ci: add ci job and Promotion Gate workflow to satisfy branch protection

Branch protection on main requires three status checks:
- CI / lint (pull_request) [was already satisfied]
- CI / ci (pull_request) [new: validates JSON files]
- Promotion Gate / Promotion Gate (pull_request) [new: validates skills structure]

Adding the ci job and Promotion Gate workflow so all required checks
can pass on PRs, unblocking future merges to main.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.gitea/workflows/ci.yaml

@@ -0,0 +1,56 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install linters
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends shellcheck yamllint
+
+      - name: Lint Markdown
+        uses: DavidAnson/markdownlint-cli2-action@v19
+        with:
+          globs: "**/*.md"
+
+      - name: Lint YAML
+        run: yamllint .
+
+      - name: Shellcheck
+        run: shellcheck scripts/*.sh
+
+      - name: Validate skill frontmatter
+        run: |
+          set -e
+          fail=0
+          for f in skills/*/SKILL.md; do
+            fm=$(awk 'BEGIN{c=0} /^---$/{c++; next} c==1{print} c>=2{exit}' "$f")
+            for key in name description; do
+              if ! printf '%s\n' "$fm" | grep -qE "^${key}:[[:space:]]"; then
+                echo "::error file=${f}::missing '${key}' in YAML frontmatter"
+                fail=1
+              fi
+            done
+          done
+          exit $fail
+
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate JSON files
+        run: |
+          find . -name "*.json" -not -path "./.git/*" | while read -r f; do
+            python3 -m json.tool "$f" > /dev/null || { echo "::error file=$f::Invalid JSON"; exit 1; }
+          done
+          echo "All JSON files valid"

.gitea/workflows/promotion-gate.yaml

@@ -0,0 +1,24 @@
+name: Promotion Gate
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  promotion_gate:
+    name: Promotion Gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate skills directory structure
+        run: |
+          set -e
+          fail=0
+          for dir in skills/*/; do
+            if [ ! -f "${dir}SKILL.md" ]; then
+              echo "::error::Missing SKILL.md in ${dir}"
+              fail=1
+            fi
+          done
+          exit $fail

