nebius-ps-services

Setup-only Skill for operator-run bootstrap or repair of Codex Agent Nebius authentication using a project service account, custom group, project access permit, authorized-key credential file, CLI profile, and Codex PreToolUse hook. Use only when explicitly asked to set up, repair, verify, or install agent-nebius-auth for Nebius; do not use for runtime token injection or general Nebius cloud automation.

Configure a public-safe Codex home setup for a developer machine, including global AGENTS.md policy, config.toml features and MCP servers, hooks, task-state layout, custom read-only agents, and validation. Use when a user wants Codex configured similarly to this repo's global context-management workflow without copying personal paths or secrets.

Use for complex Codex work: planning, implementation, debugging, refactoring, migration, architecture, reviews, tests, CI failures, or multi-file tasks. Keep parent context concise with durable task state, targeted read-only subagents when useful and permitted, focused validation, and final risk review.

Use only as part of the Agentic SDLC workflow; use when the user asks to start, resume, continue, or run the Agentic SDLC workflow for a project using `docs/requirements.md`, `docs/design.md`, private steering input, and local run state. This is the main SDLC coordinator and state-machine skill.

Use to publish Helm charts end to end from the current project: collect chart and OCI inputs, optionally set up changelog/helper/workflow assets, prep chart release changes, create and merge a PR, tag from the default branch, wait for the chart publish workflow, verify the pushed OCI chart, and report the result. Also supports explicit setup-only guidance.

Use to publish container images end to end from the current project: collect release inputs, optionally set up changelog/helper/workflow assets, prep the release branch, create and merge a PR, tag from the default branch, wait for the image publish workflow, verify pushed image tags/digest, and report the result. Also supports explicit setup-only guidance.

Use to publish GitHub Releases end to end from the current project: collect package inputs, optionally set up changelog/helper/workflow assets, prep the release branch, create and merge a PR, tag from the default branch, wait for the release workflow, verify the GitHub Release assets, and report the result. Also supports explicit setup-only guidance.

Use outside the Agentic SDLC workflow to safely verify the whole Agentic SDLC system against docs/agentic-sdlc-design.md: discover global sdlc-* skills, inspect hook configuration, run disposable PreToolUse and Stop hook fixture tests, orchestrate a disposable golden-path SDLC run, check idempotency/failure/steering behavior, and write ~/.codex/sdlc-verification/report.md without changing real projects, installed skills, hooks, or agent configuration.

Use for project-wide alignment or post-change validation: reconcile code, wiring, tests, CI, CLI/help, config, docs, workflows, and project skills; run changed-scope code-review, lint/syntax, security, and regression gates. Integrate current thread, relevant Agent Memory, and task state before low-risk evidence-backed fixes. Do not use for skill-folder-only validation; use align-skill.

Use for reviewing, hardening, validating, aligning, and improving existing or newly scaffolded Codex or Agent Skill folders. Use after skill-creator or a manual scaffold/draft exists to refine SKILL.md front matter, trigger descriptions, progressive disclosure, official portable structure, repo metadata, safety guardrails, validation, scripts/references/assets/evals, vendor-doc checks, and reusable learning capture. Do not replace skill-creator for initial new-skill scaffolding.

Use as a security reviewer, adviser, and safe remediation helper for software design, implementation, code review, infrastructure, deployment, Helm, Kubernetes, Terraform, CI/CD workflows, Bash scripts, and application code in Python, Java, JavaScript, TypeScript, or Rust. Use when work may affect secrets, public exposure, IAM/RBAC, auth, input handling, injection, deserialization, crypto, dependencies, containers, workflows, or supply-chain risk. Advises implicitly; patches only when the current task allows edits and the fix is low-risk.

Launch or reuse an Ubuntu Docker container for the current project, bind-mount it at /workdir, preconfigure VS Code attached-container defaults, and best-effort open the project in a new VS Code Dev Containers window. Use when users want a disposable Ubuntu test environment on macOS with Docker Desktop and the Dev Containers extension.

Use for exploratory, chat-only brainstorming about an idea, proposal, design direction, architecture question, product/technical topic, or research question before implementation. Gather source-ranked context from the current project folder, sibling projects in the repo, related skills, internal Confluence/Slack via connectors or MCP when available, and official vendor docs; for major decisions, consult installed `design` and `system-design-rules` skills as advisory sources when accessible; challenge assumptions and discuss options without making code changes.

