SKILL_EXECUTOR_CATALOG.md

Skill Executor Catalog — System Extension (Auto-Generated)

Auto-generated by rails system:skills:generate_catalog on 2026-09-30 19:30 UTC. Source: descriptor() class methods on extensions/system/server/app/services/system/ai/skills/*_executor.rb. Do NOT edit by hand — re-run the rake task instead.

67 executors across 8 categories.

For architecture context (agent bindings, plan vs. execute pattern, invocation surfaces), see SKILL_EXECUTORS.md.

---

Table of Contents

Devops (40)

• acme_certificate_provision — Provision (issue) a new ACME TLS certificate for the platform's public listeners. Creates the certificate record and drives it through issuance via the ACME server (Let's Encrypt by default). Use this skill when the operator asks to obtain a new TLS cert for a hostname — specify the common name, the issuer, and the challenge type (dns-01 needs a DNS provider credential).
• attach_storage — Provision a cloud volume, attach it to a running NodeInstance, and mount it at the requested path. Composes VolumeManagementService.provision/attach + SshExecutionService for filesystem setup.
• attribute_failure — Given a failed NodeInstance, rank recent module changes + promotions by likelihood of being the cause
• boot_image_drift_rollout — Plan a canary-first, halt-on-failure in-place boot-image upgrade across all drifted instances on a node platform, converging the fleet onto the promoted image.
• capacity_recommend — Recommend instance count or instance-type adjustments for a Template's fleet based on heartbeat health and assignment density
• configure_sdwan_for_project — Create an SDWAN network for a project, attach the supplied instances as peers, optionally provision a project VIP, and compile the topology preview. Composes Sdwan::Network + Sdwan::PeerEnroller + Sdwan::VirtualIp + Sdwan::TopologyCompiler.
• deploy_app_code — Deploy a Git repository onto a provisioned NodeInstance via SSH+systemd
• discover_packages_by_intent — Intent-based package discovery — describe a capability need ('reverse proxy', 'distributed cache') and get ranked packages from accessible repositories. Use system_search_packages instead when you already know the package name and just want filter/browse.
• docker_provision — Provision a managed Docker daemon on a NodeInstance — auto-registers as a Devops::DockerHost bound to the SDWAN overlay /128
• drift_remediate — Compare a NodeInstance's running modules against its assigned modules; returns a planned action set + estimated disruption %. PLANS ONLY — it applies nothing, so resolved is true only when there was no drift to apply
• expose_service_local — Expose a backend service locally at a friendly /svc/ path on the platform's own host(s), authenticated by the reverse proxy (ForwardAuth). Use this when an operator asks to 'publish for our users', 'put behind /svc/ with login', or otherwise make an overlay/internal service reachable to the site's own authenticated users (NOT the public internet — use expose_service_publicly for that). Creates or updates the Sdwan::Service, enables its local-exposure facet, and regenerates the reverse proxy.
• expose_service_public_tcp — Toggle a backend service's public (Path B) TLS-carrying TCP exposure via Traefik HostSNI routing. Use this when an operator asks to 'publish on the public internet over raw TLS/TCP', 'turn on/off public exposure for ', or otherwise flip Sdwan::Service#public_enabled. EXPOSE (enabled: true, default) validates the service's protocol is tls, that a HostSNI host resolves, and — under edge_mode terminate — that a matching valid ACME certificate exists, before enabling. UNEXPOSE (enabled: false) simply disables it. NOT for HTTP(S) (use expose_service_publicly) or the site-local /svc plane (use expose_service_local).
• expose_service_publicly — Expose a backend service to the public internet end-to-end — provisions an SDWAN Virtual IP, a hub DNAT port mapping (443 for https / 80 for http), an ACME TLS certificate for the hostname, and regenerates the reverse proxy. Use this when an operator asks to 'make reachable from the internet at ', 'put a public endpoint in front of ', or otherwise publish an internal service with TLS.
• fulfill_capability_request — On-demand: turn an NL capability request into a running, leased instance. Composes a plan and creates a DURABLE System::FulfillmentRequest (state machine); approval is an out-of-band transition on the persisted, frozen plan.
• gitops_apply_proposal — Apply one approved GitOps drift proposal to live fleet state (template / module / assignment / pool / platform diffs) and mark it implemented; a stale-conflict or unsupported diff is refused with the reason
• gitops_register_repository — Register a Git repository as a declarative source of fleet state the GitOps Reconciler syncs every 5 minutes (branch, path prefix, Vault credential path, auto_apply, SSH host key); the first sync runs on the next reconcile tick
• gitops_sync_repository — Sync one registered GitOps repository now: clone/fast-forward it, diff its desired fleet state against the live fleet and open one Ai::AgentProposal per drifted resource; returns the finalized sync run handle. Applies nothing
• list_package_repositories_summary — Summarize the package repositories configured for the operator's account — counts, kinds (apt/rpm/dnf), visibility (shared vs account), sync status. Use for 'how many package repos', 'what package sources', 'list my repositories', or similar inventory queries.
• module_compose — Compose a Template draft from a workload description — SEMANTICALLY ranks modules (embedding cosine, keyword fallback), runs conflict checks, and surfaces package gaps to materialize when no module covers a capability
• module_smoke_verify — Compose a newly-built module onto a pooled instance atop base-os and assert it's healthy (systemd unit active, manifest health endpoint answers, ldd closure complete)
• package_module_create — Materialize an apt/rpm package + transitive dep closure as NodeModule rows + ModuleDependency edges, then dispatch a CI build
• package_module_refresh — Re-materialize a NodeModule's source package when upstream drifts (replays persisted recommends_chosen for determinism)
• package_repository_sync — Enqueue a background sync of upstream apt/rpm metadata for one package repository (account-scoped or shared); returns once queued, the sync runs out-of-process
• platform_health_check — COMPOSITE platform health snapshot — the Rails API, worker, Sidekiq, Redis, PostgreSQL, the reverse proxy, the MCP endpoint, fleet tick liveness, provider egress and fleet error/silent counts, delegated whole to System::Platform::CompositeHealthProbe. Every subsystem gets its own entry; a subsystem that could not be observed reports not_measured, never ok. Use this skill when the operator asks whether the platform itself is healthy, degraded or down.
• platform_maintenance — Routine platform maintenance — certificate renewal, drift checks. Use this skill when the operator asks about (a) which certs are expiring soon, (b) whether they should rotate something, or (c) whether any instances have drifted from the modules their node is assigned. For the composite platform health answer, use platform_health_check instead.
• platform_resilience — Platform incident response — cordon and stop an instance, scale a deployment up/down (this action and the Scaling panel's PATCH both reconcile the live replica count after writing target_replicas; the GitOps bridge still only records it), or triage peer/instance health. Use this skill when the operator describes a stress event (instance misbehaving, capacity pressure, peer heartbeats stale) or asks 'what should I do about X'.
• provision_cluster — Provision N instances of a Template in a region — composes create_node + provision_instance for each
• provision_full_stack — Provision a full compute+network+storage stack from a template — composes provision_instance + optional storage volume + optional SDWAN peer enrollment
• relocate_workload — Relocate a project's compute workload from one region to another via blue/green or drain cutover. Composes ProvisionFullStackExecutor (target) + ProvisioningService.terminate_instance (source).
• restore_volume — Restore a ProviderVolume from one of its completed snapshots. Read restored_in_place in the outputs: true means the volume was rolled back and writes made since the snapshot are DISCARDED; false means the provider copied the snapshot into a new volume (restored_volume_id) and the source volume is unchanged — pass swap_into_place to have the copy swapped onto the source's instance and device (swapped in the outputs). Optionally takes a fresh snapshot first so the pre-restore state stays recoverable. Refuses on providers with no snapshot or no restore primitive rather than reporting a restore that did not happen.
• reverse_proxy_compose — Regenerate the reverse-proxy (Traefik) dynamic config for a certificate's account. Use this skill when an operator wants a valid certificate's HTTPS routers brought online (or refreshed) in the reverse proxy — it re-emits the account's dynamic YAML from its valid certs; Traefik file-watches and reloads automatically.
• rolling_module_upgrade — Size a FLEET-ATOMIC module upgrade for a NodeModule across all instances of a Template. The upgrade cannot be staged or batched: the served version resolves from a per-MODULE pointer (NodeModule#current_version_id), so every instance carrying the module converges together. PLAN ONLY — the plan is NOT executed; nothing in the platform moves the pointer from this plan. See the class doc for the manual procedure and for real staging options.
• scale_project — Adapt a provisioning project's footprint — add replicas in-region, remove the newest replicas, plan a vertical resize, or expand into a new region. Composes ProvisionFullStackExecutor + RollingModuleUpgradeExecutor.
• sdwan_compose_full_topology — Orchestrate the three SDWAN composition primitives (HostBridge, OVN, IPFIX) in one tool call. Composes SdwanHostBridgeComposeExecutor + SdwanOvnComposeTopologyExecutor + SdwanIpfixCollectorComposeExecutor.
• sdwan_host_bridge_compose — Allocate per-host SDWAN bridges (Linux for lightweight profile, OVS for heavyweight) for a set of NodeInstances. Composes Sdwan::HostBridgeAllocator. Idempotent.
• sdwan_ipfix_collector_compose — Register an IPFIX collector for an account so the topology compiler can stamp ipfix exporter config onto every heavyweight (ovs-kind) HostBridge in the per-host payload. Idempotent on (account, name). Composes Sdwan::IpfixCollector.
• sdwan_ovn_apply_acl — Apply OVN ACLs (firewall rules) to a logical switch — heavyweight-profile only. Composes Sdwan::OvnAcl entries scoped to one switch and re-compiles the deployment plan. Idempotent on (switch, acl_name).
• sdwan_ovn_compose_topology — Compose an OVN logical-network topology (deployment + logical switches + ports) for a heavyweight-profile account, then compile the ovn-nbctl plan. Composes Sdwan::OvnDeployment + Sdwan::OvnLogicalSwitch + Sdwan::OvnLogicalSwitchPort + Sdwan::OvnCompiler.
• service_discovery_composer — Make a backend service discoverable across the fleet over the SDWAN overlay end-to-end — provisions a Virtual IP (auto-advertised via iBGP for in-overlay discovery), publishes a VIP-backed federation service-catalog offering for federated peers, regenerates the local Traefik routes, and OPTIONALLY publishes a public DNS record (A/AAAA/CNAME) for internet-facing names. Use this when an operator asks to 'make discoverable', 'publish to the service catalog', or 'advertise to other sites'.
• suggest_architectures_for_fleet — Suggest which canonical architectures to materialize a package for, based on the current fleet's NodePlatform coverage and the repository's served architectures.

