From 4f18d38c52a1962c105fa49149828b573b43fc15 Mon Sep 17 00:00:00 2001
From: stxkxs <139715017+stxkxs@users.noreply.github.com>
Date: Wed, 5 Aug 2026 13:34:23 -0700
Subject: [PATCH] fix: two skills taught resources the platform does not have
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fab's skills are the regeneration source — they are read into the preamble of
every factory session and shape every artifact an agent produces. A skill that
names something nonexistent does not just mislead a reader; it re-emits the
defect into the next generated tenant.

Two instances, both live:

`eks-agent-platform-curation.md` listed BatchJob in the agents.nanohype.dev API
group and defined it as "a Bedrock batch inference run over an S3 prefix". No
control plane serves that kind. An agent curating against this skill would
author a CR the API server rejects.

`kubernetes-engineering.md` taught a NetworkPolicy whose ingress admits the
`observability` namespace. Nothing creates that namespace — the observability
addons land in `monitoring`, which is also what the Kyverno exclusion lists and
the operator both name. A policy generated from this example admits traffic from
a namespace that does not exist, so the rule matches nothing and the ingress it
was meant to permit is silently dropped.

The second is the same defect already fixed at four other sites; this file is
where those four were generated from, so leaving it would have restored them.

─── Not fixed here ───

There is no gate over fab/skills, and these are the second and third instances
found in one campaign. The obstacle is real rather than an oversight: fab
vendors two nanohype standards (language-toolchain, llm-policy) and neither
enumerates the platform's CRD kinds, so a check would need a new vendoring
channel for the kind list rather than a regex. Filed with that scope rather than
approximated with a weaker check that would pass on the next instance.
---
 skills/eks-agent-platform-curation.md | 3 +--
 skills/kubernetes-engineering.md      | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/skills/eks-agent-platform-curation.md b/skills/eks-agent-platform-curation.md
index f772cca..8e5c8ff 100644
--- a/skills/eks-agent-platform-curation.md
+++ b/skills/eks-agent-platform-curation.md
@@ -11,7 +11,7 @@ You steward the `eks-agent-platform` operator — the Kubernetes operator that t
 
 - The repo's `CLAUDE.md`, `AGENTS.md`, and `docs/` directory are authoritative.
 - Built with kubebuilder + controller-runtime in Go.
-- API groups (version `v1alpha1` across all three): `platform.nanohype.dev` (Tenant, Platform), `agents.nanohype.dev` (AgentFleet, ModelGateway, AgentSandbox, SandboxPool, BatchJob), `governance.nanohype.dev` (BudgetPolicy, EvalSuite, SLOPolicy).
+- API groups (version `v1alpha1` across all three): `platform.nanohype.dev` (Tenant, Platform), `agents.nanohype.dev` (AgentFleet, ModelGateway, AgentSandbox, SandboxPool), `governance.nanohype.dev` (BudgetPolicy, EvalSuite, SLOPolicy).
 - The generated CRD reference in `docs/crd-reference/` is the field-level authority. Read it before authoring a CR; the shapes below are the shape, not the whole schema.
 
 ## The CRDs
@@ -123,7 +123,6 @@ Every one of these references its Platform through `spec.platformRef.name`:
 - **EvalSuite** — scheduled eval cases against an AgentFleet, with a pass threshold.
 - **SLOPolicy** — an SLI + objective; a burn breach becomes a platform action.
 - **AgentSandbox** / **SandboxPool** — attributable single-session and pooled sandboxes.
-- **BatchJob** — a Bedrock batch inference run over an S3 prefix.
 
 There is no per-tool or per-skill CRD in this operator, and no `tools` field on
 an agent. Whatever an agent can reach is a property of its image and the
diff --git a/skills/kubernetes-engineering.md b/skills/kubernetes-engineering.md
index 92ee620..a20dddb 100644
--- a/skills/kubernetes-engineering.md
+++ b/skills/kubernetes-engineering.md
@@ -122,7 +122,7 @@ spec:
   ingress:
     - from:
         - namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: argocd } }
-        - namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: observability } }
+        - namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: monitoring } }
         - podSelector: { matchLabels: { app.kubernetes.io/name: ingress-nginx } }
       ports: [{ port: 8080 }]
   egress: