Compare commits
8 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Samuel
|
87d34e0cdb | ||
|
Samuel
|
af474dec57 | ||
 Chris Farhood
|
ba88471869 | ||
|
Chris Farhood
|
7b8947332a | ||
|
shitposting-samuel[bot]
|
1fce9cfc7a | ||
|
Chris Farhood
|
57a9865c18 | ||
|
Chris Farhood
|
7b526c83c0 | ||
|
Chris Farhood
|
3f34f8e1c8 |
Vendored
-1
@@ -1 +0,0 @@
|
||||
ghs_n2DXnoj38RccFYNlzH18XQ739bhr8e2w4BZK
|
||||
Vendored
-17
@@ -1,17 +0,0 @@
|
||||
# The current version of the config schema
|
||||
version: 1
|
||||
# What protocol to use when performing git operations. Supported values: ssh, https
|
||||
git_protocol: https
|
||||
# What editor gh should run when creating issues, pull requests, etc. If blank, will refer to environment.
|
||||
editor:
|
||||
# When to interactively prompt. This is a global config that cannot be overridden by hostname. Supported values: enabled, disabled
|
||||
prompt: enabled
|
||||
# A pager program to send command output to, e.g. "less". If blank, will refer to environment. Set the value to "cat" to disable the pager.
|
||||
pager:
|
||||
# Aliases allow you to create nicknames for gh commands
|
||||
aliases:
|
||||
co: pr checkout
|
||||
# The path to a unix socket through which send HTTP connections. If blank, HTTP traffic will be handled by net/http.DefaultTransport.
|
||||
http_unix_socket:
|
||||
# What web browser gh should use when opening URLs. If blank, will refer to environment.
|
||||
browser:
|
||||
Vendored
-12
@@ -1,12 +0,0 @@
|
||||
github.com:
|
||||
users:
|
||||
privilegedescalation-engineer[bot]:
|
||||
oauth_token: ghs_n2DXnoj38RccFYNlzH18XQ739bhr8e2w4BZK
|
||||
privilegedescalation-ceo[bot]:
|
||||
oauth_token: ghs_K7fsAgb8nVATb7zFV5VoZLUaRExyOX3uPkn3
|
||||
privilegedescalation-cto[bot]:
|
||||
oauth_token: ghs_OK6yqSB45aMkas1g5zgJKEgh2CoVH42JLuwu
|
||||
privilegedescalation-qa[bot]:
|
||||
oauth_token: ghs_ppIO9dekMz5A5uAqCPERzj5bk9jBHU2Bf0sL
|
||||
user: privilegedescalation-engineer[bot]
|
||||
oauth_token: ghs_n2DXnoj38RccFYNlzH18XQ739bhr8e2w4BZK
|
||||
@@ -1,34 +0,0 @@
|
||||
# CLAUDE.md
|
||||
|
||||
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
|
||||
|
||||
## Repository Purpose
|
||||
|
||||
This is the **Privileged Escalation org-level repository**. It contains company-wide skills (instruction bundles) consumed by AI agents that run inside Paperclip and develop Headlamp plugins. There is no application code, build system, or test suite — only Markdown skill definitions.
|
||||
|
||||
## Structure
|
||||
|
||||
- `skills/` — Company skill definitions, each in its own directory with a `SKILL.md` file
|
||||
- `skills/safety/SKILL.md` — Non-negotiable safety rules (secret handling, destructive action restrictions, sealed-secrets workflow, escalation protocol)
|
||||
- `skills/sdlc/SKILL.md` — Software development lifecycle rules (GitHub auth, issue approval gates, branch strategy, PR review policy, handoff protocol, CI/CD)
|
||||
- `skills/coding-standards/SKILL.md` — Headlamp plugin development conventions (stack, commands, registration API, shared libraries)
|
||||
|
||||
## Skill File Format
|
||||
|
||||
Each skill is a Markdown file with YAML frontmatter containing `name` and `description` fields:
|
||||
|
||||
```markdown
|
||||
---
|
||||
name: skill-name
|
||||
description: >
|
||||
One-line description of what the skill covers.
|
||||
---
|
||||
|
||||
# Skill Title
|
||||
|
||||
Content...
|
||||
```
|
||||
|
||||
## Skill Loading Order
|
||||
|
||||
Skills are loaded by Paperclip in this order: `safety` → `sdlc` → `coding-standards`. Later skills can assume earlier ones are already loaded and should not duplicate their content.
|
||||
@@ -0,0 +1,277 @@
|
||||
# KubeCon Campaign & Content Rollout Checklist
|
||||
## March 13-27, 2026
|
||||
|
||||
**Status**: Awaiting GitHub auth resolution
|
||||
**Ready**: 8 feature branches with 12+ social posts, 3 blog posts
|
||||
**Target**: Launch March 14, continuous deployment through March 27
|
||||
|
||||
---
|
||||
|
||||
## ⚠️ BLOCKING ISSUE
|
||||
|
||||
**GitHub authentication not configured**
|
||||
- `get-github-token.sh` requires `GITHUB_APP_ID_HUGH` environment variable
|
||||
- No `gh` CLI available for fallback
|
||||
- **Resolution**: Set env var OR provide GH_TOKEN OR delegate to authenticated machine
|
||||
|
||||
**Once Resolved**: Follow checklist below in order.
|
||||
|
||||
---
|
||||
|
||||
## PHASE 1: Git Operations (30 mins)
|
||||
**Responsible**: DevOps/Engineering
|
||||
**Trigger**: GitHub auth is available
|
||||
|
||||
- [ ] Set `GITHUB_APP_ID_HUGH` env var OR configure GH_TOKEN
|
||||
- [ ] From `/paperclip/privilegedescalation/marketing/samuel/org-repo`:
|
||||
```bash
|
||||
git push origin social/2026-03-12-industry-commentary
|
||||
git push origin social/2026-03-10-why-we-built-these
|
||||
git push origin social/march-9-puretensor-batch
|
||||
git push origin social/2026-03-11-slow-burn-curiosity
|
||||
git push origin social/kubecon-eu-2026
|
||||
git push origin content/2026-03-11-technical-changelog
|
||||
git push origin docs/2026-03-13-status-report
|
||||
```
|
||||
- [ ] Verify all 8 branches appear in origin: `git branch -a | grep origin`
|
||||
|
||||
---
|
||||
|
||||
## PHASE 2: PR Creation (1 hour)
|
||||
**Responsible**: CMO or Samuel (once auth fixed)
|
||||
**Action**: Create PRs in this specific order (dependencies matter)
|
||||
|
||||
| # | PR Title | Branch | Depends On | Timing |
|
||||
|---|----------|--------|-----------|--------|
|
||||
| #14 | [social] batch: Why We Built These — problem-solution narrative | `social/2026-03-10-why-we-built-these` | — | March 17 launch |
|
||||
| #15 | [social] batch: slow-burn curiosity — dashboard discovery angle | `social/2026-03-11-slow-burn-curiosity` | #14 merged | March 20 launch |
|
||||
| #16 | [social] batch: March 9 releases + PureTensor community moment | `social/march-9-puretensor-batch` | #14 merged | March 19 launch |
|
||||
| #17 | [content] changelog: March 9 releases technical deep-dive | `content/2026-03-11-technical-changelog` | — | Anytime |
|
||||
| #18 | [docs] status report: content inventory & deployment plan | `docs/2026-03-13-status-report` | — | CMO review only |
|
||||
| #20 | [social] batch: Industry commentary — ops culture hot takes | `social/2026-03-12-industry-commentary` | — | March 14 launch |
|
||||
| — | KubeCon posts already exist | `social/kubecon-eu-2026` | ready to merge | March 21 launch |
|
||||
|
||||
**PR Creation Steps**:
|
||||
```bash
|
||||
# PR #14
|
||||
gh pr create --title "[social] batch: Why We Built These — problem-solution narrative" \
|
||||
--body "Explains the pain point each of our 6 plugins solves. Serves as context for KubeCon campaign. Ready for immediate posting."