Documentation (1)

• runbook_generate — Generate a markdown operational runbook for a NodeTemplate — boot order, common failure modes, recovery procedures

Federation (5)

• federation_acceptance — Complete a federation handshake from a single-use acceptance token — runs the full accept chain (accept transition, platform enroll, managed-child operator grant, node_api bootstrap-token issuance, SDWAN overlay attach, and a federation governance health scan). Use when an operator wants to finish peering with a proposed federation peer whose acceptance token they hold.
• federation_manager — Survey federation peer + grant + cert health for an account and surface findings the operator (or a future autonomy loop) should action.
• federation_peer_remediate — Remediate a stale or cert-expiring federation peer: re-handshake a stale peer over mTLS (recovering it if reachable), degrade an unreachable active peer, or alert the operator that a federation cert needs an operator-driven rotation. Invoked by the fleet DecisionEngine off the FederationPeerLivenessSensor.
• multi_tenant_isolation — Provision a fully-isolated SDWAN network slice for a single tenant inside the account: a dedicated overlay network with its own VRF + isolated iBGP RIB (no shared routing table), a non-overlapping /64 (Sdwan::PrefixAllocator), default-deny nftables firewall rules scoped to the tenant CIDR, an OVN logical switch, and tenant-CIDR OVN ACLs. Composes Sdwan::Network + Sdwan::PrefixAllocator + Sdwan::FirewallRule + SdwanOvnComposeTopologyExecutor + SdwanOvnApplyAclExecutor. SDWAN-native — no k8s NetworkPolicy, no VLAN. Use when an operator asks to 'isolate tenant ', 'give its own segregated network', or 'stand up a blast-radius boundary for '.
• sdwan_federation_compose — Stand up a federation overlay topology (hub-and-spoke OR full-mesh) by composing per-peer Sdwan::PeerEnroller + Sdwan::TopologyCompiler + Sdwan::Bgp::RoutePolicyCompiler. Creates one Sdwan::Network, enrolls each member as a peer (hubs publicly_reachable), and compiles the per-peer WireGuard + FRR route-policy envelope.

Fleet (11)

• architecture_create — Directly create a custom (non-canonical) architecture. Requires system.architectures.manage; surfaces for operator approval via intervention policy.
• architecture_delete — Delete a non-canonical architecture. Fails if any NodePlatform still references it. Canonical rows are immutable and return an error.
• architecture_propose — Propose adding a new architecture to the platform-wide catalog (creates an Ai::AgentProposal for human review).
• architecture_update — Update a non-canonical architecture's fields. Canonical rows are immutable and return an error.
• disk_image_promote — Promote a published disk-image publication to its NodePlatform's active default — every instance provisioned on the platform afterwards boots from it; the previously active publication is retired in the same transaction
• disk_image_retention — Set a NodePlatform's disk-image retention count — how many publications the purge sweep keeps before soft-deleting older artifacts (1..50); reversible GC configuration
• disk_image_rollback — Roll a NodePlatform's active disk image back to a prior publication — an explicit one, else the newest retired publication, else the newest published one that is not current; restores a retired artifact and retires the previously active publication in one transaction
• promote_replica — Promote a postgres streaming replica to primary after the primary is provider-confirmed down: cut the DB VIP over to the replica's SDWAN peer, fence the old primary, and dispatch the module-declared pg_ctl promote. Refuses a live primary outright and refuses an unknown or over-bound replication lag unless the operator accepts the data loss.
• reap_instance — Terminate an unrecoverable NodeInstance whose workload has already been moved to a pooled replacement. The destructive half of a DR replace, gated separately from it.
• reap_orphan_pool_guest — Destroy a provider guest named for an ephemeral instance pool that no platform row knows — a VM left behind when its record went. Re-checked against the provider inventory and name-verified at the terminate; parks in a protected plane.
• replace_instance — Replace an unrecoverable NodeInstance with a warm pool member: acquire the replacement, reattach its volumes, re-enrol it on every SDWAN network the failed one held (inheriting the failed peer's routing ROLE rather than the schema defaults, with the endpoint re-derived from the replacement's own address so a replacement hub is not left advertising the dead instance's), move its VIPs, and re-home every published Sdwan::Service that dialled the failed instance by address onto the replacement (the dead member is drained, not removed, until the reap). The terminate of the failed instance is a SEPARATE approval, performed by ReapInstanceExecutor.

Governance (1)

• governance_gap_propose — File (or update) the one reviewable improvement offer for a governance gap the fleet tick detected — a declared category nobody owns, an agent without skills, a lane bound to no skill, an executor without a catalog row, a missing lineage edge or delegation policy — and materialise the runtime-closable ones under the Platform Architect's gates

Sdwan (5)

• sdwan_bgp_session_remediate — Triage an unhealthy iBGP session; returns a plan with likely cause + recommended next step. v1 does NOT auto-restart FRR.
• sdwan_credential_refresh — Re-issue an SDWAN peer's expiring membership credential server-side, without touching the WireGuard keypair
• sdwan_failover — Plan an SDWAN hub failover for an unreachable network; identifies promotion candidates without auto-flipping
• sdwan_peer_remediate — Rotate an SDWAN peer's keypair and force the agent to re-establish its tunnel on next reconcile
• sdwan_vip_failover — Promote the next failover candidate of a silent-holder Sdwan::VirtualIp. Anycast VIPs return informational only.

Security (3)

• cve_remediation_orchestration — Orchestrate the full CVE → exposure → rebuild → rolling-upgrade chain for one CVE
• cve_response — Triage a CVE entry against the fleet — enumerates exposure, scores risk, proposes a remediation plan
• cve_runbook_generate — Generate a markdown remediation runbook for a CVE — exposed modules, recommended steps, verification commands

System (1)

• platform_deploy — Deploy a new Powernode platform. Pass mode='standalone' for a sovereign platform. With no params, returns a wizard payload describing the form the operator should fill in. mode='federated' is NOT available here — it mints a single-use acceptance token that this surface cannot deliver; operators deploy federated platforms over POST /api/v1/system/platform/deployments, which reveals the token once in its HTTP response.

---

Devops

acme_certificate_provision

Provision (issue) a new ACME TLS certificate for the platform's public listeners. Creates the certificate record and drives it through issuance via the ACME server (Let's Encrypt by default). Use this skill when the operator asks to obtain a new TLS cert for a hostname — specify the common name, the issuer, and the challenge type (dns-01 needs a DNS provider credential).

• Class: System::Ai::Skills::AcmeCertificateProvisionExecutor
• Source: extensions/system/server/app/services/system/ai/skills/acme_certificate_provision_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
common_name	string	Yes	Primary hostname the cert secures (e.g. ops.example.com)
sans	array	No	Subject Alternative Names — additional hostnames the cert also secures
issuer	string	Yes	ACME issuer; one of: letsencrypt-prod, letsencrypt-staging, internal-ca
challenge_type	string	Yes	ACME challenge; one of: dns-01, http-01, tls-alpn-01
dns_credential_id	string	No	System::AcmeDnsCredential id — REQUIRED when challenge_type is dns-01 (publishes the validation record)
acme_email	string	No	Operator contact email for ACME registration; falls back to platform/account default if omitted

Outputs

• certificate_id: string
• common_name: string
• issuer: string
• challenge_type: string
• status: string
• issued_at: string
• expires_at: string
• vault_paths_present: boolean

attach_storage

Provision a cloud volume, attach it to a running NodeInstance, and mount it at the requested path. Composes VolumeManagementService.provision/attach + SshExecutionService for filesystem setup.

