Skip to content

SKILL_EXECUTOR_CATALOG.md

Latest commit

 

History

History
1360 lines (992 loc) · 65.7 KB

SKILL_EXECUTOR_CATALOG.md

File metadata and controls

1360 lines (992 loc) · 65.7 KB

Skill Executor Catalog — System Extension (Auto-Generated)

Auto-generated by rails system:skills:generate_catalog on 2026-06-03 17:31 UTC. Source: descriptor() class methods on extensions/system/server/app/services/system/ai/skills/*_executor.rb. Do NOT edit by hand — re-run the rake task instead.

48 executors across 7 categories.

For architecture context (agent bindings, plan vs. execute pattern, invocation surfaces), see SKILL_EXECUTORS.md.

Table of Contents

Devops (30)

  • acme_certificate_provision — Provision (issue) a new ACME TLS certificate for the platform's public listeners. Creates the certificate record and drives it through issuance via the ACME server (Let's Encrypt by default). Use this skill when the operator asks to obtain a new TLS cert for a hostname — specify the common name, the issuer, and the challenge type (dns-01 needs a DNS provider credential).
  • attach_storage — Provision a cloud volume, attach it to a running NodeInstance, and mount it at the requested path. Composes VolumeManagementService.provision/attach + SshExecutionService for filesystem setup.
  • attribute_failure — Given a failed NodeInstance, rank recent module changes + promotions by likelihood of being the cause
  • capacity_recommend — Recommend instance count or instance-type adjustments for a Template's fleet based on heartbeat health and assignment density
  • configure_sdwan_for_project — Create an SDWAN network for a project, attach the supplied instances as peers, optionally provision a project VIP, and compile the topology preview. Composes Sdwan::Network + Sdwan::PeerEnroller + Sdwan::VirtualIp + Sdwan::TopologyCompiler.
  • deploy_app_code — Deploy a Git repository onto a provisioned NodeInstance via SSH+systemd
  • discover_packages_by_intent — Intent-based package discovery — describe a capability need ('reverse proxy', 'distributed cache') and get ranked packages from accessible repositories. Use system_search_packages instead when you already know the package name and just want filter/browse.
  • docker_provision — Provision a managed Docker daemon on a NodeInstance — auto-registers as a Devops::DockerHost bound to the SDWAN overlay /128
  • drift_remediate — Reconcile a NodeInstance's running modules against its assigned modules; returns a planned action set + estimated disruption %
  • expose_service_publicly — Expose a backend service to the public internet end-to-end — provisions an SDWAN Virtual IP, a hub DNAT port mapping (443 for https / 80 for http), an ACME TLS certificate for the hostname, and regenerates the reverse proxy. Use this when an operator asks to 'make reachable from the internet at ', 'put a public endpoint in front of ', or otherwise publish an internal service with TLS.
  • list_package_repositories_summary — Summarize the package repositories configured for the operator's account — counts, kinds (apt/rpm/dnf), visibility (shared vs account), sync status. Use for 'how many package repos', 'what package sources', 'list my repositories', or similar inventory queries.
  • module_compose — Compose a Template draft from a workload description — keyword-matches modules and proposes a composition with conflict checks
  • package_module_create — Materialize an apt/rpm package + transitive dep closure as NodeModule rows + ModuleDependency edges, then dispatch a CI build
  • package_module_refresh — Re-materialize a NodeModule's source package when upstream drifts (replays persisted recommends_chosen for determinism)
  • package_repository_sync — Sync upstream apt/rpm metadata for one package repository (account-scoped or shared)
  • platform_maintenance — Routine platform maintenance — certificate renewal, drift checks, health snapshots. Use this skill when the operator asks about (a) which certs are expiring soon, (b) whether they should rotate something, (c) the current platform health, or (d) whether any instances have drifted from their template.
  • platform_resilience — Platform incident response — drain an instance, scale a deployment up/down, or triage peer/instance health. Use this skill when the operator describes a stress event (instance misbehaving, capacity pressure, peer heartbeats stale) or asks 'what should I do about X'.
  • provision_cluster — Provision N instances of a Template in a region — composes create_node + provision_instance for each
  • provision_full_stack — Provision a full compute+network+storage stack from a template — composes provision_instance + optional storage volume + optional SDWAN topology compile
  • relocate_workload — Relocate a project's compute workload from one region to another via blue/green or drain cutover. Composes ProvisionFullStackExecutor (target) + ProvisioningService.terminate_instance (source).
  • reverse_proxy_compose — Regenerate the reverse-proxy (Traefik) dynamic config for a certificate's account. Use this skill when an operator wants a valid certificate's HTTPS routers brought online (or refreshed) in the reverse proxy — it re-emits the account's dynamic YAML from its valid certs; Traefik file-watches and reloads automatically.
  • rolling_module_upgrade — Plan a batched rolling upgrade of a NodeModule across all instances of a Template, with circuit-breaker and health gating
  • scale_project — Adapt a provisioning project's footprint — add replicas in-region, plan a vertical resize, or expand into a new region. Composes ProvisionFullStackExecutor + RollingModuleUpgradeExecutor.
  • sdwan_compose_full_topology — Orchestrate the three SDWAN composition primitives (HostBridge, OVN, IPFIX) in one tool call. Composes SdwanHostBridgeComposeExecutor + SdwanOvnComposeTopologyExecutor + SdwanIpfixCollectorComposeExecutor.
  • sdwan_host_bridge_compose — Allocate per-host SDWAN bridges (Linux for lightweight profile, OVS for heavyweight) for a set of NodeInstances. Composes Sdwan::HostBridgeAllocator. Idempotent.
  • sdwan_ipfix_collector_compose — Register an IPFIX collector for an account so the topology compiler can stamp ipfix exporter config onto every heavyweight (ovs-kind) HostBridge in the per-host payload. Idempotent on (account, name). Composes Sdwan::IpfixCollector.
  • sdwan_ovn_apply_acl — Apply OVN ACLs (firewall rules) to a logical switch — heavyweight-profile only. Composes Sdwan::OvnAcl entries scoped to one switch and re-compiles the deployment plan. Idempotent on (switch, acl_name).
  • sdwan_ovn_compose_topology — Compose an OVN logical-network topology (deployment + logical switches + ports) for a heavyweight-profile account, then compile the ovn-nbctl plan. Composes Sdwan::OvnDeployment + Sdwan::OvnLogicalSwitch + Sdwan::OvnLogicalSwitchPort + Sdwan::OvnCompiler.
  • service_discovery_composer — Make a backend service discoverable across the fleet over the SDWAN overlay end-to-end — provisions a Virtual IP (auto-advertised via iBGP for in-overlay discovery), publishes a VIP-backed federation service-catalog offering for federated peers, regenerates the local Traefik routes, and OPTIONALLY publishes a public DNS record (A/AAAA/CNAME) for internet-facing names. Use this when an operator asks to 'make discoverable', 'publish to the service catalog', or 'advertise to other sites'.
  • suggest_architectures_for_fleet — Suggest which canonical architectures to materialize a package for, based on the current fleet's NodePlatform coverage and the repository's served architectures.