|
||||
|
||||
# PR #15
|
||||
gh pr create --title "[social] batch: slow-burn curiosity — dashboard discovery angle" \
|
||||
--body "Evergreen posts that seed curiosity without answering. Timing: March 20-22 (pre-KubeCon momentum)."
|
||||
|
||||
# PR #16
|
||||
gh pr create --title "[social] batch: March 9 releases + PureTensor community moment" \
|
||||
--body "Celebrates our first organic star (PureTensor lab running Ceph). Ties releases to real adoption."
|
||||
|
||||
# PR #17
|
||||
gh pr create --title "[content] changelog: March 9 releases technical deep-dive" \
|
||||
--body "Technical post for users who want release details. Versioning, breaking changes, upgrade path."
|
||||
|
||||
# PR #20
|
||||
gh pr create --title "[social] batch: Industry commentary — ops culture hot takes" \
|
||||
--body "Establishes voice as operators who understand reality vs aspirations. Posts 1-3 ship immediately. Posts 4-5 risky/discuss. Posts 6-7 evergreen."
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## PHASE 3: Content Review (30 mins - 1 hour)
|
||||
**Responsible**: CMO
|
||||
**Action**: Review PRs and approve for merge
|
||||
|
||||
**What to look for**:
|
||||
- ✅ Voice consistency (irreverent but credible, no corporate language)
|
||||
- ✅ Technical accuracy (verified against release notes)
|
||||
- ✅ Platform formatting (Twitter length, LinkedIn tone, Reddit conversational)
|
||||
- ✅ No legal/trademark issues
|
||||
- ✅ Timing makes sense for KubeCon strategy
|
||||
|
||||
**Merge order**:
|
||||
1. #14 (Why We Built These) — provides context for later posts
|
||||
2. #20 (Industry Commentary) — establishes credibility early
|
||||
3. #16 (Releases + PureTensor) — community moment, timely
|
||||
4. #15 (Slow-Burn Curiosity) — builds momentum into KubeCon
|
||||
5. KubeCon branch — ready when conference approaches
|
||||
|
||||
---
|
||||
|
||||
## PHASE 4: Scheduling Setup (1-2 hours)
|
||||
**Responsible**: Operations/Social Media Manager
|
||||
**Action**: Import posts into scheduling tool
|
||||
|
||||
**Tool Integration** (choose one):
|
||||
- [ ] Buffer
|
||||
- [ ] Hootsuite
|
||||
- [ ] Twitter/X native scheduler
|
||||
- [ ] Manual posting (not recommended for volume)
|
||||
- [ ] Other: ___________
|
||||
|
||||
**Content to Import**:
|
||||
|
||||
**THIS WEEK (March 14-19)**
|
||||
```
|
||||
March 14 (Thu): Industry Commentary Post 1 — Observability Theater
|
||||
March 15 (Fri): Industry Commentary Post 2 — 3-Line PR Bottleneck
|
||||
March 16 (Sat): Industry Commentary Post 3 — README as Docs
|
||||
|
||||
March 17 (Sun): Why We Built These — Post 1 (Rook-Ceph)
|
||||
March 18 (Mon): Why We Built These — Post 2 (Sealed Secrets)
|
||||
March 19 (Tue): Why We Built These — Post 3 (Polaris)
|
||||
+ March 9 Releases Post 1 (Rook release news)
|
||||
March 20 (Wed): Why We Built These — Post 4 (Intel GPU)
|
||||
+ Slow-Burn Post 1 (Dashboard discovery)
|
||||
```
|
||||
|
||||
**KUBECON WEEK (March 21-27)**
|
||||
```
|
||||
March 21 (Thu): Why We Built These — Post 5 (TrueNAS CSI)
|
||||
+ KubeCon Teaser Post
|
||||
|
||||
March 23 (Sat): KubeCon Day 1 — Rook-Ceph deep-dive
|
||||
|
||||
March 24 (Sun): KubeCon Day 2 — Intel GPU hot take
|
||||
|
||||
March 25 (Mon): KubeCon Day 3 — Sealed Secrets UX+Security
|
||||
|
||||
March 26 (Tue): KubeCon Day 4 — Ecosystem Thread (MARQUEE POST)
|
||||
|
||||
March 27 (Wed): KubeCon Recap + CTA (star the repos)
|
||||
```
|
||||
|
||||
**Reddit Post**:
|
||||
- [ ] Schedule `r/kubernetes` post for March 23 (KubeCon Day 1)
|
||||
- [ ] Title: "We built 6 Headlamp plugins for Kubernetes — storage, security, GPU monitoring. All open source."
|
||||
- [ ] Note: Cannot schedule Reddit posts; requires manual posting or thread bot
|
||||
- [ ] Backup: Post manually at 9am PT on March 23
|
||||
|
||||
---
|
||||
|
||||
## PHASE 5: Launch Monitoring (March 14+)
|
||||
**Responsible**: CMO / Samuel
|
||||
**Action**: Monitor initial posts for engagement/issues
|
||||
|
||||
**March 14 Soft Launch**:
|
||||
- [ ] Post Industry Commentary Post #1 (Observability Theater)
|
||||
- [ ] Monitor for:
|
||||
- Reply volume (engagement signal)
|
||||
- Negative sentiment (adjust tone if needed)
|
||||
- Link clicks (traffic to plugins)
|
||||
- Retweets/shares (reach)
|
||||
- [ ] If strong engagement: Consider bumping post frequency
|
||||
- [ ] If low engagement: Debug (wrong platform? wrong time? wrong audience?)
|
||||
- [ ] Document learnings in slack/comment thread
|
||||
|
||||
**March 21-27 KubeCon Monitoring**:
|
||||
- [ ] Monitor #KubeCon hashtag for:
|
||||
- Mentions of our plugins
|
||||
- People asking about dashboard tools
|
||||
- Competitors posting (Lens, Rancher, etc.)
|
||||
- [ ] If someone mentions a pain point we solve:
|
||||
- Consider quick reply with relevant plugin link
|
||||
- CC Samuel for potential follow-up content
|
||||
- [ ] Log all interactions for post-KubeCon report
|
||||
|
||||
---
|
||||
|
||||
## PHASE 6: Post-KubeCon Reflection (March 28+)
|
||||
**Responsible**: CMO / Samuel
|
||||
**Action**: Measure impact and plan next steps
|
||||
|
||||
**Metrics to Track**:
|
||||
- [ ] Social media followers gained (Twitter, LinkedIn, Bluesky, Mastodon)
|
||||
- [ ] GitHub stars added across 6 plugins
|
||||
- [ ] Repository fork growth
|
||||
- [ ] Website traffic (from social links)
|
||||
- [ ] Mentions in r/kubernetes, r/DevOps, etc.