• Class: System::Ai::Skills::AttachStorageExecutor
• Source: extensions/system/server/app/services/system/ai/skills/attach_storage_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
instance_id	string	Yes	System::NodeInstance to attach the volume to
size_gb	integer	Yes	Volume size in GiB (1-16384)
volume_type	string	No	Optional ProviderVolumeType name (e.g. 'gp3'); falls back to provider default when nil
mount_point	string	No	Filesystem mount path on the instance
dry_run	boolean	No	Plan only — no volume creation, no SSH

Outputs

• dry_run: boolean
• count: integer
• planned_actions: array
• outputs: {:node_instance_ids=>[:string], :storage_volume_ids=>[:string], :mount=>:object}
• failures: array
• partial: boolean

attribute_failure

Given a failed NodeInstance, rank recent module changes + promotions by likelihood of being the cause

• Class: System::Ai::Skills::AttributeFailureExecutor
• Source: extensions/system/server/app/services/system/ai/skills/attribute_failure_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
instance_id	string	Yes	-
lookback_hours	integer	No	-

Outputs

• candidates: array
• top_candidate: object
• confidence: decimal
• confidence_state: string
• confidence_detail: object
• reasoning: string

boot_image_drift_rollout

Plan a canary-first, halt-on-failure in-place boot-image upgrade across all drifted instances on a node platform, converging the fleet onto the promoted image.

• Class: System::Ai::Skills::BootImageDriftRolloutExecutor
• Source: extensions/system/server/app/services/system/ai/skills/boot_image_drift_rollout_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
instance_id	string	Yes	A drifted NodeInstance — the rollout resolves its platform + all drifted siblings
batch_pct	integer	No	Percent of drifted instances per batch (canary = first batch)
max_consecutive_failures	integer	No	Halt the rollout after this many recent failed upgrades on the platform
dry_run	boolean	No	Plan only — no tasks created (the require_approval gate path)

Outputs

• platform_id: string
• target_git_sha: string
• total_drifted: integer
• batch_size: integer
• batch_count: integer
• halted: boolean
• halt_reason: string
• circuit_breaker: object
• batches: array
• dispatched_task_ids: array
• dispatch_errors: array
• self_managed_excluded: array
• blast_radius_ceiling: integer

capacity_recommend

Recommend instance count or instance-type adjustments for a Template's fleet based on heartbeat health and assignment density

• Class: System::Ai::Skills::CapacityRecommendExecutor
• Source: extensions/system/server/app/services/system/ai/skills/capacity_recommend_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
template_id	string	Yes	-
target_min_active	integer	No	Minimum number of healthy active instances the fleet must maintain

Outputs

• template_id: string
• total_count: integer
• active_count: integer
• silent_count: integer
• errored_count: integer
• recommendation: object
• confidence: string

configure_sdwan_for_project

Create an SDWAN network for a project, attach the supplied instances as peers, optionally provision a project VIP, and compile the topology preview. Composes Sdwan::Network + Sdwan::PeerEnroller + Sdwan::VirtualIp + Sdwan::TopologyCompiler.

• Class: System::Ai::Skills::ConfigureSdwanForProjectExecutor
• Source: extensions/system/server/app/services/system/ai/skills/configure_sdwan_for_project_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
project_id	string	Yes	Ai::Mission id (the provisioning project receiving the overlay)
instance_ids	array	Yes	System::NodeInstance ids to enroll as peers (1-100)
network_name	string	Yes	Display name for the new Sdwan::Network
topology	string	Yes	One of: hub_and_spoke, mesh
with_vip	boolean	No	When true, provision a project-level VirtualIp held by the first peer
vip_name	string	No	Optional VIP name (defaults to '<network_name>-vip')
vip_cidr	string	No	VIP CIDR — required when with_vip is true (operator must provide a /128 in the network's /64)
dry_run	boolean	No	Plan only — no Sdwan::Network/Peer/VirtualIp rows are persisted

Outputs

• dry_run: boolean
• count: integer
• topology: string
• planned_actions: array
• outputs: {:sdwan_network_id=>:string, :sdwan_peer_ids=>[:string], :virtual_ip_id=>:string, :topology_preview=>[:object]}
• failures: array
• partial: boolean

deploy_app_code

Deploy a Git repository onto a provisioned NodeInstance via SSH+systemd

• Class: System::Ai::Skills::DeployAppCodeExecutor
• Source: extensions/system/server/app/services/system/ai/skills/deploy_app_code_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
node_instance_id	string	Yes	Target System::NodeInstance.id (provisioned earlier in the plan)
repo_url	string	Yes	Git remote URL (https or ssh)
branch	string	No	Git branch to deploy
start_command	string	No	Command to run as the systemd ExecStart (e.g. 'npm start'). Inferred from repo if omitted.
deploy_key_id	string	No	Secret ID for a private repo deploy key (resolved by CodeDeployService)
mission_id	string	No	Auto-injected by PlanComposer — the Ai::Mission this deploy belongs to
dry_run	boolean	No	Plan only — return projected actions without touching the node

Outputs

• deployment_id: string
• commit_sha: string
• public_url: string

discover_packages_by_intent

Intent-based package discovery — describe a capability need ('reverse proxy', 'distributed cache') and get ranked packages from accessible repositories. Use system_search_packages instead when you already know the package name and just want filter/browse.

• Class: System::Ai::Skills::DiscoverPackagesByIntentExecutor
• Source: extensions/system/server/app/services/system/ai/skills/discover_packages_by_intent_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
intent	string	Yes	Free-text capability description — what the package should do
repository_ids	array	No	PackageRepository UUIDs to restrict the search to
kind	string	No	Repository kind filter — apt
architectures	array	No	Canonical arch names (amd64, arm64) to filter against — cross-kind expanded
license	string	No	Exact license string to require (e.g. 'MIT', 'Apache-2.0')
top_k	integer	No	Max results to return (1-50)

Outputs

• intent: string
• results: array
• seed_count: integer
• confidence: string

docker_provision

Provision a managed Docker daemon on a NodeInstance — auto-registers as a Devops::DockerHost bound to the SDWAN overlay /128

• Class: System::Ai::Skills::DockerProvisionExecutor
• Source: extensions/system/server/app/services/system/ai/skills/docker_provision_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
node_instance_id	string	Yes	NodeInstance to provision (must already have an Sdwan::Peer with assigned overlay)
dry_run	boolean	No	Plan-only — return projected actions without creating the DockerHost row

Outputs

• dry_run: boolean
• host_id: string
• host_status: string
• api_endpoint: string
• already_provisioned: boolean
• plan: object

drift_remediate

Compare a NodeInstance's running modules against its assigned modules; returns a planned action set + estimated disruption %. PLANS ONLY — it applies nothing, so resolved is true only when there was no drift to apply

• Class: System::Ai::Skills::DriftRemediateExecutor
• Source: extensions/system/server/app/services/system/ai/skills/drift_remediate_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
instance_id	string	Yes	NodeInstance to reconcile
max_disruption_pct	integer	No	Disruption threshold above which the skill returns requires_approval=true

Outputs

• resolved: boolean
• requires_approval: boolean
• disruption_pct: integer
• planned_actions: {:attach=>[:string], :detach=>[:string], :update=>[:string]}

expose_service_local

Expose a backend service locally at a friendly /svc/ path on the platform's own host(s), authenticated by the reverse proxy (ForwardAuth). Use this when an operator asks to 'publish for our users', 'put behind /svc/ with login', or otherwise make an overlay/internal service reachable to the site's own authenticated users (NOT the public internet — use expose_service_publicly for that). Creates or updates the Sdwan::Service, enables its local-exposure facet, and regenerates the reverse proxy.

• Class: System::Ai::Skills::ExposeServiceLocalExecutor
• Source: extensions/system/server/app/services/system/ai/skills/expose_service_local_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
service_id	string	No	Existing Sdwan::Service id to expose (omit to create a new service from the fields below)
slug	string	No	URL slug for the /svc/ mount (required when creating; lowercase alnum + hyphen, <=64, not a reserved platform path)
name	string	No	Human-friendly service name (required when creating)
protocol	string	No	Backend protocol Traefik connects with: https or http (default https)
backend_vip_id	string	No	Sdwan::VirtualIp id of the overlay backend (provide this or backend_host when creating)
backend_host	string	No	Static backend host/IP if not using a VIP (provide this or backend_vip_id when creating)
backend_port	integer	No	Backend service port (required when creating; 1-65535)
auth_mode	string	No	public (no auth)
required_permission	string	No	Permission name required for scoped mode (e.g. services.grafana.view)
required_group	string	No	Group/role name required for scoped mode (used when no required_permission is given)
strip_prefix	boolean	No	Strip /svc/ before proxying so the backend sees '/' (default true; advertises X-Forwarded-Prefix)
certificate_id	string	No	System::AcmeCertificate id whose CN the /svc/ router mounts under (default: the account's primary valid cert)

Outputs

• service_id: string
• slug: string
• name: string
• local_path: string
• local_url: string
• auth_mode: string
• host: string
• local_services_path: string
• routes_configured: integer
• created: boolean

expose_service_public_tcp

Toggle a backend service's public (Path B) TLS-carrying TCP exposure via Traefik HostSNI routing. Use this when an operator asks to 'publish on the public internet over raw TLS/TCP', 'turn on/off public exposure for ', or otherwise flip Sdwan::Service#public_enabled. EXPOSE (enabled: true, default) validates the service's protocol is tls, that a HostSNI host resolves, and — under edge_mode terminate — that a matching valid ACME certificate exists, before enabling. UNEXPOSE (enabled: false) simply disables it. NOT for HTTP(S) (use expose_service_publicly) or the site-local /svc plane (use expose_service_local).