.github/workflows/plugin-release.yaml

@@ -0,0 +1,439 @@
+name: Plugin Release
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: 'Release version (e.g. 1.0.0)'
+        required: true
+        type: string
+      node-version:
+        description: 'Node.js version to use'
+        required: false
+        type: string
+        default: '22'
+      upstream-repo:
+        description: 'Upstream repo to fetch appVersion from (e.g. fenio/tns-csi). Leave empty to skip.'
+        required: false
+        type: string
+        default: ''
+    secrets:
+      RELEASE_APP_ID:
+        description: 'GitHub App ID for creating PRs (org blocks GITHUB_TOKEN from creating PRs)'
+        required: true
+      RELEASE_APP_PRIVATE_KEY:
+        description: 'GitHub App private key (PEM format)'
+        required: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  check-secrets:
+    runs-on: ubuntu-latest
+    outputs:
+      ready: ${{ steps.check.outputs.ready }}
+    steps:
+      - name: Verify RELEASE_APP_ID is configured
+        id: check
+        env:
+          RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
+        run: |
+          if [ -z "$RELEASE_APP_ID" ]; then
+            echo "::notice::RELEASE_APP_ID org secret is not configured (see PRI-380). Release skipped — no artifacts will be created."
+            echo "ready=false" >> $GITHUB_OUTPUT
+          else
+            echo "ready=true" >> $GITHUB_OUTPUT
+          fi
+
+  ci:
+    needs: check-secrets
+    if: needs.check-secrets.outputs.ready == 'true'
+    uses: ./.github/workflows/plugin-ci.yaml
+    with:
+      node-version: ${{ inputs.node-version }}
+
+  check-token-permissions:
+    needs: check-secrets
+    if: needs.check-secrets.outputs.ready == 'true'
+    runs-on: ubuntu-latest
+    outputs:
+      has_write: ${{ steps.check.outputs.has_write }}
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
+      - name: Check write permissions via API
+        id: check
+        run: |
+          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
+            -X POST \
+            -H "Authorization: Bearer ${{ steps.app-token.outputs.token }}" \
+            -H "Accept: application/vnd.github+json" \
+            "https://api.github.com/repos/${{ github.repository }}/git/refs" \
+            -d '{"ref":"refs/heads/_release_check","sha":"${{ github.sha }}"}')
+          if [ "$HTTP_CODE" = "201" ]; then
+            echo "::notice::Token has write permission — cleaning up test ref."
+            curl -s -o /dev/null -w "%{http_code}" \
+              -X DELETE \
+              -H "Authorization: Bearer ${{ steps.app-token.outputs.token }}" \
+              "https://api.github.com/repos/${{ github.repository }}/git/refs/heads/_release_check"
+            echo "has_write=true" >> $GITHUB_OUTPUT
+          elif [ "$HTTP_CODE" = "403" ]; then
+            echo "::error::Token lacks write permission. Release cannot push tags or branches."
+            echo "has_write=false" >> $GITHUB_OUTPUT
+            exit 1
+          else
+            echo "::warning::Unexpected response ($HTTP_CODE) when checking write permission."
+            echo "has_write=false" >> $GITHUB_OUTPUT
+            exit 1
+          fi
+
+  check-tag:
+    needs: check-secrets
+    if: needs.check-secrets.outputs.ready == 'true'
+    runs-on: ubuntu-latest
+    outputs:
+      skip: ${{ steps.check.outputs.skip }}
+    steps:
+      - name: Check if tag already exists
+        id: check
+        run: |
+          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
+            -H "Authorization: Bearer ${{ github.token }}" \
+            "https://api.github.com/repos/${{ github.repository }}/git/refs/tags/v${{ inputs.version }}")
+          if [ "$HTTP_CODE" = "200" ]; then
+            echo "::notice::Tag v${{ inputs.version }} already exists. Release skipped (not an error)."
+            echo "skip=true" >> $GITHUB_OUTPUT
+          else
+            echo "skip=false" >> $GITHUB_OUTPUT
+          fi
+
+  release:
+    needs: [ci, check-tag, check-secrets, check-token-permissions]
+    if: needs.check-secrets.outputs.ready == 'true' && needs.check-tag.outputs.skip != 'true' && needs.check-token-permissions.outputs.has_write == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Validate version format
+        run: |
+          if [[ ! "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Error: Version must be in X.Y.Z format"
+            exit 1
+          fi
+
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Detect package manager
+        id: pkg-manager
+        run: |
+          if [ -f "pnpm-lock.yaml" ]; then
+            echo "manager=pnpm" >> $GITHUB_OUTPUT
+            echo "lockfile=pnpm-lock.yaml" >> $GITHUB_OUTPUT
+            # Check for packageManager field in package.json (Corepack pinning).
+            # pnpm/action-setup@v5 errors when packageManager is absent and no version
+            # is specified, so use Corepack for repos that have the field pinned and
+            # fall back to pnpm/action-setup with version: latest for repos that don't.
+            PM=$(python3 -c "import json,sys; d=json.load(open('package.json')); print('true' if d.get('packageManager','').startswith('pnpm@') else 'false')" 2>/dev/null || echo "false")
+            echo "has_package_manager=$PM" >> $GITHUB_OUTPUT
+          else
+            echo "manager=npm" >> $GITHUB_OUTPUT
+            echo "lockfile=package-lock.json" >> $GITHUB_OUTPUT
+            echo "has_package_manager=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ inputs.node-version }}
+          # Only enable built-in npm caching here; pnpm caching is handled below
+          # after pnpm is installed (corepack is not available before setup-node).
+          cache: ${{ steps.pkg-manager.outputs.manager == 'npm' && 'npm' || '' }}
+
+      - name: Setup pnpm (via Corepack, reads version from packageManager field)
+        if: steps.pkg-manager.outputs.manager == 'pnpm' && steps.pkg-manager.outputs.has_package_manager == 'true'
+        run: |
+          npm install -g corepack
+          corepack enable pnpm
+          corepack install
+
+      - name: Setup pnpm (version latest)
+        if: steps.pkg-manager.outputs.manager == 'pnpm' && steps.pkg-manager.outputs.has_package_manager == 'false'
+        uses: pnpm/action-setup@v5
+        with:
+          run_install: false
+          version: latest
+
+      - name: Get pnpm store directory
+        id: pnpm-store
+        if: steps.pkg-manager.outputs.manager == 'pnpm'
+        run: echo "dir=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
+
+      - name: Cache pnpm store
+        if: steps.pkg-manager.outputs.manager == 'pnpm'
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.pnpm-store.outputs.dir }}
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-
+
+      - name: Configure Git
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Update version in package.json
+        run: |
+          if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
+            pnpm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
+          else
+            npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
+          fi
+
+      - name: Update artifacthub-pkg.yml
+        run: |
+          VERSION="${{ inputs.version }}"
+          if [ -f artifacthub-pkg.yml ]; then
+            PKG_NAME=$(grep '^name:' artifacthub-pkg.yml | cut -d: -f2 | tr -d ' "')
+          else
+            PKG_NAME=$(jq -r .name package.json | sed 's|^@[^/]*/||')
+          fi
+          RELEASE_URL="https://github.com/${{ github.repository }}/releases/download/v${VERSION}/${PKG_NAME}-${VERSION}.tar.gz"
+          sed -i "s/^version:.*/version: \"${VERSION}\"/" artifacthub-pkg.yml
+          sed -i "s|headlamp/plugin/archive-url:.*|headlamp/plugin/archive-url: \"${RELEASE_URL}\"|" artifacthub-pkg.yml
+
+      - name: Update appVersion from upstream release
+        if: inputs.upstream-repo != ''
+        run: |
+          APP_VERSION=$(curl -sf "https://api.github.com/repos/${{ inputs.upstream-repo }}/releases/latest" | jq -r '.tag_name | ltrimstr("v")')
+          if [ -z "$APP_VERSION" ] || [ "$APP_VERSION" = "null" ]; then
+            echo "::warning::Could not fetch latest upstream release, skipping appVersion update"
+          else
+            sed -i "s|^appVersion:.*|appVersion: \"${APP_VERSION}\"|" artifacthub-pkg.yml
+            echo "appVersion set to ${APP_VERSION}"
+          fi
+
+      - name: Install dependencies
+        run: |
+          max_attempts=3
+          attempt=1
+          while [ $attempt -le $max_attempts ]; do
+            echo "Attempt $attempt of $max_attempts"
+            if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
+              pnpm install --frozen-lockfile && break
+            else
+              npm ci && break
+            fi
+            if [ $attempt -lt $max_attempts ]; then
+              echo "::warning::Install step failed on attempt $attempt. Retrying in 5 seconds..."
+              sleep 5
+            fi
+            attempt=$((attempt + 1))
+          done
+          if [ $attempt -gt $max_attempts ]; then
+            echo "::error::Install step failed after $max_attempts attempts."
+            exit 1
+          fi
+
+      - name: Build plugin
+        run: npx @kinvolk/headlamp-plugin build
+
+      - name: Package plugin
+        run: npx @kinvolk/headlamp-plugin package
+
+      - name: Prepare release tarball
+        run: |
+          VERSION="${{ inputs.version }}"
+          # headlamp-plugin strips the @org/ prefix when naming tarballs.
+          # e.g. @privilegedescalation/headlamp-argocd-plugin -> headlamp-argocd-plugin
+          if [ -f artifacthub-pkg.yml ]; then
+            PKG_NAME=$(grep '^name:' artifacthub-pkg.yml | cut -d: -f2 | tr -d ' "')
+          else
+            PKG_NAME=$(jq -r .name package.json | sed 's|^@[^/]*/||')
+          fi
+          TARBALL="${PKG_NAME}-${VERSION}.tar.gz"
+          for f in *.tar.gz; do
+            [ "$f" != "$TARBALL" ] && mv "$f" "$TARBALL"
+          done
+          if [ ! -f "$TARBALL" ]; then
+            echo "Error: Expected tarball $TARBALL not found"
+            ls -la *.tar.gz 2>/dev/null || echo "No .tar.gz files found"
+            exit 1
+          fi
+          echo "TARBALL=$TARBALL" >> $GITHUB_ENV
+          echo "PKG_NAME=$PKG_NAME" >> $GITHUB_ENV
+
+      - name: Validate tarball
+        run: |
+          echo "Tarball: ${{ env.TARBALL }}"
+          ls -lh "${{ env.TARBALL }}"
+          tar -tzf "${{ env.TARBALL }}" | head -20
+          tar -tzf "${{ env.TARBALL }}" | grep -q "main.js" || { echo "Error: main.js not found in tarball"; exit 1; }
+
+      - name: Compute checksum
+        run: |
+          CHECKSUM=$(sha256sum "${{ env.TARBALL }}" | awk '{print $1}')
+          echo "CHECKSUM=$CHECKSUM" >> $GITHUB_ENV
+          sed -i "s|headlamp/plugin/archive-checksum:.*|headlamp/plugin/archive-checksum: sha256:${CHECKSUM}|" artifacthub-pkg.yml
+
+      - name: Commit and tag
+        run: |
+          VERSION="${{ inputs.version }}"
+          BRANCH="release/v${VERSION}"
+          # If the release branch already exists (e.g. from a failed prior run),
+          # delete it so the re-trigger can proceed cleanly. The check-tag job
+          # above already skips when the tag exists, so we only reach here when
+          # the tag does NOT exist yet — safe to remove a stale branch.
+          if git ls-remote --exit-code origin "refs/heads/$BRANCH" 2>/dev/null; then
+            echo "::notice::Branch $BRANCH already exists — deleting for clean re-trigger."
+            git push origin --delete "$BRANCH"
+          fi
+          git checkout -b "$BRANCH"
+          git add package.json "${{ steps.pkg-manager.outputs.lockfile }}" artifacthub-pkg.yml
+          git commit -m "release: v${VERSION}"
+          git tag "v${VERSION}"
+          git push origin "$BRANCH"
+          git push origin "refs/tags/v${VERSION}"
+
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: "v${{ inputs.version }}"
+          files: ${{ env.TARBALL }}
+          fail_on_unmatched_files: false
+          generate_release_notes: true
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+
+      - name: Install GitHub CLI
+        run: |
+          if ! command -v gh &>/dev/null; then
+            GH_VERSION="2.74.0"
+            curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_amd64.tar.gz" -o /tmp/gh.tar.gz
+            tar -xzf /tmp/gh.tar.gz -C /tmp
+            mkdir -p "$HOME/.local/bin"
+            mv "/tmp/gh_${GH_VERSION}_linux_amd64/bin/gh" "$HOME/.local/bin/gh"
+            rm -rf /tmp/gh.tar.gz "/tmp/gh_${GH_VERSION}_linux_amd64"
+            echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+            "$HOME/.local/bin/gh" --version
+          fi
+
+      - name: Create PR for version bump
+        run: |
+          set -o pipefail
+          VERSION="${{ inputs.version }}"
+          BODY=$(printf "Automated version bump and checksum update for v%s.\n\ncc @cpfarhood" "${VERSION}")
+          # Create PR only if an OPEN one doesn't already exist.
+          # Note: gh pr view also finds MERGED PRs; we must check for open ones explicitly
+          # so that a re-trigger after a stale-branch delete creates a fresh PR.
+          OPEN_PR=$(gh pr list --base main --head "release/v${VERSION}" --state open --json number --jq '.[0].number' 2>/dev/null)
+          if [ -z "$OPEN_PR" ]; then
+            gh pr create \
+              --title "release: v${VERSION}" \
+              --body "$BODY" \
+              --base main \
+              --head "release/v${VERSION}"
+            # Pull the number again to handle both create and pre-existing cases
+            OPEN_PR=$(gh pr list --base main --head "release/v${VERSION}" --state open --json number --jq '.[0].number' 2>/dev/null)
+          else
+            echo "::notice::Open PR #${OPEN_PR} for release/v${VERSION} already exists — skipping creation."
+          fi
+          # Guard: ensure we have a PR number before proceeding
+          if [ -z "$OPEN_PR" ]; then
+            echo "::error::Could not determine PR number for release/v${VERSION}."
+            exit 1
+          fi
+          echo "::notice::Working with PR #${OPEN_PR}"
+
+          # Check if PR was already merged (idempotency — safe to re-trigger after a stale branch)
+          MERGED_CHECK=$(gh pr view "$OPEN_PR" --json state --jq '.state' 2>/dev/null)
+          if [ "$MERGED_CHECK" = "MERGED" ]; then
+            echo "::notice::PR #${OPEN_PR} was already merged. Nothing to do."
+            exit 0
+          fi
+          # Determine whether to use --auto or not based on current status.
+          # Retry the status check up to 3 times with exponential back-off when
+          # GitHub is still computing the merge state (UNKNOWN state).
+          MAX_RETRIES=3
+          BACKOFF=3
+          MERGE_STATE=""
+          for i in $(seq 1 $MAX_RETRIES); do
+            MERGE_STATE=$(gh pr view "$OPEN_PR" --json mergeStateStatus --jq '.mergeStateStatus' 2>/dev/null)
+            if [ "$MERGE_STATE" != "UNKNOWN" ]; then
+              break
+            fi
+            if [ $i -lt $MAX_RETRIES ]; then
+              echo "PR merge state is UNKNOWN (GitHub still computing). Retry ${i}/${MAX_RETRIES} in ${BACKOFF}s..."
+              sleep $BACKOFF
+              BACKOFF=$((BACKOFF * 2))
+            fi
+          done
+
+          if [ "$MERGE_STATE" = "BLOCKED" ] || [ "$MERGE_STATE" = "UNKNOWN" ]; then
+            echo "PR is $MERGE_STATE — attempting auto-merge (safe fallback, waits for branch protection checks)."
+            if gh pr merge "$OPEN_PR" --auto --squash --delete-branch 2>&1; then
+              echo "Auto-merge initiated successfully."
+            else
+              AUTO_MERGE_ERR=$?
+              # If --auto failed because auto-merge is disabled for this repo
+              # (autoMergeAllowed: false), fall back to --admin which merges
+              # regardless of branch protection rules. --admin requires GitHub
+              # App token, not GITHUB_TOKEN, so GH_TOKEN is already correct.
+              if gh pr merge "$OPEN_PR" --admin --squash --delete-branch 2>&1; then
+                echo "Auto-merge unavailable (autoMergeAllowed: false) — merged via --admin."
+              else
+                echo "::error::Both --auto and --admin merge failed. Exiting."
+                exit 1
+              fi
+            fi
+          else
+            echo "PR is $MERGE_STATE — merging directly."
+            gh pr merge "$OPEN_PR" --squash --delete-branch
+          fi
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+
+      - name: Verify checksums are consistent (main == tag == tarball)
+        run: |
+          VERSION="${{ inputs.version }}"
+          TARBALL_CS=$(sha256sum "${{ env.TARBALL }}" | awk '{print $1}')
+
+          # Checksum recorded in the tag's artifacthub-pkg.yml
+          TAG_CS=$(git show "v${VERSION}:artifacthub-pkg.yml" 2>/dev/null             | grep "archive-checksum" | awk '{print $2}' | sed 's/sha256://')
+
+          # Checksum now on main (after PR merge)
+          MAIN_CS=$(git fetch origin main 2>/dev/null; git show "origin/main:artifacthub-pkg.yml"             | grep "archive-checksum" | awk '{print $2}' | sed 's/sha256://')
+
+          echo "Tarball SHA256 : $TARBALL_CS"
+          echo "Tag artifacthub: $TAG_CS"
+          echo "Main artifacthub: $MAIN_CS"
+
+          FAIL=0
+          [ "$TARBALL_CS" != "$TAG_CS"  ] && echo "ERROR: tag checksum mismatch!"  && FAIL=1
+          [ "$TARBALL_CS" != "$MAIN_CS" ] && echo "ERROR: main checksum mismatch!" && FAIL=1
+          [ "$FAIL" = "1" ] && exit 1
+          echo "All checksums consistent — ArtifactHub will index correctly."
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}

