawns debugger:**
+1. Cook encounters failing tests → creates debug pipeline tasks
+2. Debug pipeline executes (assess → collect → analyze → fix → verify)
+3. All debug tasks complete → cook marks phase debugging as done
+4. Cook proceeds to next phase
+
+## Report Sync-Back
+
+After investigation completes, write diagnostic report per reporting-standards.md. Report persists as the "source of truth" for cross-session reference (tasks are session-scoped only).
+
+## Error Handling
+
+If `TaskCreate` fails: log warning, continue with sequential debugging. Tasks add visibility and coordination, not core functionality.

package/templates/skills/devops/SKILL.md

@@ -1,285 +1,97 @@
 ---
-name: devops
-description: Deploy and manage cloud infrastructure on Cloudflare (Workers, R2, D1, KV, Pages, Durable Objects, Browser Rendering), Docker containers, and Google Cloud Platform (Compute Engine, GKE, Cloud Run, App Engine, Cloud Storage). Use when deploying serverless functions to the edge, configuring edge computing solutions, managing Docker containers and images, setting up CI/CD pipelines, optimizing cloud infrastructure costs, implementing global caching strategies, working with cloud databases, or building cloud-native applications.
+name: ck:devops
+description: Deploy to Cloudflare (Workers, R2, D1), Docker, GCP (Cloud Run, GKE), Kubernetes (kubectl, Helm). Use for serverless, containers, CI/CD, GitOps, security audit.
 license: MIT
-version: 1.0.0
+version: 2.0.0
+argument-hint: "[platform] [task]"
 ---
 
 # DevOps Skill
 
-Comprehensive guide for deploying and managing cloud infrastructure across Cloudflare edge platform, Docker containerization, and Google Cloud Platform.
+Deploy and manage cloud infrastructure across Cloudflare, Docker, Google Cloud, and Kubernetes.
 
-## When to Use This Skill
+## When to Use
 
-Use this skill when:
-- Deploying serverless applications to Cloudflare Workers
-- Containerizing applications with Docker
-- Managing Google Cloud infrastructure with gcloud CLI
-- Setting up CI/CD pipelines across platforms
-- Optimizing cloud infrastructure costs
-- Implementing multi-region deployments
-- Building edge-first architectures
-- Managing container orchestration with Kubernetes
-- Configuring cloud storage solutions (R2, Cloud Storage)
-- Automating infrastructure with scripts and IaC
+- Deploy serverless apps to Cloudflare Workers/Pages
+- Containerize apps with Docker, Docker Compose
+- Manage GCP with gcloud CLI (Cloud Run, GKE, Cloud SQL)
+- Kubernetes cluster management (kubectl, Helm)
+- GitOps workflows (Argo CD, Flux)
+- CI/CD pipelines, multi-region deployments
+- Security audits, RBAC, network policies
 
-## Platform Selection Guide
+## Platform Selection
 
-### When to Use Cloudflare
-
-**Best For:**
-- Edge-first applications with global distribution
-- Ultra-low latency requirements (<50ms)
-- Static sites with serverless functions
-- Zero egress cost scenarios (R2 storage)
-- WebSocket/real-time applications (Durable Objects)
-- AI/ML at the edge (Workers AI)
-
-**Key Products:**
-- Workers (serverless functions)
-- R2 (object storage, S3-compatible)
-- D1 (SQLite database with global replication)
-- KV (key-value store)
-- Pages (static hosting + functions)
-- Durable Objects (stateful compute)
-- Browser Rendering (headless browser automation)
-
-**Cost Profile:** Pay-per-request, generous free tier, zero egress fees
-
-### When to Use Docker
-
-**Best For:**
-- Local development consistency
-- Microservices architectures
-- Multi-language stack applications
-- Traditional VPS/VM deployments
-- Kubernetes orchestration
-- CI/CD build environments
-- Database containerization (dev/test)
-
-**Key Capabilities:**
-- Application isolation and portability
-- Multi-stage builds for optimization
-- Docker Compose for multi-container apps
-- Volume management for data persistence
-- Network configuration and service discovery
-- Cross-platform compatibility (amd64, arm64)
-
-**Cost Profile:** Infrastructure cost only (compute + storage)
-
-### When to Use Google Cloud
-
-**Best For:**
-- Enterprise-scale applications
-- Data analytics and ML pipelines (BigQuery, Vertex AI)
-- Hybrid/multi-cloud deployments
-- Kubernetes at scale (GKE)
-- Managed databases (Cloud SQL, Firestore, Spanner)
-- Complex IAM and compliance requirements
-
-**Key Services:**
-- Compute Engine (VMs)
-- GKE (managed Kubernetes)
-- Cloud Run (containerized serverless)
-- App Engine (PaaS)
-- Cloud Storage (object storage)
-- Cloud SQL (managed databases)
-
-**Cost Profile:** Varied pricing, sustained use discounts, committed use contracts
+| Need | Choose |
+|------|--------|
+| Sub-50ms latency globally | Cloudflare Workers |
+| Large file storage (zero egress) | Cloudflare R2 |
+| SQL database (global reads) | Cloudflare D1 |
+| Containerized workloads | Docker + Cloud Run/GKE |
+| Enterprise Kubernetes | GKE |
+| Managed relational DB | Cloud SQL |
+| Static site + API | Cloudflare Pages |
+| Container orchestration | Kubernetes |
+| Package management for K8s | Helm |
 