• Class: System::Ai::Skills::ExposeServicePublicTcpExecutor
• Source: extensions/system/server/app/services/system/ai/skills/expose_service_public_tcp_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
service_id	string	Yes	Existing Sdwan::Service id to toggle public (Path B) TCP exposure for
enabled	boolean	No	true (default) to EXPOSE (enable public_enabled); false to UNEXPOSE (disable it)

Outputs

• service_id: string
• slug: string
• public_enabled: boolean
• edge_mode: string
• client_auth: string
• host: string
• local_services_path: string
• routes_configured: integer

expose_service_publicly

Expose a backend service to the public internet end-to-end — provisions an SDWAN Virtual IP, a hub DNAT port mapping (443 for https / 80 for http), an ACME TLS certificate for the hostname, and regenerates the reverse proxy. Use this when an operator asks to 'make reachable from the internet at ', 'put a public endpoint in front of ', or otherwise publish an internal service with TLS.

• Class: System::Ai::Skills::ExposeServicePubliclyExecutor
• Source: extensions/system/server/app/services/system/ai/skills/expose_service_publicly_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
service_hostname	string	Yes	Public DNS hostname the service will answer on, e.g. app.example.com
service_protocol	string	Yes	Public-facing protocol: http or https
sdwan_network_id	string	Yes	SDWAN network the VIP + port mapping live in
sdwan_hub_peer_id	string	Yes	Publicly-reachable hub peer that terminates the public port
vip_cidr	string	Yes	Operator-supplied host CIDR for the VIP (typically a /128 v6 or /32 v4) within the SDWAN network's /64
target_peer_id	string	No	Backend peer to front (provide exactly one of target_peer_id / target_instance_id)
target_instance_id	string	No	Backend NodeInstance to front (provide exactly one of target_peer_id / target_instance_id)
backend_port	integer	Yes	Port the backend service listens on (the DNAT target_port)
tls_issuer	string	No	ACME issuer slug for the certificate
challenge_type	string	No	ACME challenge type (dns-01 / http-01)
dns_credential_id	string	No	Credential id for the DNS provider (dns-01 challenges)

Outputs

• service_hostname: string
• vip_id: string
• vip_cidr: string
• port_mapping_id: string
• certificate_id: string
• certificate_status: string
• public_endpoints: array
• steps_completed: array
• warnings: array

fulfill_capability_request

On-demand: turn an NL capability request into a running, leased instance. Composes a plan and creates a DURABLE System::FulfillmentRequest (state machine); approval is an out-of-band transition on the persisted, frozen plan.

• Class: System::Ai::Skills::FulfillCapabilityRequestExecutor
• Source: extensions/system/server/app/services/system/ai/skills/fulfill_capability_request_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
request	string	Yes	Free-form capability request, e.g. 'give me a running memcached instance'
count	integer	No	Instances to provision (default 1; capped by SiteSetting system.fulfill.max_instances)
approved	boolean	No	false (default) → create the request in composed and return the plan + id for OUT-OF-BAND approval. true (autonomous callers) → also transition composed→approved and drive the first advance inline.
base_os_module_name	string	No	-
platform_id	string	No	Restrict module composition to a NodePlatform (defaults to the base-os module's platform)
provider_region_id	string	No	Override region for provisioning (defaults to account's first enabled region / SiteSetting)
provider_instance_type_id	string	No	Override instance type (defaults to account's cheapest / SiteSetting)

Outputs

• fulfillment_request_id: string
• state: string
• plan: object
• executed: boolean
• requires_approval: boolean
• reused_modules: array
• materialized_modules: array
• build_batch_id: string
• template_id: string
• instance_id: string
• instance_ids: array
• lease: object
• leases: array
• smoke: object
• parked: array
• unresolved_gaps: array
• approval_withheld_reason: string

gitops_apply_proposal

Apply one approved GitOps drift proposal to live fleet state (template / module / assignment / pool / platform diffs) and mark it implemented; a stale-conflict or unsupported diff is refused with the reason

• Class: System::Ai::Skills::GitopsApplyProposalExecutor
• Source: extensions/system/server/app/services/system/ai/skills/gitops_apply_proposal_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
proposal_id	string	Yes	Ai::AgentProposal.id — an approved proposal with source gitops

Outputs

• applied: boolean
• applied_action: string
• resource_id: string
• proposal_id: string
• proposal_status: string

gitops_register_repository

Register a Git repository as a declarative source of fleet state the GitOps Reconciler syncs every 5 minutes (branch, path prefix, Vault credential path, auto_apply, SSH host key); the first sync runs on the next reconcile tick

• Class: System::Ai::Skills::GitopsRegisterRepositoryExecutor
• Source: extensions/system/server/app/services/system/ai/skills/gitops_register_repository_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
name	string	Yes	Display name, unique within the account (<= 64 chars)
repo_url	string	Yes	Clone URL (https or ssh); never put credentials in it — use vault_credential_path
branch	string	No	Branch to track (default main)
vault_credential_path	string	No	Vault path holding the clone credentials
path_prefix	string	No	Directory inside the repo holding fleet.yaml (default repo root)
auto_apply	boolean	No	Apply non-destructive drift without operator review (default false)
ssh_host_key	string	No	The git host's SSH PUBLIC host key line (' ', as ssh-keyscan prints it) the sync verifies against; omitted, an SSH remote is keyscanned and the result pinned

Outputs

• repository_id: string
• name: string
• branch: string
• path_prefix: string
• auto_apply: boolean
• last_status: string
• ssh_host_key_fingerprints: array
• ssh_host_key_source: string

gitops_sync_repository

Sync one registered GitOps repository now: clone/fast-forward it, diff its desired fleet state against the live fleet and open one Ai::AgentProposal per drifted resource; returns the finalized sync run handle. Applies nothing

• Class: System::Ai::Skills::GitopsSyncRepositoryExecutor
• Source: extensions/system/server/app/services/system/ai/skills/gitops_sync_repository_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
repository_id	string	Yes	System::GitopsRepository.id

Outputs

• repository_id: string
• sync_run_id: string
• diff_count: integer
• proposal_ids: array
• synced_revision: string
• diff_summary: object

list_package_repositories_summary

Summarize the package repositories configured for the operator's account — counts, kinds (apt/rpm/dnf), visibility (shared vs account), sync status. Use for 'how many package repos', 'what package sources', 'list my repositories', or similar inventory queries.

• Class: System::Ai::Skills::ListPackageRepositoriesSummaryExecutor
• Source: extensions/system/server/app/services/system/ai/skills/list_package_repositories_summary_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
intent	string	Yes	Free-text query — typically the user's natural-language ask about repositories

Outputs

• total: integer
• by_kind: object
• by_visibility: object
• by_sync_status: object
• repositories: array
• summary: string

module_compose

Compose a Template draft from a workload description — SEMANTICALLY ranks modules (embedding cosine, keyword fallback), runs conflict checks, and surfaces package gaps to materialize when no module covers a capability

• Class: System::Ai::Skills::ModuleComposeExecutor
• Source: extensions/system/server/app/services/system/ai/skills/module_compose_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
description	string	Yes	Free-form workload description, e.g. 'nginx web server with SSL and metrics'
platform_id	string	No	Restrict the search to modules for a specific NodePlatform
max_modules	integer	No	-

Outputs

• draft_template: object
• conflicts: array
• gaps: array
• candidate_count: integer
• ranking_mode: string
• reasoning: string

module_smoke_verify

Compose a newly-built module onto a pooled instance atop base-os and assert it's healthy (systemd unit active, manifest health endpoint answers, ldd closure complete)

• Class: System::Ai::Skills::ModuleSmokeVerifyExecutor
• Source: extensions/system/server/app/services/system/ai/skills/module_smoke_verify_executor.rb
• Category: devops

Inputs

Field	Type	Required	Description
module_name	string	No	NodeModule name to smoke-verify (module_name or module_id required)
module_id	string	No	NodeModule id to smoke-verify (module_name or module_id required)
base_os_module_name	string	No	Base-os module composed alongside the target module
template_id	string	No	Existing NodeTemplate to reuse instead of the acquired instance's own template
instance_id	string	No	Verify THIS already-provisioned instance in place (caller-owned: not acquired from a pool, not released/terminated). Omit to self-acquire an ephemeral pool member for a standalone smoke (which IS released afterward).