Documentation (1)

  • runbook_generate — Generate a markdown operational runbook for a NodeTemplate — boot order, common failure modes, recovery procedures

Federation (5)

  • federation_acceptance — Complete a federation handshake from a single-use acceptance token — runs the full accept chain (accept transition, platform enroll, managed-child operator grant, node_api bootstrap-token issuance, SDWAN overlay attach, and a federation governance health scan). Use when an operator wants to finish peering with a proposed federation peer whose acceptance token they hold.
  • federation_manager — Survey federation peer + grant + cert health for an account and surface findings the operator (or a future autonomy loop) should action.
  • federation_peer_remediate — Remediate a stale or cert-expiring federation peer: re-handshake a stale peer over mTLS (recovering it if reachable), degrade an unreachable active peer, or alert the operator that a federation cert needs an operator-driven rotation. Invoked by the fleet DecisionEngine off the FederationPeerLivenessSensor.
  • multi_tenant_isolation — Provision a fully-isolated SDWAN network slice for a single tenant inside the account: a dedicated overlay network with its own VRF + isolated iBGP RIB (no shared routing table), a non-overlapping /64 (Sdwan::PrefixAllocator), default-deny nftables firewall rules scoped to the tenant CIDR, an OVN logical switch, and tenant-CIDR OVN ACLs. Composes Sdwan::Network + Sdwan::PrefixAllocator + Sdwan::FirewallRule + SdwanOvnComposeTopologyExecutor + SdwanOvnApplyAclExecutor. SDWAN-native — no k8s NetworkPolicy, no VLAN. Use when an operator asks to 'isolate tenant ', 'give its own segregated network', or 'stand up a blast-radius boundary for '.
  • sdwan_federation_compose — Stand up a federation overlay topology (hub-and-spoke OR full-mesh) by composing per-peer Sdwan::PeerEnroller + Sdwan::TopologyCompiler + Sdwan::Bgp::RoutePolicyCompiler. Creates one Sdwan::Network, enrolls each member as a peer (hubs publicly_reachable), and compiles the per-peer WireGuard + FRR route-policy envelope.

Fleet (4)

  • architecture_create — Directly create a custom (non-canonical) architecture. Requires system.architectures.manage; surfaces for operator approval via intervention policy.
  • architecture_delete — Delete a non-canonical architecture. Fails if any NodePlatform still references it. Canonical rows are immutable and return an error.
  • architecture_propose — Propose adding a new architecture to the platform-wide catalog (creates an Ai::AgentProposal for human review).
  • architecture_update — Update a non-canonical architecture's fields. Canonical rows are immutable and return an error.

Sdwan (4)

  • sdwan_bgp_session_remediate — Triage an unhealthy iBGP session; returns a plan with likely cause + recommended next step. v1 does NOT auto-restart FRR.
  • sdwan_failover — Plan an SDWAN hub failover for an unreachable network; identifies promotion candidates without auto-flipping
  • sdwan_peer_remediate — Rotate an SDWAN peer's keypair and force the agent to re-establish its tunnel on next reconcile
  • sdwan_vip_failover — Promote the next failover candidate of a silent-holder Sdwan::VirtualIp. Anycast VIPs return informational only.

Security (3)

  • cve_remediation_orchestration — Orchestrate the full CVE → exposure → rebuild → rolling-upgrade chain for one CVE
  • cve_response — Triage a CVE entry against the fleet — enumerates exposure, scores risk, proposes a remediation plan
  • cve_runbook_generate — Generate a markdown remediation runbook for a CVE — exposed modules, recommended steps, verification commands

System (1)

  • platform_deploy — Deploy a new Powernode platform. Pass mode='standalone' for a sovereign platform or mode='federated' for one that handshakes back with this platform on first boot. With no params, returns a wizard payload describing the form the operator should fill in.

Devops

acme_certificate_provision

Provision (issue) a new ACME TLS certificate for the platform's public listeners. Creates the certificate record and drives it through issuance via the ACME server (Let's Encrypt by default). Use this skill when the operator asks to obtain a new TLS cert for a hostname — specify the common name, the issuer, and the challenge type (dns-01 needs a DNS provider credential).

  • Class: System::Ai::Skills::AcmeCertificateProvisionExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/acme_certificate_provision_executor.rb
  • Category: devops

Inputs

Field Type Required Description
common_name string Yes Primary hostname the cert secures (e.g. ops.example.com)
sans array No Subject Alternative Names — additional hostnames the cert also secures
issuer string Yes ACME issuer; one of: letsencrypt-prod, letsencrypt-staging, internal-ca
challenge_type string Yes ACME challenge; one of: dns-01, http-01, tls-alpn-01
dns_credential_id string No System::AcmeDnsCredential id — REQUIRED when challenge_type is dns-01 (publishes the validation record)
acme_email string No Operator contact email for ACME registration; falls back to platform/account default if omitted

Outputs

  • certificate_id: string
  • common_name: string
  • issuer: string
  • challenge_type: string
  • status: string
  • issued_at: string
  • expires_at: string
  • vault_path_certificate: string
  • vault_path_private_key: string
  • vault_path_chain: string

attach_storage

Provision a cloud volume, attach it to a running NodeInstance, and mount it at the requested path. Composes VolumeManagementService.provision/attach + SshExecutionService for filesystem setup.

  • Class: System::Ai::Skills::AttachStorageExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/attach_storage_executor.rb
  • Category: devops

Inputs

Field Type Required Description
instance_id string Yes System::NodeInstance to attach the volume to
size_gb integer Yes Volume size in GiB (1-16384)
volume_type string No Optional ProviderVolumeType name (e.g. 'gp3'); falls back to provider default when nil
mount_point string No Filesystem mount path on the instance
dry_run boolean No Plan only — no volume creation, no SSH

Outputs

  • dry_run: boolean
  • count: integer
  • planned_actions: array
  • outputs: {:node_instance_ids=>[:string], :storage_volume_ids=>[:string], :mount=>:object}
  • failures: array
  • partial: boolean

    • attribute_failure

    Given a failed NodeInstance, rank recent module changes + promotions by likelihood of being the cause

    • Class: System::Ai::Skills::AttributeFailureExecutor
    • Source: extensions/system/server/app/services/system/ai/skills/attribute_failure_executor.rb
    • Category: devops

    Inputs

    Field Type Required Description
    instance_id string Yes -
    lookback_hours integer No -

    Outputs

    • candidates: array
    • top_candidate: object
    • confidence: decimal
    • reasoning: string

      • capacity_recommend

      Recommend instance count or instance-type adjustments for a Template's fleet based on heartbeat health and assignment density

      • Class: System::Ai::Skills::CapacityRecommendExecutor
      • Source: extensions/system/server/app/services/system/ai/skills/capacity_recommend_executor.rb
      • Category: devops

      Inputs

      Field Type Required Description
      template_id string Yes -
      target_min_active integer No Minimum number of healthy active instances the fleet must maintain

      Outputs

      • template_id: string
      • total_count: integer
      • active_count: integer
      • silent_count: integer
      • errored_count: integer
      • recommendation: object
      • confidence: string

      configure_sdwan_for_project

      Create an SDWAN network for a project, attach the supplied instances as peers, optionally provision a project VIP, and compile the topology preview. Composes Sdwan::Network + Sdwan::PeerEnroller + Sdwan::VirtualIp + Sdwan::TopologyCompiler.

