Defame1297
c705a38809
Produces docs/notes/skill-implementation-workflow.md with agreed conventions for all Chunk 3 skill issues (0017–0028). Key decisions: - Per-skill process: source discovery (sub-agent) → source review with licence/security check (sub-agent) → conflict check vs constitution + factory principles (sub-agent) → synthesis grill → co-write iteratively - Bootstrap: write-eval (hand-written) → write-skill (hand-written) → write-docs (first factory-authored, phase 2 of 0018) → everything else - Upstream review changed from per-chunk-start to per-skill - `when:` and `references:` frontmatter fields added to authoring standard - Sub-agent usage prescribed as named steps in the workflow - HITL: human reviewed and approved conventions Updates: PRD implementation decisions; issues 0016–0028 with specific acceptance criteria; docs/spec/overview.md; ROADMAP Chunk 3 housekeeping note (bootstrap order, cadence, acceptance criteria status); CONTEXT.md Source field (per-skill cadence, references: companion field); LESSONS.md with three patterns from the grill session. Post-grill additions (same session): Step 6 (session handoff) added to the workflow; handoff section appended to issue 0016; handoff checklist item added to Chunk 3 closure issue (0028). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
3.0 KiB
3.0 KiB
0026 — IaC skills: write-docker-compose, iac-security-review
Type: HITL
Parent PRD: docs/prd/chunk-3-skills-library.md
What to build
The 2 IaC domain skills scoped for Chunk 3. Both are new. The 5 deferred IaC skills (Ansible, Molecule, Terraform, K8s, Proxmox) are explicitly out of scope. Authored via write-skill (0018), evals via write-eval (0017).
Skills and trigger descriptions:
| Flat name | Trigger description |
|---|---|
write-docker-compose |
Write Docker Compose, compose stack for X |
iac-security-review |
Security review this IaC, check Terraform/Ansible for issues |
Key constraints per skill:
write-docker-compose: pinned image versions; secrets via env vars (never hardcoded); healthchecks included on all servicesiac-security-review: checks — hardcoded secrets, overly permissive access, missing resource limits, unpinned versions, Terraform provisioners (HashiCorp designates these "last resort"; break idempotency), non-idempotent Ansible patterns (shell/command withoutcreates:guards, missingnotify, unconditional handlers)
Implementation notes
Follow the per-skill workflow defined in docs/notes/skill-implementation-workflow.md.
Known upstream sources to review:
- Search GitHub and agentskills.io for open-source Docker Compose and IaC security review skills
- OWASP IaC security guidance for
iac-security-reviewchecklist - HashiCorp provisioner documentation (to understand and reference the "last resort" designation)
Acceptance criteria
- Both SKILL.md files exist at
.agents/skills/<skill-name>/SKILL.md;metadata.category: iac; authoring standard met write-docker-composedefaults to pinned versions, env-var secrets, and healthchecks without requiring the user to askiac-security-reviewcovers all listed check categories; non-idempotent Ansible patterns are explicitly enumeratedsource:fields populated for any adopted upstream content- Each skill has a co-located eval at
.agents/evals/iac/<skill-name>/eval.yamlviawrite-eval install.shdeploys both to~/.agents/skills/- HITL: human runs behavioral test per skill
- HITL: human reviews each SKILL.md and eval before committing
- Per-skill process followed for both skills: source discovery (sub-agent) → source review with licence/security check (sub-agent) → conflict check against constitution + factory principles (sub-agent) → synthesis grill → co-write iteratively
- Trigger description for each skill tested against explicit, implicit, and negative queries before body written
when:frontmatter field present in both SKILL.md filessource:andreferences:fields correctly populated or absent- eval.yaml for each skill contains all 5 required test types
- Body ≤500 lines for each skill
docs/spec/overview.mdupdated to reflect both skills deployed
Blocked by
- 0016 (per-skill workflow)
- 0017 (
write-eval) - 0018 (
write-skill)