template-onboard

name	template-onboard
description	Interview the adopter and emit a context file for their organization
allowed-tools	["Read","Grep","Glob","Bash(python3:*)","Bash(cat:*)","Bash(test:*)"]
when_to_use	Use when a new adopter needs to generate a *_context.local.yaml file that captures their organization's specific configuration (cloud provider, registry, MLflow URL, etc.) without writing secrets. Examples: 'onboard my org', 'generate context file', 'set up adoption context'.
argument-hint	[service-path]
arguments	["service-path"]
authorization_mode	{"generate_context":"AUTO","validate_context":"AUTO","escalation_triggers":[{"secret_in_context":"STOP"},{"invalid_schema":"STOP"}]}

Template Onboard — Generate adopter context file

When to use

When a new adopter needs to create a *_context.local.yaml file that captures their organization's configuration without writing secrets. This is the first step after scaffolding a service.

When NOT to use

• To store secrets — this skill NEVER writes secrets. Use your cloud's secret manager (AWS Secrets Manager / GCP Secret Manager) per D-17/D-18.
• To configure production — the context file is for local development. Staging/prod use IRSA/WI + CSI driver.

Pre-conditions

1. The service was scaffolded via copier copy (or new-service.sh).
2. *_context.local.yaml is in .gitignore (verified by the scaffolder).
3. adopter_context.schema.json exists in the service config/ directory. This is a distinct schema from context.schema.json (ADR-023's company/project risk-context, consumed by risk_context.py) — the adopter context captures infrastructure wiring (cloud provider, registry, tracking URIs), not risk/compliance posture, and validating this file against context.schema.json would always fail (additionalProperties: false on an unrelated shape).

Steps

Step 1 — Check pre-conditions (AUTO, 5s)

cd "$service-path"
test -f config/adopter_context.schema.json  # schema must exist
grep -q "_context.local.yaml" .gitignore  # must be gitignored

If either check fails → STOP with a clear message.

Step 2 — Interview the adopter (AUTO)

Ask the following questions. Each answer is written to <service_slug>_context.local.yaml. If the adopter declines to answer, the field is left as null (never guessed).

Questions:

1. Cloud provider: gcp, aws, or local?
2. Container registry: URL (e.g. gcr.io/my-org/, 123456.dkr.ecr.us-east-1.amazonaws.com/). Leave null if using local profile.
3. MLflow tracking URI: URL or file://./mlruns for local.
4. DVC remote: gs://my-bucket/dvc/, s3://my-bucket/dvc/, or null for local.
5. GitHub org: org name for CI/CD workflows.
6. Monitoring endpoint: Prometheus push gateway URL, or null for local.
7. Log level: DEBUG, INFO, WARNING, ERROR (default: INFO).

Step 3 — Write context file (AUTO)

Write the answers to <service_slug>_context.local.yaml:

# Generated by /onboard — NEVER commit this file (gitignored).
# This file contains organizational configuration, NOT secrets.
# Secrets go in AWS Secrets Manager / GCP Secret Manager (D-17/D-18).

cloud_provider: gcp  # or aws, local
container_registry: gcr.io/my-org/
mlflow_tracking_uri: file://./mlruns
dvc_remote: null
github_org: my-org
monitoring_endpoint: null
log_level: INFO
profile: local  # matches active_profile.yaml

Step 4 — Validate against schema (AUTO, 5s)

python3 -c "
import json, yaml, jsonschema
schema = json.load(open('config/adopter_context.schema.json'))
data = yaml.safe_load(open('${service_slug}_context.local.yaml'))
jsonschema.validate(data, schema)
print('Context file valid')
"

If validation fails → STOP with the schema error.

Step 5 — Secret scan (AUTO, 5s)

# D-17: no credentials in any file
grep -rEI "AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|ghp_[A-Za-z0-9]{36}" \
    "${service_slug}_context.local.yaml"

If any pattern matches → STOP. Chain to /secret-breach.

Step 6 — Report (AUTO)

Print a summary:

• Context file path
• Cloud provider selected
• Profile (from active_profile.yaml)
• Validation status
• Reminder: secrets go in cloud secret manager, not this file

What this skill does NOT do

• Does NOT write secrets — ever. D-17 is non-negotiable.
• Does NOT modify active_profile.yaml — use /stack-switch for that.
• Does NOT create cloud resources — that's Terraform's job.
• Does NOT commit the context file — it's gitignored by design.

Invariants

• The context file MUST be gitignored (checked in Step 1).
• The context file MUST pass context.schema.json (checked in Step 4).
• The context file MUST NOT contain credentials (checked in Step 5).
• The skill NEVER guesses values — unanswered fields are null.