Add Enclave virtualized installation skill - #563

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.claude/skills/install-virtualized/SKILL.md:
- Around line 562-574: The Self-Improvement section in SKILL.md currently
instructs the runtime agent to edit the same skill, commit a branch, and open a
PR, which should be removed from execution-time guidance. Update the section
around the Self-Improvement rules to stop any self-modification workflow, and
replace it with a safer non-editing response that only reports the issue and
asks the user how to proceed; keep the change localized to the Self-Improvement
instructions in SKILL.md.
- Around line 186-213: The pull-secret validation in the install-virtualized
skill uses a literal "/home/$(whoami)/.pull-secret.json" path, so the Python
check never resolves the current user’s home directory. Update the validation
command in the pull-secret flow to use a real expanded home path or a
shell-expanded variable before invoking Python, and keep the check aligned with
the existing SSH upload/copy steps and the pull-secret validation block.
- Around line 286-293: Step 9 is too broad because it derives prompts from the
full CI env block, which can drift and expose new secrets or host-specific
values. Update the Step 9 guidance in SKILL.md to use a fixed allowlist of
user-supplied environment variables instead of scanning all CI `env:` entries,
and keep unattended mode using CI defaults except for the already-collected pull
secret and branch.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.claude/skills/install-virtualized/SKILL.md:
- Around line 335-350: Update the storage plugin contract in Step 9 to permit
only lvms for virtualized deployments, removing odf from the STORAGE_PLUGIN
values and any related defaults or day-2 selection logic. Keep Step 8’s
lvms-only behavior consistent and do not introduce an ODF path.
- Line 14: Add permission for the Step 9 discovery command by including Bash(ls
*) in the allowed-tools declaration of the install-virtualized skill, or update
Step 9 to use an existing Read-based discovery mechanism. Ensure plugin and
experience enumeration remains available in restricted runtimes.
- Around line 61-78: Update the deployment-procedure extraction instructions to
include every CI workflow uses: action, including its with: inputs and if:
conditions, alongside run steps. Require executing each action in the same order
and under the same conditions, or documenting an equivalent implementation for
prerequisites such as preflight validation and subnet allocation.
- Around line 655-659: Update the failure-diagnosis instructions to reuse the
existing target-to-log mapping when selecting the LZ deployment log filename,
rather than constructing deployment_bootstrap_<step>.log directly. Ensure mapped
targets such as deploy-cluster-prepare resolve to
deployment_bootstrap_download-content.log, while preserving the existing command
and tail behavior.
- Around line 272-304: The resource calculation instructions must use the
script-defined names: ENCLAVE_NUM_MASTERS, VM_EXTRADISKS_SIZE_VAL, and
LZ_DISK_SIZE, while sourcing Landing Zone memory and vCPU from
provision_landing_zone.sh. Replace the hardcoded 200/1200 disk thresholds with
dynamically extracted MIN_DISK_GB values from validate_prerequisites.sh,
preserving mode-specific validation and warnings.
- Around line 115-129: Update the existing-deployment check around the virsh
query to identify only Enclave resources, using known Enclave VM names,
working-directory artifacts, or successful cluster access rather than treating
every VM as an Enclave deployment. Show the existing-deployment warning and
cleanup guidance only when an Enclave match is confirmed, while leaving
unrelated VMs unblocked.
- Around line 115-119: Make all libvirt commands in the skill, including the
enclave discovery and the sections around the additional referenced locations,
non-interactive by using sudo -n or an explicitly supported unprivileged virsh
invocation. Update the prerequisites to require passwordless sudo or
libvirt-group access consistent with the chosen command path, and ensure
commands fail promptly rather than prompting for credentials.
- Around line 306-327: Define the reduced-resource calculation in the “Resource
sizing logic” section for hosts with ≤64 GB RAM, including integer rounding and
explicit minimum values for master and Landing Zone memory/vCPU allocations.
Specify how to detect when available resources cannot satisfy those floors, then
stop safely with a clear failure outcome instead of proceeding with invalid
settings; preserve the existing warning and user-confirmation behavior.
- Around line 181-200: Harden the SSH setup commands throughout the documented
install flow, including the clone/update steps and the referenced secret/config
sections, so untrusted branches, paths, repository values, and file contents are
never interpolated into shell command strings. Validate expected identifiers,
apply shell-safe argument quoting, and transfer pull-secret or configuration
content via stdin or scp rather than heredocs; preserve the existing clone,
reuse, and checkout behavior.
- Around line 181-200: Update the PR branch resolution and clone/update flow to
retrieve the PR head repository and immutable commit SHA, rather than only
headRefName. For PR deployments, fetch the PR head ref from the correct
repository or checkout the resolved SHA, then verify the checked-out commit
matches that SHA before proceeding; retain the existing branch flow for non-PR
inputs.
- Around line 342-364: Update the Step 10 environment handling in the deployment
instructions to preserve the required workflow variables LZ_CLOUD_IMAGE_URL,
LZ_CLOUD_IMAGE_NAME, LZ_RHSM_ORG, LZ_RHSM_ACTIVATION_KEY, BASE_WORKING_DIR, and
ENCLAVE_IRONIC_HTTPS. Collect them securely or require host configuration, pass
each only to the relevant Landing Zone or connected TLS steps, and never display
secret values; keep unrelated CI variables excluded.
- Around line 146-147: Remove StrictHostKeyChecking=no from the SSH commands in
the install-virtualized instructions, including all referenced LZ-hop commands.
Require the LZ host fingerprint to be established and verified through a
controlled known_hosts entry, and configure SSH to fail closed on an unknown or
mismatched key while preserving the existing command flow.
- Around line 90-100: Update the E2E status check instructions around the
workflow query to inspect the selected job rather than the overall workflow
conclusion. For the most recent matching run, use its run ID with gh run view
and examine the jobs JSON, filtering for e2e-connected or e2e-disconnected as
appropriate; report that job’s status, failure details, and URL before asking
whether to proceed, switch branches, or wait.