Production-grade platform engineering handbook — Kubernetes, Terraform, Flux CD, GitHub Actions, AWS, and more.
64
80%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Advisory
Suggest reviewing before use
Status: Stable
Two examples showing how /platform-skills:setup-agents generate produces different agent rosters for different repos. Same command, different inputs, completely different outputs.
Example 1 leads with the surprising case. Example 2 shows the expected case.
nitinjain999/platform-skillsScan stopped after step 2 — README + root ls gave full picture. No runtime, all Markdown.
Signals detected:
commands/, references/, examples/Roster decided:
app: no service frameworkinfra: Terraform only in examples/ for testing — not infrastructure the team deploystest-writer: tests are bash scripts owned by the platform agentGenerated files (all start with <!-- generated by platform-skills -->):
AGENTS.md — shared context + usage instructions + metadata block
.cursor/rules/coordinator.mdc
.cursor/rules/platform.mdc
.cursor/rules/content-reviewer.mdc
.cursor/rules/navigator.mdc
.cursor/rules/reviewer.mdc
CLAUDE.md — Agent Context section appended
agents/openai.yaml — multi-agent section added
scripts/verify-agents.shplatform.mdc (excerpt):
<!-- generated by platform-skills -->
---
description: Platform agent — GHA workflows, release process, CI scripts
globs: .github/workflows/*.yml,.claude-plugin/**,tests/**
alwaysApply: false
---
## Context
Platform agent for nitinjain999/platform-skills — a Claude Code skill plugin.
Owns: .github/workflows/, .claude-plugin/, tests/, scripts/, release process.
Does not touch: commands/, references/, examples/ — content-reviewer owns those.
Your source of truth is AGENTS.md. Always read it first before acting.
## How to work here
- CI: validate.yml runs handbook-consistency.sh + skill structure checks on every PR
- Release: release.yml tags, publishes to marketplace, updates .claude-plugin/marketplace.json
- marketplace.json source.sha must match current main HEAD after every merge
- setup-terraform SHA pinned to v4.0.1 — never float this
## Boundaries
- Autonomy: plan — propose, show blast radius, wait for approval
- Hand off to content-reviewer for any commands/, references/, examples/ changes
- Hand off to human for: marketplace releases, branch protection changes
- Never modify commands/ or references/ — those are content, not platform
- Before any CI change: run `bash tests/handbook-consistency.sh` locally
- **Always read `AGENTS.md` first** before acting on any request.Key insight: A Markdown-only repo with no runtime still gets meaningful, specific agents. The scan reads what the repo does (CI scripts, release workflow, marketplace.json), not what it runs. The platform agent's ## Boundaries catches the most common mistake in this repo: modifying CI without running handbook-consistency.sh first — a fact derived directly from the CI config, not a generic rule.
Scan stopped after step 3 — README + root ls + pyproject.toml gave full picture.
Signals detected:
Roster decided:
infra: no Terraform or IaCplatform: workflows support the app, they're not the productGenerated files (all start with <!-- generated by platform-skills -->):
AGENTS.md — shared context + usage + metadata block
.cursor/rules/coordinator.mdc
.cursor/rules/app.mdc
.cursor/rules/test-writer.mdc
.cursor/rules/navigator.mdc
.cursor/rules/reviewer.mdc
CLAUDE.md — Agent Context section appended
scripts/verify-agents.shapp.mdc (excerpt):
<!-- generated by platform-skills -->
---
description: App agent for payments-service — FastAPI routes, tests, Dockerfile
globs: src/**/*.py,tests/**/*.py,Dockerfile
alwaysApply: false
---
## Context
App agent for payments-service — a FastAPI service on EKS eu-central-1.
Owns: src/, tests/, Dockerfile. Does not touch: terraform/, .github/workflows/.
Your source of truth is AGENTS.md. Always read it first before acting.
## How to work here
- Entry point: src/main.py (uvicorn port 8000)
- Routers: src/routers/<domain>.py — all registered in src/main.py
- DB: SQLAlchemy 2.0 async via src/db/session.py — always use `async with`
- Tests: pytest + httpx AsyncClient; fixtures in tests/conftest.py
- Coverage gate: 80%, enforced in .github/workflows/test.yml
## Boundaries
- Autonomy: interactive
- Hand off to infra agent for anything in terraform/ (none exists — hand to human)
- Hand off to human for prod deploys or schema migrations
- Never touch: .github/workflows/, billing/
- If a test fails after your change, fix it before marking done
- **Always read `AGENTS.md` first** before acting on any request.AGENTS.md (bottom metadata block):
<!-- setup-agents metadata
generated: 2026-06-07
q1: |
Last change: added a payments endpoint. PR review, automated tests, deploy to
staging, then 2-day wait for prod deploy window.
off-limits: |
Never touch billing/ or run DB migrations without DBA sign-off.
pain-points:
- "Prod deploy windows make hotfixes painful"
- "Coverage gate is manual — no CI enforcement yet"
models:
coordinator: claude-sonnet-4-6
app: claude-sonnet-4-6
test-writer: claude-haiku-4-5
navigator: claude-haiku-4-5
-->When upgrade runs in 6 months, it reads this block and asks: "You mentioned prod deploy windows being painful last time — is that still true? Has coverage enforcement changed?"
.claude-plugin
.github
assets
commands
docs
examples
agent-self-improve
argocd
awesome-docs
aws
cloudfront
functions
lambda-edge
functions
azure
compliance
conventional-commits
datadog
llm-observability
demo
documentation
dora
dynatrace
fluxcd
github-actions
composite-actions
configure-cloud
db-migrate
docker-build-push
k8s-deploy
notify-slack
pr-comment
release-tag
security-scan
setup-env
setup-terraform
terraform-plan
helm
web-service
templates
karpenter
kubernetes
kyverno
mcp
observability
openshift
pr-review
ownership
runtime-security
setup-agents
terraform
references
scripts
skills
platform-skills
tests