rl-agents-n-skills

Generic BC Gov deployment and CI/CD assessment orchestrator for SaaS, container, and hybrid delivery pipelines. Use when producing evidence-based deployment governance reports, control matrices, remediation roadmaps, and executive summaries across platforms such as GitHub Actions, Bitbucket Pipelines, Azure DevOps, and GitLab CI.

Multi-app BC Gov OCP analysis orchestrator — phases 0-5, coupling matrix, per-app deep-dive template, cross-cutting reports, and PDF packaging.

BC Government network security classification and zone model. Use when determining what security zone a workload belongs to, mapping ISCF data classification to DataClass labels, designing connectivity between zones, evaluating internet egress constraints, or planning Third Party Gateway (3PG) connections to external partners.

BC Government network architect combining SDN zone classification, NetworkPolicy authoring, and Emerald enforcement mechanics. Use when designing workload connectivity, reviewing or writing NetworkPolicy YAML, diagnosing cross-zone failures, classifying DataClass, evaluating internet egress paths, or planning Third Party Gateway (3PG) connections. Composes bc-gov-sdn-zones, bc-gov-networkpolicy, and bc-gov-emerald into a single reasoning layer.

Data classification and cross-service data flow analysis — ISCF classification quick reference, data flow ledger template, cross-boundary risk matrix, Azure data residency pattern, collection commands, and PIA trigger checklist. Use when mapping data flows for STRA/PIA, assessing cloud data residency risk, or generating a data flow ledger.

Structured logging, metrics, and tracing for BC Gov .NET / React / OpenShift projects — Serilog JSON configuration, log level standards, PII-free logging rules, Prometheus pod annotations, OpenTelemetry .NET SDK setup, health check endpoints, and alert baseline. Use when configuring logging, adding metrics instrumentation, setting up health checks, or diagnosing production issues.

Orchestrates a full OpenShift platform migration analysis — namespace discovery, repo inspection, gap analysis against target platform requirements, network flow mapping, migration task planning, and PDF report generation. Input: OCP namespace prefix + source cluster + GitHub repo + target platform. Output: a JUSTINRCC-style migration analysis report (markdown + PDF). Invoke when asked to analyse any OCP project for platform migration readiness, or to generate a migration report.

Security architecture and analysis for BC Gov .NET / React / OpenShift projects — OWASP Top 10 mitigations, SAST/DAST toolchain, secrets management with Vault, container security baseline, input validation, audit logging, OIDC session management, STRA/PIA process, and security hardening roadmap. Use when designing security controls, reviewing code for vulnerabilities, setting up scanning workflows, or completing the AI/securityNextSteps.md hardening plan.

BC Government Database Security Standard for Information Protection — 23 mandatory controls covering data classification, separation of duties, encryption, access provisioning, environment segregation, vulnerability assessment, change management, patching, bulk-data export controls, audit logging, and access reviews. Use when designing or reviewing database systems for BC Government services (Oracle, MariaDB, SQL Server, PostgreSQL, etc.) or when answering STRA/PIA questions about database controls.

BC Government REST API Development Standard — 8 mandated minimums for public APIs (RESTful architecture, HTTP verbs per RFC, single-resource URLs, multiple output formats, response metadata, error messaging, version numbers). Use when designing or reviewing public BC Gov APIs, writing OpenAPI specs, or evaluating API conformance.

BC Government Emerald OpenShift platform mechanics: namespace conventions, AVI InfraSettings route annotations, DataClass pod labels, Helm openshift mode, StorageClass, and DNS split-tunneling. Use when creating or reviewing Helm charts, Routes, or deployment manifests targeting Emerald specifically. For zone/classification decisions see bc-gov-sdn-zones; for NetworkPolicy YAML patterns see bc-gov-networkpolicy.

Kubernetes / OpenShift NetworkPolicy authoring for BC Gov Private Cloud (Silver, Gold, Emerald). Use when writing, reviewing, or debugging NetworkPolicy YAML — two-policy rule, ag-helm intent API, DNS egress, CIDR-based egress to external systems, inter-namespace flows, and common port patterns. Applies across all BC Gov OCP clusters; Emerald-specific enforcement is in bc-gov-emerald.