      • Class: System::Ai::Skills::ConfigureSdwanForProjectExecutor
      • Source: extensions/system/server/app/services/system/ai/skills/configure_sdwan_for_project_executor.rb
      • Category: devops

      Inputs

      Field Type Required Description
      project_id string Yes Ai::Mission id (the provisioning project receiving the overlay)
      instance_ids array Yes System::NodeInstance ids to enroll as peers (1-100)
      network_name string Yes Display name for the new Sdwan::Network
      topology string Yes One of: hub_and_spoke, mesh
      with_vip boolean No When true, provision a project-level VirtualIp held by the first peer
      vip_name string No Optional VIP name (defaults to '<network_name>-vip')
      vip_cidr string No VIP CIDR — required when with_vip is true (operator must provide a /128 in the network's /64)
      dry_run boolean No Plan only — no Sdwan::Network/Peer/VirtualIp rows are persisted

      Outputs

      • dry_run: boolean
      • count: integer
      • topology: string
      • planned_actions: array
      • outputs: {:sdwan_network_id=>:string, :sdwan_peer_ids=>[:string], :virtual_ip_id=>:string, :topology_preview=>[:object]}
      • failures: array
      • partial: boolean

        • deploy_app_code

        Deploy a Git repository onto a provisioned NodeInstance via SSH+systemd

        • Class: System::Ai::Skills::DeployAppCodeExecutor
        • Source: extensions/system/server/app/services/system/ai/skills/deploy_app_code_executor.rb
        • Category: devops

        Inputs

        Field Type Required Description
        node_instance_id string Yes Target System::NodeInstance.id (provisioned earlier in the plan)
        repo_url string Yes Git remote URL (https or ssh)
        branch string No Git branch to deploy
        start_command string No Command to run as the systemd ExecStart (e.g. 'npm start'). Inferred from repo if omitted.
        deploy_key_id string No Secret ID for a private repo deploy key (resolved by CodeDeployService)
        mission_id string No Auto-injected by PlanComposer — the Ai::Mission this deploy belongs to
        dry_run boolean No Plan only — return projected actions without touching the node

        Outputs

        • deployment_id: string
        • commit_sha: string
        • public_url: string

        discover_packages_by_intent

        Intent-based package discovery — describe a capability need ('reverse proxy', 'distributed cache') and get ranked packages from accessible repositories. Use system_search_packages instead when you already know the package name and just want filter/browse.

        • Class: System::Ai::Skills::DiscoverPackagesByIntentExecutor
        • Source: extensions/system/server/app/services/system/ai/skills/discover_packages_by_intent_executor.rb
        • Category: devops

        Inputs

        Field Type Required Description
        intent string Yes Free-text capability description — what the package should do
        repository_ids array No PackageRepository UUIDs to restrict the search to
        kind string No Repository kind filter — apt
        architectures array No Canonical arch names (amd64, arm64) to filter against — cross-kind expanded
        license string No Exact license string to require (e.g. 'MIT', 'Apache-2.0')
        top_k integer No Max results to return (1-50)

        Outputs

        • intent: string
        • results: array
        • seed_count: integer
        • confidence: string

        docker_provision

        Provision a managed Docker daemon on a NodeInstance — auto-registers as a Devops::DockerHost bound to the SDWAN overlay /128

        • Class: System::Ai::Skills::DockerProvisionExecutor
        • Source: extensions/system/server/app/services/system/ai/skills/docker_provision_executor.rb
        • Category: devops

        Inputs

        Field Type Required Description
        node_instance_id string Yes NodeInstance to provision (must already have an Sdwan::Peer with assigned overlay)
        dry_run boolean No Plan-only — return projected actions without creating the DockerHost row

        Outputs

        • dry_run: boolean
        • host_id: string
        • host_status: string
        • api_endpoint: string
        • already_provisioned: boolean
        • plan: object

        drift_remediate

        Reconcile a NodeInstance's running modules against its assigned modules; returns a planned action set + estimated disruption %

        • Class: System::Ai::Skills::DriftRemediateExecutor
        • Source: extensions/system/server/app/services/system/ai/skills/drift_remediate_executor.rb
        • Category: devops

        Inputs

        Field Type Required Description
        instance_id string Yes NodeInstance to reconcile
        max_disruption_pct integer No Disruption threshold above which the skill returns requires_approval=true

        Outputs

        • resolved: boolean
        • requires_approval: boolean
        • disruption_pct: integer
        • planned_actions: {:attach=>[:string], :detach=>[:string], :update=>[:string]}

        expose_service_publicly

        Expose a backend service to the public internet end-to-end — provisions an SDWAN Virtual IP, a hub DNAT port mapping (443 for https / 80 for http), an ACME TLS certificate for the hostname, and regenerates the reverse proxy. Use this when an operator asks to 'make reachable from the internet at ', 'put a public endpoint in front of ', or otherwise publish an internal service with TLS.

        • Class: System::Ai::Skills::ExposeServicePubliclyExecutor
        • Source: extensions/system/server/app/services/system/ai/skills/expose_service_publicly_executor.rb
        • Category: devops

        Inputs

        Field Type Required Description
        service_hostname string Yes Public DNS hostname the service will answer on, e.g. app.example.com
        service_protocol string Yes Public-facing protocol: http or https
        sdwan_network_id string Yes SDWAN network the VIP + port mapping live in
        sdwan_hub_peer_id string Yes Publicly-reachable hub peer that terminates the public port
        vip_cidr string Yes Operator-supplied host CIDR for the VIP (typically a /128 v6 or /32 v4) within the SDWAN network's /64
        target_peer_id string No Backend peer to front (provide exactly one of target_peer_id / target_instance_id)
        target_instance_id string No Backend NodeInstance to front (provide exactly one of target_peer_id / target_instance_id)
        backend_port integer Yes Port the backend service listens on (the DNAT target_port)
        tls_issuer string No ACME issuer slug for the certificate
        challenge_type string No ACME challenge type (dns-01 / http-01)
        dns_credential_id string No Credential id for the DNS provider (dns-01 challenges)

        Outputs

        • service_hostname: string
        • vip_id: string
        • vip_cidr: string
        • port_mapping_id: string
        • certificate_id: string
        • certificate_status: string
        • public_endpoints: array
        • steps_completed: array
        • warnings: array

        list_package_repositories_summary

        Summarize the package repositories configured for the operator's account — counts, kinds (apt/rpm/dnf), visibility (shared vs account), sync status. Use for 'how many package repos', 'what package sources', 'list my repositories', or similar inventory queries.

