Menu
Connect to staging servers by authenticating with Teleport and connecting `kubectl` to `staging-main`. Use when the user asks to connect to staging servers.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Cuts a new release of ai-sdk — creates a Linear issue, branches, bumps version, updates changelog, runs checks, commits, opens a PR, and returns to main. Merging the PR triggers CI to auto-tag. Use when the user wants to release a new version of the ai_sdk gem.
References Semaphore's sem-ai CLI command set, output formats, safety defaults, and legacy sem replacement patterns. Use when exact sem-ai commands or flags are needed before inspecting or mutating Semaphore state.
Debugs and triages Semaphore CI pipelines and jobs with sem-ai first, falling back to legacy sem only for interactive attach/debug shells. Use when CI is failing, flaky, stuck, queued, or needs logs, reruns, stops, or deployment-state inspection.
Find an unreserved staging namespace and promote a Semaphore pipeline into it. Use when a user asks to pick a free `revNN`/`qaNN` server, trigger `Deploy to EKS staging`, or validate that promotion/deploy completed.
Run an extremely strict maintainability review for abstraction quality, giant files, and spaghetti-condition growth. Use for a thermo-nuclear code quality review, thermonuclear review, deep code quality audit, or especially harsh maintainability review.
Promote an Amadeus PR to the shared `data` staging namespace using Semaphore `Deploy to Staging`, then verify the SLSA-backed artifact flow, deployed image, and live log contract through Kubernetes.
| name | staging-kube-connect |
| description | Connect to staging servers by authenticating with Teleport and connecting `kubectl` to `staging-main`. Use when the user asks to connect to staging servers. |
Connect local kubectl to staging-main. This skill does not choose or reserve namespaces.
tshkubectlnamespace (revNN or qaNN) when the user explicitly asks to set onekubectl config current-context targets staging-mainnamespace was provided, current context namespace is set to that valuekubectl auth can-i get pods (namespace-scoped when provided)tsh login --proxy=teleport.simplepractice.com --auth=gsuite
kubectl to staging cluster.tsh kube login staging-main
kubectl config current-context
namespace, validate and set it.kubectl get ns <namespace>
kubectl config set-context --current --namespace=<namespace>
kubectl auth can-i get pods -n <namespace>
namespace was provided, verify access without changing namespace.kubectl auth can-i get pods
In Kubernetes staging, do not validate Rails/AI SDK behavior with plain
kubectl exec ... bundle exec rails runner.
The pod env contains encrypted kms://... placeholders from ConfigMaps. The
actual SimplePractice server is launched through aws-env exec, which decrypts
those values before starting /sbin/my_init / Passenger. A fresh kubectl exec
process does not inherit that decrypted server env, so plain runner probes can
produce false failures like:
AI::AuthenticationError: AMADEUS_API_KEY is invalid or missing
Use this shape instead:
kubectl exec -n "$NAMESPACE" -c simplepractice "$POD" -- \
aws-env exec -- bash -lc 'FCM_CREDENTIALS_JSON="{}" FCM_WEB_API_KEY=dummy FCM_IOS_BUNDLE_ID=dummy FCM_ANDROID_PROJECT_ID=dummy bundle exec rails runner "<ruby>"'
Before blaming config, compare sanitized env:
kubectl exec -n "$NAMESPACE" -c simplepractice "$POD" -- \
aws-env exec -- ruby -e 'v=ENV["AMADEUS_API_KEY"].to_s; puts "aws_env_exec AMADEUS_API_KEY=#{v[0,6]} len=#{v.length}"'
If plain kubectl exec shows kms://... but aws-env exec shows a
decrypted-looking value, the config is present and the plain probe is invalid.
First-principles version: aws-env exec decrypts env for the process tree it
starts. kubectl exec starts a separate process with the original pod env. So
plain exec is testing the wrong runtime.
staging-main unless the user explicitly requests a different cluster.staging-server-promote