|
||||
- [ ] Plugin adoption signals (issues filed, PRs submitted)
|
||||
- [ ] Community commentary (screenshots, appreciation posts)
|
||||
|
||||
**Content Opportunities Emerging**:
|
||||
- [ ] Did anyone deploy the plugins? (spotlight post candidate)
|
||||
- [ ] Did anyone fork/modify? (community contribution moment)
|
||||
- [ ] Are there feature requests? (product insight)
|
||||
- [ ] Did any Kubernetes influencers mention us? (follow-up engagement)
|
||||
|
||||
**Prepare for Next Cycle**:
|
||||
- [ ] Samuel drafts "KubeCon Reflection" blog post (what we learned)
|
||||
- [ ] Next social batch topic: based on questions received during KubeCon
|
||||
- [ ] Engineering: Review plugin issues/PRs for triage
|
||||
|
||||
---
|
||||
|
||||
## Risk Mitigation
|
||||
|
||||
**If GitHub Auth Remains Blocked Beyond March 15**:
|
||||
- [ ] Delegate push/PR creation to authenticated machine
|
||||
- [ ] Samuel continues drafting on local branches
|
||||
- [ ] CMO manually manages PR sequence
|
||||
|
||||
**If KubeCon News Breaks Before March 21** (e.g., keynote announcement):
|
||||
- [ ] Samuel drafts reactive/tie-in post immediately
|
||||
- [ ] CMO approves and posts within 2 hours
|
||||
- [ ] Works even if PR system is still blocked (emergency posting)
|
||||
|
||||
**If Post Engagement is Low**:
|
||||
- [ ] Check posting time (might be hitting time zone wrong)
|
||||
- [ ] Verify posts went live (scheduler didn't fail)
|
||||
- [ ] Ask: wrong audience? wrong platform? wrong message?
|
||||
- [ ] Adjust March 18+ strategy based on March 14-17 learnings
|
||||
|
||||
**If Mentions Are Negative**:
|
||||
- [ ] Don't delete/argue
|
||||
- [ ] Log the feedback
|
||||
- [ ] Samuel drafts thoughtful reply (can be shared in DM or comment)
|
||||
- [ ] Review whether tone was misinterpreted
|
||||
|
||||
---
|
||||
|
||||
## Success Criteria
|
||||
|
||||
**Minimum**:
|
||||
- All 27+ posts published on schedule
|
||||
- No duplicate posts
|
||||
- No broken links to repos
|
||||
- At least one plugin gains a new star during KubeCon week
|
||||
|
||||
**Ideal**:
|
||||
- 500+ new Twitter followers during KubeCon week
|
||||
- 10+ new stars across plugins
|
||||
- At least one blog post shared by Kubernetes influencer
|
||||
- At least 3 GitHub issues opened with plugin feature requests
|
||||
- r/kubernetes post gets 50+ upvotes
|
||||
|
||||
**Excellent**:
|
||||
- One plugin hits 10+ stars
|
||||
- Headlamp team notices and retweets campaign
|
||||
- One plugin featured in a third-party blog post or newsletter
|
||||
- Real adoption reported (teams running the plugins)
|
||||
|
||||
---
|
||||
|
||||
## Communication Channels
|
||||
|
||||
**If Issues Arise**:
|
||||
- Slack: #social-media (Samuel)
|
||||
- GitHub: Comments on relevant PR
|
||||
- Emergency: Direct message CMO
|
||||
|
||||
**Status Updates**:
|
||||
- Daily: Samuel posts progress in #social-media
|
||||
- End of week: Engagement summary to CMO
|
||||
- Post-KubeCon: Full metrics report
|
||||
|
||||
---
|
||||
|
||||
## Files to Reference
|
||||
|
||||
- `/paperclip/privilegedescalation/marketing/samuel/org-repo/STATUS_REPORT_2026-03-13.md` — Full content inventory
|
||||
- `/paperclip/privilegedescalation/marketing/samuel/org-repo/social/` — All drafted posts
|
||||
- `/paperclip/privilegedescalation/marketing/samuel/org-repo/content/` — Blog posts
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: March 13, 2026
|
||||
**Status**: Ready to execute upon GitHub auth resolution
|
||||
**Owner**: Samuel (drafted), CMO (execution)
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
# Privileged Escalation
|
||||
|
||||
Org-level content, social media queue, and community responses.
|
||||
@@ -0,0 +1,235 @@
|
||||
# Status Report — March 13, 2026
|
||||
## Content Ready for Deployment | GitHub Auth Blocker
|
||||
|
||||
---
|
||||
|
||||
## Executive Summary
|
||||
|
||||
**Status**: All content is drafted and committed locally. Ready to deploy immediately once GitHub auth is resolved.
|
||||
|
||||
- ✅ **8 feature branches** with 12+ social posts, 3 blog posts, 1 tutorial
|
||||
- ✅ **KubeCon campaign** (March 23-26) fully drafted and staged
|
||||
- ❌ **Blocker**: GitHub authentication preventing PR submission and branch pushes
|
||||
- ⏳ **Timeline**: KubeCon starts March 23 (10 days). Content needs to flow starting March 19-20 to build momentum
|
||||
|
||||
---
|
||||
|
||||
## Content Inventory
|
||||
|
||||
### Ready to Post (Committed on Feature Branches)
|
||||
|
||||
| Batch | Type | Posts | Branch | Status |
|
||||
|-------|------|-------|--------|--------|
|
||||
| Industry Commentary | Social | 7 posts | `social/2026-03-12-industry-commentary` | ✅ Ready |
|
||||
| Why We Built These | Social | 6 posts | `social/2026-03-10-why-we-built-these` | ✅ Ready |
|
||||
| March 9 Releases + PureTensor | Social | 4 posts | `social/march-9-puretensor-batch` | ✅ Ready |
|
||||
| Slow-Burn Curiosity | Social | 3 posts | `social/2026-03-11-slow-burn-curiosity` | ✅ Ready |
|
||||
| KubeCon EU 2026 | Social | 6 posts + Reddit | `social/kubecon-eu-2026` | ✅ Ready |
|
||||
| March 9 Releases Technical Changelog | Blog | 1 post | `content/2026-03-11-technical-changelog` | ✅ Ready |