        • Class: System::Ai::Skills::ListPackageRepositoriesSummaryExecutor
        • Source: extensions/system/server/app/services/system/ai/skills/list_package_repositories_summary_executor.rb
        • Category: devops

        Inputs

        Field Type Required Description
        intent string Yes Free-text query — typically the user's natural-language ask about repositories

        Outputs

        • total: integer
        • by_kind: object
        • by_visibility: object
        • by_sync_status: object
        • repositories: array
        • summary: string

        module_compose

        Compose a Template draft from a workload description — keyword-matches modules and proposes a composition with conflict checks

        • Class: System::Ai::Skills::ModuleComposeExecutor
        • Source: extensions/system/server/app/services/system/ai/skills/module_compose_executor.rb
        • Category: devops

        Inputs

        Field Type Required Description
        description string Yes Free-form workload description, e.g. 'nginx web server with SSL and metrics'
        platform_id string No Restrict the search to modules for a specific NodePlatform
        max_modules integer No -

        Outputs

        • draft_template: object
        • conflicts: array
        • candidate_count: integer
        • reasoning: string

          • package_module_create

          Materialize an apt/rpm package + transitive dep closure as NodeModule rows + ModuleDependency edges, then dispatch a CI build

          • Class: System::Ai::Skills::PackageModuleCreateExecutor
          • Source: extensions/system/server/app/services/system/ai/skills/package_module_create_executor.rb
          • Category: devops

          Inputs

          Field Type Required Description
          repository_id string Yes -
          package_name string Yes -
          architectures array No Defaults to repository.architectures if omitted
          recommends_selected array No Per-edge recommends opt-in list (defaults to none)
          category_id string No -

          Outputs

          • top_level_module_id: string
          • dependency_count: integer
          • recommends_count: integer
          • build_dispatches: array
          • warnings: array

          package_module_refresh

          Re-materialize a NodeModule's source package when upstream drifts (replays persisted recommends_chosen for determinism)

          • Class: System::Ai::Skills::PackageModuleRefreshExecutor
          • Source: extensions/system/server/app/services/system/ai/skills/package_module_refresh_executor.rb
          • Category: devops

          Inputs

          Field Type Required Description
          package_module_link_id string Yes PackageModuleLink.id of the module to refresh
          force boolean No -

          Outputs

          • enqueued: boolean
          • package_module_link_id: string

          package_repository_sync

          Sync upstream apt/rpm metadata for one package repository (account-scoped or shared)

          • Class: System::Ai::Skills::PackageRepositorySyncExecutor
          • Source: extensions/system/server/app/services/system/ai/skills/package_repository_sync_executor.rb
          • Category: devops

          Inputs

          Field Type Required Description
          repository_id string Yes PackageRepository.id

          Outputs

          • ok: boolean
          • upserted: integer
          • obsoleted: integer
          • package_count: integer
          • error: string

          platform_maintenance

          Routine platform maintenance — certificate renewal, drift checks, health snapshots. Use this skill when the operator asks about (a) which certs are expiring soon, (b) whether they should rotate something, (c) the current platform health, or (d) whether any instances have drifted from their template.

          • Class: System::Ai::Skills::PlatformMaintenanceExecutor
          • Source: extensions/system/server/app/services/system/ai/skills/platform_maintenance_executor.rb
          • Category: devops

          Inputs

          Field Type Required Description
          action string Yes One of: cert_status, cert_rotate, drift_check, health_check
          certificate_id string No Cert id (only for cert_rotate of a specific row; omit to rotate all expiring)
          deployment_id string No PlatformDeployment id (for drift_check; omit to scan all deployments)
          renewal_window_days integer No How many days ahead to consider a cert 'expiring soon' (cert_status / cert_rotate)

          Outputs

          • action: string
          • data: object
          • recommendations: array

          platform_resilience

          Platform incident response — drain an instance, scale a deployment up/down, or triage peer/instance health. Use this skill when the operator describes a stress event (instance misbehaving, capacity pressure, peer heartbeats stale) or asks 'what should I do about X'.

          • Class: System::Ai::Skills::PlatformResilienceExecutor
          • Source: extensions/system/server/app/services/system/ai/skills/platform_resilience_executor.rb
          • Category: devops

          Inputs

          Field Type Required Description
          action string Yes One of: drain_instance, scale, failover_check
          instance_id string No NodeInstance id (required for drain_instance)
          timeout_seconds integer No Drain timeout for in-flight work (drain_instance only)
          deployment_id string No PlatformDeployment id (required for scale)
          direction string No scale direction: set
          target_replicas integer No When direction=set, the new target_replicas value

          Outputs

          • action: string
          • data: object
          • recommendations: array

          provision_cluster

          Provision N instances of a Template in a region — composes create_node + provision_instance for each

          • Class: System::Ai::Skills::ProvisionClusterExecutor
          • Source: extensions/system/server/app/services/system/ai/skills/provision_cluster_executor.rb
          • Category: devops

          Inputs

          Field Type Required Description
          template_id string Yes -
          count integer Yes Number of nodes/instances to spin up (1-50)
          provider_region_id string Yes -
          provider_instance_type_id string Yes -
          name_prefix string No Prefix for node names (default: "node")
          dry_run boolean No Plan only — return projected actions without creating resources

          Outputs

          • dry_run: boolean
          • count: integer
          • created_nodes: array
          • provisioned: array
          • failures: array
          • partial: boolean

            • provision_full_stack

            Provision a full compute+network+storage stack from a template — composes provision_instance + optional storage volume + optional SDWAN topology compile

            • Class: System::Ai::Skills::ProvisionFullStackExecutor
            • Source: extensions/system/server/app/services/system/ai/skills/provision_full_stack_executor.rb
            • Category: devops

            Inputs

            Field Type Required Description
            template_id string Yes System::NodeTemplate to instantiate
            count integer Yes Number of node instances to provision (1-50)
            provider_region_id string Yes System::ProviderRegion target
            provider_instance_type_id string Yes System::ProviderInstanceType for each instance
            network_id string No Sdwan::Network — when present, the SDWAN topology is compiled and the resulting peer ids are returned for downstream attach
            with_storage_gb integer No When present, provision a per-instance ProviderVolume of this size
            dry_run boolean No Plan only — return projected actions without creating any cloud resources

            Outputs

            • dry_run: boolean
            • count: integer
            • planned_actions: array
            • outputs: {:node_ids=>[:string], :node_instance_ids=>[:string], :sdwan_peer_ids=>[:string], :storage_volume_ids=>[:string]}
            • failures: array
            • partial: boolean

              • relocate_workload

              Relocate a project's compute workload from one region to another via blue/green or drain cutover. Composes ProvisionFullStackExecutor (target) + ProvisioningService.terminate_instance (source).

