infrabroker

Unbreak CI when the required govulncheck check goes red on every PR because of a new Go stdlib CVE — bump the go directive in go.mod to the fixed version (single-sourced into all workflows), verify locally, ship as a standalone auto-merged PR, then re-run the blocked PRs' checks. Also handles the dependency-CVE variant. Use when govulncheck fails in CI or locally, a Go security release / stdlib CVE lands, or PRs are suddenly all red on the govulncheck check.

Triage and land the open Dependabot PRs — verify each bump is what it claims (diff scope, release notes, breaking changes vs our actual usage), let the required checks gate it, and auto-merge one at a time. Use when the user asks to review/merge dependency updates or Dependabot PRs, or when Dependabot PRs are piling up.

Recurring security & correctness audit of the infrabroker repo. Iteratively find, fix, and CLOSE issues across security / logic / documentation — each finding tracked as a GitHub issue, each fix landing as an auto-merged PR that closes it. Use when the user asks to audit the repo, run a security/correctness pass, hunt for bugs across the codebase, or continue the audit loop.

Analyze a GitHub issue and its comment thread, verify the technical claims against the code, and draft a maintainer reply that follows the conversation — the draft is shown for approval and NEVER posted without explicit confirmation. Use when the user asks to analyze an issue, propose/draft an answer or reply to an issue or comment thread, or figure out what to respond.

Work a GitHub issue of infrabroker end-to-end — branch first, implement with tests, changelog entry under [Unreleased], make verify, then a PR that closes the issue on merge (auto-merge). Use when the user asks to work on, implement, fix or ship a specific issue, pick up the next issue from the backlog, or continue issue work.

Cut and publish a new infrabroker release end-to-end — semver bump, CHANGELOG (folding the [Unreleased] section), server.json + HANDOFF, make verify, release PR, annotated tag, and the CI-driven GitHub release + multi-arch ghcr image + MCP Registry publish. Use when the user asks to release, publish, cut/ship/tag a release, bump the version and release, or make a new version.

Deploy infrabroker to production (or upgrade an existing install) using make dist + deploy/install.sh, with preflight policy checks, operator choice of CA custody (Azure Key Vault vs local PEM), and post-deploy health verification. Use when the user asks to deploy, release, install as a service, or upgrade infrabroker on a host.