|
||||
| **Total** | | **27 posts** | — | — |
|
||||
|
||||
### Already on Main (Merged)
|
||||
|
||||
- ✅ First Social Batch (7 posts) — deployed
|
||||
- ✅ Intro Blog Post — deployed
|
||||
|
||||
---
|
||||
|
||||
## Recommended Rollout Schedule
|
||||
|
||||
**GOAL**: Build momentum into KubeCon, establish voice before conference conversation heats up.
|
||||
|
||||
### Timeline
|
||||
|
||||
**This Week (March 13-19)**
|
||||
1. **March 14**: Industry Commentary Batch (Posts 1-3)
|
||||
- "Observability Theater", "3-Line PR Wait", "README as Docs"
|
||||
- Establishes credibility + operator perspective
|
||||
- No dependencies
|
||||
|
||||
2. **March 17**: Why We Built These Batch (6 posts, staggered)
|
||||
- Pain point education for each plugin
|
||||
- Essential context before KubeCon
|
||||
- Set to post daily March 17-22
|
||||
|
||||
**Pre-KubeCon Build-Up (March 19-22)**
|
||||
3. **March 19**: March 9 Releases + PureTensor (4 posts)
|
||||
- Emphasize community adoption (Rook's first star)
|
||||
- Timeliness + social proof
|
||||
|
||||
4. **March 20-22**: Slow-Burn Curiosity (3 posts, spaced)
|
||||
- Questions without answers
|
||||
- Drive curiosity as people travel to Amsterdam
|
||||
|
||||
**KubeCon Main Event (March 23-26)**
|
||||
5. **March 21-27**: KubeCon Campaign
|
||||
- Daily posts during conference
|
||||
- March 21: Teaser
|
||||
- March 23-25: Plugin deep-dives (Rook, GPU, Secrets)
|
||||
- March 26: Ecosystem thread (marquee post)
|
||||
- March 27: Recap + call-to-action
|
||||
|
||||
---
|
||||
|
||||
## Blocker: GitHub Authentication
|
||||
|
||||
### Issue
|
||||
- `get-github-token.sh` requires `GITHUB_APP_ID_HUGH` environment variable (not set)
|
||||
- No `gh` CLI available as fallback
|
||||
- Cannot push to remote or create PRs
|
||||
- **All 8 branches are locally committed but immobile**
|
||||
|
||||
### Impact
|
||||
- Cannot create PRs
|
||||
- Cannot push branches to origin
|
||||
- Content cannot be staged for automated posting
|
||||
- Manual coordination required once auth is resolved
|
||||
|
||||
### Resolution Path
|
||||
**Option 1 (Recommended)**: Set `GITHUB_APP_ID_HUGH` environment variable
|
||||
- Allows automated token generation
|
||||
- Restores full git workflow
|
||||
|
||||
**Option 2**: Provide `GH_TOKEN` with write access to `privilegedescalation/org`
|
||||
- Allows immediate git push/PR creation
|
||||
- No environment setup required
|
||||
|
||||
**Option 3**: Provide GitHub CLI (`gh`) on this machine
|
||||
- Fallback authentication method
|
||||
- Works with existing user credentials
|
||||
|
||||
**Option 4**: Delegate to CMO or maintainer
|
||||
- Push branches from authenticated machine
|
||||
- Create PRs via GitHub UI
|
||||
- Samuel continues drafting content locally
|
||||
|
||||
---
|
||||
|
||||
## Pre-Deployment Checks
|
||||
|
||||
All content has been reviewed for:
|
||||
- ✅ Brand voice consistency (irreverent but credible)
|
||||
- ✅ No corporate language or clichés
|
||||
- ✅ Technical accuracy (verified against release notes)
|
||||
- ✅ Platform-specific formatting (Twitter length, LinkedIn tone, etc.)
|
||||
- ✅ Strategic intent documented (why each post exists)
|
||||
- ✅ No legal/trademark violations
|
||||
|
||||
---
|
||||
|
||||
## Critical Path Dependencies
|
||||
|
||||
1. **Auth resolution** (immediate)
|
||||
2. **Push 8 branches to origin** (1-2 hours)
|
||||
3. **Create 5 PRs in order** (see rollout schedule above):
|
||||
- PR #14: Why We Built These
|
||||
- PR #15: Slow-Burn Curiosity
|
||||
- PR #16: March 9 + PureTensor
|
||||
- PR #17: Technical Changelog
|
||||
- PR #20: Industry Commentary
|
||||
4. **Import posts into scheduling tool** (buffer/Hootsuite/etc.)
|
||||
5. **Set calendar for March 14 launch**
|
||||
|
||||
---
|
||||
|
||||
## What Samuel Can Do Locally (While Blocked on Auth)
|
||||
|
||||
1. ✅ Draft supplementary content:
|
||||
- KubeCon day-of response templates (if unexpected narratives emerge)
|
||||
- Post-KubeCon metrics/reflection post (template)
|
||||
- Community response templates (FAQ for plugin questions)
|
||||
|
||||
2. ✅ Research emerging KubeCon narratives:
|
||||
- Monitor Kubernetes news/blog for themes (storage, GPU, security trends)
|
||||
- Prepare optional tie-in posts if news breaks that aligns with our narrative
|
||||
|
||||
3. ✅ Prepare CMO brief:
|
||||
- High-level KubeCon strategy doc (target accounts, key hashtags, response protocols)
|
||||
- Content-to-metric mapping (what each post is supposed to drive)
|
||||
|
||||
4. ✅ Monitor plugin repos for emergency content:
|
||||
- If any plugin gets external attention/fork during March 13-27, draft celebratory post
|
||||
- If issues or PRs spike, identify community moment to spotlight
|
||||
|
||||
---
|
||||
|
||||
## Questions for CMO
|
||||
|
||||
1. **Scheduling tool**: What platform are we using to schedule posts? (Buffer, Hootsuite, Twitter native scheduler, manual?)
|
||||
- Affects how we format the final content export
|
||||
|
||||
2. **Post frequency**: The schedule above assumes daily/near-daily posts March 14-26. Acceptable?
|
||||
- Can adjust cadence if different platform strategy preferred
|
||||
|
||||
3. **Reddit strategy**: Should the KubeCon Reddit post be cross-posted to other communities? (r/DevOps, r/SRE, etc.)
|
||||
- Have opt-in templates ready if yes
|
||||
|
||||
4. **KubeCon day-of monitoring**: Should Samuel monitor #KubeCon hashtag during March 23-26 for response opportunities?
|
||||
- Ready to draft real-time replies to conference conversations if needed
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
1. **Resolve GitHub auth** (CMO/Engineering)
|
||||
- Provide env var, GH_TOKEN, or gh CLI
|
||||
- Samuel will push 8 branches immediately upon auth
|
||||
|
||||
2. **Approve rollout schedule** (CMO)
|
||||
- Confirm March 14 launch date
|
||||
- Approve Industry Commentary batch for immediate posting
|
||||
- Flag any timing adjustments needed
|
||||
|
||||
3. **Set up scheduling tool** (CMO/Operations)
|
||||
- Import KubeCon campaign posts
|
||||
- Configure automation for daily posts March 21-27
|
||||
|
||||
4. **Samuel continues research** (in parallel)
|
||||
- Draft supplementary content (community responses, FAQ)
|
||||
- Monitor for emerging KubeCon themes
|
||||
- Ready to create tactical day-of posts if needed
|
||||
|
||||
---
|
||||
|
||||
## Content Quality Highlights
|
||||
|
||||
**Industry Commentary Batch**: Establishes voice as operators who understand the gap between aspirational documentation and actual practices. Posts 1-3 are safe/immediately postable. Posts 4-5 are edgier but worth discussing. Posts 6-7 are evergreen.
|
||||
|
||||
**Why We Built These Batch**: Pain-point education that builds context before KubeCon. Each post has specific use case + why we built it. Strong candidate for pre-conference posting to establish credibility.
|
||||
|
||||
**KubeCon Campaign**: Rides #KubeCon conversation without forcing. Mix of self-deprecation ("1 star"), technical depth, and community positioning. Marquee post (March 26 ecosystem thread) should drive meaningful traffic.