              • Class: System::Ai::Skills::RelocateWorkloadExecutor
              • Source: extensions/system/server/app/services/system/ai/skills/relocate_workload_executor.rb
              • Category: devops

              Inputs

              Field Type Required Description
              project_id string Yes Ai::Mission id (the provisioning project being relocated)
              from_region_id string Yes System::ProviderRegion the workload is leaving (audit hint, no lookup)
              to_region_id string Yes System::ProviderRegion the workload is moving to (target for new stack)
              cutover_strategy string Yes One of: blue_green, drain
              template_id string Yes System::NodeTemplate to instantiate at the target region
              provider_instance_type_id string Yes Instance type for the target stack
              count integer Yes Number of new instances to bring up at the target (1-50)
              source_instance_ids array Yes System::NodeInstance ids in the source region to terminate during cutover
              network_id string No Sdwan::Network — when present, target instances are wired into the SDWAN topology and peer ids returned
              with_storage_gb integer No When present, provision a per-instance ProviderVolume of this size at the target
              dry_run boolean No Plan only — return projected actions without provisioning or terminating

              Outputs

              • dry_run: boolean
              • count: integer
              • cutover_strategy: string
              • planned_actions: array
              • outputs: {:node_ids=>[:string], :node_instance_ids=>[:string], :sdwan_peer_ids=>[:string], :storage_volume_ids=>[:string], :terminated_instance_ids=>[:string]}
              • failures: array
              • partial: boolean

                • reverse_proxy_compose

                Regenerate the reverse-proxy (Traefik) dynamic config for a certificate's account. Use this skill when an operator wants a valid certificate's HTTPS routers brought online (or refreshed) in the reverse proxy — it re-emits the account's dynamic YAML from its valid certs; Traefik file-watches and reloads automatically.

                • Class: System::Ai::Skills::ReverseProxyComposeExecutor
                • Source: extensions/system/server/app/services/system/ai/skills/reverse_proxy_compose_executor.rb
                • Category: devops

                Inputs

                Field Type Required Description
                certificate_id string Yes AcmeCertificate id (must be status=valid) whose account's reverse-proxy config to regenerate

                Outputs

                • certificate_id: string
                • common_name: string
                • status: string
                • dynamic_config_path: string
                • routers_configured: integer

                rolling_module_upgrade

                Plan a batched rolling upgrade of a NodeModule across all instances of a Template, with circuit-breaker and health gating

                • Class: System::Ai::Skills::RollingModuleUpgradeExecutor
                • Source: extensions/system/server/app/services/system/ai/skills/rolling_module_upgrade_executor.rb
                • Category: devops

                Inputs

                Field Type Required Description
                template_id string Yes -
                module_id string Yes -
                target_version_id string Yes -
                batch_pct integer No Percent of fleet to upgrade per batch (1-100). Smaller = safer + slower.
                max_consecutive_failures integer No Trip the circuit-breaker after this many consecutive batch failures
                health_timeout_sec integer No How long to wait for a batch to report healthy heartbeats before marking failed

                Outputs

                • total_instances: integer
                • batch_size: integer
                • batch_count: integer
                • estimated_total_seconds: integer
                • circuit_breaker: object
                • batches: array

                  scale_project

                  Adapt a provisioning project's footprint — add replicas in-region, plan a vertical resize, or expand into a new region. Composes ProvisionFullStackExecutor + RollingModuleUpgradeExecutor.

                  • Class: System::Ai::Skills::ScaleProjectExecutor
                  • Source: extensions/system/server/app/services/system/ai/skills/scale_project_executor.rb
                  • Category: devops

                  Inputs

                  Field Type Required Description
                  project_id string Yes Ai::Mission id (the provisioning project being scaled)
                  target_count integer Yes Number of new instances (add_replicas / add_region) — bounded 1..50. Ignored for vertical_resize.
                  scaling_strategy string Yes One of: add_replicas, vertical_resize, add_region
                  template_id string No System::NodeTemplate to instantiate (add_replicas / add_region) or whose fleet is being resized (vertical_resize)
                  provider_region_id string No Region for new instances (add_replicas: same as project; add_region: NEW region)
                  provider_instance_type_id string No Instance type for new instances
                  module_id string No vertical_resize: System::NodeModule whose target_version replaces in-place
                  target_version_id string No vertical_resize: target System::NodeModuleVersion id
                  network_id string No add_region: optional Sdwan::Network to attach new instances to
                  with_storage_gb integer No add_region: optional per-instance volume size
                  dry_run boolean No Plan only — return projected actions without creating any cloud resources

                  Outputs

                  • dry_run: boolean
                  • count: integer
                  • scaling_strategy: string
                  • planned_actions: array
                  • outputs: {:node_ids=>[:string], :node_instance_ids=>[:string], :sdwan_peer_ids=>[:string], :storage_volume_ids=>[:string], :rolling_upgrade_plan=>:object}
                  • failures: array
                  • partial: boolean

                    • sdwan_compose_full_topology

                    Orchestrate the three SDWAN composition primitives (HostBridge, OVN, IPFIX) in one tool call. Composes SdwanHostBridgeComposeExecutor + SdwanOvnComposeTopologyExecutor + SdwanIpfixCollectorComposeExecutor.

                    • Class: System::Ai::Skills::SdwanComposeFullTopologyExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_compose_full_topology_executor.rb
                    • Category: devops

                    Inputs

                    Field Type Required Description
                    host_node_instance_ids array Yes System::NodeInstance ids — passed through to host_bridge_compose
                    kind string No Optional explicit bridge kind override (linux
                    ovn_topology object No Optional OVN composition payload: {nb_db_endpoint, sb_db_endpoint, northd_host?, switches} — when supplied, runs sdwan_ovn_compose_topology
                    ipfix_collector object No Optional IPFIX collector payload: {name, host, port, sampling_rate?} — when supplied, runs sdwan_ipfix_collector_compose
                    dry_run boolean No Plan only — invokes each sub-skill in dry_run mode

                    Outputs

                    • dry_run: boolean
                    • planned_actions: array
                    • outputs: {:host_bridges=>:object, :ovn=>:object, :ipfix=>:object}
                    • failures: array
                    • partial: boolean

                      • sdwan_host_bridge_compose

                      Allocate per-host SDWAN bridges (Linux for lightweight profile, OVS for heavyweight) for a set of NodeInstances. Composes Sdwan::HostBridgeAllocator. Idempotent.

                    • Class: System::Ai::Skills::SdwanHostBridgeComposeExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_host_bridge_compose_executor.rb
                    • Category: devops

                      • Inputs

                      Field Type Required Description
                      host_node_instance_ids array Yes System::NodeInstance ids to allocate bridges for (1-100)
                      kind string No Optional explicit bridge kind override: linux
                      dry_run boolean No Plan only — no Sdwan::HostBridge rows are persisted

                      Outputs

                    • dry_run: boolean
                    • bridge_count: integer
                    • planned_actions: array
                    • outputs: {:host_bridge_ids=>[:string], :allocations=>[:object]}
                    • failures: array
                    • partial: boolean

                      • sdwan_ipfix_collector_compose

                      Register an IPFIX collector for an account so the topology compiler can stamp ipfix exporter config onto every heavyweight (ovs-kind) HostBridge in the per-host payload. Idempotent on (account, name). Composes Sdwan::IpfixCollector.