.markdownlint.yaml

@@ -0,0 +1,15 @@
+# Markdownlint configuration for the org repo.
+# Skill files intentionally use longer lines and emphasis-as-headings.
+# Allow these patterns for skills directory.
+
+# Line length is disabled for skill documentation
+MD013: false
+
+# Emphasis used as headings is allowed in skill files
+MD036: false
+
+# Compact table style is allowed
+MD060: false
+
+# Unordered list style (dash vs asterisk) is flexible
+MD004: false

.yamllint.yaml

@@ -0,0 +1,7 @@
+extends: default
+
+rules:
+  line-length: disable
+  document-start: disable
+  truthy:
+    check-keys: false

CLAUDE.md

@@ -0,0 +1,35 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Repository Purpose
+
+This is the **Privileged Escalation org-level repository**. It contains company-wide skills (instruction bundles) consumed by AI agents that run inside Paperclip and develop Headlamp plugins. There is no application code, build system, or test suite — only Markdown skill definitions.
+
+## Structure
+
+- `skills/` — Company skill definitions, each in its own directory with a `SKILL.md` file
+  - `skills/safety/SKILL.md` — Non-negotiable safety rules (secret handling, destructive action restrictions, sealed-secrets workflow, escalation protocol)
+  - `skills/sdlc/SKILL.md` — Software development lifecycle rules (GitHub auth, issue approval gates, branch strategy, PR review policy, handoff protocol, CI/CD)
+  - `skills/coding-standards/SKILL.md` — Headlamp plugin development conventions (stack, commands, registration API, shared libraries)
+  - `skills/product-context/SKILL.md` — Product context (plugin portfolio, target users, competitive landscape, evaluation framework, feature spec template)
+
+## Skill File Format
+
+Each skill is a Markdown file with YAML frontmatter containing `name` and `description` fields:
+
+```markdown
+---
+name: skill-name
+description: >
+  One-line description of what the skill covers.
+---
+
+# Skill Title
+
+Content...
+```
+
+## Skill Loading Order
+
+Skills are loaded by Paperclip in this order: `safety` → `sdlc` → `coding-standards` → `product-context`. Later skills can assume earlier ones are already loaded and should not duplicate their content.

README.md

@@ -1,3 +0,0 @@
-# Privileged Escalation
-
-Org-level content, social media queue, and community responses.

content/drafts/2026-03-07-six-headlamp-plugins-nobody-asked-for.md

@@ -1,55 +0,0 @@
----
-title: "Six Headlamp Plugins Nobody Asked For"
-date: 2026-03-07
-author: Privileged Escalation
-type: blog
-status: draft
----
-
-# Six Headlamp Plugins Nobody Asked For
-
-There's a particular kind of optimism that only exists in open source. It's the belief that if you build something genuinely useful, put it on GitHub, list it on Artifact Hub, write actual documentation, and then wait — someone will eventually find it.
-
-We're currently in the "wait" phase.
-
-## What We Actually Built
-
-Privileged Escalation makes [Headlamp](https://headlamp.dev/) plugins. If you don't know what Headlamp is: it's a CNCF-listed Kubernetes dashboard that was designed to be extended. If you don't know what Kubernetes is, this blog post is going to be a rough ride.
-
-We have six plugins. Each one takes something you'd normally do with `kubectl`, a terminal, and quiet desperation, and puts it in a web UI that your teammates might actually use.
-
-**[headlamp-polaris-plugin](https://github.com/privilegedescalation/headlamp-polaris-plugin)** — Surfaces Fairwinds Polaris audit results directly in Headlamp. Cluster score in the app bar, per-namespace breakdowns, exemption management from the UI instead of annotation YAML editing. Recently hit v0.6.0 with dark mode support, because apparently that's what it takes to be taken seriously in 2026.
-
-**[headlamp-tns-csi-plugin](https://github.com/privilegedescalation/headlamp-tns-csi-plugin)** — TrueNAS CSI driver visibility and storage benchmarking via kbench. If you've ever wondered whether your NFS share is actually performing the way iX Systems promised, this is the plugin that tells you the uncomfortable truth.
-
-**[headlamp-rook-plugin](https://github.com/privilegedescalation/headlamp-rook-plugin)** — Rook-Ceph cluster health, pool status, and CSI driver monitoring. For people who chose distributed storage and now live with the consequences.
-
-**[headlamp-sealed-secrets-plugin](https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin)** — Bitnami Sealed Secrets management with client-side RSA-OAEP and AES-256-GCM encryption. Your plaintext never leaves the browser. We're fairly proud of this one, which is why it hurts that it has zero stars.
-
-**[headlamp-intel-gpu-plugin](https://github.com/privilegedescalation/headlamp-intel-gpu-plugin)** — Intel GPU device visibility and resource monitoring. For the subset of people running Intel GPUs in Kubernetes, which is a smaller group than Intel's marketing department would like.
-
-**[headlamp-kube-vip-plugin](https://github.com/privilegedescalation/headlamp-kube-vip-plugin)** — kube-vip virtual IP and load balancer visibility. Because sometimes you just need to know if the VIP is actually where it's supposed to be.
-
-## Why Headlamp Plugins
-
-The Kubernetes dashboard space is... let's call it "stratified." There are expensive commercial options that do everything. There are free options that do almost nothing. And then there's Headlamp, which does a reasonable amount and lets you extend it.
-
-We chose the extension path. Every plugin installs through Headlamp's native plugin system — no separate deployments, no new URLs to bookmark, no "please also install this sidecar that needs its own RBAC." You add a plugin and it appears in the sidebar. That's it.
-
-This matters because the alternative is what most teams actually do: they `kubectl` their way through everything, pipe JSON through `jq`, and call it observability. It works. It's also miserable if you're trying to onboard anyone who doesn't have muscle memory for `kubectl get pods -n rook-ceph -o jsonpath='{.items[*].status.phase}'`.
-
-## The Honest Part
-
-We launched all six plugins in the same week. Combined star count across all repos: zero. Combined fork count: one, and we're not entirely sure it was intentional.
-
-Our CI is sometimes in a state that could charitably be described as "aspirational." We filed a bug against ourselves about E2E tests that have never passed because we haven't set up the test infrastructure yet. We committed LICENSE badges to READMEs before we committed the actual LICENSE files.
-
-This is normal. This is what early open source looks like before the narrative gets cleaned up. We'd rather be honest about it than pretend we emerged fully formed with 200 stars and a contributor covenant.
-
-## What's Next
-
-We're working on getting every plugin listed on Artifact Hub with proper metadata, fixing the CI pipelines that are currently failing for reasons ranging from "missing secrets" to "format check disagreements," and writing the kind of documentation that makes people confident enough to actually install something.
-
-If you run Headlamp and any of these plugins sound useful, try one. If something breaks, file an issue. If it works and you like it, a star would be nice. We're not above admitting that.
-
-All plugins are Apache-2.0 licensed. All repos are at [github.com/privilegedescalation](https://github.com/privilegedescalation).

renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "local>privilegedescalation/.github:renovate-config"
+  ]
+}

scripts/ci-health-check.sh

@@ -0,0 +1,106 @@
+#!/bin/bash
+# CI Health Check Script
+# Checks CI health across all privilegedescalation repos and reports failures
+
+set -euo pipefail
+
+# Configuration
+ORG="privilegedescalation"
+MAX_AGE_DAYS=30
+CRITICAL_THRESHOLD=3  # Number of consecutive failures to consider critical
+
+# Colors for output
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+GREEN='\033[0;32m'
+NC='\033[0m' # No Color
+
+# Repos to monitor
+REPOS=(
+  "org"
+  "infra"
+  "headlamp-sealed-secrets-plugin"
+  "headlamp-rook-plugin"
+  "headlamp-intel-gpu-plugin"
+  "headlamp-kube-vip-plugin"
+  "headlamp-tns-csi-plugin"
+  "headlamp-argocd-plugin"
+  "headlamp-polaris-plugin"
+)
+
+echo "=== CI Health Check for $ORG ==="
+echo "Generated: $(date -u +"%Y-%m-%d %H:%M:%S UTC")"
+echo ""
+
+# Track issues
+FAILURES=()
+STALE_REPOS=()
+NO_CI_REPOS=()
+
+for repo in "${REPOS[@]}"; do
+  echo "Checking $repo..."
+
+  # Check for stale repos
+  last_updated=$(gh repo view "$ORG/$repo" --json updatedAt --jq '.updatedAt' 2>/dev/null || echo "unknown")
+  if [[ "$last_updated" != "unknown" ]]; then
+    last_updated_date=$(date -d "$last_updated" +%s 2>/dev/null || echo "0")
+    cutoff_date=$(date -d "$MAX_AGE_DAYS days ago" +%s)
+    if [[ "$last_updated_date" -lt "$cutoff_date" ]]; then
+      STALE_REPOS+=("$repo (last updated: $last_updated)")
+      echo -e "  ${YELLOW}⚠ Stale repo${NC}"
+    fi
+  fi
+
+  # Check for CI workflows
+  workflow_count=$(gh api repos/"$ORG/$repo"/actions/workflows 2>/dev/null | jq -r '.total_count' || echo "0")
+  if [[ "$workflow_count" -eq 0 ]]; then
+    NO_CI_REPOS+=("$repo")
+    echo -e "  ${YELLOW}⚠ No CI workflows configured${NC}"
+    continue
+  fi
+
+  # Check recent CI runs (exclude approval gates)
+  recent_failures=$(gh run list --repo "$ORG/$repo" --limit 10 \
+    --json status,conclusion,name \
+    | jq -r '.[] | select(.conclusion == "failure") | select(.name | contains("CI") or contains("E2E") or contains("ci") or contains("e2e")) | .conclusion' \
+    | wc -l)
+
+  if [[ "$recent_failures" -ge "$CRITICAL_THRESHOLD" ]]; then
+    FAILURES+=("$repo: $recent_failures recent CI/E2E failures")
+    echo -e "  ${RED}✗ $recent_failures recent CI/E2E failures${NC}"
+  else
+    echo -e "  ${GREEN}✓ CI healthy${NC}"
+  fi
+done
+
+# Summary
+echo ""
+echo "=== Summary ==="
+
+if [[ ${#FAILURES[@]} -eq 0 && ${#STALE_REPOS[@]} -eq 0 && ${#NO_CI_REPOS[@]} -eq 0 ]]; then
+  echo -e "${GREEN}All systems healthy!${NC}"
+  exit 0
+else
+  if [[ ${#FAILURES[@]} -gt 0 ]]; then
+    echo -e "${RED}CI Failures:${NC}"
+    for failure in "${FAILURES[@]}"; do
+      echo "  - $failure"
+    done
+  fi
+
+  if [[ ${#STALE_REPOS[@]} -gt 0 ]]; then
+    echo -e "${YELLOW}Stale Repos (no updates in $MAX_AGE_DAYS+ days):${NC}"
+    for stale in "${STALE_REPOS[@]}"; do
+      echo "  - $stale"
+    done
+  fi
+
+  if [[ ${#NO_CI_REPOS[@]} -gt 0 ]]; then
+    echo -e "${YELLOW}Repos without CI:${NC}"
+    for no_ci in "${NO_CI_REPOS[@]}"; do
+      echo "  - $no_ci"
+    done
+  fi
+
+  exit 1
+fi

skills/coding-standards/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: coding-standards
+description: >
+  Coding standards for Privileged Escalation. Covers Headlamp plugin
+  development workflow, registration API, shared libraries, versioning,
+  dependency management, container registry, and distribution policy.
+---
+
+# Coding Standards
+
+## Headlamp Plugins
+
+All plugins extend [Headlamp](https://headlamp.dev/docs/latest/development/plugins/getting-started), a Kubernetes dashboard with a plugin system.
+
+- **Language:** TypeScript + React 18, MUI v5
+- **Scaffolding:** `npx --yes @kinvolk/headlamp-plugin create <plugin-name>`
+- **Entry point:** `src/index.tsx`
+- **Linting:** ESLint via `@headlamp-k8s/eslint-config` + Prettier
+- **Testing:** Vitest + React Testing Library
+
+### Plugin Commands
+
+Run from the plugin directory:
+
+| Command | Purpose |
+|---|---|
+| `npm run start` | Dev mode with hot reload |
+| `npm run build` | Production build (`dist/main.js`) |
+| `npm run format` | Prettier format |
+| `npm run lint` | ESLint check |
+| `npm run lint-fix` | ESLint auto-fix |
+| `npm run tsc` | Typecheck |
+| `npm run test` | Vitest tests |
+
+### Registration API
+
+Import from `@kinvolk/headlamp-plugin/lib`:
+
+- `registerAppBarAction()` — add components to the nav bar
+- `registerRoute()` — create new pages
+- `registerSidebarEntry()` — add sidebar items
+- `registerDetailsViewSection()` — extend resource detail views
+- `registerPluginSettings()` — add plugin configuration UI
+
+### K8s API Access
+
+```typescript
+import { K8s } from '@kinvolk/headlamp-plugin/lib';
+const [pods, error] = K8s.ResourceClasses.Pod.useList();
+```
+
+### Shared Libraries
+
+These are provided by Headlamp at runtime — **do not bundle them**:
+React, React Router, Redux, MUI, Lodash, Monaco Editor, Notistack, Iconify.
+
+## Versioning & Distribution
+
+- **All releases use SemVer.** ArtifactHub requires SemVer for Headlamp plugin packages — no CalVer, no custom schemes.
+- **Plugin distribution is ArtifactHub only.** Plugins are installed through Headlamp's native plugin installer sourced from ArtifactHub. No Helm charts, install scripts, or custom install mechanisms.
+- **Container images go to `ghcr.io` only.** Never Docker Hub, never mirror public images, never reference any other registry.
+
+## Dependency Management
+
+- **Dependency updates are owned by Mend Renovate.** Never enable Dependabot, never create `.github/dependabot.yml`, never reference Dependabot in workflows or docs.
+- **No package mirrors.** Never set up, configure, or reference package mirrors or proxies (npm, pip, Maven, container, etc.). Always use upstream registries directly.
+- **Security scanning uses local tools.** Run `npm audit` or `pnpm audit` for vulnerability scanning. Do not use the GitHub vulnerability alerts API.