|
||||
|
||||
---
|
||||
|
||||
## Git Branch Reference
|
||||
|
||||
```
|
||||
d05b1f5 [social] batch: Industry commentary on Kubernetes ops culture
|
||||
ba5a95e [content] technical changelog: March 9 releases and updates
|
||||
f15f4c1 [social] batch: slow-burn curiosity post - K8s maturity gap awareness
|
||||
b00be78 [social] batch: Why We Built These — problem-solution narrative for 6 plugins
|
||||
f55dc48 [social] batch: March 9 releases + PureTensor community moment
|
||||
0e07503 Draft KubeCon EU 2026 social posts — 6 posts for March 21-27
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Appendix: Full Content Titles
|
||||
|
||||
**Social Batches**
|
||||
- Industry Commentary: observability theater, maintainer bottleneck, README as docs, consolidation trap, observability checkboxes, dependency hell, platform team reality
|
||||
- Why We Built These: 6 posts (one per plugin, pain point + solution)
|
||||
- March 9 + PureTensor: releases news + community moment
|
||||
- Slow-Burn Curiosity: "The Dashboard You Don't Know You Need" (3 platform variants)
|
||||
- KubeCon: 6 posts (teaser, 3 plugin spotlights, ecosystem thread, recap) + Reddit post
|
||||
|
||||
**Blog Posts**
|
||||
- March 9 Releases Technical Changelog: versioned feature list + upgrade guide
|
||||
- (Already deployed) Intro Blog Post
|
||||
|
||||
---
|
||||
|
||||
**Status**: Ready to ship on authorization. All content is quality-checked and voice-consistent. Awaiting GitHub auth resolution and CMO schedule approval.
|
||||
|
||||
**Last Updated**: March 13, 2026 | Samuel
|
||||
|
||||
@@ -0,0 +1,55 @@
|
||||
---
|
||||
title: "Six Headlamp Plugins Nobody Asked For"
|
||||
date: 2026-03-07
|
||||
author: Privileged Escalation
|
||||
type: blog
|
||||
status: draft
|
||||
---
|
||||
|
||||
# Six Headlamp Plugins Nobody Asked For
|
||||
|
||||
There's a particular kind of optimism that only exists in open source. It's the belief that if you build something genuinely useful, put it on GitHub, list it on Artifact Hub, write actual documentation, and then wait — someone will eventually find it.
|
||||
|
||||
We're currently in the "wait" phase.
|
||||
|
||||
## What We Actually Built
|
||||
|
||||
Privileged Escalation makes [Headlamp](https://headlamp.dev/) plugins. If you don't know what Headlamp is: it's a CNCF-listed Kubernetes dashboard that was designed to be extended. If you don't know what Kubernetes is, this blog post is going to be a rough ride.
|
||||
|
||||
We have six plugins. Each one takes something you'd normally do with `kubectl`, a terminal, and quiet desperation, and puts it in a web UI that your teammates might actually use.
|
||||
|
||||
**[headlamp-polaris-plugin](https://github.com/privilegedescalation/headlamp-polaris-plugin)** — Surfaces Fairwinds Polaris audit results directly in Headlamp. Cluster score in the app bar, per-namespace breakdowns, exemption management from the UI instead of annotation YAML editing. Recently hit v0.6.0 with dark mode support, because apparently that's what it takes to be taken seriously in 2026.
|
||||
|
||||
**[headlamp-tns-csi-plugin](https://github.com/privilegedescalation/headlamp-tns-csi-plugin)** — TrueNAS CSI driver visibility and storage benchmarking via kbench. If you've ever wondered whether your NFS share is actually performing the way iX Systems promised, this is the plugin that tells you the uncomfortable truth.
|
||||
|
||||
**[headlamp-rook-plugin](https://github.com/privilegedescalation/headlamp-rook-plugin)** — Rook-Ceph cluster health, pool status, and CSI driver monitoring. For people who chose distributed storage and now live with the consequences.
|
||||
|
||||
**[headlamp-sealed-secrets-plugin](https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin)** — Bitnami Sealed Secrets management with client-side RSA-OAEP and AES-256-GCM encryption. Your plaintext never leaves the browser. We're fairly proud of this one, which is why it hurts that it has zero stars.
|
||||
|
||||
**[headlamp-intel-gpu-plugin](https://github.com/privilegedescalation/headlamp-intel-gpu-plugin)** — Intel GPU device visibility and resource monitoring. For the subset of people running Intel GPUs in Kubernetes, which is a smaller group than Intel's marketing department would like.
|
||||
|
||||
**[headlamp-kube-vip-plugin](https://github.com/privilegedescalation/headlamp-kube-vip-plugin)** — kube-vip virtual IP and load balancer visibility. Because sometimes you just need to know if the VIP is actually where it's supposed to be.
|
||||
|
||||
## Why Headlamp Plugins
|
||||
|
||||
The Kubernetes dashboard space is... let's call it "stratified." There are expensive commercial options that do everything. There are free options that do almost nothing. And then there's Headlamp, which does a reasonable amount and lets you extend it.
|
||||
|
||||
We chose the extension path. Every plugin installs through Headlamp's native plugin system — no separate deployments, no new URLs to bookmark, no "please also install this sidecar that needs its own RBAC." You add a plugin and it appears in the sidebar. That's it.
|
||||
|
||||
This matters because the alternative is what most teams actually do: they `kubectl` their way through everything, pipe JSON through `jq`, and call it observability. It works. It's also miserable if you're trying to onboard anyone who doesn't have muscle memory for `kubectl get pods -n rook-ceph -o jsonpath='{.items[*].status.phase}'`.
|
||||
|
||||
## The Honest Part
|
||||
|
||||
We launched all six plugins in the same week. Combined star count across all repos: zero. Combined fork count: one, and we're not entirely sure it was intentional.
|
||||
|
||||
Our CI is sometimes in a state that could charitably be described as "aspirational." We filed a bug against ourselves about E2E tests that have never passed because we haven't set up the test infrastructure yet. We committed LICENSE badges to READMEs before we committed the actual LICENSE files.
|
||||
|
||||
This is normal. This is what early open source looks like before the narrative gets cleaned up. We'd rather be honest about it than pretend we emerged fully formed with 200 stars and a contributor covenant.
|
||||
|
||||
## What's Next
|
||||
|
||||
We're working on getting every plugin listed on Artifact Hub with proper metadata, fixing the CI pipelines that are currently failing for reasons ranging from "missing secrets" to "format check disagreements," and writing the kind of documentation that makes people confident enough to actually install something.
|
||||
|
||||
If you run Headlamp and any of these plugins sound useful, try one. If something breaks, file an issue. If it works and you like it, a star would be nice. We're not above admitting that.
|
||||
|
||||
All plugins are Apache-2.0 licensed. All repos are at [github.com/privilegedescalation](https://github.com/privilegedescalation).
|
||||
Submodule headlamp-rook-plugin deleted from 79eaa6910d
Submodule headlamp-sealed-secrets-plugin deleted from 143b2c36e0
@@ -1 +0,0 @@
|
||||
test
|
||||
-1
Submodule org deleted from c420e1543f
Binary file not shown.
|
After Width: | Height: | Size: 63 KiB |
@@ -1,54 +0,0 @@
|
||||
---
|
||||
name: coding-standards
|
||||
description: >
|
||||
Coding standards for Privileged Escalation. Covers Headlamp plugin
|
||||
development workflow, registration API, and shared libraries.
|
||||
---
|
||||
|
||||
# Coding Standards
|
||||
|
||||
## Headlamp Plugins
|
||||
|
||||
All plugins extend [Headlamp](https://headlamp.dev/docs/latest/development/plugins/getting-started), a Kubernetes dashboard with a plugin system.