Read-only project information gathering: summarize local project folders or GitHub repositories in a copy/paste-friendly code metrics report without changing code or files. Use when the user asks for basic project code information, repository statistics, LOC by language or component, repo size, repo link, test file counts, CLI command counts, module/package counts, build artifact sizes, available test coverage, or a GitHub repo that may not be cloned locally.

Use for neutral, evidence-based code review of the current local branch, local diff, changed files, module, repository area, or provided patch: find bugs, regressions, test gaps, reliability risks, security-adjacent issues, maintainability problems, abstraction drift, type-boundary problems, file-size growth, spaghetti branches, and missed structural simplifications. Use when the user asks for code review, code quality audit, maintainability review, implementation review, or rigorous findings-first feedback on code. Do not use for GitHub PR review by number, URL, or current branch; PR readiness; branch updates; dedicated security scans; whole-project alignment; or design-phase architecture review.

Commit all current local changes across the whole Git repository on the active non-default feature branch with repo-root git add -A, repair simple staged whitespace validation blockers when safe, generate or use a commit message, push the branch to origin, and report final worktree cleanliness. Use when the user explicitly asks to commit and push the current branch without opening a pull request.

Create a fast local Git commit on the current branch without pushing. Use when the user explicitly asks to commit current local changes only: stage the complete repository diff from the Git root with `git add -A`, run lightweight staged validation, use or generate a concise commit message, commit with normal hooks, and report final status. Do not use for pushes, pull requests, branch repair, or Agentic SDLC feature commits.

Use only when explicitly invoked for creating or revising public-safe learning courses, lesson plans, curricula, course workspaces, syllabi, exercises, glossaries, and learner progress records from a learner mission and trusted sources. Use when Codex needs to turn a topic, audience, resource set, or existing notes into a structured course with lessons, retrieval practice, citations, and publication/security review.

Use for GitHub PR creation from local work or named branches: reuse or prepare feature branches, run format/whitespace/lint/test gates before committing, stage repo-root changes with git add -A, merge the latest base branch into the PR branch, push with explicit refspecs, open or reuse PRs, repair safe check failures, and report PR URLs/readiness. Do not use for direct commit-and-push only.

Use for non-SDLC software design before implementation: understand requirements, inspect an existing codebase or greenfield context, route topic, requirement, and technology due diligence through `research` when available, apply `system-design-rules` to standard/deep solution decisions, choose components and architecture, compare alternatives, and create a Codex `/plan` handoff. Use for new features, major changes, architecture/design docs, ADR-like decisions, and new applications when the user needs a design and implementation plan rather than immediate coding; do not use for open-ended brainstorming, checklist-only review, Agentic SDLC-owned `docs/design.md`, or immediate implementation.

Use for GitHub Actions workflow work: create, review, or standardize PR/merge CI, bot-safe merge automation, reusable workflows, permissions, service-scoped checks, and release/image workflow YAML. For full project-specific release, image, or Helm publication flows with scripts or changelogs, use the matching publish-* skill.

Create or update a project's .gitignore file with sensible defaults for macOS and VS Code, then extend it for detected stacks (for example Node, Python, Go, Rust, Java, Terraform). Use when the user asks to generate, fix, or standardize .gitignore.

Use for Helm chart work: create, review, harden, refactor, lint, template, or standardize Chart.yaml, values.yaml, values.schema.json, templates/, NOTES.txt, README, and chart CI. Do not use for OCI chart publication flow generation; use publish-helm. Do not use for plain Kubernetes YAML, Kustomize, Dockerfiles, or Terraform unless integrating with Helm.

Install and configure the official Grafana MCP server for Codex against Nebius-managed Grafana. Use when Codex needs to set up mcp-grafana on macOS or Linux, wire Codex MCP config, refresh Nebius-managed Grafana IAM token files, query metrics/logs through PromQL-compatible monitoring and Loki Grafana datasources, check whether trace tools are available, or troubleshoot Grafana MCP access to Nebius observability data. Only use Nebius static-key/data-source setup when the user explicitly asks to connect external Grafana to Nebius read endpoints.