                    • Class: System::Ai::Skills::SdwanIpfixCollectorComposeExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_ipfix_collector_compose_executor.rb
                    • Category: devops

                      • Inputs

                      Field Type Required Description
                      name string Yes Display name for the collector — unique per account; reused on re-execution
                      host string Yes Collector host (IPv4, IPv6, or hostname). IPv6 addresses are bracketed automatically when emitted to ovs-vsctl.
                      port integer Yes Collector UDP port (1-65535)
                      sampling_rate integer No Sampling rate (1 = export every flow). Ignored when re-using an existing collector.
                      dry_run boolean No Plan only — no Sdwan::IpfixCollector row is persisted

                      Outputs

                    • dry_run: boolean
                    • planned_actions: array
                    • outputs: {:ipfix_collector_id=>:string, :created=>:boolean, :name=>:string, :target_endpoint=>:string, :sampling_rate=>:integer, :state=>:string, :is_winning_collector=>:boolean}
                    • failures: array
                    • partial: boolean

                      • sdwan_ovn_apply_acl

                      Apply OVN ACLs (firewall rules) to a logical switch — heavyweight-profile only. Composes Sdwan::OvnAcl entries scoped to one switch and re-compiles the deployment plan. Idempotent on (switch, acl_name).

                    • Class: System::Ai::Skills::SdwanOvnApplyAclExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_ovn_apply_acl_executor.rb
                    • Category: devops

                      • Inputs

                      Field Type Required Description
                      logical_switch_id string Yes Sdwan::OvnLogicalSwitch id the ACLs apply to (must belong to the executing account)
                      acls array Yes Array of {name, direction, priority?, match, action} (1-100). direction: from-lport
                      dry_run boolean No Plan only — no Sdwan::OvnAcl rows are persisted

                      Outputs

                    • dry_run: boolean
                    • acl_count: integer
                    • planned_actions: array
                    • outputs: {:logical_switch_id=>:string, :ovn_acl_ids=>[:string], :allocations=>[:object], :compiled_plan=>:object}
                    • failures: array
                    • partial: boolean

                      • sdwan_ovn_compose_topology

                      Compose an OVN logical-network topology (deployment + logical switches + ports) for a heavyweight-profile account, then compile the ovn-nbctl plan. Composes Sdwan::OvnDeployment + Sdwan::OvnLogicalSwitch + Sdwan::OvnLogicalSwitchPort + Sdwan::OvnCompiler.

                    • Class: System::Ai::Skills::SdwanOvnComposeTopologyExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_ovn_compose_topology_executor.rb
                    • Category: devops

                      • Inputs

                      Field Type Required Description
                      switches array Yes Array of {name, cidr?, ports: [{name, kind, addresses?, host_node_instance_id?}]} (1-50)
                      nb_db_endpoint string No OVN NB DB endpoint (e.g., tcp:127.0.0.1:6641) — required only when the account has no OvnDeployment yet
                      sb_db_endpoint string No OVN SB DB endpoint (e.g., tcp:127.0.0.1:6642) — required only when the account has no OvnDeployment yet
                      northd_host string No Advisory hint for which host runs ovn-northd — only used when creating a new deployment
                      dry_run boolean No Plan only — no Sdwan rows are persisted

                      Outputs

                    • dry_run: boolean
                    • switch_count: integer
                    • port_count: integer
                    • planned_actions: array
                    • outputs: {:ovn_deployment_id=>:string, :created_deployment=>:boolean, :logical_switch_ids=>[:string], :logical_switch_port_ids=>[:string], :compiled_plan=>:object}
                    • failures: array
                    • partial: boolean

                      • service_discovery_composer

                      Make a backend service discoverable across the fleet over the SDWAN overlay end-to-end — provisions a Virtual IP (auto-advertised via iBGP for in-overlay discovery), publishes a VIP-backed federation service-catalog offering for federated peers, regenerates the local Traefik routes, and OPTIONALLY publishes a public DNS record (A/AAAA/CNAME) for internet-facing names. Use this when an operator asks to 'make discoverable', 'publish to the service catalog', or 'advertise to other sites'.

                    • Class: System::Ai::Skills::ServiceDiscoveryComposerExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/service_discovery_composer_executor.rb
                    • Category: devops

                      • Inputs

                      Field Type Required Description
                      service_name string Yes Human-readable name of the service (catalog display name)
                      service_slug string Yes Lowercase-alphanumeric-hyphen slug — the catalog's natural key (also names the VIP). e.g. 'orders-api'
                      sdwan_network_id string Yes SDWAN network the VIP lives in
                      backend_peer_id string Yes Sdwan::Peer that hosts the service; seated as the VIP's primary holder (and thus the iBGP advertiser)
                      backend_port integer Yes Port the backend service listens on (advertised in the catalog offering)
                      vip_cidr string Yes Operator-supplied host CIDR for the VIP (a /128 v6 or /32 v4) within the SDWAN network's /64
                      protocol string No Service protocol advertised in the catalog: one of https, http, tcp, tls
                      grant_scopes array No Default FederationGrant scopes subscribers receive (subset of read, write, admin, migrate). Defaults to ['read']
                      grant_ttl_days integer No Default grant TTL in days (>= 7). Defaults to the offering default
                      traefik_dynamic_dir string No Override for the Traefik dynamic-config directory (defaults to /etc/traefik/dynamic)
                      public_dns object No INTERNET-FACING name only: { dns_credential_id, record_name, record_type? (A

                      Outputs

                    • service_slug: string
                    • vip_id: string
                    • vip_cidr: string
                    • vip_address: string
                    • offering_id: string
                    • offering_slug: string
                    • route_output_path: string
                    • route_count: integer
                    • dns_record_id: string
                    • dns_record_fqdn: string
                    • public_dns_published: boolean
                    • steps_completed: array
                    • warnings: array

                      • suggest_architectures_for_fleet

                      Suggest which canonical architectures to materialize a package for, based on the current fleet's NodePlatform coverage and the repository's served architectures.

                    • Class: System::Ai::Skills::SuggestArchitecturesForFleetExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/suggest_architectures_for_fleet_executor.rb
                    • Category: devops

                      • Inputs

                      Field Type Required Description
                      repository_id string Yes PackageRepository.id whose architectures bound the suggestion set
                      max_suggestions integer No Cap on the number of suggested arches (1-7)

                      Outputs

                    • repository_id: string
                    • suggested: array
                    • rationale: array
                    • fallback: boolean
                    • confidence: string

                      • Documentation

                      runbook_generate

                      Generate a markdown operational runbook for a NodeTemplate — boot order, common failure modes, recovery procedures

                    • Class: System::Ai::Skills::RunbookGenerateExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/runbook_generate_executor.rb
                    • Category: documentation

                      • Inputs

                      Field Type Required Description
                      template_id string Yes -
                      persist_as_page boolean No Save the result as a Pages document so it's reachable via list_pages

                      Outputs

                    • runbook_markdown: string
                    • section_count: integer
                    • persisted_page_id: string
                    • source_artifacts: object

                      • Federation

                      federation_acceptance

                      Complete a federation handshake from a single-use acceptance token — runs the full accept chain (accept transition, platform enroll, managed-child operator grant, node_api bootstrap-token issuance, SDWAN overlay attach, and a federation governance health scan). Use when an operator wants to finish peering with a proposed federation peer whose acceptance token they hold.