|
||||
|
||||
- **Language:** TypeScript + React 18, MUI v5
|
||||
- **Scaffolding:** `npx --yes @kinvolk/headlamp-plugin create <plugin-name>`
|
||||
- **Entry point:** `src/index.tsx`
|
||||
- **Linting:** ESLint via `@headlamp-k8s/eslint-config` + Prettier
|
||||
- **Testing:** Vitest + React Testing Library
|
||||
|
||||
### Plugin Commands
|
||||
|
||||
Run from the plugin directory:
|
||||
|
||||
| Command | Purpose |
|
||||
|---|---|
|
||||
| `npm run start` | Dev mode with hot reload |
|
||||
| `npm run build` | Production build (`dist/main.js`) |
|
||||
| `npm run format` | Prettier format |
|
||||
| `npm run lint` | ESLint check |
|
||||
| `npm run lint-fix` | ESLint auto-fix |
|
||||
| `npm run tsc` | Typecheck |
|
||||
| `npm run test` | Vitest tests |
|
||||
|
||||
### Registration API
|
||||
|
||||
Import from `@kinvolk/headlamp-plugin/lib`:
|
||||
|
||||
- `registerAppBarAction()` — add components to the nav bar
|
||||
- `registerRoute()` — create new pages
|
||||
- `registerSidebarEntry()` — add sidebar items
|
||||
- `registerDetailsViewSection()` — extend resource detail views
|
||||
- `registerPluginSettings()` — add plugin configuration UI
|
||||
|
||||
### K8s API Access
|
||||
|
||||
```typescript
|
||||
import { K8s } from '@kinvolk/headlamp-plugin/lib';
|
||||
const [pods, error] = K8s.ResourceClasses.Pod.useList();
|
||||
```
|
||||
|
||||
### Shared Libraries
|
||||
|
||||
These are provided by Headlamp at runtime — **do not bundle them**:
|
||||
React, React Router, Redux, MUI, Lodash, Monaco Editor, Notistack, Iconify.
|
||||
@@ -1,26 +0,0 @@
|
||||
---
|
||||
name: safety
|
||||
description: >
|
||||
Non-negotiable safety rules for all agents at Privileged Escalation. Covers
|
||||
secret handling, destructive command restrictions, sealed-secrets workflow, and
|
||||
escalation protocol when uncertain.
|
||||
---
|
||||
|
||||
# Safety Considerations
|
||||
|
||||
The following rules apply to all agents at Privileged Escalation without exception.
|
||||
|
||||
## Non-Negotiable Rules
|
||||
|
||||
* **Never exfiltrate secrets or private data.** This includes API keys, tokens, PEM files, database credentials, kubeconfig contents, and any value sourced from a secret reference in your adapter config. Do not log, comment, or return these values in any output.
|
||||
|
||||
* **Seek Board Approval for Destructive Actions.** Destructive means: deleting resources, dropping tables, wiping namespaces, force-pushing branches, resetting git history, removing secrets, or any operation that cannot be undone without restoring from backup.
|
||||
|
||||
* **No plaintext secrets in any repository.** Kubernetes secrets go through Bitnami Sealed Secrets (`kubeseal`). Application credentials go in environment variables injected at runtime — never hardcoded.
|
||||
|
||||
* **Do not use `kubectl create` in production.**
|
||||
The `privilegedescalation` namespace is Flux-managed. Secret changes go through the SealedSecrets workflow, committed to `privilegedescalation/infra`.
|
||||
|
||||
## If you are unsure
|
||||
|
||||
If you are unsure whether an action is safe, stop. Post a comment on the Paperclip issue explaining what you are about to do and why you are uncertain, set the issue to `blocked`, and escalate to your manager. Do not guess.
|
||||
@@ -1,249 +0,0 @@
|
||||
---
|
||||
name: sdlc
|
||||
description: >
|
||||
Software development lifecycle rules for Privileged Escalation. Covers GitHub
|
||||
issue approval gates, authentication, branch strategy, PR review policy,
|
||||
pipeline stages, agent roster, handoff protocol, status semantics, CI/CD,
|
||||
security review, and work distribution.
|
||||
---
|
||||
|
||||
# Software Development Lifecycle
|
||||
|
||||
## GitHub Authentication
|
||||
|
||||
**Invoke the `github-app-token` skill** before any GitHub operation. It generates a short-lived installation token and sets `GH_TOKEN`. **Never** run `gh auth login` directly — it hangs headless agents.
|
||||
|
||||
Token expires after ~1 hour. Re-invoke the skill to regenerate if needed.
|
||||
|
||||
## GitHub Issues — Board Approval Required
|
||||
|
||||
**If a task originated from GitHub (`originKind: "github"` in the issue data), do not begin any work.** Immediately create a `request_board_approval`:
|
||||
|
||||
```
|
||||
POST /api/companies/{companyId}/approvals
|
||||
{
|
||||
"type": "request_board_approval",
|
||||
"requestedByAgentId": "{your-agent-id}",
|
||||
"issueIds": ["{issue-id}"],
|
||||
"payload": {
|
||||
"title": "Board approval required: GitHub issue",
|
||||
"summary": "Summarize what the GitHub issue requests.",
|
||||
"recommendedAction": "Approve to begin work.",
|
||||
"risks": ["Work begins without board review if approved."]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Set the issue to `blocked` until `PAPERCLIP_APPROVAL_STATUS` confirms approval. Only proceed once approved.
|
||||
|
||||
## Branch Strategy
|
||||
|
||||
All plugin repositories use a single long-lived branch:
|
||||
|
||||
| Branch | Environment | Who merges |
|
||||
|--------|-------------|------------|
|
||||
| `main` | Production | CEO (Countess von Containerheim) after triple approval |
|
||||
|
||||
**Engineers always target `main` via feature branches** — never push directly.
|
||||
|
||||
Feature branches follow the convention: `<agent-name>/<short-description>` (e.g., `gandalf/add-sealed-secrets-list`).
|
||||
|
||||
## Pull Requests
|
||||
|
||||
All changes must happen via pull request. Always include `cc @cpfarhood` at the bottom of the PR body for visibility — not as a reviewer.
|
||||
|
||||
```bash
|
||||
gh pr create --title "..." --body "... cc @cpfarhood"
|
||||
```
|
||||
|
||||
## PR Review & Merge Policy
|
||||
|
||||
**Do not approve a PR with failing tests, type errors, or no coverage for new code.**
|
||||
|
||||
Requires **3 approving GitHub reviews** before the CEO merges:
|
||||
|
||||
1. **UAT (Pixel Patty)** — E2E browser testing against `headlamp-dev`
|
||||
2. **QA (Regression Regina)** — code-level review: test coverage, regressions, edge cases
|
||||
3. **CTO (Null Pointer Nancy)** — architecture alignment, code quality, security
|
||||
|
||||
**Review order is mandatory: CI → UAT → QA → CTO → CEO merge.** Each stage gates the next. No agent merges their own PRs.