Outputs

• ok: boolean
• module_name: string
• base_os_module_name: string
• instance_id: string
• template_id: string
• checks: array

  package_module_create

  Materialize an apt/rpm package + transitive dep closure as NodeModule rows + ModuleDependency edges, then dispatch a CI build

  • Class: System::Ai::Skills::PackageModuleCreateExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/package_module_create_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  repository_id	string	Yes	-
  package_name	string	Yes	-
  architectures	array	No	Defaults to repository.architectures if omitted
  recommends_selected	array	No	Per-edge recommends opt-in list (defaults to none)
  category_id	string	No	-

  Outputs

  • top_level_module_id: string
  • dependency_count: integer
  • recommends_count: integer
  • build_dispatches: array
  • warnings: array

  package_module_refresh

  Re-materialize a NodeModule's source package when upstream drifts (replays persisted recommends_chosen for determinism)

  • Class: System::Ai::Skills::PackageModuleRefreshExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/package_module_refresh_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  package_module_link_id	string	Yes	PackageModuleLink.id of the module to refresh
  force	boolean	No	-

  Outputs

  • enqueued: boolean
  • package_module_link_id: string

  package_repository_sync

  Enqueue a background sync of upstream apt/rpm metadata for one package repository (account-scoped or shared); returns once queued, the sync runs out-of-process

  • Class: System::Ai::Skills::PackageRepositorySyncExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/package_repository_sync_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  repository_id	string	Yes	PackageRepository.id

  Outputs

  • ok: boolean
  • queued: boolean
  • status: string
  • repository_id: string

  platform_health_check

  COMPOSITE platform health snapshot — the Rails API, worker, Sidekiq, Redis, PostgreSQL, the reverse proxy, the MCP endpoint, fleet tick liveness, provider egress and fleet error/silent counts, delegated whole to System::Platform::CompositeHealthProbe. Every subsystem gets its own entry; a subsystem that could not be observed reports not_measured, never ok. Use this skill when the operator asks whether the platform itself is healthy, degraded or down.

  • Class: System::Ai::Skills::PlatformHealthCheckExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/platform_health_check_executor.rb
  • Category: devops

  Outputs

  • action: string
  • data: object
  • recommendations: array

  platform_maintenance

  Routine platform maintenance — certificate renewal, drift checks. Use this skill when the operator asks about (a) which certs are expiring soon, (b) whether they should rotate something, or (c) whether any instances have drifted from the modules their node is assigned. For the composite platform health answer, use platform_health_check instead.

  • Class: System::Ai::Skills::PlatformMaintenanceExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/platform_maintenance_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  action	string	Yes	One of: cert_status, cert_rotate, drift_check, health_check
  certificate_id	string	No	Cert id (only for cert_rotate of a specific row; omit to rotate all expiring)
  deployment_id	string	No	PlatformDeployment id (for drift_check; omit to scan all deployments)
  renewal_window_days	integer	No	How many days ahead to consider a cert 'expiring soon' (cert_status / cert_rotate)

  Outputs

  • action: string
  • data: object
  • recommendations: array

  platform_resilience

  Platform incident response — cordon and stop an instance, scale a deployment up/down (this action and the Scaling panel's PATCH both reconcile the live replica count after writing target_replicas; the GitOps bridge still only records it), or triage peer/instance health. Use this skill when the operator describes a stress event (instance misbehaving, capacity pressure, peer heartbeats stale) or asks 'what should I do about X'.

  • Class: System::Ai::Skills::PlatformResilienceExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/platform_resilience_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  action	string	Yes	One of: drain_instance, scale, failover_check
  instance_id	string	No	NodeInstance id (required for drain_instance)
  deployment_id	string	No	PlatformDeployment id (required for scale)
  direction	string	No	scale direction: set
  target_replicas	integer	No	When direction=set, the new target_replicas value

  Outputs

  • action: string
  • data: object
  • recommendations: array

  provision_cluster

  Provision N instances of a Template in a region — composes create_node + provision_instance for each

  • Class: System::Ai::Skills::ProvisionClusterExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/provision_cluster_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  template_id	string	Yes	-
  count	integer	Yes	Number of nodes/instances to spin up (1-50)
  provider_region_id	string	Yes	-
  provider_instance_type_id	string	Yes	-
  name_prefix	string	No	Prefix for node names (default: "node")
  dry_run	boolean	No	Plan only — return projected actions without creating resources

  Outputs

  • dry_run: boolean
  • count: integer
  • created_nodes: array
  • provisioned: array
  • outputs: {:node_ids=>[:string], :node_instance_ids=>[:string]}
  • failures: array
  • partial: boolean

  provision_full_stack

  Provision a full compute+network+storage stack from a template — composes provision_instance + optional storage volume + optional SDWAN peer enrollment

  • Class: System::Ai::Skills::ProvisionFullStackExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/provision_full_stack_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  template_id	string	Yes	System::NodeTemplate to instantiate
  count	integer	Yes	Number of node instances to provision (1-50)
  provider_region_id	string	Yes	System::ProviderRegion target
  provider_instance_type_id	string	Yes	System::ProviderInstanceType for each instance
  network_id	string	No	Sdwan::Network — when present, every instance this step provisions is enrolled onto the network and the NEW peer ids are returned
  with_storage_gb	integer	No	When present, provision a per-instance ProviderVolume of this size
  dry_run	boolean	No	Plan only — return projected actions without creating any cloud resources

  Outputs

  • dry_run: boolean
  • count: integer
  • planned_actions: array
  • outputs: {:node_ids=>[:string], :node_instance_ids=>[:string], :sdwan_peer_ids=>[:string], :storage_volume_ids=>[:string]}
  • failures: array
  • partial: boolean

  relocate_workload

  Relocate a project's compute workload from one region to another via blue/green or drain cutover. Composes ProvisionFullStackExecutor (target) + ProvisioningService.terminate_instance (source).

  • Class: System::Ai::Skills::RelocateWorkloadExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/relocate_workload_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  project_id	string	Yes	Ai::Mission id (the provisioning project being relocated)
  from_region_id	string	Yes	System::ProviderRegion the workload is leaving (audit hint, no lookup)
  to_region_id	string	Yes	System::ProviderRegion the workload is moving to (target for new stack)
  cutover_strategy	string	Yes	One of: blue_green, drain
  template_id	string	Yes	System::NodeTemplate to instantiate at the target region
  provider_instance_type_id	string	Yes	Instance type for the target stack
  count	integer	Yes	Number of new instances to bring up at the target (1-50)
  source_instance_ids	array	Yes	System::NodeInstance ids in the source region to terminate during cutover
  network_id	string	No	Sdwan::Network — when present, target instances are wired into the SDWAN topology and peer ids returned
  with_storage_gb	integer	No	When present, provision a per-instance ProviderVolume of this size at the target
  dry_run	boolean	No	Plan only — return projected actions without provisioning or terminating

  Outputs

  • dry_run: boolean
  • count: integer
  • cutover_strategy: string
  • planned_actions: array
  • outputs: {:node_ids=>[:string], :node_instance_ids=>[:string], :sdwan_peer_ids=>[:string], :storage_volume_ids=>[:string], :terminated_instance_ids=>[:string]}
  • failures: array
  • partial: boolean

  restore_volume

  Restore a ProviderVolume from one of its completed snapshots. Read restored_in_place in the outputs: true means the volume was rolled back and writes made since the snapshot are DISCARDED; false means the provider copied the snapshot into a new volume (restored_volume_id) and the source volume is unchanged — pass swap_into_place to have the copy swapped onto the source's instance and device (swapped in the outputs). Optionally takes a fresh snapshot first so the pre-restore state stays recoverable. Refuses on providers with no snapshot or no restore primitive rather than reporting a restore that did not happen.

  • Class: System::Ai::Skills::RestoreVolumeExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/restore_volume_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  snapshot_id	string	Yes	System::ProviderVolumeSnapshot to restore from (must be status 'completed')
  take_snapshot_first	boolean	No	Snapshot the volume's CURRENT state before restoring, so the pre-restore data stays recoverable
  swap_into_place	boolean	No	Copy-restore only: detach the source volume from its instance and attach the restored copy at the same device. Ignored on an in-place restore and when the source is not attached
  dry_run	boolean	No	Plan only — no snapshot, no restore, no swap

  Outputs

  • dry_run: boolean
  • count: integer
  • planned_actions: array
  • outputs: {:storage_volume_ids=>[:string], :restored_from_snapshot_id=>:string, :pre_restore_snapshot_id=>:string, :restored_in_place=>:boolean, :restored_volume_id=>:string, :swapped=>:boolean}
  • failures: array
  • partial: boolean

  reverse_proxy_compose

  Regenerate the reverse-proxy (Traefik) dynamic config for a certificate's account. Use this skill when an operator wants a valid certificate's HTTPS routers brought online (or refreshed) in the reverse proxy — it re-emits the account's dynamic YAML from its valid certs; Traefik file-watches and reloads automatically.

  • Class: System::Ai::Skills::ReverseProxyComposeExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/reverse_proxy_compose_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  certificate_id	string	Yes	AcmeCertificate id (must be status=valid) whose account's reverse-proxy config to regenerate

  Outputs

  • certificate_id: string
  • common_name: string
  • status: string
  • dynamic_config_path: string
  • routers_configured: integer
  • local_services_path: string
  • local_services_configured: integer

  rolling_module_upgrade

  Size a FLEET-ATOMIC module upgrade for a NodeModule across all instances of a Template. The upgrade cannot be staged or batched: the served version resolves from a per-MODULE pointer (NodeModule#current_version_id), so every instance carrying the module converges together. PLAN ONLY — the plan is NOT executed; nothing in the platform moves the pointer from this plan. See the class doc for the manual procedure and for real staging options.