Network security controls including ACLs (standard/extended/named/object-group), NAT/PAT, IPsec VPN (IKEv1/IKEv2, site-to-site, remote access), zone-based firewall, VLAN security hardening (DHCP snooping, DAI, 802.1X, port security), and common attack vectors (ARP spoofing, VLAN hopping, rogue DHCP, DDoS mitigation). Use when designing or auditing firewall policy, ACL rules, VPN configurations, or switch security hardening.

Drives spec-first feature development using GitHub Spec-Kit (specify-cli) — enforces constitution → specify → plan → tasks → implement workflow, manages extensions and presets, and applies the Spec-Driven Development lifecycle. Use when starting a new feature, writing spec or plan files, breaking work into tasks, or installing extensions/presets.

BC Government Identity and Access Management — DIAM/Keycloak OIDC PKCE integration, realm selection, React oidc-client-ts setup, token lifecycle, backchannel logout, Common SSO vs DIAM comparison, and user attribute mapping. Use when implementing authentication, configuring an OIDC client, troubleshooting token refresh, or choosing between identity providers.

Self-learning agent that monitors development sessions and evolves the agent skill library — surfaces past relevant knowledge before sessions begin (pre-session retrieval), appends causal discoveries to *_KNOWLEDGE sections, identifies candidate shared skills from recurring patterns across sessions, flags oversized agents needing references/ splits, and records all updates in the evolution log. Use at session start for retrieval and at session end to grow the team's shared intelligence.

Enforces safe versioning discipline for numbered report/document files — copy-first rule, header-filename consistency, un-numbered file classification, PDF parity, and pre-operation inventory. Use whenever creating a new version of a versioned document or working with a report that has both .md and .pdf artefacts.

Governs session startup and shutdown discipline for AI-assisted development — reads orientation files, checks git state, reviews Dependabot PRs, updates session logs, and commits work. Use at the start and end of every development session, or when asked about session process and AI collaboration protocol.

Unix/Linux sysadmin skill covering Solaris 9/10/11 SPARC (LDoms, Zones, SMF, ZFS, DTrace) and RHEL/Linux (systemd, LVM, SELinux, firewalld, nmcli, dnf). Use when diagnosing service failures, managing storage, recovering from boot issues, configuring networking, or performing package management on Solaris or RHEL hosts. Delegates to solaris and linux-rhel skills.

BC Government Emerald OpenShift deployment patterns — Artifactory image registry setup, Helm chart requirements, health check standards, Common SSO authentication integration, OpenShift oc command reference, secrets management, and ArgoCD GitOps CRDs. Use when deploying, configuring, or troubleshooting services on the Emerald OpenShift platform.

Cisco IOS, IOS-XE, and NX-OS configuration and troubleshooting for home lab and enterprise environments. Covers initial device setup, interface configuration, VLANs and trunking (802.1Q), routing (static, OSPF, BGP, EIGRP), NAT/PAT, ACLs, HSRP, VTP, EtherChannel, SSH hardening, password recovery, IOS image management (TFTP/SCP), and NX-OS basics. Use when configuring Cisco routers and switches, troubleshooting connectivity, or building lab topologies.

DNS query and troubleshooting using dig, nslookup, and host. Covers all record types (A, AAAA, CNAME, MX, NS, SOA, TXT, PTR, SRV, CAA), delegation tracing, DNSSEC validation, reverse lookups, zone transfer testing, TTL analysis, and split-horizon diagnosis. Use when troubleshooting DNS resolution issues, validating zone configuration, checking email/SPF/DMARC records, or confirming propagation.

Red Hat Enterprise Linux (RHEL 7/8/9) and compatible distros (CentOS, AlmaLinux, Rocky). Covers systemd (units/targets/journald), LVM (pvcreate/vgcreate/lvcreate/extend/migrate), SELinux (enforcing/permissive/audit2allow/semanage/restorecon), firewalld/iptables, nmcli/nmtui network configuration, bonding/teaming/VLANs, dnf/rpm/subscription-manager, kdump/crash analysis, performance tuning (perf/sar/vmstat/iostat/tuned), and RHEL security hardening (PAM/auditd/FIPS). Use for RHEL admin tasks, systemd troubleshooting, storage expansion, SELinux policy issues, and performance investigation.

Sets up, runs, and troubleshoots the local development environment — dev-ctl consolidated multi-project manager, podman-compose multi-container stack, EF Core migrations, MariaDB socket and TCP connection patterns, port conventions, admin token seeding, and test execution. Use when setting up local dev, scaffolding a .dev-env for a new project, running migrations, debugging connection errors, or troubleshooting the local stack.