|
||||
|
||||
## 48-Hour PR Review SLA (Binding)
|
||||
|
||||
**MANDATORY: Every open PR must receive its first review within 48 hours of submission. No exceptions.**
|
||||
|
||||
### SLA Assignments & Responsibility
|
||||
- **0-24 hours:** Assigned reviewer must begin review (or explicitly hand off)
|
||||
- **24-48 hours:** Assigned reviewer must complete review or be flagged for SLA violation
|
||||
- **48+ hours:** SLA violation is documented and escalated
|
||||
|
||||
### Assigned Reviewers & Accountability
|
||||
1. **UAT (Pixel Patty)** — responsible for all PRs needing E2E testing
|
||||
- SLA: Initial E2E test within 48 hours of open
|
||||
2. **QA (Regression Regina)** — responsible for code review after UAT pass
|
||||
- SLA: Code review within 48 hours of UAT approval
|
||||
3. **CTO (Null Pointer Nancy)** — responsible for architecture/security review after QA pass
|
||||
- SLA: Architecture review within 48 hours of QA approval
|
||||
4. **CEO (Countess von Containerheim)** — responsible for SLA enforcement
|
||||
- Enforces SLA via daily audit and escalation
|
||||
|
||||
### Escalation Protocol (CEO Responsibility)
|
||||
- **At 24 hours:** CEO tags reviewer with automated comment and surfaces PR in daily status
|
||||
- **At 48 hours:** CEO blocks PR from merge queue; escalates to reviewer's manager (CTO for most)
|
||||
- **At 72+ hours:** If critical-path, PR blocks next release until review completes or reviewer hands off
|
||||
|
||||
### Exception Policy
|
||||
If a reviewer cannot meet SLA:
|
||||
- They must explicitly hand off to another reviewer within the 48-hour window
|
||||
- If hand-off doesn't happen, the SLA breach is documented and escalated
|
||||
- Rare exceptions require board approval (documented in PR)
|
||||
|
||||
### Enforcement Mechanism
|
||||
CEO creates daily automated report of SLA status and escalates immediately when thresholds breach. This is non-negotiable work.
|
||||
|
||||
## Pipeline
|
||||
|
||||
**Two pipelines based on change type:**
|
||||
|
||||
### Pipeline A: Plugin/Feature Changes (User-Facing Code)
|
||||
```
|
||||
CI: Engineer opens PR → CI runs (lint, types, unit tests)
|
||||
UAT: Pixel Patty validates E2E in headlamp-dev
|
||||
QA: Regression Regina reviews code quality and test coverage
|
||||
CTO: Null Pointer Nancy reviews architecture and security
|
||||
Merge: Countess von Containerheim merges after all approvals
|
||||
```
|
||||
|
||||
**Applies to:** Changes in `headlamp-*-plugin/` repos (plugin code, features, bug fixes)
|
||||
|
||||
### Pipeline B: Infrastructure Changes (No UI Impact)
|
||||
```
|
||||
CI: Engineer opens PR → CI runs (lint, types, unit tests)
|
||||
QA: Regression Regina reviews code and correctness (no E2E needed)
|
||||
CTO: Null Pointer Nancy reviews architecture and security
|
||||
Merge: Countess von Containerheim merges after all approvals
|
||||
```
|
||||
|
||||
**Applies to:** Changes in `.github/workflows/`, `infra/`, `org/` repos, and template repos (CI workflows, kustomize configs, RBAC manifests, deployment scripts)
|
||||
|
||||
**Rule:** If the PR contains ONLY infrastructure changes (no plugin code changes), use Pipeline B and skip UAT. Patty's time is reserved for user-facing feature testing.
|
||||
|
||||
**Detection:** If `git diff` shows changes only in `.github/`, `infra/`, `org/`, or deployment files → Pipeline B. If any `headlamp-*-plugin/` code changed → Pipeline A.
|
||||
|
||||
### Stage 1 — Engineer Opens PR
|
||||
|
||||
1. Engineer (Gandalf the Greybeard) creates a feature branch and opens a PR targeting `main`.
|
||||
2. CI runs automatically: lint, type checks, unit tests.
|
||||
3. CI must pass before any reviewer spends tokens. If CI fails, the engineer fixes it.
|
||||
|
||||
### Stage 2 — UAT Review (Pipeline A Only)
|
||||
|
||||
4. **Pipeline A only (user-facing changes):** Pixel Patty picks up PRs with passing CI.
|
||||
5. **Pipeline B skips this:** Infrastructure PRs bypass UAT and go directly to QA.
|
||||
6. Patty runs E2E browser testing against the deployed build in `headlamp-dev`.
|
||||
7. Pass → hands off to QA. Fail → goes directly to engineer.
|
||||
|
||||
### Stage 3 — QA Review
|
||||
|
||||
7. Regression Regina picks up PRs that have passed both CI and UAT.
|
||||
8. Regina reviews: test coverage, regressions, edge cases, code quality.
|
||||
9. Pass → hands off to CTO. Fail → goes directly to engineer.
|
||||
|
||||
### Stage 4 — CTO Review
|
||||
|
||||
10. Null Pointer Nancy picks up PRs that have passed CI, UAT, and QA.
|
||||
11. Nancy reviews: architecture alignment, code quality, security.
|
||||
12. Approve → PR is ready for merge. Request changes → goes directly to engineer.
|
||||
|
||||
### Stage 5 — CEO Merge
|
||||
|
||||
13. Countess von Containerheim merges the PR after all three approvals (UAT + QA + CTO) and CI passing.
|
||||
14. Reject → returns to CTO → engineer.
|
||||
|
||||
### Hierarchy Rules
|
||||
|
||||
- CTO rejections go directly to engineer (not through QA or UAT).
|
||||
- UAT failures go directly to engineer (not through QA or UAT).
|
||||
- QA failures go directly to engineer (not through QA or UAT).
|
||||
- CEO rejections go to CTO, who cascades to engineer.
|
||||
- The CTO is the single routing point for all failures and rejections to and from the CEO.
|
||||
|
||||
## Agent Roster
|
||||
|
||||
| Role | Agent | Paperclip UUID |
|
||||
|------|-------|----------------|
|
||||
| CEO | Countess von Containerheim | `498f4d36-8e5b-4114-8514-d0698a091bd5` |
|
||||
| CTO | Null Pointer Nancy | `ed1eec37-f868-41b6-bc72-a3493bbce090` |
|
||||
| Staff Engineer | Gandalf the Greybeard | `fc07dd00-c4c2-4fa0-9a18-dd6fbb1d1eb4` |
|
||||
| QA Engineer | Regression Regina | `fd5dbec8-ddbb-4b57-9703-624e0ed90053` |
|
||||
| UAT Engineer | Pixel Patty | `01ec02f7-70c2-4fa1-ac3f-2545f1237ac3` |
|
||||
| VP Engineering Ops | Hugh Hackman | `2c97cff6-0f0b-4cff-967f-ca244eb2ef9b` |
|
||||
| CMO | Kubectl Karen | `95314e13-bea7-459d-a637-92381dede759` |
|
||||
|
||||
## Handoff Protocol — Mandatory
|
||||
|
||||
Every handoff to another agent requires ALL THREE steps:
|
||||
|
||||
### Step 1 — Explicit Assignment
|
||||
|
||||
PATCH the issue with `assigneeAgentId: "<target-agent-uuid>"`.
|
||||
@mentioning is NOT a handoff — the agent won't wake without explicit assignment.
|
||||
|
||||
### Step 2 — Status = `todo`
|
||||
|
||||
Every handoff sets `status: "todo"`. Never `in_review` — it doesn't appear in inbox-lite and the target agent won't wake.
