skills.rest
koala-man-64
koala-man-64COMMUNITY
Explore all skills by this author →
GitHub

runtime-ownership-enforcer

Audit cloud-native AI systems for cross-plane runtime mutations and missing lifecycle evidence.

Updated Dec 20, 2025
Search Tags:#static analysis#cloud-native#least privilege#ai governance#ci/cd gate#lifecycle validation#ownership enforcement
One-click install
npx skills add https://github.com/koala-man-64/helpful-scripts --skill runtime-ownership-enforcer-koala-man-64
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: runtime-ownership-enforcer
Source: https://github.com/koala-man-64/helpful-scripts/tree/main/.codex/skills/runtime-ownership-enforcer
Command: npx skills add https://github.com/koala-man-64/helpful-scripts --skill runtime-ownership-enforcer-koala-man-64

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Runtime code that silently creates tables, provisions cloud resources, mutates Kubernetes state, or swaps AI assets hides broken environments and violates ownership boundaries. This Skill detects those violations in source code and validates that every lifecycle phase has passing evidence before release. ## Core Features & Use Cases - Runtime Ownership Scanning: Scans selected runtime directories for provisioning-like patterns (DDL, GRANT/REVOKE, kubectl apply, Terraform apply, AI endpoint creation, mutable 'latest' model aliases, safety bypasses) and emits JSON findings with lifecycle phase, plane, and remediation. - Lifecycle Evidence Validation: Validates an 11-phase evidence manifest (discovery through retirement) against environment rules, blocking production releases with failed, conditional, or unjustifiably skipped gates. - Exception Governance: Enforces a strict allowlist format for temporary non-production exceptions with owner, expiry (max 180 days), tracking item, and production-disablement proof. - Use Case: Before releasing an AI service to production, run the scanner over src/ and jobs/ to catch a helper that auto-creates a vector index, then validate lifecycle-evidence.json to confirm operations, incident recovery, and retirement gates all pass. ## Quick Start Ask the agent to audit this repository's runtime directories for ownership violations and validate the lifecycle evidence manifest for the production environment.

Frequently Asked Questions about runtime-ownership-enforcer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan runtime code for infrastructure mutations?▼

Run scan_runtime_ownership.py with the repository root and one or more --runtime-dir flags pointing at serving code directories. It emits JSON findings for patterns like DDL, GRANT, kubectl apply, Terraform apply, and AI resource creation, exiting 1 when non-allowlisted hard failures exist.

How do I validate lifecycle evidence before a production release?▼

Run validate_lifecycle_evidence.py with a JSON manifest containing all eleven phase records and an ownership map, passing --environment production. Production rejects failed, conditional, or unjustified not_applicable phases and cross-plane runtime operations.

What runtime behaviors does the ownership scanner flag?▼

The scanner flags database DDL and privilege changes, migration execution, bootstrap or self-heal helpers, cloud and Kubernetes provisioning, AI endpoint or index creation, mutable 'latest' model aliases, safety bypasses, and exception handlers masking environment errors.

Can I allow temporary exceptions for local development code?▼

Yes, via a JSON allowlist where each exception names an exact path, owner, reason, expiry within 180 days, tracking item, tests, compensating controls, and production-disablement proof. Allowlisted findings become warnings; production-capable or expired exceptions are rejected.

Why does the scanner exit with code 2 instead of 1?▼

Exit code 2 indicates invalid input, such as a missing runtime directory, malformed allowlist, or unparseable manifest. Exit code 1 means the input was valid but enforcement found hard-failure findings.

Related Skills

Explore More Software Engineering Skills→
toddbadamstoddbadams

infrastructure

Manage cloud infrastructure with Terraform using Infrastructure as Code.

Community
Advanced
summarybotngsummarybotng
2

qcsd-cicd-swarm

Analyze CI/CD pipeline artifacts and issue RELEASE, REMEDIATE, or BLOCK decisions.

Official
Advanced
UnitOneAIUnitOneAI
44

agent-security

Review AI agent architectures for security risks across permissions and oversight.

Official
Advanced
AngelP17AngelP17
1

k8s-security-policies

Implement Kubernetes NetworkPolicy, PodSecurityPolicy, and RBAC security controls.

Community
Advanced