  • Class: System::Ai::Skills::RollingModuleUpgradeExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/rolling_module_upgrade_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  template_id	string	Yes	-
  module_id	string	Yes	-
  target_version_id	string	Yes	-
  max_consecutive_failures	integer	No	NOT IMPLEMENTED — echoed into the returned circuit_breaker hash and read by nothing
  health_timeout_sec	integer	No	NOT IMPLEMENTED — echoed into the returned circuit_breaker hash and read by nothing

  Outputs

  • total_instances: integer
  • affected_instance_ids: array
  • estimated_total_seconds: integer
  • circuit_breaker: object
  • by_environment: object
  • blast_radius_ceiling_exceeded: boolean

  scale_project

  Adapt a provisioning project's footprint — add replicas in-region, remove the newest replicas, plan a vertical resize, or expand into a new region. Composes ProvisionFullStackExecutor + RollingModuleUpgradeExecutor.

  • Class: System::Ai::Skills::ScaleProjectExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/scale_project_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  project_id	string	Yes	Ai::Mission id (the provisioning project being scaled)
  target_count	integer	Yes	Number of instances to add (add_replicas / add_region) or remove (remove_replicas) — bounded 1..50. Ignored for vertical_resize.
  scaling_strategy	string	Yes	One of: add_replicas, vertical_resize, add_region, remove_replicas
  template_id	string	No	System::NodeTemplate to instantiate (add_replicas / add_region) or whose fleet is being resized (vertical_resize)
  provider_region_id	string	No	Region for new instances (add_replicas: same as project; add_region: NEW region)
  provider_instance_type_id	string	No	Instance type for new instances
  module_id	string	No	vertical_resize: System::NodeModule whose target_version replaces in-place
  target_version_id	string	No	vertical_resize: target System::NodeModuleVersion id
  network_id	string	No	add_region: optional Sdwan::Network to attach new instances to
  with_storage_gb	integer	No	add_region: optional per-instance volume size
  name_prefix	string	No	Blast-radius marker. add_replicas/add_region stamp it onto new node names; remove_replicas refuses any victim whose name lacks it (hard error). Defaults to the mission's own prefix — when the mission declares none the rail is not applied, and outputs.prefix_enforced says so.
  dry_run	boolean	No	Plan only — return projected actions without creating any cloud resources

  Outputs

  • dry_run: boolean
  • count: integer
  • scaling_strategy: string
  • planned_actions: array
  • outputs: {:node_ids=>[:string], :node_instance_ids=>[:string], :sdwan_peer_ids=>[:string], :storage_volume_ids=>[:string], :rolling_upgrade_plan=>:object, :sdwan_service_ids=>[:string], :sdwan_service_backend_ids=>[:string], :removed_node_instance_ids=>[:string], :detached_sdwan_peer_ids=>[:string], :deleted_storage_volume_ids=>[:string], :removed_sdwan_service_backend_ids=>[:string], :orphans=>[:object], :floor_reached=>:boolean, :prefix_enforced=>:string}
  • failures: array
  • partial: boolean

  sdwan_compose_full_topology

  Orchestrate the three SDWAN composition primitives (HostBridge, OVN, IPFIX) in one tool call. Composes SdwanHostBridgeComposeExecutor + SdwanOvnComposeTopologyExecutor + SdwanIpfixCollectorComposeExecutor.

  • Class: System::Ai::Skills::SdwanComposeFullTopologyExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/sdwan_compose_full_topology_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  host_node_instance_ids	array	Yes	System::NodeInstance ids — passed through to host_bridge_compose
  kind	string	No	Optional explicit bridge kind override (linux
  ovn_topology	object	No	Optional OVN composition payload: {nb_db_endpoint, sb_db_endpoint, northd_host?, switches} — when supplied, runs sdwan_ovn_compose_topology
  ipfix_collector	object	No	Optional IPFIX collector payload: {name, host, port, sampling_rate?} — when supplied, runs sdwan_ipfix_collector_compose
  dry_run	boolean	No	Plan only — invokes each sub-skill in dry_run mode

  Outputs

  • dry_run: boolean
  • planned_actions: array
  • outputs: {:host_bridges=>:object, :ovn=>:object, :ipfix=>:object}
  • failures: array
  • partial: boolean

  sdwan_host_bridge_compose

  Allocate per-host SDWAN bridges (Linux for lightweight profile, OVS for heavyweight) for a set of NodeInstances. Composes Sdwan::HostBridgeAllocator. Idempotent.

  • Class: System::Ai::Skills::SdwanHostBridgeComposeExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/sdwan_host_bridge_compose_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  host_node_instance_ids	array	Yes	System::NodeInstance ids to allocate bridges for (1-100)
  kind	string	No	Optional explicit bridge kind override: linux
  dry_run	boolean	No	Plan only — no Sdwan::HostBridge rows are persisted

  Outputs

  • dry_run: boolean
  • bridge_count: integer
  • planned_actions: array
  • outputs: {:host_bridge_ids=>[:string], :allocations=>[:object]}
  • failures: array
  • partial: boolean

  sdwan_ipfix_collector_compose

  Register an IPFIX collector for an account so the topology compiler can stamp ipfix exporter config onto every heavyweight (ovs-kind) HostBridge in the per-host payload. Idempotent on (account, name). Composes Sdwan::IpfixCollector.

  • Class: System::Ai::Skills::SdwanIpfixCollectorComposeExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/sdwan_ipfix_collector_compose_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  name	string	Yes	Display name for the collector — unique per account; reused on re-execution
  host	string	Yes	Collector host (IPv4, IPv6, or hostname). IPv6 addresses are bracketed automatically when emitted to ovs-vsctl.
  port	integer	Yes	Collector UDP port (1-65535)
  sampling_rate	integer	No	Sampling rate (1 = export every flow). Ignored when re-using an existing collector.
  dry_run	boolean	No	Plan only — no Sdwan::IpfixCollector row is persisted

  Outputs

  • dry_run: boolean
  • planned_actions: array
  • outputs: {:ipfix_collector_id=>:string, :created=>:boolean, :name=>:string, :target_endpoint=>:string, :sampling_rate=>:integer, :state=>:string, :is_winning_collector=>:boolean}
  • failures: array
  • partial: boolean

  sdwan_ovn_apply_acl

  Apply OVN ACLs (firewall rules) to a logical switch — heavyweight-profile only. Composes Sdwan::OvnAcl entries scoped to one switch and re-compiles the deployment plan. Idempotent on (switch, acl_name).

  • Class: System::Ai::Skills::SdwanOvnApplyAclExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/sdwan_ovn_apply_acl_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  logical_switch_id	string	Yes	Sdwan::OvnLogicalSwitch id the ACLs apply to (must belong to the executing account)
  acls	array	Yes	Array of {name, direction, priority?, match, action} (1-100). direction: from-lport
  dry_run	boolean	No	Plan only — no Sdwan::OvnAcl rows are persisted

  Outputs

  • dry_run: boolean
  • acl_count: integer
  • planned_actions: array
  • outputs: {:logical_switch_id=>:string, :ovn_acl_ids=>[:string], :allocations=>[:object], :compiled_plan=>:object}
  • failures: array
  • partial: boolean

  sdwan_ovn_compose_topology

  Compose an OVN logical-network topology (deployment + logical switches + ports) for a heavyweight-profile account, then compile the ovn-nbctl plan. Composes Sdwan::OvnDeployment + Sdwan::OvnLogicalSwitch + Sdwan::OvnLogicalSwitchPort + Sdwan::OvnCompiler.

  • Class: System::Ai::Skills::SdwanOvnComposeTopologyExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/sdwan_ovn_compose_topology_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  switches	array	Yes	Array of {name, cidr?, ports: [{name, kind, addresses?, host_node_instance_id?}]} (1-50)
  nb_db_endpoint	string	No	OVN NB DB endpoint (e.g., tcp:127.0.0.1:6641) — required only when the account has no OvnDeployment yet
  sb_db_endpoint	string	No	OVN SB DB endpoint (e.g., tcp:127.0.0.1:6642) — required only when the account has no OvnDeployment yet
  northd_host	string	No	Advisory hint for which host runs ovn-northd — only used when creating a new deployment
  dry_run	boolean	No	Plan only — no Sdwan rows are persisted

  Outputs

  • dry_run: boolean
  • switch_count: integer
  • port_count: integer
  • planned_actions: array
  • outputs: {:ovn_deployment_id=>:string, :created_deployment=>:boolean, :logical_switch_ids=>[:string], :logical_switch_port_ids=>[:string], :compiled_plan=>:object}
  • failures: array
  • partial: boolean

  service_discovery_composer

  Make a backend service discoverable across the fleet over the SDWAN overlay end-to-end — provisions a Virtual IP (auto-advertised via iBGP for in-overlay discovery), publishes a VIP-backed federation service-catalog offering for federated peers, regenerates the local Traefik routes, and OPTIONALLY publishes a public DNS record (A/AAAA/CNAME) for internet-facing names. Use this when an operator asks to 'make discoverable', 'publish to the service catalog', or 'advertise to other sites'.

