Produces a weekly CISO management briefing as a Marp-compatible Markdown presentation. Use when: weekly cybersecurity notes, KPI/KRI data, incidents, vulnerabilities, threat intelligence, regulatory updates, or management decision needs must become an executive-ready cyber risk and security management brief.
Operating protocol for a Crux project. Use when: an agent or IDE needs to understand Crux layout, locate framework-home definitions, locate project `.crux` state, route work to the right agent, run onboarding, manage task continuity, or decide which files are read-only versus writable.
Enforces a disciplined implementation posture before coding or broad refactors: surface assumptions, narrow scope, prefer the simplest complete fix, define verification targets, and avoid speculative cleanup. Use when: a developer agent is about to implement, refactor, review, or change non-trivial code and there is meaningful ambiguity, risk, or temptation to over-engineer.
Analyses a live Kubernetes cluster and produces .crux/docs/kubernetes.md and .crux/summaries/kubernetes.md. Read-only — does not modify any cluster resources. Use when: (1) .crux/docs/kubernetes.md is missing during onboarding, (2) user requests an architecture review, (3) cluster configuration has significantly changed.
Audits all cluster namespaces against tenant naming conventions defined in decisions/tenant-naming-conventions.md. Checks label compliance, missing resource quotas, and naming pattern violations. Use when: naming convention question, pre-release namespace review, SOC Type 2 audit, or periodic drift check.
Applies or updates Kubernetes NetworkPolicy resources for a target namespace. Supports standard policy templates (deny-all-ingress, allow-same-namespace, allow-ingress-controller, allow-monitoring) and custom policies from user input. Requires explicit user approval before applying any change. Use when: hardening a namespace, onboarding a new tenant, policy drift repair.
Inspects cluster storage health: PersistentVolumes, PersistentVolumeClaims, StorageClasses, and volume-related events. Identifies unbound PVCs, full or near-full volumes, and provisioner errors. Use when: storage questions, PVC issues, pre-release storage review, or on-demand capacity check.
Kubernetes-specific step of tenant onboarding. Creates namespace(s) with correct labels, applies ResourceQuota and LimitRange from the tier preset, enforces NetworkPolicy defaults (default-deny, allow-same-namespace, allow-monitoring), sets up RBAC for the tenant team, registers the tenant in Grafana (if enabled), and updates docs/tenants.md. Part of the multi-step tenant onboarding workflow (.crux/workflows/tenant-onboarding.md). Use when: Kubernetes provisioning step of tenant onboarding, or re-applying standards to a drifted tenant namespace (reconcile mode).