菜单
Run the UAP validation gate (tests/verify-local.ps1) and interpret its result. Use before handing any change back, and before any commit/push. Knows the success tokens and which failures are EXPECTED on the Windows workstation.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | uap-verify |
| description | Run the UAP validation gate (tests/verify-local.ps1) and interpret its result. Use before handing any change back, and before any commit/push. Knows the success tokens and which failures are EXPECTED on the Windows workstation. |
The owner does NOT review code, so this gate is the definition of done.
Full (against the live cluster, from a machine that can reach the tailnet):
powershell -ExecutionPolicy Bypass -File .\tests\verify-local.ps1
Offline / no cluster reachable (static only):
powershell -ExecutionPolicy Bypass -File .\tests\verify-local.ps1 -SkipSmoke
secret-scan-okiac-static-ok100.106.223.120 and 100.94.228.67 (omitted with -SkipSmoke)verify-local-ok ← the final token; absence of it = the gate did not complete-IncludeReadiness reports git-remote-missing and s3-env-missing — the origin + S3 creds live on uap-ops-1 and in SOPS, not on Windows.The default gate does NOT run the hermes tests yet. Until verify-local.ps1 wires them in, also run:
python -m unittest discover -s hermes/tests -p 'test_*.py'
(use test_*.py, not *.py — the latter also imports reliability.py / run_integration.py, which run module-level code that needs a live cluster/LITELLM_BASE and will fail at import. Plain python -m unittest from hermes/ finds 0 tests — discover -s is required.)
Authoritative reference: runbooks/validation-matrix.md, AGENTS.md -> Validation Command.
Run long or multi-checkpoint repository work through Hermes Kanban with autonomous OpenAI author/reviewer routing.
Take a routine on-demand k3s etcd snapshot and confirm it reached offsite R2. Non-destructive. Use for ad-hoc backups. RESTORE is NOT covered here (it is destructive + owner-gated).
Commit a change and get it pushed. The git origin + write deploy key live ONLY on uap-ops-1 (100.82.241.121), NOT the workstation. Use whenever a change is ready to land.
Deploy a change to the cluster via Flux GitOps and VERIFY it actually reconciled. Use after editing anything under clusters/prod. A push alone is NOT a verified deploy.
Offload a token-HEAVY, quote-verifiable read (big log/doc/corpus) to the free local LLM so the big input never enters this paid context. Use when you are about to read a large file only to extract/locate/enumerate specific facts. NOT for judgment, synthesis, code edits, or small inputs.
Encrypt a Kubernetes Secret with SOPS for clusters/prod. MUST run on uap-home-1 (sops is absent on Windows; the age private key lives only there). Use when adding/rotating any secret.