 ## Quick Start
 
-### Cloudflare Workers
-
-```bash
-# Install Wrangler CLI
-npm install -g wrangler
-
-# Create and deploy Worker
-wrangler init my-worker
-cd my-worker
-wrangler deploy
-```
-
-See: `references/cloudflare-workers-basics.md`
-
-### Docker Container
-
 ```bash
-# Create Dockerfile
-cat > Dockerfile <<EOF
-FROM node:20-alpine
-WORKDIR /app
-COPY package*.json ./
-RUN npm ci --production
-COPY . .
-EXPOSE 3000
-CMD ["node", "server.js"]
-EOF
-
-# Build and run
-docker build -t myapp .
-docker run -p 3000:3000 myapp
-```
+# Cloudflare Worker
+wrangler init my-worker && cd my-worker && wrangler deploy
 
-See: `references/docker-basics.md`
+# Docker
+docker build -t myapp . && docker run -p 3000:3000 myapp
 
-### Google Cloud Deployment
+# GCP Cloud Run
+gcloud run deploy my-service --image gcr.io/project/image --region us-central1
 
-```bash
-# Install and authenticate
-curl https://sdk.cloud.google.com | bash
-gcloud init
-gcloud auth login
-
-# Deploy to Cloud Run
-gcloud run deploy my-service \
-  --image gcr.io/project/image \
-  --region us-central1
+# Kubernetes
+kubectl apply -f manifests/ && kubectl get pods
 ```
 
-See: `references/gcloud-platform.md`
-
 ## Reference Navigation
 
 ### Cloudflare Platform
-- `cloudflare-platform.md` - Edge computing overview, key components
-- `cloudflare-workers-basics.md` - Getting started, handler types, basic patterns
-- `cloudflare-workers-advanced.md` - Advanced patterns, performance, optimization
-- `cloudflare-workers-apis.md` - Runtime APIs, bindings, integrations
-- `cloudflare-r2-storage.md` - R2 object storage, S3 compatibility, best practices
-- `cloudflare-d1-kv.md` - D1 SQLite database, KV store, use cases
-- `browser-rendering.md` - Puppeteer/Playwright automation on Cloudflare
-
-### Docker Containerization
-- `docker-basics.md` - Core concepts, Dockerfile, images, containers
-- `docker-compose.md` - Multi-container apps, networking, volumes
+- `cloudflare-platform.md` - Edge computing overview
+- `cloudflare-workers-basics.md` - Handler types, patterns
+- `cloudflare-workers-advanced.md` - Performance, optimization
+- `cloudflare-workers-apis.md` - Runtime APIs, bindings
+- `cloudflare-r2-storage.md` - Object storage, S3 compatibility
+- `cloudflare-d1-kv.md` - D1 SQLite, KV store
+- `browser-rendering.md` - Puppeteer automation
 
-### Google Cloud Platform
-- `gcloud-platform.md` - GCP overview, gcloud CLI, authentication
-- `gcloud-services.md` - Compute Engine, GKE, Cloud Run, App Engine
-
-### Python Utilities
-- `scripts/cloudflare-deploy.py` - Automate Cloudflare Worker deployments
-- `scripts/docker-optimize.py` - Analyze and optimize Dockerfiles
-
-## Common Workflows
-
-### Edge + Container Hybrid
-
-```yaml
-# Cloudflare Workers (API Gateway)
-# -> Docker containers on Cloud Run (Backend Services)
-# -> R2 (Object Storage)
-
-# Benefits:
-# - Edge caching and routing
-# - Containerized business logic
-# - Global distribution
-```
-
-### Multi-Stage Docker Build
-
-```dockerfile
-# Build stage
-FROM node:20-alpine AS build
-WORKDIR /app
-COPY package*.json ./
-RUN npm ci
-COPY . .
-RUN npm run build
+### Docker
+- `docker-basics.md` - Dockerfile, images, containers
+- `docker-compose.md` - Multi-container apps
 
-# Production stage
-FROM node:20-alpine
-WORKDIR /app
-COPY --from=build /app/dist ./dist
-COPY --from=build /app/node_modules ./node_modules
-USER node
-CMD ["node", "dist/server.js"]
-```
+### Google Cloud
+- `gcloud-platform.md` - gcloud CLI, authentication
+- `gcloud-services.md` - Compute Engine, GKE, Cloud Run
 
-### CI/CD Pipeline Pattern
+### Kubernetes
+- `kubernetes-basics.md` - Core concepts, architecture, workloads
+- `kubernetes-kubectl.md` - Essential commands, debugging workflow
+- `kubernetes-helm.md` / `kubernetes-helm-advanced.md` - Helm charts, templates
+- `kubernetes-security.md` / `kubernetes-security-advanced.md` - RBAC, secrets
+- `kubernetes-workflows.md` / `kubernetes-workflows-advanced.md` - GitOps, CI/CD
+- `kubernetes-troubleshooting.md` / `kubernetes-troubleshooting-advanced.md` - Debug
 
-```yaml
-# 1. Build: Docker multi-stage build
-# 2. Test: Run tests in container
-# 3. Push: Push to registry (GCR, Docker Hub)
-# 4. Deploy: Deploy to Cloudflare Workers / Cloud Run
-# 5. Verify: Health checks and smoke tests
-```
+### Scripts
+- `scripts/cloudflare-deploy.py` - Automate Worker deployments
+- `scripts/docker-optimize.py` - Analyze Dockerfiles
 
 ## Best Practices
 
-### Security
-- Run containers as non-root user
-- Use service account impersonation (GCP)
-- Store secrets in environment variables, not code
-- Scan images for vulnerabilities (Docker Scout)
-- Use API tokens with minimal permissions
-
-### Performance
-- Multi-stage Docker builds to reduce image size
-- Edge caching with Cloudflare KV
-- Use R2 for zero egress cost storage
-- Implement health checks for containers
-- Set appropriate timeouts and resource limits
-
-### Cost Optimization
-- Use Cloudflare R2 instead of S3 for large egress
-- Implement caching strategies (edge + KV)
-- Right-size container resources
-- Use sustained use discounts (GCP)
-- Monitor usage with cloud provider dashboards
-
-### Development
-- Use Docker Compose for local development
-- Wrangler dev for local Worker testing
-- Named gcloud configurations for multi-environment
-- Version control infrastructure code
-- Implement automated testing in CI/CD
-
-## Decision Matrix
-
-| Need | Choose |
-|------|--------|
-| Sub-50ms latency globally | Cloudflare Workers |
-| Large file storage (zero egress) | Cloudflare R2 |
-| SQL database (global reads) | Cloudflare D1 |
-| Containerized workloads | Docker + Cloud Run/GKE |
-| Enterprise Kubernetes | GKE |
-| Managed relational DB | Cloud SQL |
-| Static site + API | Cloudflare Pages |
-| WebSocket/real-time | Cloudflare Durable Objects |
-| ML/AI pipelines | GCP Vertex AI |
-| Browser automation | Cloudflare Browser Rendering |
+**Security:** Non-root containers, RBAC, secrets in env vars, image scanning
+**Performance:** Multi-stage builds, edge caching, resource limits
+**Cost:** R2 for large egress, caching, right-size resources
+**Development:** Docker Compose local dev, wrangler dev, version control IaC
 