  • Class: System::Ai::Skills::ServiceDiscoveryComposerExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/service_discovery_composer_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  service_name	string	Yes	Human-readable name of the service (catalog display name)
  service_slug	string	Yes	Lowercase-alphanumeric-hyphen slug — the catalog's natural key (also names the VIP). e.g. 'orders-api'
  sdwan_network_id	string	Yes	SDWAN network the VIP lives in
  backend_peer_id	string	Yes	Sdwan::Peer that hosts the service; seated as the VIP's primary holder (and thus the iBGP advertiser)
  backend_port	integer	Yes	Port the backend service listens on (advertised in the catalog offering)
  vip_cidr	string	Yes	Operator-supplied host CIDR for the VIP (a /128 v6 or /32 v4) within the SDWAN network's /64
  protocol	string	No	Service protocol advertised in the catalog: one of https, http, tcp, tls
  grant_scopes	array	No	Default FederationGrant scopes subscribers receive (subset of read, write, admin, migrate). Defaults to ['read']
  grant_ttl_days	integer	No	Default grant TTL in days (>= 7). Defaults to the offering default
  traefik_dynamic_dir	string	No	Override for the Traefik dynamic-config directory (defaults to /etc/traefik/dynamic)
  public_dns	object	No	INTERNET-FACING name only: { dns_credential_id, record_name, record_type? (A

  Outputs

  • service_slug: string
  • vip_id: string
  • vip_cidr: string
  • vip_address: string
  • offering_id: string
  • offering_slug: string
  • route_output_path: string
  • route_count: integer
  • dns_record_id: string
  • dns_record_fqdn: string
  • public_dns_published: boolean
  • steps_completed: array
  • warnings: array

  suggest_architectures_for_fleet

  Suggest which canonical architectures to materialize a package for, based on the current fleet's NodePlatform coverage and the repository's served architectures.

  • Class: System::Ai::Skills::SuggestArchitecturesForFleetExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/suggest_architectures_for_fleet_executor.rb
  • Category: devops

  Inputs

  Field	Type	Required	Description
  repository_id	string	Yes	PackageRepository.id whose architectures bound the suggestion set
  max_suggestions	integer	No	Cap on the number of suggested arches (1-7)

  Outputs

  • repository_id: string
  • suggested: array
  • rationale: array
  • fallback: boolean
  • confidence: string

  ---

  Documentation

  runbook_generate

  Generate a markdown operational runbook for a NodeTemplate — boot order, common failure modes, recovery procedures

  • Class: System::Ai::Skills::RunbookGenerateExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/runbook_generate_executor.rb
  • Category: documentation

  Inputs

  Field	Type	Required	Description
  template_id	string	Yes	-
  persist_as_page	boolean	No	Save the result as a Pages document so it's reachable via list_pages

  Outputs

  • runbook_markdown: string
  • section_count: integer
  • persisted_page_id: string
  • source_artifacts: object

  ---

  Federation

  federation_acceptance

  Complete a federation handshake from a single-use acceptance token — runs the full accept chain (accept transition, platform enroll, managed-child operator grant, node_api bootstrap-token issuance, SDWAN overlay attach, and a federation governance health scan). Use when an operator wants to finish peering with a proposed federation peer whose acceptance token they hold.

  • Class: System::Ai::Skills::FederationAcceptanceExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/federation_acceptance_executor.rb
  • Category: federation

  Inputs

  Field	Type	Required	Description
  acceptance_token	string	Yes	The single-use acceptance token plaintext (from the propose step). Consumed on success.
  contract_version	integer	Yes	Contract version to agree on. Must be one of the supported versions (currently [1]).
  capabilities	object	No	Forward-compat capability advertisement exchanged with the peer.
  extension_slugs	array	No	Extension slugs the peer carries (e.g. ['trading']).
  endpoints	array	No	Peer endpoints: array of { url, scope, priority, cidr_hint? }.

  Outputs

  • peer_id: string
  • status: string
  • peer_kind: string
  • contract_version_agreed: integer
  • accepted_at: string
  • handshake_at: string
  • node_enrollment: object
  • sdwan_attach: object
  • governance: object
  • warnings: array

  federation_manager

  Survey federation peer + grant + cert health for an account and surface findings the operator (or a future autonomy loop) should action.

  • Class: System::Ai::Skills::FederationManagerExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/federation_manager_executor.rb
  • Category: federation

  Outputs

  • account_id: string
  • ran_at: string
  • cert_rotation_candidates: array
  • grants_approaching_expiry: array
  • grants_overdue_for_review: array
  • broad_scope_grants: array
  • capability_drift: array
  • finding_count: integer

  federation_peer_remediate

  Remediate a stale or cert-expiring federation peer: re-handshake a stale peer over mTLS (recovering it if reachable), degrade an unreachable active peer, or alert the operator that a federation cert needs an operator-driven rotation. Invoked by the fleet DecisionEngine off the FederationPeerLivenessSensor.

  • Class: System::Ai::Skills::FederationPeerRemediateExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/federation_peer_remediate_executor.rb
  • Category: federation

  Inputs

  Field	Type	Required	Description
  federation_peer_id	string	Yes	System::FederationPeer to remediate
  reason	string	No	Liveness failure class from the sensor: heartbeat_stale
  dry_run	boolean	No	Plan-only mode — report the action that would be taken without probing, degrading, or alerting

  Outputs

  • remediated: boolean
  • action: string
  • reason: string
  • federation_peer_id: string
  • peer_status: string
  • reachable: boolean
  • detail: string

  multi_tenant_isolation

  Provision a fully-isolated SDWAN network slice for a single tenant inside the account: a dedicated overlay network with its own VRF + isolated iBGP RIB (no shared routing table), a non-overlapping /64 (Sdwan::PrefixAllocator), default-deny nftables firewall rules scoped to the tenant CIDR, an OVN logical switch, and tenant-CIDR OVN ACLs. Composes Sdwan::Network + Sdwan::PrefixAllocator + Sdwan::FirewallRule + SdwanOvnComposeTopologyExecutor + SdwanOvnApplyAclExecutor. SDWAN-native — no k8s NetworkPolicy, no VLAN. Use when an operator asks to 'isolate tenant ', 'give its own segregated network', or 'stand up a blast-radius boundary for '.

  • Class: System::Ai::Skills::MultiTenantIsolationExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/multi_tenant_isolation_executor.rb
  • Category: federation

  Inputs

  Field	Type	Required	Description
  tenant_key	string	Yes	Stable tenant identifier within the account (slug-safe; used to name the network, firewall rules, OVN switch, and ACLs). e.g. 'acme-prod'.
  network_name	string	No	Display name for the tenant's Sdwan::Network (defaults to 'tenant-<tenant_key>').
  tenant_cidr	string	No	Explicit tenant CIDR for the firewall + ACL selectors. When omitted, the /64 auto-allocated for the new network (PrefixAllocator) is used — the recommended path.
  nb_db_endpoint	string	No	OVN NB DB endpoint (e.g. tcp:127.0.0.1:6641) — required only when the account has no Sdwan::OvnDeployment yet.
  sb_db_endpoint	string	No	OVN SB DB endpoint (e.g. tcp:127.0.0.1:6642) — required only when the account has no Sdwan::OvnDeployment yet.
  ovn_switch_name	string	No	Override the OVN logical switch name (defaults to 'ls-tenant-<tenant_key>').
  dry_run	boolean	No	Plan only — no Sdwan rows are persisted.

  Outputs

  • dry_run: boolean
  • tenant_key: string
  • tenant_cidr: string
  • planned_actions: array
  • outputs: {:sdwan_network_id=>:string, :sdwan_network_handle=>:string, :vrf_name=>:string, :tenant_cidr=>:string, :firewall_rule_ids=>[:string], :ovn_deployment_id=>:string, :ovn_logical_switch_id=>:string, :ovn_acl_ids=>[:string], :ovn_acl_allocations=>[:object]}
  • failures: array
  • partial: boolean

  sdwan_federation_compose

  Stand up a federation overlay topology (hub-and-spoke OR full-mesh) by composing per-peer Sdwan::PeerEnroller + Sdwan::TopologyCompiler + Sdwan::Bgp::RoutePolicyCompiler. Creates one Sdwan::Network, enrolls each member as a peer (hubs publicly_reachable), and compiles the per-peer WireGuard + FRR route-policy envelope.

  • Class: System::Ai::Skills::SdwanFederationComposeExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/sdwan_federation_compose_executor.rb
  • Category: federation

  Inputs

  Field	Type	Required	Description
  network_name	string	Yes	Display name for the new federation Sdwan::Network
  topology	string	Yes	One of: hub_and_spoke, full_mesh
  peers	array	Yes	Member descriptors (1-200). Each: {node_instance_id (required), role: 'hub'
  routing_protocol	string	No	One of: static, ibgp — 'ibgp' enables FRR route-policy distribution
  dry_run	boolean	No	Plan only — no Sdwan::Network/Peer rows are persisted

  Outputs

  • dry_run: boolean
  • count: integer
  • topology: string
  • routing_protocol: string
  • planned_actions: array
  • outputs: {:sdwan_network_id=>:string, :sdwan_peer_ids=>[:string], :hub_peer_ids=>[:string], :topology_preview=>[:object], :route_policy_preview=>[:object]}
  • failures: array
  • partial: boolean

  ---

  Fleet

  architecture_create

  Directly create a custom (non-canonical) architecture. Requires system.architectures.manage; surfaces for operator approval via intervention policy.