Network architecture and engineering — routing (BGP, OSPF, EIGRP), switching (STP, VLANs, 802.1Q, EtherChannel), WAN (MPLS, SD-WAN, DMVPN, IPsec), QoS, redundancy (HSRP/VRRP/GLBP), IPv4/IPv6 addressing and subnetting, and network troubleshooting. Use when designing topology, reviewing routing policy, troubleshooting L2/L3, or producing network architecture documentation.

Solaris 9/10/11 administration on SPARC (UltraSPARC III/IV/T-series) and x86. Covers SMF (svcs/svcadm/svccfg), ZFS (pools/datasets/snapshots/send-receive/scrub), Zones (sparse/whole-root/branded/LDoms), DTrace, IPMP, LACP/dladm/ipadm, VxVM/VxFS, UFS, OpenBoot (OBP), Jumpstart/AI install, hardware diagnostics (prtdiag/prtconf/luxadm/cfgadm), Solaris RBAC, and process management. Use when working on production Solaris systems or migrating Solaris workloads.

Zero Trust Architecture (ZTA) and SASE design — identity-first access, ZTNA, CASB, SWG, FWaaS, SSE/SASE frameworks, SD-WAN security integration, microsegmentation, policy engine design, and NIST SP 800-207 control mapping. Use when designing a ZTA, building a SASE deployment model, evaluating SD-WAN + security stack integration, or auditing implicit trust assumptions.

Maintains the AI collaboration audit trail in every project — WORKLOG.md, CHANGES.csv, COMMANDS.sh, and COMMIT_INFO.txt. Use when ending a session, writing session logs, or when any of the files under AI/ need to be created or updated.

BC Government Design System for React/Vite applications — npm packages, component usage (Header, Footer, Button), BC Sans font loading, design token CSS variables, and colour scheme. Use when building or reviewing BC Gov React frontends, replacing manual header/footer markup, or applying correct colour tokens instead of hard-coded hex values.

Configures and troubleshoots GitHub Actions CI/CD pipelines for BC Government OpenShift projects following ISB EA Option 2 — five-workflow pattern, image tag strategy, yq GitOps updates, Trivy scanning, and pipeline failure triage. Use when creating workflows, diagnosing failures, setting up branch protection, or updating the OpenShift GitOps image tag after a successful build.

Standard Containerfile patterns for .NET API and React/Vite frontend images used in BC Gov projects: port 8080, non-root appuser, HEALTHCHECK, and runtime config.json for frontend API URL. Use when creating or modifying any Containerfile or Dockerfile for a BC Gov project.

Creates and exports architecture diagrams for every project using draw.io, PlantUML, and Mermaid — manages the 10-diagram standard suite required by CODING_STANDARDS.md §7, file organisation, VS Code extension setup, and CLI export commands. Use when creating, updating, or exporting any architecture, sequence, class, state, ERD, or deployment diagram.

Entity Framework Core patterns for .NET projects using Pomelo MariaDB provider — migration workflow, startup auto-migrate, primary constructors, service layer structure, and the Linux LINQ ReadOnlySpan overload bug. Use when adding migrations, setting up DbContext, structuring services, writing LINQ queries, or troubleshooting EF Core issues.

Enforces branch naming, commit message format, and conventional commit types across all rloisell/ and bcgov-c/ repositories. Use when creating branches, writing commit messages, reviewing PR titles, or answering questions about git workflow conventions.

Manages the complete branch-first, PR-required GitHub workflow — branch naming, commit conventions, PR lifecycle, CI status monitoring, merge strategy, and GitHub Ruleset management. Use when creating branches, opening PRs, diagnosing CI failures, managing branch protection rules, or reviewing Dependabot PRs.

Drives spec-first feature development using the spec-kitty framework — enforces spec.md before implementation, creates WP task files with correct YAML frontmatter, runs validate-tasks, and tracks lanes through the planned→done lifecycle. Use when starting a new feature, writing spec or plan files, creating WP task files, or validating the spec-kitty task board.

HashiCorp Vault secrets management on BC Gov Emerald OpenShift — Vault path conventions, External Secrets Operator CRD patterns, Vault Agent Injector annotations, GitHub Actions Vault integration for CI build-time secrets, and Helm shape-only Secret templates. Use when bootstrapping Vault for a new project, reading or writing secrets in CI, or configuring pod-level secret injection.