                    • Class: System::Ai::Skills::FederationAcceptanceExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/federation_acceptance_executor.rb
                    • Category: federation

                      • Inputs

                      Field Type Required Description
                      acceptance_token string Yes The single-use acceptance token plaintext (from the propose step). Consumed on success.
                      contract_version integer Yes Contract version to agree on. Must be one of the supported versions (currently [1]).
                      capabilities object No Forward-compat capability advertisement exchanged with the peer.
                      extension_slugs array No Extension slugs the peer carries (e.g. ['trading']).
                      endpoints array No Peer endpoints: array of { url, scope, priority, cidr_hint? }.

                      Outputs

                    • peer_id: string
                    • status: string
                    • peer_kind: string
                    • contract_version_agreed: integer
                    • accepted_at: string
                    • handshake_at: string
                    • node_enrollment: object
                    • sdwan_attach: object
                    • governance: object
                    • warnings: array

                      • federation_manager

                      Survey federation peer + grant + cert health for an account and surface findings the operator (or a future autonomy loop) should action.

                    • Class: System::Ai::Skills::FederationManagerExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/federation_manager_executor.rb
                    • Category: federation

                      • Outputs

                    • account_id: string
                    • ran_at: string
                    • cert_rotation_candidates: array
                    • grants_approaching_expiry: array
                    • grants_overdue_for_review: array
                    • broad_scope_grants: array
                    • capability_drift: array
                    • finding_count: integer

                      • federation_peer_remediate

                      Remediate a stale or cert-expiring federation peer: re-handshake a stale peer over mTLS (recovering it if reachable), degrade an unreachable active peer, or alert the operator that a federation cert needs an operator-driven rotation. Invoked by the fleet DecisionEngine off the FederationPeerLivenessSensor.

                    • Class: System::Ai::Skills::FederationPeerRemediateExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/federation_peer_remediate_executor.rb
                    • Category: federation

                      • Inputs

                      Field Type Required Description
                      federation_peer_id string Yes System::FederationPeer to remediate
                      reason string No Liveness failure class from the sensor: heartbeat_stale
                      dry_run boolean No Plan-only mode — report the action that would be taken without probing, degrading, or alerting

                      Outputs

                    • remediated: boolean
                    • action: string
                    • reason: string
                    • federation_peer_id: string
                    • peer_status: string
                    • reachable: boolean
                    • detail: string

                      • multi_tenant_isolation

                      Provision a fully-isolated SDWAN network slice for a single tenant inside the account: a dedicated overlay network with its own VRF + isolated iBGP RIB (no shared routing table), a non-overlapping /64 (Sdwan::PrefixAllocator), default-deny nftables firewall rules scoped to the tenant CIDR, an OVN logical switch, and tenant-CIDR OVN ACLs. Composes Sdwan::Network + Sdwan::PrefixAllocator + Sdwan::FirewallRule + SdwanOvnComposeTopologyExecutor + SdwanOvnApplyAclExecutor. SDWAN-native — no k8s NetworkPolicy, no VLAN. Use when an operator asks to 'isolate tenant ', 'give its own segregated network', or 'stand up a blast-radius boundary for '.

                    • Class: System::Ai::Skills::MultiTenantIsolationExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/multi_tenant_isolation_executor.rb
                    • Category: federation

                      • Inputs

                      Field Type Required Description
                      tenant_key string Yes Stable tenant identifier within the account (slug-safe; used to name the network, firewall rules, OVN switch, and ACLs). e.g. 'acme-prod'.
                      network_name string No Display name for the tenant's Sdwan::Network (defaults to 'tenant-<tenant_key>').
                      tenant_cidr string No Explicit tenant CIDR for the firewall + ACL selectors. When omitted, the /64 auto-allocated for the new network (PrefixAllocator) is used — the recommended path.
                      nb_db_endpoint string No OVN NB DB endpoint (e.g. tcp:127.0.0.1:6641) — required only when the account has no Sdwan::OvnDeployment yet.
                      sb_db_endpoint string No OVN SB DB endpoint (e.g. tcp:127.0.0.1:6642) — required only when the account has no Sdwan::OvnDeployment yet.
                      ovn_switch_name string No Override the OVN logical switch name (defaults to 'ls-tenant-<tenant_key>').
                      dry_run boolean No Plan only — no Sdwan rows are persisted.

                      Outputs

                    • dry_run: boolean
                    • tenant_key: string
                    • tenant_cidr: string
                    • planned_actions: array
                    • outputs: {:sdwan_network_id=>:string, :sdwan_network_handle=>:string, :vrf_name=>:string, :tenant_cidr=>:string, :firewall_rule_ids=>[:string], :ovn_deployment_id=>:string, :ovn_logical_switch_id=>:string, :ovn_acl_ids=>[:string], :ovn_acl_allocations=>[:object]}
                    • failures: array
                    • partial: boolean

                      • sdwan_federation_compose

                      Stand up a federation overlay topology (hub-and-spoke OR full-mesh) by composing per-peer Sdwan::PeerEnroller + Sdwan::TopologyCompiler + Sdwan::Bgp::RoutePolicyCompiler. Creates one Sdwan::Network, enrolls each member as a peer (hubs publicly_reachable), and compiles the per-peer WireGuard + FRR route-policy envelope.

                    • Class: System::Ai::Skills::SdwanFederationComposeExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_federation_compose_executor.rb
                    • Category: federation

                      • Inputs

                      Field Type Required Description
                      network_name string Yes Display name for the new federation Sdwan::Network
                      topology string Yes One of: hub_and_spoke, full_mesh
                      peers array Yes Member descriptors (1-200). Each: {node_instance_id (required), role: 'hub'
                      routing_protocol string No One of: static, ibgp — 'ibgp' enables FRR route-policy distribution
                      dry_run boolean No Plan only — no Sdwan::Network/Peer rows are persisted

                      Outputs

                    • dry_run: boolean
                    • count: integer
                    • topology: string
                    • routing_protocol: string
                    • planned_actions: array
                    • outputs: {:sdwan_network_id=>:string, :sdwan_peer_ids=>[:string], :hub_peer_ids=>[:string], :topology_preview=>[:object], :route_policy_preview=>[:object]}
                    • failures: array
                    • partial: boolean

                      • Fleet

                      architecture_create

                      Directly create a custom (non-canonical) architecture. Requires system.architectures.manage; surfaces for operator approval via intervention policy.

                    • Class: System::Ai::Skills::ArchitectureCreateExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/architecture_create_executor.rb
                    • Category: fleet

                      • Inputs

                      Field Type Required Description
                      name string Yes -
                      family string Yes -
                      apt_name string No -
                      rpm_name string No -
                      display_name string No -
                      description string No -
                      enabled boolean No -
                      public boolean No -

                      Outputs

                    • architecture: object

                      • architecture_delete

                      Delete a non-canonical architecture. Fails if any NodePlatform still references it. Canonical rows are immutable and return an error.

                    • Class: System::Ai::Skills::ArchitectureDeleteExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/architecture_delete_executor.rb
                    • Category: fleet

                      • Inputs

                      Field Type Required Description
                      architecture_id string Yes -

                      Outputs

                    • deleted: boolean
                    • architecture_id: string

                      • architecture_propose

                      Propose adding a new architecture to the platform-wide catalog (creates an Ai::AgentProposal for human review).

