feat: Claude Code Monitor — lanes, pipelines and a merged workspace

Internal SmartGift build of a Claude Code monitoring dashboard. Lanes: a durable unit of parallel agent work, one per working directory, tracked across session restarts. Managed lanes are git worktrees the dashboard provisions and can reset or remove behind a three-check destroy guard and a counted preflight; adopted lanes are directories you already own and are never destroyable. Pipelines: a lane moves through pipeline stages. A stage the agent declares with evidence renders green; a stage inferred from the tool-event stream renders dashed amber and never counts as done. Detection is forward-only within a 30-minute window, and never writes the declared stage. Workspace: one page at /run with a lane grid, the selected lane's pipeline, and a full Claude console behind a disclosure.
2026-07-29 17:07:45 +07:00
commit 57dc91585d
783 changed files with 221743 additions and 0 deletions
@@ -0,0 +1,58 @@
+# Kubernetes Manifests
+
+Production-ready Kubernetes resources using Kustomize for environment management, with optional blue-green and canary deployment strategies.
+
+## Structure
+
+```
+kubernetes/
+├── base/                    # Shared base (all environments inherit from this)
+│   ├── kustomization.yaml
+│   ├── namespace.yaml       # agent-monitor namespace with Pod Security Standards
+│   ├── configmap.yaml       # Environment configuration
+│   ├── serviceaccount.yaml  # Minimal-privilege service account
+│   ├── deployment.yaml      # Main deployment (2 replicas, 3 health probes)
+│   ├── service.yaml         # ClusterIP with WebSocket sticky sessions
+│   ├── ingress.yaml         # NGINX ingress with TLS + WebSocket headers
+│   ├── pvc.yaml             # 10Gi persistent volume for SQLite
+│   ├── hpa.yaml             # Horizontal Pod Autoscaler (2–10 pods)
+│   ├── pdb.yaml             # Pod Disruption Budget (minAvailable: 1)
+│   └── networkpolicy.yaml   # Ingress restricted to NGINX controller
+├── overlays/
+│   ├── dev/                 # 1 replica, no HPA, minimal resources
+│   ├── staging/             # 2 replicas, standard resources
+│   └── production/          # 3 replicas, HPA 3–20, strict anti-affinity
+├── strategies/
+│   ├── blue-green/          # Dual-slot deployment with service switching
+│   └── canary/              # Progressive rollout with Argo Rollouts analysis
+└── components/
+    ├── mcp-sidecar/         # Adds MCP server container to pods
+    └── monitoring/          # Adds Prometheus ServiceMonitor
+```
+
+## Usage
+
+```bash
+# Apply an environment
+kubectl apply -k overlays/dev/
+kubectl apply -k overlays/staging/
+kubectl apply -k overlays/production/
+
+# Add MCP sidecar (edit overlay kustomization.yaml):
+#   components:
+#     - ../../components/mcp-sidecar
+
+# Blue-green switch
+kubectl patch svc agent-monitor -n agent-monitor \
+  -p '{"spec":{"selector":{"slot":"green"}}}'
+```
+
+## Security
+
+All manifests enforce:
+- `runAsNonRoot: true`
+- `readOnlyRootFilesystem: true`
+- `drop: [ALL]` capabilities
+- `seccompProfile: RuntimeDefault`
+- No service account token auto-mount
+- NetworkPolicy restricting ingress sources