skills/product-context/SKILL.md

@@ -0,0 +1,119 @@
+---
+name: product-context
+description: >
+  Product context for Privileged Escalation. Covers current plugin portfolio,
+  target users, competitive landscape, plugin evaluation framework, and feature
+  spec template.
+---
+
+# Product Context
+
+Load this section when triaging feature requests, evaluating new plugin proposals, or writing specs.
+
+## Current plugin portfolio
+
+| Plugin             | Repo                             | What it does                                    | Status |
+| ------------------ | -------------------------------- | ----------------------------------------------- | ------ |
+| **Polaris**        | `headlamp-polaris-plugin`        | Kubernetes best practice validation and scoring | Active |
+| **Kube-VIP**       | `headlamp-kube-vip-plugin`       | Kube-VIP load balancer management               | Active |
+| **Rook/Ceph**      | `headlamp-rook-plugin`           | Rook-Ceph storage cluster monitoring            | Active |
+| **Sealed Secrets** | `headlamp-sealed-secrets-plugin` | Bitnami Sealed Secrets management               | Active |
+| **Intel GPU**      | `headlamp-intel-gpu-plugin`      | Intel GPU device plugin monitoring              | Active |
+| **TrueNAS CSI**    | `headlamp-tns-csi-plugin`        | TrueNAS SCALE CSI driver monitoring             | Active |
+| **Argo CD**        | `headlamp-argocd-plugin`         | Argo CD application delivery management         | Active |
+
+All plugins distributed via **ArtifactHub**, installed through Headlamp's native plugin installer only.
+
+## Target users
+
+**Primary: The Platform Engineer**
+
+* Manages 1-50 Kubernetes clusters, mid-size company (100-2000 employees)
+* Pain point: "I have 15 tools open to monitor my clusters. I want one dashboard that shows me everything."
+* Very high tech comfort. Knows Kubernetes deeply. Will read your source code.
+* Will adopt a plugin in 5 minutes if it solves a real problem. Will drop it in 5 seconds if it's buggy or doesn't add value over `kubectl`.
+
+**Secondary: The DevOps Lead / SRE Manager**
+
+* Manages a platform team, responsible for cluster health and reliability.
+* Wants plugins that visualize what matters and surface problems proactively — NOT another monitoring tool.
+
+**Anti-persona: The Application Developer**
+
+App developers care about their deployments, not the cluster. Features like "show me my pod logs" are already in Headlamp core. Don't build for them.
+
+## Scope
+
+**In scope**
+
+* Headlamp plugins that visualize and manage specific Kubernetes ecosystem tools
+* Plugins that surface operational insights not available in Headlamp core
+* Plugins for CNCF projects and widely-adopted K8s ecosystem tools
+* ArtifactHub packaging and distribution
+
+**Explicitly out of scope**
+
+* Plugins that duplicate Headlamp core functionality
+* Non-Kubernetes tools
+* Hosted/SaaS versions of plugins
+* Helm-based or sidecar-based plugin installation
+* Custom Headlamp forks
+* Monitoring/alerting backends (we visualize, we don't collect metrics)
+* Multi-cluster management
+* CLI tools
+
+## Competitive landscape
+
+| Competitor                       | Where PRI differs                                                                   |
+| -------------------------------- | ----------------------------------------------------------------------------------- |
+| **Headlamp core**                | We extend it, not compete. If a feature belongs in core, contribute upstream.       |
+| **Lens**                         | Heavy, desktop-only, commercial. We make web-based, open source Headlamp better.    |
+| **k9s**                          | Different modality (TUI vs web). Not competitive.                                   |
+| **Komodor / Kubecost / Robusta** | Standalone products. Our plugins bring their insights INTO Headlamp. Complementary. |
+
+PRI's moat: leading third-party Headlamp plugin developer. Plugins are free, open source, on ArtifactHub.
+
+## Plugin evaluation framework
+
+1. **Is there a widely-adopted K8s ecosystem tool that lacks Headlamp visibility?**
+   * Fewer than 1,000 GitHub stars or in alpha → too early. Close with "revisit when more mature."
+   * Already has a Headlamp plugin → duplicate. Close.
+2. **Does the plugin add value over `kubectl` + the tool's own CLI/UI?**
+   * "It shows the same thing but in Headlamp" → weak value prop. Good plugins correlate data, surface problems proactively, simplify complex operations.
+3. **Can Gandalf build and maintain it?**
+   * One engineer can maintain ~6-8 plugins at current complexity. We're at 7 now. New plugins mean either dropping an existing one or hiring.
+4. **Is it installable via ArtifactHub without extras?**
+   * Plugin requires CRDs/RBAC/cluster resources installed separately → degraded experience.
+   * Unacceptable: plugin requires its own operator or sidecar.
+
+**Priority tiers**
+
+* **P0**: Bugs in existing plugins that break functionality or produce incorrect data
+* **P1**: Enhancements to existing plugins users are requesting
+* **P2**: New plugins for high-value K8s tools with clear user demand
+* **P3**: Speculative plugins, cross-plugin features, UX experiments
+
+## Feature spec template
+
+```markdown
+## Problem
+What operational visibility or capability is missing? Who needs it? What do they do today instead?
+
+## Proposed Solution
+What should the plugin show or enable that isn't available today?
+
+## Acceptance Criteria
+- [ ] Plugin displays...
+- [ ] User can...
+- [ ] Data is accurate when compared to `kubectl` / native CLI output
+- [ ] Works with [tool name] version X.Y+
+- [ ] Installable via ArtifactHub without additional cluster-level setup
+- [ ] Has unit tests covering core display logic
+
+## Out of Scope for This Issue
+## Dependencies
+What must exist in the cluster for this plugin to work? (CRDs, operators, RBAC)
+
+## Priority
+P0/P1/P2/P3 with one-sentence justification.
+```

skills/safety/SKILL.md

@@ -0,0 +1,38 @@
+---
+name: safety
+description: >
+  Non-negotiable safety rules for all agents at Privileged Escalation. Covers
+  secret handling, destructive command restrictions, sealed-secrets workflow,
+  anti-impersonation rules, role-boundary rules for GitHub actions, and
+  escalation protocol when uncertain.
+---
+
+# Safety Considerations
+
+The following rules apply to all agents at Privileged Escalation without exception.
+
+## Non-Negotiable Rules
+
+* **Never exfiltrate secrets or private data.** This includes API keys, tokens, PEM files, database credentials, kubeconfig contents, and any value sourced from a secret reference in your adapter config. Do not log, comment, or return these values in any output.
+
+* **Seek Board Approval for Destructive Actions.** Destructive means: deleting resources, dropping tables, wiping namespaces, force-pushing branches, resetting git history, removing secrets, or any operation that cannot be undone without restoring from backup.
+
+* **No plaintext secrets in any repository.** Kubernetes secrets go through Bitnami Sealed Secrets (`kubeseal`). Application credentials go in environment variables injected at runtime — never hardcoded.
+
+* **Do not use `kubectl create` in production.**
+The `privilegedescalation` namespace is Flux-managed. Secret changes go through the SealedSecrets workflow, committed to `privilegedescalation/infra`.
+
+* **Never impersonate another agent or human.** Agents must never sign, attribute, or present GitHub comments, PR reviews, or any external communications as another agent. Every comment must accurately identify the authoring agent. Signing as another agent — even when forwarding their work — is a process violation.
+
+* **Post GitHub comments only within your defined SDLC role.** An agent must not post a review type that belongs to another role, even if that role's agent has not yet completed its review:
+  - **Engineer bot** posts: implementation comments, CI results
+  - **QA bot** posts: QA reviews
+  - **UAT bot** posts: UAT reviews
+  - **CTO bot** posts: CTO reviews and approvals
+  - **CEO bot** posts: merge confirmations only
+
+* **Never change another agent's model configuration.** No agent may suggest, request, or execute a change to any other agent's model settings — including for quota exhaustion, cost optimization, or any other reason. Quota issues must be escalated to the board. This is a non-negotiable board directive.
+
+## If you are unsure
+
+If you are unsure whether an action is safe, stop. Post a comment on the Paperclip issue explaining what you are about to do and why you are uncertain, set the issue to `blocked`, and escalate to your manager. Do not guess.

skills/sdlc/SKILL.md

@@ -0,0 +1,181 @@
+---
+name: sdlc
+description: >
+  Software development lifecycle rules for Privileged Escalation. Covers GitHub
+  issue approval gates, authentication, branch strategy, PR review policy,
+  pipeline stages, CI/CD, and security review.
+---
+
+# Software Development Lifecycle
+
+## GitHub Authentication
+
+Access to GitHub is done via token in your env **Never** run `gh auth login` directly — it hangs headless agents.
+
+## GitHub Issues — Board Approval Required
+
+**If a task originated from GitHub (`originKind: "github"` in the issue data), do not begin any work.** Immediately create a `request_board_approval`:
+
+```json
+POST /api/companies/{companyId}/approvals
+{
+  "type": "request_board_approval",
+  "requestedByAgentId": "{your-agent-id}",
+  "issueIds": ["{issue-id}"],
+  "payload": {
+    "title": "Board approval required: GitHub issue",
+    "summary": "Summarize what the GitHub issue requests.",
+    "recommendedAction": "Approve to begin work.",
+    "risks": ["Work begins without board review if approved."]
+  }
+}
+```
+
+Set the issue to `blocked` until `PAPERCLIP_APPROVAL_STATUS` confirms approval. Only proceed once approved.
+
+## Branch Strategy
+
+All plugin repositories use three long-lived branches representing a promotion chain:
+
+| Branch | Environment | Owner | Who merges to it |
+|--------|-------------|-------|-----------------|
+| `dev` | Development | Engineer | Engineer self-merges after CI passes |
+| `uat` | User Acceptance Testing | QA (Regression Regina) | QA merges after code review |
+| `main` | Production | UAT (Pixel Patty) | UAT merges after browser validation |
+
+**Engineers target `dev` via feature branches** — never push directly to any long-lived branch.
+
+Feature branches follow the convention: `<agent-name>/<short-description>` (e.g., `gandalf/add-sealed-secrets-list`).
+
+## Pull Requests
+
+All changes must happen via pull request. Always include `cc @cpfarhood` at the bottom of the PR body for visibility — not as a reviewer.
+
+```bash
+gh pr create --title "..." --body "... cc @cpfarhood"
+```
+
+## PR Review & Merge Policy
+
+**Do not approve a PR with failing tests, type errors, or no coverage for new code.**
+
+### Promotion chain
+
+Each promotion is a PR reviewed and merged by its gate owner:
+
+1. **feature → dev** — Engineer self-merges after CI passes. No review required. Dev is for validation, not quality gates.
+2. **dev → uat** — QA (Regression Regina) reviews code quality: test coverage, regressions, edge cases. QA merges to `uat` after approval.
+3. **uat → main** — UAT (Pixel Patty) validates the deployed application via Playwright browser testing. UAT merges to `main` after validation passes. For detailed UAT testing procedures, see the `uat` company skill.
+
+**Each gate owner has merge authority.** No separate merge step by another role. No agent merges their own code to `uat` or `main` — only the gate owner merges promotions they review.
+
+## Pipeline
+
+### Pipeline A: Plugin/Feature Changes
+
+```text
+Engineer → PR to dev → self-merge → deploys to dev
+→ Engineer validates on dev
+→ PR from dev → uat → QA reviews → QA merges
+→ Deploys to UAT environment
+→ PR from uat → main → UAT validates → UAT merges
+→ Production
+```
+
+Applies to changes in `headlamp-*-plugin/` repos (plugin code, features, bug fixes).
+
+**UAT_PLAYBOOK.md maintenance:** When modifying a plugin in any way that changes how it must be tested — including new features, changed behavior, updated UI flows, or different data sources — the engineer must update the `UAT_PLAYBOOK.md` file in the plugin repository root with the current testing steps before requesting UAT. This ensures the playbook stays current as plugins evolve and UAT agents have accurate test guidance.
+
+### Pipeline B: Infrastructure Changes (No UI Impact)
+
+```text
+Engineer → PR to main → CI passes → QA reviews → QA merges
+→ Production
+```
+
+Applies to changes in `.github/workflows/`, `infra/`, `org/` repos, and template repos. No UAT stage needed — infrastructure changes have no UI to validate.
+
+**Detection:** If `git diff` shows changes only in `.github/`, `infra/`, `org/`, or deployment files → Pipeline B. If any `headlamp-*-plugin/` code changed → Pipeline A.
+
+**Failure routing:** Any stage failure returns directly to the engineer via PR comments.
+
+## Issue Reviewers and Approvers
+
+Every Paperclip issue has **Reviewers** and **Approvers** fields visible in the UI sidebar. These are populated by setting `executionPolicy` when creating the issue. Without an execution policy, those fields show "None" and handoffs never trigger.
+
+**All stage and participant `id` fields must be random UUIDs.** Generate them at issue-creation time (e.g. via `uuidgen` or your language's UUID library). Do not use descriptive strings — the API rejects non-UUID values.
+
+### Pipeline A — set reviewers on issue creation
+
+For plugin/feature work (Pipeline A), set a two-stage execution policy so QA and UAT appear as reviewers:
+
+```bash
+QA_STAGE_ID=$(uuidgen)
+QA_PART_ID=$(uuidgen)
+UAT_STAGE_ID=$(uuidgen)
+UAT_PART_ID=$(uuidgen)
+```
+
+```json
+"executionPolicy": {
+  "mode": "normal",
+  "commentRequired": true,
+  "stages": [
+    {
+      "id": "<QA_STAGE_ID>",
+      "type": "review",
+      "approvalsNeeded": 1,
+      "participants": [
+        { "id": "<QA_PART_ID>", "type": "agent", "agentId": "fd5dbec8-ddbb-4b57-9703-624e0ed90053" }
+      ]
+    },
+    {
+      "id": "<UAT_STAGE_ID>",
+      "type": "review",
+      "approvalsNeeded": 1,
+      "participants": [
+        { "id": "<UAT_PART_ID>", "type": "agent", "agentId": "01ec02f7-70c2-4fa1-ac3f-2545f1237ac3" }
+      ]
+    }
+  ]
+}
+```
+
+- Stage 1 reviewer: Regression Regina (`fd5dbec8-ddbb-4b57-9703-624e0ed90053`)
+- Stage 2 reviewer: Pixel Patty (`01ec02f7-70c2-4fa1-ac3f-2545f1237ac3`)
+
+### Pipeline B — single reviewer
+
+For infrastructure changes (Pipeline B), use one QA review stage:
+
+```json
+"executionPolicy": {
+  "mode": "normal",
+  "commentRequired": true,
+  "stages": [
+    {
+      "id": "<QA_STAGE_ID>",
+      "type": "review",
+      "approvalsNeeded": 1,
+      "participants": [
+        { "id": "<QA_PART_ID>", "type": "agent", "agentId": "fd5dbec8-ddbb-4b57-9703-624e0ed90053" }
+      ]
+    }
+  ]
+}
+```
+
+### Triggering the handoff
+
+When an engineer completes work and merges to `dev`, set the Paperclip issue status to `in_review`. This activates the execution policy and wakes the first reviewer. Each reviewer approves or requests changes through the normal Paperclip issue update flow — see the Paperclip skill's `references/api-reference.md` for details.
+
+## CI/CD
+
+- CI runs on self-hosted ARC runners: `runs-on: runners-privilegedescalation`
+- CI triggers on PRs to `dev`, `uat`, and `main` branches
+- Engineers may modify `.github/workflows/` files directly via PR
+- Runners scale to zero when idle and start automatically when a workflow triggers
+
+## Security Review
+
+Security review is handled as part of the QA review stage. Regression Regina evaluates security concerns during her code quality review. There is no separate dedicated security review agent.

skills/sdlc/sdlc-diagram.md

@@ -0,0 +1,134 @@
+# SDLC Pipeline Diagram
+
+## Full Lifecycle
+
+```mermaid
+flowchart TD
+    subgraph Origin["Task Origin"]
+        GH["GitHub Issue"]
+        PP["Paperclip Issue"]
+    end
+
+    subgraph Approval["Board Gate"]
+        BA{"Board Approval<br/>Required?"}
+        REQ["Request Board Approval<br/>→ Issue blocked"]
+        APPROVED["Approved"]
+    end
+
+    subgraph Detection["Pipeline Detection"]
+        DET{"Changed files?"}
+        PA["Pipeline A<br/>Plugin / Feature"]
+        PB["Pipeline B<br/>Infrastructure"]
+    end
+
+    subgraph PipelineA["Pipeline A: Plugin / Feature Changes"]
+        direction TB
+        A_ENG["Engineer writes code<br/>(Gandalf)"]
+        A_PR_DEV["PR → dev<br/>Engineer self-merges"]
+        A_CI_DEV{"CI Passes?"}
+        A_DEV["Deploys to dev<br/>Engineer validates"]
+        A_PR_UAT["PR dev → uat"]
+        A_QA["QA Review<br/>(Regression Regina)<br/>Code quality, test coverage"]
+        A_QA_PASS{"QA Approved?"}
+        A_QA_MERGE["QA merges to uat"]
+        A_UAT_DEPLOY["Deploys to UAT env"]
+        A_PR_MAIN["PR uat → main"]
+        A_UAT["UAT Review<br/>(Pixel Patty)<br/>Playwright browser validation"]
+        A_UAT_PASS{"UAT Approved?"}
+        A_UAT_MERGE["UAT merges to main"]
+    end
+
+    subgraph PipelineB["Pipeline B: Infrastructure Changes"]
+        direction TB
+        B_ENG["Engineer writes code<br/>(Gandalf / Hugh)"]
+        B_PR["PR → main"]
+        B_CI{"CI Passes?"}
+        B_QA["QA Review<br/>(Regression Regina)"]
+        B_QA_PASS{"QA Approved?"}
+        B_QA_MERGE["QA merges to main"]
+    end
+
+    subgraph Result["Outcome"]
+        PROD["Merged to main<br/>✓ Production"]
+        RETURNED["Returned to Engineer<br/>Fix and resubmit"]
+    end
+
+    %% Origin routing
+    GH --> BA
+    PP --> DET
+    BA -->|"originKind: github"| REQ
+    REQ -->|"PAPERCLIP_APPROVAL_STATUS"| APPROVED
+    BA -->|"originKind: other"| DET
+    APPROVED --> DET
+
+    %% Pipeline detection
+    DET -->|"headlamp-*-plugin/ code"| PA
+    DET -->|".github/, infra/, org/"| PB
+
+    %% Pipeline A flow
+    PA --> A_ENG --> A_PR_DEV --> A_CI_DEV
+    A_CI_DEV -->|"Pass"| A_DEV
+    A_CI_DEV -->|"Fail"| RETURNED
+    A_DEV --> A_PR_UAT --> A_QA --> A_QA_PASS
+    A_QA_PASS -->|"Approved"| A_QA_MERGE --> A_UAT_DEPLOY
+    A_QA_PASS -->|"Changes requested"| RETURNED
+    A_UAT_DEPLOY --> A_PR_MAIN --> A_UAT --> A_UAT_PASS
+    A_UAT_PASS -->|"Approved"| A_UAT_MERGE --> PROD
+    A_UAT_PASS -->|"Changes requested"| RETURNED
+
+    %% Pipeline B flow
+    PB --> B_ENG --> B_PR --> B_CI
+    B_CI -->|"Pass"| B_QA --> B_QA_PASS
+    B_CI -->|"Fail"| RETURNED
+    B_QA_PASS -->|"Approved"| B_QA_MERGE --> PROD
+    B_QA_PASS -->|"Changes requested"| RETURNED
+
+    RETURNED -->|"Fix and resubmit"| A_PR_DEV
+    RETURNED -->|"Fix and resubmit"| B_PR
+
+    %% Styling
+    classDef gate fill:#f9e4e4,stroke:#c0392b,color:#000
+    classDef pass fill:#e4f9e4,stroke:#27ae60,color:#000
+    classDef agent fill:#e4e9f9,stroke:#2980b9,color:#000
+    classDef decision fill:#fef9e7,stroke:#f39c12,color:#000
+    classDef deploy fill:#e8f4f8,stroke:#2c3e50,color:#000
+
+    class BA,A_CI_DEV,A_QA_PASS,A_UAT_PASS,B_CI,B_QA_PASS,DET decision
+    class A_QA,A_UAT,B_QA gate
+    class PROD pass
+    class A_ENG,B_ENG agent
+    class A_DEV,A_UAT_DEPLOY deploy
+```
+
+## Branch Promotion Chain
+
+```mermaid
+flowchart LR
+    subgraph Feature["Feature Branch"]
+        FB["gandalf/feature-name"]
+    end
+
+    subgraph Dev["dev branch"]
+        DEV["Engineer self-merges<br/>Deploys to dev env"]
+    end
+
+    subgraph UAT["uat branch"]
+        UATB["QA reviews & merges<br/>Deploys to UAT env"]
+    end
+
+    subgraph Main["main branch"]
+        MAIN["UAT validates & merges<br/>Deploys to production"]
+    end
+
+    FB -->|"PR + CI"| DEV
+    DEV -->|"PR + QA review"| UATB
+    UATB -->|"PR + UAT review"| MAIN
+
+    classDef dev fill:#fff3cd,stroke:#856404,color:#000
+    classDef uat fill:#cce5ff,stroke:#004085,color:#000
+    classDef prod fill:#d4edda,stroke:#155724,color:#000
+
+    class DEV dev
+    class UATB uat
+    class MAIN prod
+```

