t-cloud-public

Files (4)

• SKILL.md
• scenarios.json · evals/
• operator-setup.md · references/
• t_cloud_public.cjs

SKILL.md (first lines)

# T Cloud Public

Use this skill for T Cloud Public, formerly Open Telekom Cloud, infrastructure
inventory, deployment-readiness checks, incident summaries, and guarded DevOps
request planning. Invoke it as `t-cloud-public`. The helper path uses the
current product name; credential names intentionally keep established `OTC_*`
identifiers because the public API docs, domains, and customer terminology
still use OTC/Open Telekom Cloud names.

## Default Workflow

1. Start with read-only inventory or `plan`. V1 helper operations are
   read/list/describe only.
2. Treat `t_cloud_public.cjs` as the API wrapper. Do not handcraft OTC API
   URLs, service endpoints, signing metadata, request tiers, or SecretRefs from
   memory.
3. For prompt/user testing, stop after `plan` or helper `http-request` payload
   generation. Do not call helper `run` or the built-in `http_request` tool.
4. For real user requests that need live OTC data, use helper `run`. The helper
   constructs an allowlisted request and sends it through the HybridClaw gateway
   `http_request` route. For IaaS/API inventory, the gateway resolves
   `OTC_ACCESS_KEY_ID`, `OTC_SECRET_ACCESS_KEY`, optional `OTC_SECURITY_TOKEN`,
   and `OTC_PROJECT_ID`, then signs the request server-side.
5. Use `http-request` only to inspect the generated gateway payload or when
   the active runtime cannot give the helper gateway access.
6. If a live helper `run` or `http_request` call returns 401, 403, or a
   signature/authentication failure, stop after that first failed call. Do not
   retry or fan out to more OTC endpoints. Ask the operator to verify
   credentials, project ID, region, IAM permissions, and clock skew.
7. If a live call returns 429, stop fan-out and report retry guidance from
   `Retry-After` or rate-limit response headers when present.
8. For account billing, current spend, charges, and consumption, use the
   documented Enterprise Dashboard API v2 through helper operations
   `billing-daily-consumption` and `billing-hourly-consumption`. These calls use
   `https://api-enterprise-dashboard.otc-service.com/`, bearer secret
   `OTC_ENTERPRISE_DASHBOARD_TOKEN`, and NDJSON responses from
   `/v2/daily/consumption/` or `/v2/hourly/consumption/`.
9. Mutating actions are outside v1 execution. For create/delete/reboot,
   network/security group, volume/backup restore, DNS/load-balancer, IAM/KMS,
   database, or container mutations, produce a plan with exact region, project,
   resource IDs, intended action, rollback, blast radius, and the required F8/F14
   operator approval text. Do not execute the mutation.
10. Never paste, print, inspect, or ask for OTC signing material, passwords, API
   tokens, AK/SK pairs, project IDs stored as secrets, or session tokens.
11. Treat region as plain configuration. Pass `--region eu-de` explicitly or
    set `OTC_REGION=eu-de` in the helper environment; do not store region in the
    encrypted secret store.

See [references/operator-setup.md](references/operator-setup.md) for operator
setup, credential scope, companion tooling, autonomy defaults, and rate-limit
handling.

## Command Contract

Run the helper:

```bash
node skills/t-cloud-public/t_cloud_public.cjs --help
```

Plan without contacting OTC:

```bash
node skills/t-cloud-public/t_cloud_public.cjs --format json plan \
  "deploy-check for eu-de production"
```

Build dry-run gateway payloads:

```bash
node skills/t-cloud-public/t_cloud_public.cjs --format json http-request regions
node skills/t-cloud-public/t_cloud_public.cjs --format json http-request service-endpoints --region eu-de
node skills/t-cloud-public/t_cloud_public.cjs --format json http-request service-status
node skills/t-cloud-public/t_cloud_public.cjs --format json http-request quotas --region eu-de
node skills/t-cloud-public/t_cloud_public.cjs --format json http-request servers --region eu-de --limit 50
node skills/t-cloud-public/t_cloud_public.cjs --format json http-request networks --region eu-de --limit 50
node skills/t-cloud-public/t_cloud_public.cjs --format json http-request volumes --region eu-de --limit 50
node skills/t-cloud-public/t_cloud_public.cjs --format json http-request cloud-eye-alarms --region eu-de --limit 50
node skills/t-cloud-public/t_cloud_public.cjs --format json http-request billing-daily-consumption --date 2026-05-24
node skills/t-cloud-public/t_cloud_public.cjs --format json http-request billing-hourly-consumption --date 2026-05-24 --hour 13
```

Run live read requests through the gateway:

```bash
node skills/t-cloud-public/t_cloud_public.cjs --format json run servers --region eu-de --limit 50
node skills/t-cloud-public/t_cloud_public.cjs --format json run security-groups --region eu-de
node skills/t-cloud-public/t_cloud_public.cjs --format json run backups --region eu-de --limit 50
node skills/t-cloud-public/t_cloud_public.cjs --format json run rds-instances --region eu-de --limit 50
node skills/t-cloud-public/t_cloud_public.cjs --format json run billing-daily-consumption --date 2026-05-24
```

## Inventory Coverage

- ECS: servers, server details, flavors, quotas
- VPC/network: VPCs, subnets, security groups, EIPs, load balancers
- Storage: EVS volumes, EVS snapshots, Cloud Backup and Recovery backups,
  OBS bucket/object listings, SFS shares
- Containers and databases: CCE clusters/nodes and RDS instances
- Observability/audit: Cloud Eye alarms, Cloud Trace events, and Log Tank
  Service log groups
- Security/platform checks: IAM regions/projects, IAM service endpoints and
  service catalog, public status dashboard checks, KMS keys, WAF policies,
  regional endpoints, and service-status oriented readiness summaries
- Billing/spend: Enterprise Dashboard daily and hourly consumption streams.
  Parse each NDJSON line, then sum `amount` for the requested period.

## Readiness Checks

For deployment or incident summaries, gather only the minimum inventory needed:

- region/project/auth readiness without exposing secrets
- quota pressure before deploys
- unhealthy ECS/RDS/CCE resources
- missing recent backups or snapshots
- public EIPs and security groups that expose admin ports
- missing or disabled Cloud Eye alarms
- recent Cloud Trace changes around the incident window

From HybridAIOne/hybridclaw, MIT.

More from HybridAIOne/hybridclaw