added ai eng and infracoders content

.github/copilot-instructions.md

@@ -0,0 +1,3 @@
+# GitHub Copilot instructions
+
+Read and follow the repository-wide instructions in [AGENTS.md](../AGENTS.md). It is the single source of truth; keep this file minimal.

.github/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: offline-checks
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  offline:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24.19.0
+          cache: npm
+          cache-dependency-path: 10-26 Cloud Native AI Summit APAC/demo/agent/package-lock.json
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install TypeScript dependencies
+        working-directory: 10-26 Cloud Native AI Summit APAC/demo/agent
+        run: npm ci
+      - name: Offline smoke, tests, types, and build
+        working-directory: 10-26 Cloud Native AI Summit APAC/demo/agent
+        run: |
+          npm run smoke
+          npm test
+          npm run typecheck
+          npm run build
+      - name: Python fixture tests
+        working-directory: 11-26 AI Engineer/workshop/scenarios/python
+        run: python -m unittest -v
+      - name: Container fixture smoke
+        run: |
+          docker build -f "10-26 Cloud Native AI Summit APAC/demo/agent/Dockerfile" -t platform-agent:fixture .
+          docker run --rm platform-agent:fixture

.gitignore

@@ -1,3 +1,13 @@
 .stackql/
 .env
 *.log
+**/.env
+**/.venv/
+**/venv/
+**/__pycache__/
+**/.pytest_cache/
+**/node_modules/
+**/dist/
+**/runs/*
+!**/runs/.gitkeep
+/ref

10-26 Cloud Native AI Summit APAC/demo/.env.example

@@ -2,37 +2,20 @@
 #   set -a; source .env; set +a
 # stackql-deploy reads it with --env-file .env; the agent loads it itself.
 
-# --- the model --------------------------------------------------------------
-ANTHROPIC_API_KEY=sk-ant-...
-# claude-opus-5-5 is the default. claude-sonnet-5-5 is faster for a live demo.
-ANTHROPIC_MODEL=claude-opus-5-5
-# low | medium | high | xhigh | max. Thinking is always on for the Claude 5 family;
-# effort is the latency and cost control. medium is the API default for claude-opus-5-5.
-ANTHROPIC_EFFORT=medium
+# Fixture and offline mode need no environment variables.
+# Live model mode is opt-in: npm run agent requires --live-model and OPENAI_API_KEY.
+OPENAI_API_KEY=
+# Verified in current official OpenAI model/function-calling documentation.
+# Do not replace with a different model family or silently fall back.
+# Verified IDs: gpt-6-astra, gpt-6.1-sol, gpt-6-luna. Availability is account-specific.
+OPENAI_MODEL=gpt-6-astra
+# read_only prevents execution. safe requires interactive exact-plan confirmation.
+DEMO_POLICY_MODE=read_only
 
-# --- the platform: StackQL MCP server ----------------------------------------
-# read_only: writes refused by the server. safe: writes pause for operator approval.
-# The agent code never starts a full_access server.
-STACKQL_MCP_MODE=read_only
-# where providers are pulled to; the npm launcher, stackql on PATH and this demo
-# all need to agree. Default is ~/.stackql.
-STACKQL_APPROOT=
-# the server writes its audit sink (stackql_mcp_server_<timestamp>.log, one JSON line
-# per tool call) into this directory. Default is runs/ under the demo directory.
-STACKQL_AUDIT_DIR=
-# optional: an existing stackql binary for the npm launcher to use instead of
-# downloading one (for example C:/Program Files/StackQL/stackql.exe)
-STACKQL_MCP_BIN=
-# cap on model steps per run (each tool call round trip is a step)
-AGENT_MAX_STEPS=24
-# production posture: never offer the write tools to the model (default false, so the
-# server's refusal is what you see on screen)
-AGENT_HIDE_WRITE_TOOLS=false
-# newest MCP revision the server advertises; auto is fine (see agent.ts for why discovery is off)
-STACKQL_MCP_PROTOCOL_VERSION=auto
-
-# --- the estate: kind cluster via kubectl proxy --------------------------------
+# Retained StackQL/kind stack example; scripts require explicit disposable-cluster
+# confirmation and are not used by the fixture agent.
 KIND_CLUSTER=platform-demo
 KUBE_CLUSTER_ADDR=localhost:8001
 KUBE_PROTOCOL=http
 K8S_NAMESPACE=shop
+STACKQL_APPROOT=

10-26 Cloud Native AI Summit APAC/demo/agent/Dockerfile

@@ -1,29 +1,23 @@
-# The agent as a container image: Node, the agent, the stackql binary and the
-# k8s provider baked in so a run makes no downloads.
-#   docker build -t platform-agent:dev .
-#   kind load docker-image platform-agent:dev --name platform-demo
-FROM node:24-slim
-
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl unzip \
-    && rm -rf /var/lib/apt/lists/*
-
-# the stackql binary; the npm launcher uses it through STACKQL_MCP_BIN instead of downloading
-RUN curl -fsSL https://releases.stackql.io/stackql/latest/stackql_linux_amd64.zip -o /tmp/stackql.zip \
-    && unzip -q /tmp/stackql.zip -d /usr/local/bin && chmod +x /usr/local/bin/stackql && rm /tmp/stackql.zip
-ENV STACKQL_MCP_BIN=/usr/local/bin/stackql
-ENV STACKQL_APPROOT=/stackql
-
-# the k8s provider, pulled at build time
-RUN mkdir -p /stackql && stackql exec --approot /stackql "REGISTRY PULL k8s"
-
+# Build runtime JavaScript in one stage; do not launch development-only tsx in production.
+FROM node:24.19.0-slim AS build
 WORKDIR /app
-COPY package.json package-lock.json ./
-RUN npm ci --omit=dev --no-fund --no-audit
-COPY tsconfig.json ./
-COPY src ./src
-COPY prompts ./prompts
+COPY ["10-26 Cloud Native AI Summit APAC/demo/agent/package.json", "./package.json"]
+COPY ["10-26 Cloud Native AI Summit APAC/demo/agent/package-lock.json", "./package-lock.json"]
+RUN npm ci --no-fund --no-audit
+COPY ["10-26 Cloud Native AI Summit APAC/demo/agent/tsconfig.json", "./tsconfig.json"]
+COPY ["10-26 Cloud Native AI Summit APAC/demo/agent/src", "./src"]
+RUN npm run build
 
-RUN mkdir -p /audit && chown -R node:node /app /audit /stackql
-USER node
+FROM node:24.19.0-slim AS runtime
 ENV NODE_ENV=production
-CMD ["npx", "tsx", "src/agent.ts"]
+WORKDIR /app
+COPY ["10-26 Cloud Native AI Summit APAC/demo/agent/package.json", "./package.json"]
+COPY ["10-26 Cloud Native AI Summit APAC/demo/agent/package-lock.json", "./package-lock.json"]
+RUN npm ci --omit=dev --no-fund --no-audit && npm cache clean --force
+COPY --from=build /app/dist ./dist
+COPY ["11-26 AI Engineer/workshop/scenarios/fixture.json", "./workshop/scenarios/fixture.json"]
+COPY ["11-26 AI Engineer/workshop/scenarios/tracks.json", "./workshop/scenarios/tracks.json"]
+ENV SCENARIO_PATH=/app/workshop/scenarios/fixture.json
+ENV TRACK_SCENARIOS_PATH=/app/workshop/scenarios/tracks.json
+USER node
+CMD ["node", "dist/offline.js", "--offline"]