 ## Resources
 
-- **Cloudflare Docs:** https://developers.cloudflare.com
-- **Docker Docs:** https://docs.docker.com
-- **GCP Docs:** https://cloud.google.com/docs
-- **Wrangler CLI:** https://developers.cloudflare.com/workers/wrangler/
-- **gcloud CLI:** https://cloud.google.com/sdk/gcloud
-
-## Implementation Checklist
-
-### Cloudflare Workers
-- [ ] Install Wrangler CLI
-- [ ] Create Worker project
-- [ ] Configure wrangler.toml (bindings, routes)
-- [ ] Test locally with `wrangler dev`
-- [ ] Deploy with `wrangler deploy`
-
-### Docker
-- [ ] Write Dockerfile with multi-stage builds
-- [ ] Create .dockerignore file
-- [ ] Test build locally
-- [ ] Push to registry
-- [ ] Deploy to target platform
-
-### Google Cloud
-- [ ] Install gcloud CLI
-- [ ] Authenticate with service account
-- [ ] Create project and enable APIs
-- [ ] Configure IAM permissions
-- [ ] Deploy and monitor resources
+- Cloudflare: https://developers.cloudflare.com
+- Docker: https://docs.docker.com
+- GCP: https://cloud.google.com/docs
+- Kubernetes: https://kubernetes.io/docs
+- Helm: https://helm.sh/docs

package/templates/skills/devops/references/kubernetes-basics.md

@@ -0,0 +1,99 @@
+# Kubernetes Core Concepts
+
+## Cluster Architecture
+
+```
+CONTROL PLANE                    WORKER NODES
+├── API Server (kubectl)         ├── Kubelet (node agent)
+├── Scheduler (pod placement)    ├── Kube-proxy (networking)
+├── Controller Manager           └── Container Runtime
+└── etcd (cluster state)
+```
+
+## Pod
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: myapp-pod
+spec:
+  containers:
+  - name: myapp
+    image: myapp:1.0
+    ports:
+    - containerPort: 8080
+    resources:
+      requests: { memory: "256Mi", cpu: "250m" }
+      limits: { memory: "512Mi", cpu: "500m" }
+```
+
+## Deployment
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myapp
+spec:
+  replicas: 3
+  strategy:
+    type: RollingUpdate
+    rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }
+  selector:
+    matchLabels: { app: myapp }
+  template:
+    metadata:
+      labels: { app: myapp }
+    spec:
+      containers:
+      - name: myapp
+        image: myapp:1.0
+```
+
+## Service
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: myapp-service
+spec:
+  type: ClusterIP  # ClusterIP, NodePort, LoadBalancer
+  selector: { app: myapp }
+  ports:
+  - port: 8080
+    targetPort: 8080
+```
+
+## ConfigMap & Secret
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: app-config
+data:
+  DATABASE_HOST: "postgres.svc.cluster.local"
+---
+apiVersion: v1
+kind: Secret
+type: Opaque
+stringData:
+  password: secretpassword
+```
+
+## Workload Types
+
+| Type | Use Case |
+|------|----------|
+| Deployment | Stateless apps |
+| StatefulSet | Databases |
+| DaemonSet | One per node |
+| Job | Batch tasks |
+| CronJob | Scheduled |
+
+## Labels
+```yaml
+labels:
+  app: myapp
+  version: v1.0.0
+  tier: frontend
+  environment: prod
+```

package/templates/skills/devops/references/kubernetes-helm-advanced.md

@@ -0,0 +1,75 @@
+# Helm Advanced - Templates & Hooks
+
+## Template Variables
+```yaml
+# templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "mychart.fullname" . }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  template:
+    spec:
+      containers:
+      - name: {{ .Chart.Name }}
+        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        {{- if .Values.resources }}
+        resources:
+          {{- toYaml .Values.resources | nindent 10 }}
+        {{- end }}
+```
+
+## Helper Templates
+```yaml
+# templates/_helpers.tpl
+{{- define "mychart.fullname" -}}
+{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "mychart.labels" -}}
+app.kubernetes.io/name: {{ .Chart.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+```
+
+## Hooks
+```yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "{{ .Release.Name }}-post-install"
+  annotations:
+    "helm.sh/hook": post-install
+    "helm.sh/hook-delete-policy": hook-succeeded
+spec:
+  template:
+    spec:
+      containers:
+      - name: post-install
+        command: ["/bin/sh", "-c", "echo 'Done'"]
+      restartPolicy: Never
+```
+
+Hook types: `pre-install`, `post-install`, `pre-upgrade`, `post-upgrade`
+
+## Packaging
+```bash
+helm package mychart
+helm repo index . --url https://charts.example.com
+helm push mychart-1.0.0.tgz oci://registry.example.com/helm
+helm repo add myrepo https://charts.example.com
+helm install myapp myrepo/mychart
+```
+
+## Commands
+
+| Command | Purpose |
+|---------|---------|
+| `helm create` | Create |
+| `helm lint` | Validate |
+| `helm template` | Render |
+| `helm install` | Deploy |
+| `helm upgrade` | Update |
+| `helm rollback` | Revert |
+| `helm uninstall` | Remove |