kubemend 0.4.0__tar.gz

kubemend-0.4.0/.claude/commands/new-scenario.md

@@ -0,0 +1,7 @@
+Create a new fault-injection scenario named $ARGUMENTS.
+
+1. Read docs/knowledge/lab-and-evals.md (scenario format + checker rules) first.
+2. Propose scenario.yaml (scope, task_prompt written as an on-call human would phrase it, expected_outcome, symptom_probe) and the break.patch against lab/gitops — show me both before writing files.
+3. Write checker.py asserting PROPERTIES only (never diff equality); include at least: gate passed (or handoff-without-PR for negative scenarios), scope compliance, and one scenario-specific rendered-value predicate.
+4. Run it once end-to-end with the cheap model: `task evals -- -s $ARGUMENTS -n 1 --model cheap`, and paste the checker report.
+5. If it fails, write the triage note per the eval rules before changing anything.

kubemend-0.4.0/.claude/commands/replay-trace.md

@@ -0,0 +1,5 @@
+Replay and analyze trace $ARGUMENTS.
+
+1. Run `kubemend trace replay $ARGUMENTS` and reconstruct the run timeline: iterations, tool calls with durations/raw_bytes, truncations, verdicts, cost.
+2. Identify the decisive moment (wrong hypothesis, missed evidence due to truncation, loop, gate failure) with event references.
+3. Recommend exactly one of: new unit fixture, new scenario, tool contract change, prompt change — with a one-paragraph justification referencing harness-design.md trade-offs.

kubemend-0.4.0/.claude/commands/run-evals.md

@@ -0,0 +1,6 @@
+Run an eval sweep and summarize.
+
+1. Ensure the lab is up (`task lab:up` is idempotent).
+2. Run: `task evals -- --scenarios all -n ${1:-5} --model ${2:-cheap}`.
+3. Present the report table (pass, iters avg, cost avg, p95 wall) and compare against the latest committed report in evals/reports/ — call out every regression explicitly.
+4. For each scenario below its previous pass rate, open the worst failing trace and give a one-paragraph diagnosis per docs/knowledge/lab-and-evals.md triage rules. Do NOT change prompts or code in this session.

kubemend-0.4.0/.claude/settings.json

@@ -0,0 +1,16 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(task test:*)", "Bash(task lint:*)", "Bash(task evals:*)",
+      "Bash(task lab:up)", "Bash(task lab:forward)",
+      "Bash(uv run:*)", "Bash(uv add:*)",
+      "Bash(git status)", "Bash(git diff:*)", "Bash(git log:*)", "Bash(git add:*)", "Bash(git commit:*)"
+    ],
+    "deny": [
+      "Bash(kubectl apply:*)", "Bash(kubectl delete:*)", "Bash(kubectl edit:*)", "Bash(kubectl patch:*)",
+      "Bash(helm install:*)", "Bash(helm upgrade:*)", "Bash(helm uninstall:*)",
+      "Bash(git push --force:*)", "Bash(git push origin main:*)",
+      "Read(.lab/**)"
+    ]
+  }
+}

kubemend-0.4.0/.dockerignore

@@ -0,0 +1,19 @@
+.git
+.github
+.venv
+.lab
+.mypy_cache
+.pytest_cache
+.ruff_cache
+__pycache__
+*.pyc
+traces
+evals/reports
+tests
+docs
+charts
+lab
+*.md
+!README.md
+.dockerignore
+Dockerfile

kubemend-0.4.0/.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - uses: go-task/setup-task@v1
+        with:
+          version: 3.x
+
+      - name: Install dependencies
+        run: uv sync --locked
+
+      # ruff check + ruff format --check + mypy --strict, zero warnings.
+      - name: Lint and typecheck
+        run: task lint
+
+      # Unit tests only; `lab`-marked integration tests need a kind cluster
+      # and `docker`-marked ones need a Docker daemon — both are excluded by
+      # the default pytest addopts.
+      - name: Unit tests
+        run: task test
+
+      # helm lint + a render smoke test across the chart's real value
+      # permutations (default, cluster-scoped RBAC, job-enabled).
+      - name: Helm chart lint
+        run: task chart:lint

kubemend-0.4.0/.github/workflows/release.yml

@@ -0,0 +1,145 @@
+name: Release
+
+# Triggered by pushing an annotated tag (v0.1, v0.2, ...). GitHub reads this
+# workflow from the tag's own commit, so it only fires for tags pushed after
+# this file first landed on main. workflow_dispatch is a manual fallback to
+# (re-)publish the release for a tag that already exists, without pushing
+# anything new — e.g. if the tag-push run failed partway through.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing tag to (re-)publish a release for"
+        required: true
+        type: string
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ inputs.tag || github.ref_name }}
+          # Auto-generated from merged PRs since the previous tag (or since
+          # the repo's start, for the first release).
+          generate_release_notes: true
+
+  # -- M8a: multi-arch container image, published to ghcr.io ------------------
+  #
+  # Native arm64 + amd64 runners (ubuntu-24.04-arm is free and unlimited on
+  # public repos as of 2025) rather than QEMU emulation — each leg builds and
+  # pushes its own single-arch image by digest, and merge-manifest below
+  # combines the two digests into one multi-arch manifest under the release
+  # tag. Splitting it this way is the documented way to avoid QEMU: a single
+  # buildx invocation targeting both platforms on one runner would emulate
+  # whichever platform isn't native to that runner.
+  build-container:
+    strategy:
+      matrix:
+        include:
+          - platform: linux/amd64
+            runs-on: ubuntu-24.04
+            digest-name: amd64
+          - platform: linux/arm64
+            runs-on: ubuntu-24.04-arm
+            digest-name: arm64
+    runs-on: ${{ matrix.runs-on }}
+    permissions:
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          platforms: ${{ matrix.platform }}
+          push: true
+          outputs: type=image,name=ghcr.io/${{ github.repository }},push-by-digest=true,name-canonical=true
+
+      - name: Export digest for the merge job
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ matrix.digest-name }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge-manifest:
+    needs: build-container
+    runs-on: ubuntu-24.04
+    permissions:
+      packages: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create the multi-arch manifest and push it
+        working-directory: /tmp/digests
+        run: |
+          set -eu
+          IMAGE=ghcr.io/${{ github.repository }}
+          TAG=${{ inputs.tag || github.ref_name }}
+          refs=()
+          for digest in *; do
+            refs+=("$IMAGE@sha256:$digest")
+          done
+          docker buildx imagetools create -t "$IMAGE:$TAG" -t "$IMAGE:latest" "${refs[@]}"
+
+  # -- M8a: PyPI publish --------------------------------------------------
+  #
+  # Trusted publishing (OIDC, no stored secret) — requires a one-time,
+  # manual registration on PyPI's own site first: pypi.org project settings
+  # -> "Add a new pending publisher" -> this repo, this workflow filename,
+  # environment left blank unless one is added below. Until that's done,
+  # this job will fail at the publish step with an authorization error;
+  # the build step itself has no such dependency and always works.
+  publish-pypi:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
+      - uses: astral-sh/setup-uv@v5
+
+      - name: Build sdist + wheel
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

kubemend-0.4.0/.gitignore

@@ -0,0 +1,17 @@
+.venv/
+__pycache__/
+*.py[cod]
+*.egg-info/
+dist/
+build/
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+
+# Lab credentials and generated kubeconfigs (never committed)
+.lab/
+
+# Per-run JSONL traces
+traces/

kubemend-0.4.0/.python-version

@@ -0,0 +1 @@
+3.12