skills/uat/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: uat
+description: >
+  Functional UAT procedures for Privileged Escalation Headlamp plugins. General
+  behavior, acceptance criteria, artifact requirements, and reference to
+  plugin-specific test steps in UAT_PLAYBOOK.md.
+---
+
+# UAT Procedures
+
+## Purpose
+
+This skill defines **functional User Acceptance Testing** for all Privileged Escalation Headlamp plugins. UAT validates that plugins work correctly in the deployed environment — by exercising plugin features in a running Headlamp instance, not by reviewing code or CI results.
+
+## UAT Environment
+
+The UAT Headlamp instance runs in the `headlamp-uat` Kubernetes namespace. Navigate to the Headlamp UAT URL using your Playwright browser. The plugin under test must be deployed to UAT before testing begins.
+
+## General Process
+
+For every `uat→main` promotion:
+
+1. Open the Headlamp UAT instance in the browser
+2. Confirm the plugin appears in the sidebar or app bar
+3. Read the plugin's `UAT_PLAYBOOK.md` for the specific test steps to run
+4. Execute the test steps from the playbook, capturing screenshots at each verification
+5. Check the browser console for errors throughout
+6. Post a structured test report (see Artifacts section)
+
+## Acceptance Criteria
+
+A plugin passes UAT when:
+
+- **Plugin loads** — sidebar entry or app bar action is visible and accessible
+- **Features work** — all core features in the playbook execute without errors
+- **No console errors** — browser console shows no errors during normal operation
+- **Data matches cluster state** — plugin data is consistent with `kubectl` queries against the cluster
+
+A plugin fails UAT when:
+
+- Plugin does not load or renders only an error state
+- Any core feature is inaccessible or produces errors
+- Console errors are present and not explainable as unrelated noise
+- Displayed data contradicts known cluster state
+
+## Artifact Requirements
+
+For each plugin tested, the UAT report must include:
+
+1. **Screenshots** of the plugin running in Headlamp — sidebar entry visible, main view loaded, at least one detail view
+2. **Test checklist** — each step from `UAT_PLAYBOOK.md` marked pass/fail
+3. **Console errors** — any browser console errors observed (attach screenshot if present)
+4. **Environment info** — Headlamp version, plugin version, browser used, namespace context
+
+## Reading UAT_PLAYBOOK.md
+
+Each plugin repository contains a `UAT_PLAYBOOK.md` in its root directory. That file contains the canonical test steps for that specific plugin. Before running UAT, read the relevant playbook to know:
+
+- Which features to exercise
+- What the expected results are
+- What screenshots to capture at each step
+
+If `UAT_PLAYBOOK.md` does not exist for a plugin, treat that as a gap — report it in the UAT findings and flag it as a documentation issue.
+
+## Decision Criteria
+
+- **Approve** the `uat→main` promotion when all applicable test steps from the playbook pass and no console errors are present
+- **Request changes** when any test step fails — include specific failing steps, observed results vs. expected results, and failure screenshots
+- **Block** if the plugin fails to load entirely — escalate to CTO as a deployment issue requiring immediate resolution

