air-gapped/skills

Agent workflow suite — Karpathy-pattern autoresearch (hill-climbing, multi-agent research) and skill-improver (Claude Code skill optimization loop).

NVIDIA AIPerf — vendor-neutral generative-AI inference benchmarking (the genai-perf successor): `aiperf profile` with concurrency / request-rate / fixed-schedule trace-replay / user-centric / multi-run-confidence load, 15 endpoint types and 6 custom dataset formats, goodput SLOs, GPU + Prometheus telemetry, and the reasoning-token TTFT/TTFO split — benchmarks vLLM / SGLang / TensorRT-LLM / Dynamo / NIM / Triton / Ollama.

Vet an open-source product for air-gap readiness BEFORE adoption

Advise on USING Confluence well, not operating it: make the structural call

Security find-and-fix loop — adapted (Apache-2.0) from anthropics/defending-code-reference-harness and generalised to all vulnerability classes. Four read/write-only skills (no target-code execution): threat-model (bootstrap from code+CVEs+git-history, or interview an owner via Shostack's four questions, or both -> THREAT_MODEL.md), vuln-scan (static source review, parallel per-focus-area subagents -> VULN-FINDINGS.json), triage (adversarial N-vote verification, 16 false-positive exclusion rules, root-cause dedup, impact-on-asset x exploitability severity with stated deployment conditions, owner routing, checkpoint/resume -> TRIAGE.json), and patch (root-cause candidate diffs + independent reviewer, fix-first priority for deployment-conditional dangerous primitives, never auto-applied -> PATCHES/). The autonomous C/C++ + AddressSanitizer execution pipeline this was extracted from is referenced, not bundled (vuln-scan/HARNESS.md).

Dell hardware suite — Ansible automation against Dell PowerEdge iDRAC 9 (14G–16G) and iDRAC 10 (17G) BMCs via the `dellemc.openmanage` collection. Covers the iDRAC 10 / iDRAC 9 ≥ 7.30.10.50 `BasicAuthState: Unadvertised` default that silently 401s `ansible.builtin.uri`, the canonical `idrac_session` + `x_auth_token` lifecycle, iDRAC 10 attribute registry deltas (renamed groups, deprecated `vFlashSD*`/`Telemetry*`/`GroupManager`, the BIOS→`System.ServerPwr.*` move), iDRAC 9-only modules to avoid on 17G, WS-MAN removal on 17G, and the upstream bug catalog. Room for sibling skills covering RACADM, OpenManage Enterprise, DUP catalogs, and PowerEdge BIOS tuning.

Developer tooling suite — BAML (typed LLM functions), Jinja2 templates (HuggingFace chat templates, Ansible), GNU Make best practices, and HuggingFace transformers config/tokenizer preflight (vLLM/sglang engine bridge).

Harvester HCI operator suite — controlled, community-edition Harvester upgrades off an EOL line up to latest stable: the no-skip minor ladder (1.5→1.6→1.7→1.8 carrying embedded RKE2 / KubeVirt / Longhorn / SLE-Micro together), external-Rancher + Harvester UI-extension pairing and ordering, air-gapped version detection, controlling the node-by-node upgrade flow (serial interlock, the v1.7+ pause-map, and the PodDisruptionBudget + VMI-readinessProbe native gate for 1.5/1.6), keeping VM-hosted self-managed RKE2 control planes quorate via anti-affinity spread and live-migration-vs-clean-shutdown tradeoffs (busy-etcd non-convergence, auto-converge, dedicated migration network), per-hop breaking changes (wicked→NetworkManager, Intel NIC rename, DHCP churn), the enforced pre-flight health gates, and the no-downgrade backup/rollback reality. Companion to the k8s suite's k8s-components-checker (Harvester↔Rancher↔RKE2 pairing registry) and rancher-upgrade (the external Rancher's own chain).

Inference KV-cache and transport suite — LMCache multiprocess (MP) standalone-server mode (DaemonSet + Deployment K8s pattern, ZMQ connector, L1 + L2 NIXL/POSIX/GDS/HF3FS/fs/s3/mooncake adapters) and NVIDIA NIXL transfer library (UCX/GDS/Mooncake/libfabric/HF3FS/S3 plugins, agent API, telemetry) used by Dynamo/vLLM/SGLang. Pairs with the vllm-caching skill in the `vllm` suite and sglang-hicache in the `sglang` suite.

Inference host bring-up + tuning suite — Linux/GPU bare-metal host work that sits beneath any inference framework (vLLM, sglang, TensorRT-LLM). Two phases. Bring-up (nvidia-datacenter-bringup): Ubuntu 24.04 LTS from clean OS to gpu-operator cuda-validator passing — B300/B200/H100/A100/L40S/L4 driver + fabricmanager + NVLSM + DOCA-OFED install order, NVIDIA CUDA repo + DOCA repo + air-gap mirror, MOK + DKMS sign-on-build under Secure Boot, Dell PowerEdge XE9780/XE9785 baseboard firmware via iDRAC Redfish DellOemChassis.ExtendedReset, gpu-operator pre-installed-driver-mode integration. Tuning (gpu-host-tuning): read-only snapshot of CPU power state, C-states, NUMA topology, PCIe link state, GPU settings, kernel boot params, sysctl, ulimits, IRQ affinity, container runtime; optional pinned-host↔GPU memcpy bench (torch + numactl); per-lever cheat-sheets to flip settings (governor, EPP, cpuidle, persistence, ECC, hugepages, intel_iommu, NCCL env, tuned-adm profiles, BIOS guidance for Dell XE / SMC / HPE). Surfaces config gaps that bottleneck LMCache CPU-tier throughput, KV offload, NCCL bandwidth, prefix-cache rebuild.

