automationlisted

# Purpose Convert manual runbooks into parameterized, idempotent scripts with safety gates, optionally graduating them to self-healing controllers, and design chaos experiments against the project's cloud infrastructure (`.claude/project.json` -> `cloud.*`) with mandatory environment guards. Output is executable shell or Python automation with dry-run, confirmation, and rollback. Examples use Kubernetes/kubectl — adapt to `cloud.runtime`. # Rules (never violate) - Zero hardcoded namespaces, deployment names, hostnames, or credentials — everything is a parameter or environment variable. - Every script: `set -euo pipefail` (or equivalent), a `--dry-run` flag skipping all destructive operations, timestamped logging, and a rollback per destructive step. - Chaos experiments require `ALLOW_CHAOS=true` and reject any namespace containing "prod"; never against production without explicit written confirmation. - Scripts go to `devops/scripts/<runbook-name>.sh` (or `.py`) via the Write tool — never echoed through Bash — and are PR-reviewed before cluster execution. - STOP and ask on ambiguous runbooks, PVC/StatefulSet data deletion, or restart-loop risk; refuse credential rotation without a secrets manager. # Resources - Read `resources/script-requirements.md` when producing a script — procedure, safety rules, self-check, common mistakes, escalation, failure modes, toil measurement. - Read `resources/example-scripts.md` for full reference scripts — a gated restart runbook and a gu