social/kubecon-eu-2026/kubecon-eu-2026-posts.md

@@ -1,165 +0,0 @@
-# Social Media Batch — KubeCon EU 2026
-
-## Strategic Summary
-
-KubeCon + CloudNativeCon Europe 2026 runs March 23-26 in Amsterdam. We are not speaking, but we should be visible in the conversation. The play: ride the #KubeCon hashtag with technically credible content that highlights our Headlamp plugin suite. Each post ties to a real platform engineering pain point. Tone is irreverent but useful — consistent with our brand voice from the first batch.
-
-Current state: 6 plugins, 1 star total (rook got our first organic star), 1 fork on sealed-secrets, listed on Artifact Hub, and we have an open intro issue on the headlamp-k8s/plugins repo (#548). Headlamp is now under kubernetes-sigs — the CNCF halo is real.
-
----
-
-## Pre-KubeCon: March 21-22
-
-### Post 1 — Teaser
-
-**Platform**: Twitter/X
-**Scheduled**: March 21
-**Post**:
-Next week at #KubeCon EU, people will complain about Kubernetes dashboards. Again.
-
-We've been quietly building Headlamp plugins that solve the problems people complain about at conferences but never fix when they get home.
-
-Storage visibility. GPU monitoring. Secrets management without the YAML ritual.
-
-6 plugins. 1 star. We're ready for Amsterdam.
-
-github.com/privilegedescalation
-
-#KubeCon #CloudNativeCon #Kubernetes #Headlamp
-**CMO Note**: Sets up the week. Self-deprecating "1 star" callback to our first batch voice. The "problems people complain about at conferences" angle resonates with anyone who has been to KubeCon. Does not oversell — lets curiosity drive clicks.
-
----
-
-## During KubeCon: March 23-26
-
-### Post 2 — Day 1: Rook-Ceph
-
-**Platform**: Twitter/X
-**Scheduled**: March 23
-**Post**:
-Day 1 at #KubeCon EU and someone just asked "how do I see my Ceph cluster health without shelling into the pod?"
-
-Brother, there is a Headlamp plugin for that.
-
-CephCluster status, pool utilization, OSD health — all in one dashboard view. No kubectl required.
-
-github.com/privilegedescalation/headlamp-rook-plugin
-
-#KubeCon #CloudNativeCon #RookCeph #Kubernetes
-**CMO Note**: Rook-Ceph is our strongest plugin (first organic star). The "shelling into the pod" pain point is universal for storage teams. Framing as a response to a conference conversation makes it timely without being fictional.
-
----
-
-### Post 3 — Day 2: Intel GPU
-
-**Platform**: Twitter/X
-**Scheduled**: March 24
-**Post**:
-Hot take: your Kubernetes dashboard should know about your GPU allocations.
-
-Not just "how many GPUs does this node have" but actual device-level monitoring — allocation status, health, per-GPU resource tracking.
-
-We built a Headlamp plugin for Intel GPUs because nobody else did. Platform engineers running GPU workloads shouldn't need a separate monitoring stack for accelerator visibility.
-
-github.com/privilegedescalation/headlamp-intel-gpu-plugin
-
-#KubeCon #CloudNativeCon #GPU #Kubernetes #PlatformEngineering
-**CMO Note**: GPU/AI workloads on K8s will be a huge theme at KubeCon EU 2026. This positions us in that conversation without pretending to be an AI company. The "because nobody else did" line is true and plays well.
-
----
-
-### Post 4 — Day 3: Sealed Secrets
-
-**Platform**: Twitter/X
-**Scheduled**: March 25
-**Post**:
-Sealed Secrets is great until you need to actually manage them without leaving your terminal.
-
-Our Headlamp plugin does client-side RSA-OAEP + AES-256-GCM encryption — your plaintext never leaves the browser. Create, view, and rotate sealed secrets from the dashboard.
-
-The kind of tool you build because you got tired of explaining the sealing workflow to the new person on the platform team. Again.
-
-github.com/privilegedescalation/headlamp-sealed-secrets-plugin
-
-#KubeCon #CloudNativeCon #Kubernetes #SecretsManagement
-**CMO Note**: Security + UX angle. The "explaining to the new person" line targets the exact audience (platform team leads) who would adopt this. Technical specificity on the encryption approach builds credibility with the security-conscious KubeCon crowd.
-
----
-
-### Post 5 — Day 4: Ecosystem Thread
-
-**Platform**: Twitter/X
-**Scheduled**: March 26
-**Post**:
-It's the last day of #KubeCon EU so here's the thread nobody asked for: why we bet everything on Headlamp plugins.
-
-Headlamp is a CNCF project (now under kubernetes-sigs). It has a plugin system. Almost nobody uses it.
-
-We built 6 plugins:
-🔒 Sealed Secrets — client-side encryption in the browser
-📊 Rook-Ceph — Ceph cluster visibility without kubectl
-🖥️ Intel GPU — device-level GPU monitoring
-⚡ kube-vip — virtual IP and load balancer dashboards
-🔍 Polaris — security auditing baked into your dashboard
-💾 TrueNAS CSI — storage benchmarking with kbench
-
-All open source. All on Artifact Hub. All free.
-
-The Kubernetes dashboard space is crowded with paid products. We think the free one just needs better plugins.
-
-github.com/privilegedescalation
-artifacthub.io/packages/search?ts_query_web=privilegedescalation&kind=21
-
-#KubeCon #CloudNativeCon #CNCF #Headlamp #PlatformEngineering #OpenSource
-**CMO Note**: This is the marquee post of the campaign. The "thread nobody asked for" framing disarms the promo feel. Listing all 6 plugins with one-liners gives people a reason to click. The anti-paid-dashboard positioning is our core narrative. Closing day timing means people are reflecting on the event and more receptive to "what's next" content.
-
----
-
-## Post-KubeCon: March 27
-
-### Post 6 — Recap
-
-**Platform**: Twitter/X
-**Scheduled**: March 27
-**Post**:
-KubeCon EU 2026 recap from an org with 1 star and zero conference passes:
-
-— We posted about our Headlamp plugins all week
-— Nobody at the conference noticed
-— But you're reading this, so maybe the strategy is working
-
-Serious note: if you're running Headlamp and want plugins that solve real infrastructure problems, we're building the ecosystem. Storage, security, GPU monitoring, networking — all open source.
-
-Star the ones you'd actually use: github.com/privilegedescalation
-
-#KubeCon #CloudNativeCon #Kubernetes
-**CMO Note**: Self-aware wrap-up. Acknowledging that we weren't there but participated remotely is more honest (and funnier) than pretending we were in the room. The "star the ones you'd actually use" CTA is low-pressure but gives us a measurable signal. Maintains the irreverent brand voice.
-
----
-
-## Reddit Adaptation
-
-### r/kubernetes Post
-
-**Scheduled**: March 23 (cross-post with Day 1)
-**Title**: We built 6 Headlamp plugins for Kubernetes — storage, security, GPU monitoring. All open source.
-**Body**:
-Hey r/kubernetes — we're Privileged Escalation (yes, that's the real name).
-
-We've been building Headlamp plugins because we think the Kubernetes dashboard space needs more open source options. Headlamp is a CNCF project under kubernetes-sigs, and its plugin system is underused.
-
-Here's what we built:
-
-- **Rook-Ceph plugin** — CephCluster health, pool stats, OSD monitoring in the dashboard
-- **Sealed Secrets plugin** — create/manage sealed secrets with client-side encryption (RSA-OAEP + AES-256-GCM, plaintext never leaves browser)
-- **Intel GPU plugin** — device-level GPU allocation and health monitoring
-- **Polaris plugin** — Fairwinds Polaris security auditing integrated into Headlamp
-- **kube-vip plugin** — virtual IP and load balancer visibility
-- **TrueNAS CSI plugin** — storage benchmarking with kbench integration
-
-Everything is on GitHub and Artifact Hub:
-- GitHub: github.com/privilegedescalation
-- Artifact Hub: artifacthub.io/packages/search?ts_query_web=privilegedescalation&kind=21
-
-We're not selling anything. Feedback welcome — especially if you're running Headlamp already and want plugins that do X.
-**CMO Note**: Reddit hates promotional content, so this leans informational. "We're not selling anything" defuses the self-promo response. Asking for feedback invites engagement. The "if you want plugins that do X" line is a customer development move — we learn what people actually want.

social/queue/2026-03-07-first-batch.md

@@ -1,85 +0,0 @@
-# Social Media Batch - 2026-03-07
-
-## Strategic Summary
-
-First-ever social batch for Privileged Escalation. The org has 6 Headlamp plugins across storage, security, and infrastructure -- all freshly released, all at zero stars. The play here is name recognition and curiosity: make people encounter "Privileged Escalation" in their feed and wonder what it is before they click. Leading with the sealed-secrets plugin (client-side crypto angle) and the absurdity of launching 6 plugins to zero fanfare.
-
----
-
-## 1. Ready to Post
-
-### Post 1
-
-**Platform**: Twitter/X
-**Post**:
-We shipped 6 Kubernetes Headlamp plugins and nobody noticed.
-
-Storage benchmarking, Rook-Ceph visibility, Polaris auditing, Sealed Secrets with actual client-side encryption, Intel GPU monitoring, and kube-vip dashboards.
-
-Zero stars across the board. We are crushing it.
-
-github.com/privilegedescalation
-**CMO Note**: Self-deprecating launch acknowledgment. The honesty about zero stars is the hook -- it reads as human, not corporate. Links to the org for curious clicks.
-
----
-
-### Post 2
-
-**Platform**: Bluesky
-**Post**:
-the sealed secrets headlamp plugin does client-side RSA-OAEP + AES-256-GCM encryption so your plaintext never leaves the browser.
-
-someone forked it last month. we have our first user. or our first person who accidentally clicked fork. either way, we are celebrating.
-**CMO Note**: Technical specificity makes it credible. The fork joke (sm-moshi, Feb 22) is real and plays well on Bluesky's irony-friendly audience. Seeds curiosity about what Headlamp plugins are.
-
----
-
-### Post 3
-
-**Platform**: Mastodon
-**Post**:
-Genuine question for the fediverse: if you have 6 open source projects and zero stars on any of them, are you a software company or just a guy with a lot of repos?
-
-Asking for a friend. The friend is github.com/privilegedescalation.
-**CMO Note**: Mastodon audience appreciates self-aware humor. This is pure slow-burn -- raises the question of what Privileged Escalation is without explaining it. The link is there for anyone curious enough to click.
-
----
-
-## 2. Risky but Worth Discussing
-
-### Post 4
-
-**Platform**: Twitter/X
-**Post**:
-Every Kubernetes UI either costs money or looks like it was designed during a mass layoff event.
-
-We've been building Headlamp plugins that make the free one actually useful. Rook-Ceph dashboards, Polaris auditing, storage benchmarks -- the stuff you duct-tape together with kubectl and regret.
-
-github.com/privilegedescalation
-**CMO Note**: Mildly spicy take on the K8s UI landscape. Does not name competitors directly but the implication is clear. Could rub Lens/Rancher people the wrong way. Worth discussing tone.
-
----
-
-## 3. Backlog (Evergreen)
-
-### Post 5
-
-**Platform**: LinkedIn
-**Post**:
-We just audited our own GitHub repos and found that 4 out of 6 were missing LICENSE files.
-
-They all had Apache-2.0 badges in the README. The actual license text? Not present. Technically, anyone using our code was operating on vibes and good faith.
-
-Fixed now. But if your open source project has a license badge and no LICENSE file, maybe go check. We'll wait.
-**CMO Note**: Honest product personality at work. Admitting a real flaw (that we just fixed) builds trust and is genuinely useful advice. LinkedIn audience will share practical open source governance content.
-
----
-
-### Post 6
-
-**Platform**: Twitter/X
-**Post**:
-TIL "Privileged Escalation" as a GitHub org name gets flagged by approximately zero security scanners.
-
-We checked.
-**CMO Note**: Pure name recognition play. The org name is inherently memorable and slightly provocative -- leaning into that. Short enough for easy engagement.