Jira suite — drive Atlassian Jira from the terminal with `jira` (ankitpokhrel/jira-cli, v1.7.0) against ANY Jira (Cloud or on-premise/Data Center). Covers the full command surface (issue / epic / sprint / board / project / release), the non-interactive automation contract (`--no-input` + `--plain`/`--raw`/`--csv` for agent-safe, parseable runs), JQL filtering and the date/negation idioms, GitHub- and Jira-flavored markdown → Atlassian Document Format (ADF) conversion and its lossy edges, authentication for every backend (Cloud API token, on-prem basic, PAT/bearer, mTLS), and live-discovery of instance-specific values (project keys, issue types, statuses, priorities, resolutions, link types, custom field IDs) instead of hardcoding them. Instance-agnostic — no account-specific content.

Advise on USING Jira well, not operating it: make the structural call

Install, configure, secure, and troubleshoot the mcp-atlassian MCP server (sooperset/mcp-atlassian) that connects an agent to Jira/Confluence

Kubernetes suite — Argo CD application authoring (GitOps Application/ApplicationSet manifests, sync policies, AppProjects), Helm chart authoring, KEDA event-driven autoscaling, Keycloak IAM (Operator + CRDs, realm/client configuration, OIDC/SAML integration, security hardening), OpenShift application packaging, and k8s-components-checker (cross-component compatibility registry for RKE2 community stacks — kubectl/helm/pluto cluster survey, structured verdict + pre-upgrade report wrapper, skill-improver freshen and operator floor-override flows; covers 19 components: RKE2, Rancher, Harvester, Cilium, Tetragon, cert-manager, Kyverno, KEDA, Argo CD, Harbor, Traefik, Rook, Ceph, OpenEBS, GitLab, ECK, Zalando postgres-operator, Grafana Mimir, NVIDIA GPU Operator), plus rancher-upgrade — community Rancher fleet upgrade methodology (KDM downstream support matrix, CAPI→Turtles migration, Fleet, air-gapped upgrade procedure, per-minor 2.11→2.14 runbook), companion to k8s-components-checker. Harvester HCI upgrades live in the separate `harvester` suite.

NetBox 4.2-4.6 deployment and upgrade knowledge that the official netboxlabs/skills marketplace does NOT cover - use for deploying or upgrading NetBox on Kubernetes with the netbox-community helm…

Observability suite — Prometheus, Grafana Mimir, and Grafana reference for agents querying metrics, writing PromQL, building and fixing dashboards, and reasoning about SLOs, KPIs, and burn-rate alerting.

Open WebUI operator suite — RAG pipeline wiring (HuggingFace embedding + reranker via LiteLLM in front of HuggingFace Text Embeddings Inference; exact wire shapes, LiteLLM ↔ TEI gotchas, TEI configuration cliffs, end-to-end production config; BGE-M3 + BGE-Reranker-v2-m3 worked examples) and multi-pod deployment with WebSockets + Valkey Sentinel at 1000+ user scale (the structural Socket.IO + Redis frame-amplification bug #23733 and the CHAT_RESPONSE_STREAM_DELTA_CHUNK_SIZE mitigation, all multi-pod env vars, custom-model-icon perf history, helm chart gaps, full known-issues catalog with fix status).

Secure Boot certificate-rotation suite — triage and remediate the Microsoft Secure Boot 2011→2023 UEFI CA rotation (CAs expiring 2026) across Dell PowerEdge / iDRAC9 bare metal, Ubuntu/Linux servers, and Harvester HCI / KubeVirt guest VMs: the PK→KEK→db trust chain, per-platform fixes (iDRAC BIOS-staged keys applied on reboot, self-authenticating manual `db` append via the existing 2011 KEK, the Harvester OVMF v1.6.0 floor with ephemeral-vs-persistent NVRAM triage), and audit via mokutil / efi-readvar / racadm bioscert / Redfish.

SGLang operator reference suite — HiCache (three-tier hierarchical prefix cache: GPU HBM → host DRAM → distributed L3 via Mooncake/3FS/NIXL/AIBrix/EIC/SiMM/file/LMCache) and the SGLang Model Gateway (`sgl-model-gateway`, formerly `sgl-router`) — Rust router fronting vLLM/SGLang inference workers on Kubernetes with cache-aware/prefix-hash/consistent-hash routing, K8s label-selector service discovery, PD-disaggregation, and `--enable-mesh` CRDT sync between gateway replicas. Pairs with the `vllm` suite for vLLM-side reference and `inference-cache` for engine-agnostic KV-cache transport.

Ubuntu Server provisioning suite — the three configuration layers of an unattended on-premise / air-gapped Ubuntu Server LTS 24.04 / 26.04 bring-up: ubuntu-autoinstall (the Subiquity `autoinstall:` v1 schema — identity, storage LVM/ZFS/RAID/encryption, apt mirror + proxy + offline fallback, early/late-commands, NoCloud zero-touch delivery), ubuntu-cloud-init (NoCloud-datasource `#cloud-config` user-data — users, ssh, write_files, runcmd, local apt mirrors, internal-CA ca_certs, seed ISO / SMBIOS serial / `ds=nocloud` cmdline, boot stages, `datasource_list` pinning), and ubuntu-netplan (the `/etc/netplan/*.yaml` v2 network substrate both share — static addressing, bonds, bridges, VLANs, VRFs, policy routing, predictable interface naming, systemd-networkd renderer). The installer's `network:` block is netplan and its `user-data:` block is cloud-config, so the three are designed to be used together.

vLLM operator reference suite — deployment, configuration, quantization, caching, KV, tool parsers, reasoning parsers, chat templates, benchmarking, performance tuning, observability, omni, input modalities, speculative decoding, NVIDIA hardware, and a Gemma 4 31B operating-point serve recipe.