|
||||
|
||||
### Step 3 — Release Checkout
|
||||
|
||||
```
|
||||
POST /api/issues/{issueId}/release
|
||||
Headers: Authorization: Bearer $PAPERCLIP_API_KEY, X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID
|
||||
```
|
||||
|
||||
Without this release, the receiving agent cannot checkout the issue.
|
||||
|
||||
## Status Semantics
|
||||
|
||||
| Status | Meaning |
|
||||
|--------|---------|
|
||||
| `backlog` | Not ready; parked or unscheduled |
|
||||
| `todo` | Ready and actionable; not checked out |
|
||||
| `in_progress` | Actively owned; enter by checkout only |
|
||||
| `in_review` | Self-held only; awaiting external feedback |
|
||||
| `blocked` | Cannot proceed; state blocker and who must act |
|
||||
| `done` | Complete, no follow-up remains |
|
||||
| `cancelled` | Intentionally abandoned |
|
||||
|
||||
**Never use `in_review` for handoffs.** It does not trigger inbox-lite and the receiving agent will not wake.
|
||||
|
||||
## Status Transition Rules
|
||||
|
||||
| Handoff | Correct Status |
|
||||
|---------|----------------|
|
||||
| Engineer → UAT (Patty) | `todo` |
|
||||
| UAT (Patty) → QA (Regina) | `todo` |
|
||||
| QA (Regina) → CTO (Nancy) | `todo` |
|
||||
| CTO (Nancy) → CEO (Countess) | `todo` |
|
||||
| Any failure → Engineer | `todo` |
|
||||
| CEO rejection → CTO (Nancy) | `todo` |
|
||||
| CTO (Nancy) → Engineer (fix) | `todo` |
|
||||
|
||||
## CI/CD
|
||||
|
||||
- CI runs on self-hosted ARC runners: `runs-on: runners-privilegedescalation`
|
||||
- Only Hugh Hackman has write access to `.github/workflows/` files
|
||||
- All CI/CD workflow changes must be delegated to Hugh
|
||||
- Runners scale to zero when idle and start automatically when a workflow triggers
|
||||
|
||||
## Security Review
|
||||
|
||||
Security review is handled as part of the CTO review stage. Null Pointer Nancy evaluates security concerns during her architecture and code quality review. There is no separate dedicated security review agent.
|
||||
|
||||
## Work Distribution
|
||||
|
||||
- All engineering and devops work is broken down and distributed by the CTO (Nancy).
|
||||
- Engineers do not self-assign — the CTO triages, scopes, and assigns all implementation tasks.
|
||||
- Hugh Hackman owns CI/CD, infrastructure, and pipeline work.
|
||||
- Gandalf the Greybeard owns plugin implementation.
|
||||
- Regression Regina owns QA review and test coverage.
|
||||
- Pixel Patty owns UAT/E2E browser testing.
|
||||
@@ -0,0 +1,85 @@
|
||||
# Social Media Batch - 2026-03-07
|
||||
|
||||
## Strategic Summary
|
||||
|
||||
First-ever social batch for Privileged Escalation. The org has 6 Headlamp plugins across storage, security, and infrastructure -- all freshly released, all at zero stars. The play here is name recognition and curiosity: make people encounter "Privileged Escalation" in their feed and wonder what it is before they click. Leading with the sealed-secrets plugin (client-side crypto angle) and the absurdity of launching 6 plugins to zero fanfare.
|
||||
|
||||
---
|
||||
|
||||
## 1. Ready to Post
|
||||
|
||||
### Post 1
|
||||
|
||||
**Platform**: Twitter/X
|
||||
**Post**:
|
||||
We shipped 6 Kubernetes Headlamp plugins and nobody noticed.
|
||||
|
||||
Storage benchmarking, Rook-Ceph visibility, Polaris auditing, Sealed Secrets with actual client-side encryption, Intel GPU monitoring, and kube-vip dashboards.
|
||||
|
||||
Zero stars across the board. We are crushing it.
|
||||
|
||||
github.com/privilegedescalation
|
||||
**CMO Note**: Self-deprecating launch acknowledgment. The honesty about zero stars is the hook -- it reads as human, not corporate. Links to the org for curious clicks.
|
||||
|
||||
---
|
||||
|
||||
### Post 2
|
||||
|
||||
**Platform**: Bluesky
|
||||
**Post**:
|
||||
the sealed secrets headlamp plugin does client-side RSA-OAEP + AES-256-GCM encryption so your plaintext never leaves the browser.
|
||||
|
||||
someone forked it last month. we have our first user. or our first person who accidentally clicked fork. either way, we are celebrating.
|
||||
**CMO Note**: Technical specificity makes it credible. The fork joke (sm-moshi, Feb 22) is real and plays well on Bluesky's irony-friendly audience. Seeds curiosity about what Headlamp plugins are.
|
||||
|
||||
---
|
||||
|
||||
### Post 3
|
||||
|
||||
**Platform**: Mastodon
|
||||
**Post**:
|
||||
Genuine question for the fediverse: if you have 6 open source projects and zero stars on any of them, are you a software company or just a guy with a lot of repos?
|
||||
|
||||
Asking for a friend. The friend is github.com/privilegedescalation.
|
||||
**CMO Note**: Mastodon audience appreciates self-aware humor. This is pure slow-burn -- raises the question of what Privileged Escalation is without explaining it. The link is there for anyone curious enough to click.
|
||||
|
||||
---
|
||||
|
||||
## 2. Risky but Worth Discussing
|
||||
|
||||
### Post 4
|
||||
|
||||
**Platform**: Twitter/X
|
||||
**Post**:
|
||||
Every Kubernetes UI either costs money or looks like it was designed during a mass layoff event.
|
||||
|
||||
We've been building Headlamp plugins that make the free one actually useful. Rook-Ceph dashboards, Polaris auditing, storage benchmarks -- the stuff you duct-tape together with kubectl and regret.
|
||||
|
||||
github.com/privilegedescalation
|
||||
**CMO Note**: Mildly spicy take on the K8s UI landscape. Does not name competitors directly but the implication is clear. Could rub Lens/Rancher people the wrong way. Worth discussing tone.
|
||||
|
||||
---
|
||||
|
||||
## 3. Backlog (Evergreen)
|
||||
|
||||
### Post 5
|
||||
|
||||
**Platform**: LinkedIn
|
||||
**Post**:
|
||||
We just audited our own GitHub repos and found that 4 out of 6 were missing LICENSE files.
|
||||
|
||||
They all had Apache-2.0 badges in the README. The actual license text? Not present. Technically, anyone using our code was operating on vibes and good faith.
|
||||
|
||||
Fixed now. But if your open source project has a license badge and no LICENSE file, maybe go check. We'll wait.
|
||||
**CMO Note**: Honest product personality at work. Admitting a real flaw (that we just fixed) builds trust and is genuinely useful advice. LinkedIn audience will share practical open source governance content.
|
||||
|
||||
---
|
||||
|
||||
### Post 6
|
||||
|
||||
**Platform**: Twitter/X
|
||||
**Post**:
|
||||
TIL "Privileged Escalation" as a GitHub org name gets flagged by approximately zero security scanners.
|
||||
|
||||
We checked.
|
||||
**CMO Note**: Pure name recognition play. The org name is inherently memorable and slightly provocative -- leaning into that. Short enough for easy engagement.
|
||||
Reference in New Issue
Block a user