schematize
Skills · Claude Code · Agent Skills

Operate production with minimal blast radius — no negotiation.

Per-app isolation, deny-by-default, secrets out of the repo, gated deploys and a restore that's actually tested. Everything declared, everything audited.

v0.1.0Disciplina · Infra/DevOps/SREgithub.com/schematizeme/skill-infra

Maintained by Lucas Andrade

schematize-infra · v0.1.0bash
$ schematize install infra
GitHub →download skill (.zip)/infra-help · github.com/schematizeme/schematize-cli

Non-negotiable floors

Never switched off "to go faster". Full list in the skill.

Isolation per app

One Linux user + hardened systemd + container per service — never root, never two services on the same user.

Deny-by-default, least-privilege

Firewall, security groups and cloud IAM deny by default and grant the minimum.

Secrets out of the repo

Never in the repo/layer/committed env — vault + documented rotation + a secret scan that blocks the merge.

Deploy is gated

Fixed flow local → local test green → GitHub → hml → prd; nothing skips a step; the front deploys manual/gated on Vercel.

Restore actually tested

RPO/RTO defined and the restore proven — a backup without a proven restore is not a backup.

Declared and audited

Declarative, idempotent IaC; immutable artifact with git provenance; SBOM and @sha256 pinning verified on admission.

Commands

Installed in .claude/commands/. Run /infra-help anytime.

/infra-ccContext compact: writes context + checklist to the archive and runs /compact.
/infra-claudeCreates or merges the always-on infra CLAUDE.md at the repo root (won't overwrite other skills' blocks).
/infra-deployAudits/plans the gated deploy: fixed flow (local→test→git→hml→prd), immutable artifact with git provenance, strategy + healthcheck gating + rollback.
/infra-handoffWrites the context handoff without compacting — session end or task switch.
/infra-helpLists every command.
/infra-iacAudits/scaffolds IaC (declarative, idempotent, reviewable): plan-before-apply, drift detection, safe state, layout + seed, and ops as the single interface.
/infra-loadForce-loads the whole normative body: isolation, IaC, delivery, secrets, observability, resilience.
/infra-secretsAudits secret management: nothing in the repo/layer/committed env, vault + rotation, a secret scan that blocks; flags immediate rotation on a leaked secret.

For AI agents

Install with no human in the loop. Metadata in llms.txt.

  • Run: git clone https://github.com/schematizeme/skill-infra.git && ./skill-infra/install.sh
  • Or download: https://github.com/schematizeme/skill-infra/releases/latest/download/skill-infra.zip and unzip into .claude/skills/
  • Copy assets/CLAUDE.md to the repo root (always-on rule).
  • Confirm with /infra-help.

Don't want to install?

Read the full standards and copy them straight into your project — or install the skill so the agent enforces it for you.

GitHub →Packs