Lint and auto-fix Shell, Markdown, and Python files in a repository. Use when users ask to lint shell scripts with shellcheck and bash -n, lint all nested Markdown files with markdownlint (fix first, then .markdownlint.json fallback rules), or lint Python files with ruff (fix first, then targeted Ruff rules in pyproject.toml).

Use for merging GitHub pull requests outside Agentic SDLC: verify PR checks, reviews, mergeability, branch state, and head SHA, then merge with gh pr merge without admin bypass. Use after create-pr or review-pr when the user explicitly asks to merge a ready PR.

Use only when the user explicitly asks to query Nebius Control Plane Audit Logs for a resource, subject, service, action, status, region, or time range. Requires explicit invocation because it reads tenant-level audit/security data; do not use for broad Nebius SDK/IAM/VPC/quota/MK8s/observability automation.

Use for Nebius SDK/cloud automation in Python: IAM/Object Storage, service accounts/access keys, VPC pools/subnets/routes, quota checks, MK8s compatibility/readiness, GPU platform/preset/fabric/operator decisions, and observability endpoint/auth wiring. Do not use for Terraform scaffolding, Helm charts, or nebius-cxcli module onboarding.

Use for Python repo scaffolding and hardening: pyproject/setuptools-scm, src layout, Ruff, pytest, Typer, Pydantic, CLI tools, systemd services, APIs/UI apps, and Python project CI. Do not use for domain-specific Nebius automation, Terraform modules, Helm charts, or generic non-Python projects.

Use for senior-engineer technical research and due diligence on a topic, technology, architecture pattern, product, framework, RFC, protocol, API, problem statement, or feature requirement. Search internal Slack and Confluence sources first when organization context matters, fall back to MCP access for internal systems when connectors are unavailable, verify technical claims with official vendor docs and authoritative external sources, and distinguish internal guidance from vendor facts and industry practice. Do not use for implementation, open-ended brainstorming, final software design or `/plan` handoff, checklist-only design review, or Agentic SDLC artifact creation.

Use for GitHub PR review by number, URL, or current branch: inspect base/head, issues, checks, reviews, conflicts, and changed files; fix safe issues or conflicts on writable branches; route to sibling skills; report merge readiness and blockers.

Use only as part of the Agentic SDLC workflow; use when Agentic SDLC requirements, design, plans, tests, implementation, documentation, and evidence must be checked for consistency. This is SDLC-specific and does not replace the general `align` skill.

Use only as part of the Agentic SDLC workflow; use when an active SDLC run needs private `STEERING.md` refreshed from mid-run user prompts, requirements, design, context, locked plans, fingerprints, or recent evidence before selecting the next phase.

Use only as part of the Agentic SDLC workflow; use when an Agentic SDLC phase fails and the loop must classify the failure before retrying. Routes failures to requirements, context, design, plan, TDD, implementation, validation, tests, evaluation, UAT, environment, policy, or human input.

Use only as part of the Agentic SDLC workflow; use after a single Agentic SDLC feature has passed validation, tests, and evaluation to create a local feature-scoped Git commit. This skill does not push and does not replace the general `commit` or `commit-push` skills.

Use only as part of the Agentic SDLC workflow; use when `docs/design.md` must be created or updated from `docs/requirements.md`, gathered context, and codebase evidence. This skill owns design.md, stable FEAT IDs, design decisions, alternatives, and implementation-ready validation boundaries.

Use only as part of the Agentic SDLC workflow; use when one ready Agentic SDLC feature from `docs/design.md` needs a locked local execution plan before tests or implementation. Plans are private local artifacts and must not be committed.

Use only as part of the Agentic SDLC workflow; use when the user provides a product idea, ticket, rough prompt, user story, change request, feature request, or optional live experiment environment details and needs `docs/requirements.md` created or updated. This Agentic SDLC skill owns requirements.md and preserves stable REQ IDs.

Use only as part of the Agentic SDLC workflow; use after validation and tests in the Agentic SDLC loop to determine whether the current feature solves the real-world requirement using acceptance criteria, the correct evaluation harness, and any confirmed safe live experiment environment.

Use only as part of the Agentic SDLC workflow; use when an Agentic SDLC feature needs technical, product, vendor, internal, codebase, or test context before design or implementation. Produces a compact feature-specific context pack.