                    • Class: System::Ai::Skills::ArchitectureProposeExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/architecture_propose_executor.rb
                    • Category: fleet

                      • Inputs

                      Field Type Required Description
                      name string Yes Canonical lowercase name (e.g. loongarch64, mips64el)
                      family string Yes One of: x86, arm, power, z, risc-v, mips, other
                      apt_name string No apt-style name (e.g. amd64 for x86_64)
                      rpm_name string No rpm-style name (matches name for most arches)
                      display_name string No -
                      description string No -
                      justification string No Why this arch is needed — surfaces in the approval UI

                      Outputs

                    • proposal_id: string
                    • status: string
                    • review_deadline: datetime

                      • architecture_update

                      Update a non-canonical architecture's fields. Canonical rows are immutable and return an error.

                    • Class: System::Ai::Skills::ArchitectureUpdateExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/architecture_update_executor.rb
                    • Category: fleet

                      • Inputs

                      Field Type Required Description
                      architecture_id string Yes -
                      attributes object Yes Allowed: name, family, apt_name, rpm_name, display_name, description, kernel_options, enabled, public

                      Outputs

                    • architecture: object

                      • Sdwan

                      sdwan_bgp_session_remediate

                      Triage an unhealthy iBGP session; returns a plan with likely cause + recommended next step. v1 does NOT auto-restart FRR.

                    • Class: System::Ai::Skills::SdwanBgpSessionRemediateExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_bgp_session_remediate_executor.rb
                    • Category: sdwan

                      • Inputs

                      Field Type Required Description
                      bgp_session_id string No -
                      peer_id string No Local peer (resolves session via peer_id + neighbor_address)
                      neighbor_address string No -
                      dry_run boolean No -

                      Outputs

                    • resolved: boolean
                    • session_id: string
                    • state: string
                    • likely_cause: string
                    • recommended_action: string

                      • sdwan_failover

                      Plan an SDWAN hub failover for an unreachable network; identifies promotion candidates without auto-flipping

                    • Class: System::Ai::Skills::SdwanFailoverExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_failover_executor.rb
                    • Category: sdwan

                      • Inputs

                      Field Type Required Description
                      network_id string Yes -
                      dry_run boolean No v1 only supports dry_run=true — auto-promotion deferred

                      Outputs

                    • resolved: boolean
                    • network_id: string
                    • current_hub_count: integer
                    • candidates: {:peer_id=>:string, :endpoint_host=>:string, :endpoint_port=>:integer, :last_handshake_at=>:string}

                      • sdwan_peer_remediate

                      Rotate an SDWAN peer's keypair and force the agent to re-establish its tunnel on next reconcile

                    • Class: System::Ai::Skills::SdwanPeerRemediateExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_peer_remediate_executor.rb
                    • Category: sdwan

                      • Inputs

                      Field Type Required Description
                      peer_id string Yes Sdwan::Peer to remediate
                      dry_run boolean No Plan-only mode — return what would happen without rotating keys

                      Outputs

                    • resolved: boolean
                    • rotated_from_key_id: string
                    • new_key_id: string
                    • new_public_key: string

                      • sdwan_vip_failover

                      Promote the next failover candidate of a silent-holder Sdwan::VirtualIp. Anycast VIPs return informational only.

                    • Class: System::Ai::Skills::SdwanVipFailoverExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_vip_failover_executor.rb
                    • Category: sdwan

                      • Inputs

                      Field Type Required Description
                      virtual_ip_id string Yes -
                      dry_run boolean No -

                      Outputs

                    • resolved: boolean
                    • virtual_ip_id: string
                    • previous_holder_peer_id: string
                    • new_holder_peer_id: string
                    • anycast: boolean

                      • Security

                      cve_remediation_orchestration

                      Orchestrate the full CVE → exposure → rebuild → rolling-upgrade chain for one CVE

                    • Class: System::Ai::Skills::CveRemediationOrchestrationExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/cve_remediation_orchestration_executor.rb
                    • Category: security

                      • Inputs

                      Field Type Required Description
                      cve_id string Yes Canonical CVE id, e.g. CVE-2026-12345
                      severity string No critical
                      affected_module_ids array No Optional pre-resolved list of module ids — when omitted, derived from CveExposure rows
                      exposure_ids array No Optional list of CveExposure ids to transition to remediating

                      Outputs

                    • cve_id: string
                    • triage: object
                    • refresh_dispatches: array
                    • rolling_upgrade_plans: array
                    • exposures_remediating: integer
                    • skipped_reason: string

                      • cve_response

                      Triage a CVE entry against the fleet — enumerates exposure, scores risk, proposes a remediation plan

                    • Class: System::Ai::Skills::CveResponseExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/cve_response_executor.rb
                    • Category: security

                      • Inputs

                      Field Type Required Description
                      cve_id string Yes Canonical CVE id, e.g. CVE-2026-12345
                      severity string Yes critical
                      affected_packages array Yes [{name: 'openssl', version: '<3.1.4'}, ...]
                      summary string No -

                      Outputs

                    • cve_id: string
                    • severity: string
                    • risk_score: integer
                    • exposed_modules: array
                    • exposed_instance_count: integer
                    • remediation_plan: object
                    • requires_approval: boolean

                      • cve_runbook_generate

                      Generate a markdown remediation runbook for a CVE — exposed modules, recommended steps, verification commands

                    • Class: System::Ai::Skills::CveRunbookGenerateExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/cve_runbook_generate_executor.rb
                    • Category: security

                      • Inputs

                      Field Type Required Description
                      cve_id string Yes Canonical CVE id, e.g. CVE-2026-12345
                      persist_as_page boolean No Save the runbook as a Pages document so it's reachable via list_pages

                      Outputs

                    • runbook_markdown: string
                    • cve_id: string
                    • exposed_module_count: integer
                    • exposed_instance_count: integer
                    • risk_score: integer
                    • requires_approval: boolean
                    • persisted_page_id: string

                      • System

                      platform_deploy

                      Deploy a new Powernode platform. Pass mode='standalone' for a sovereign platform or mode='federated' for one that handshakes back with this platform on first boot. With no params, returns a wizard payload describing the form the operator should fill in.

                    • Class: System::Ai::Skills::PlatformDeployExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/platform_deploy_executor.rb
                    • Category: system

                      • Inputs

                      Field Type Required Description
                      mode string No Deployment mode: standalone
                      name string No Human-readable name for the new platform / deployment.
                      template_slug string No NodeTemplate slug to use (default: powernode-hub).
                      parent_url string No Required for federated mode — reachable URL of THIS platform that the child posts back to.
                      spawn_mode string No Required for federated mode — one of: managed_child, autonomous_peer, cluster_member.
                      region string No Optional provider region preference.
                      instance_size string No Optional provider instance type preference.
                      service_role string No Service role for the PlatformDeployment row (default: api).
                      public_dns_hostname string No Optional public DNS hostname for the new platform.
                      token_ttl_seconds integer No Acceptance-token TTL for federated spawns (default: 7 days).

                      Outputs

                    • ok: boolean
                    • card: object
                    • deployment: object
                    • acceptance_token: string
                    • spawn_payload: object