  • Class: System::Ai::Skills::ArchitectureCreateExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/architecture_create_executor.rb
  • Category: fleet

  Inputs

  Field	Type	Required	Description
  name	string	Yes	-
  family	string	Yes	-
  apt_name	string	No	-
  rpm_name	string	No	-
  display_name	string	No	-
  description	string	No	-
  enabled	boolean	No	-
  public	boolean	No	-

  Outputs

  • architecture: object

  architecture_delete

  Delete a non-canonical architecture. Fails if any NodePlatform still references it. Canonical rows are immutable and return an error.

  • Class: System::Ai::Skills::ArchitectureDeleteExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/architecture_delete_executor.rb
  • Category: fleet

  Inputs

  Field	Type	Required	Description
  architecture_id	string	Yes	-

  Outputs

  • deleted: boolean
  • architecture_id: string

  architecture_propose

  Propose adding a new architecture to the platform-wide catalog (creates an Ai::AgentProposal for human review).

  • Class: System::Ai::Skills::ArchitectureProposeExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/architecture_propose_executor.rb
  • Category: fleet

  Inputs

  Field	Type	Required	Description
  name	string	Yes	Canonical lowercase name (e.g. loongarch64, mips64el)
  family	string	Yes	One of: x86, arm, power, z, risc-v, mips, other
  apt_name	string	No	apt-style name (e.g. amd64 for x86_64)
  rpm_name	string	No	rpm-style name (matches name for most arches)
  display_name	string	No	-
  description	string	No	-
  justification	string	No	Why this arch is needed — surfaces in the approval UI

  Outputs

  • proposal_id: string
  • status: string
  • review_deadline: datetime

  architecture_update

  Update a non-canonical architecture's fields. Canonical rows are immutable and return an error.

  • Class: System::Ai::Skills::ArchitectureUpdateExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/architecture_update_executor.rb
  • Category: fleet

  Inputs

  Field	Type	Required	Description
  architecture_id	string	Yes	-
  attributes	object	Yes	Allowed: name, family, apt_name, rpm_name, display_name, description, kernel_options, enabled, public

  Outputs

  • architecture: object

  disk_image_promote

  Promote a published disk-image publication to its NodePlatform's active default — every instance provisioned on the platform afterwards boots from it; the previously active publication is retired in the same transaction

  • Class: System::Ai::Skills::DiskImagePromoteExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/disk_image_promote_executor.rb
  • Category: fleet

  Inputs

  Field	Type	Required	Description
  publication_id	string	Yes	System::DiskImagePublication.id — must be in status published

  Outputs

  • promoted: boolean
  • publication_id: string
  • node_platform_id: string
  • oci_ref: string
  • git_sha: string
  • previous_publication_id: string

  disk_image_retention

  Set a NodePlatform's disk-image retention count — how many publications the purge sweep keeps before soft-deleting older artifacts (1..50); reversible GC configuration

  • Class: System::Ai::Skills::DiskImageRetentionExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/disk_image_retention_executor.rb
  • Category: fleet

  Inputs

  Field	Type	Required	Description
  platform_id	string	Yes	System::NodePlatform.id
  retention_count	integer	Yes	Publications to keep, 1..50

  Outputs

  • updated: boolean
  • node_platform_id: string
  • retention_count: integer
  • previous_retention_count: integer

  disk_image_rollback

  Roll a NodePlatform's active disk image back to a prior publication — an explicit one, else the newest retired publication, else the newest published one that is not current; restores a retired artifact and retires the previously active publication in one transaction

  • Class: System::Ai::Skills::DiskImageRollbackExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/disk_image_rollback_executor.rb
  • Category: fleet

  Inputs

  Field	Type	Required	Description
  platform_id	string	Yes	System::NodePlatform.id whose active image is rolled back
  publication_id	string	No	Target System::DiskImagePublication.id; omitted = auto-select the prior publication

  Outputs

  • reverted: boolean
  • node_platform_id: string
  • activated_publication_id: string
  • previous_publication_id: string
  • previous_file_object_id: string

  promote_replica

  Promote a postgres streaming replica to primary after the primary is provider-confirmed down: cut the DB VIP over to the replica's SDWAN peer, fence the old primary, and dispatch the module-declared pg_ctl promote. Refuses a live primary outright and refuses an unknown or over-bound replication lag unless the operator accepts the data loss.

  • Class: System::Ai::Skills::PromoteReplicaExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/promote_replica_executor.rb
  • Category: fleet

  Inputs

  Field	Type	Required	Description
  peer_id	string	Yes	System::FederationPeer carrying the cluster_pg replication record (spawn_mode cluster_member)
  primary_instance_id	string	Yes	System::NodeInstance running postgres-primary — the LOST one
  replica_instance_id	string	Yes	System::NodeInstance running postgres-replica — the one to promote
  operation_id	string	Yes	Idempotency key — the promote is replayed if a FleetEvent already records it for this id
  virtual_ip_id	string	No	Restrict the cutover to ONE Sdwan::VirtualIp (default: every VIP the old primary's peers hold)
  reason	string	No	Classified reason from the sensor, carried onto every step event
  accept_data_loss	boolean	No	Waive the replication-lag bound. Waives NOTHING else — a live primary is refused regardless.
  dry_run	boolean	No	Plan only — report the safety verdict and what would move, without promoting

  Outputs

  • promoted: boolean
  • replayed: boolean
  • moved_virtual_ip_ids: array
  • promote_task_id: string
  • fence_command: string
  • fence_dispatched: boolean
  • data_loss_accepted: boolean
  • blocked: boolean

  reap_instance

  Terminate an unrecoverable NodeInstance whose workload has already been moved to a pooled replacement. The destructive half of a DR replace, gated separately from it.

  • Class: System::Ai::Skills::ReapInstanceExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/reap_instance_executor.rb
  • Category: fleet

  Inputs

  Field	Type	Required	Description
  instance_id	string	Yes	System::NodeInstance to terminate — the FAILED one, whose volumes/VIPs have already moved
  operation_id	string	Yes	The replace's idempotency key — the terminate is skipped if a FleetEvent already records it for this id
  reason	string	No	Classified reason from the unrecoverable sensor, carried onto the step event

  Outputs

  • reaped: boolean
  • failed_instance_id: string
  • removed_sdwan_service_backend_ids: array
  • stranded_sdwan_service_ids: array
  • replayed: boolean

  reap_orphan_pool_guest

  Destroy a provider guest named for an ephemeral instance pool that no platform row knows — a VM left behind when its record went. Re-checked against the provider inventory and name-verified at the terminate; parks in a protected plane.

  • Class: System::Ai::Skills::ReapOrphanPoolGuestExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/reap_orphan_pool_guest_executor.rb
  • Category: fleet

  Inputs

  Field	Type	Required	Description
  instance_pool_id	string	Yes	System::InstancePool the guest is named for (places the reap in that pool's plane)
  cloud_instance_id	string	Yes	Provider id the guest was listed under
  guest_name	string	Yes	The guest's name at the provider; nothing is destroyed unless the id still holds this guest
  provider_region_id	string	No	Region whose inventory listed the guest (one of the pool's regions); defaults to the pool's own region

  Outputs

  • reaped: boolean
  • already_gone: boolean
  • instance_pool_id: string
  • cloud_instance_id: string
  • guest_name: string

  replace_instance

  Replace an unrecoverable NodeInstance with a warm pool member: acquire the replacement, reattach its volumes, re-enrol it on every SDWAN network the failed one held (inheriting the failed peer's routing ROLE rather than the schema defaults, with the endpoint re-derived from the replacement's own address so a replacement hub is not left advertising the dead instance's), move its VIPs, and re-home every published Sdwan::Service that dialled the failed instance by address onto the replacement (the dead member is drained, not removed, until the reap). The terminate of the failed instance is a SEPARATE approval, performed by ReapInstanceExecutor.

  • Class: System::Ai::Skills::ReplaceInstanceExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/replace_instance_executor.rb
  • Category: fleet

  Inputs

  Field	Type	Required	Description
  instance_id	string	Yes	System::NodeInstance the platform classified unrecoverable
  operation_id	string	Yes	Idempotency key — every step is skipped if a FleetEvent already records it for this id
  pool_id	string	No	System::InstancePool to draw the replacement from (defaults to the failed instance's own pool)
  pool_name	string	No	Pool by name, when the failed instance is not itself a pool member
  reason	string	No	Classified reason from the unrecoverable sensor, carried onto every step event
  reap	boolean	No	Ask for the failed instance to be terminated. Handed to ReapInstanceExecutor under system.instance_reap as a second approval; this executor never terminates anything itself.
  dry_run	boolean	No	Plan only — report what would be moved without acquiring, attaching or enrolling

  Outputs

  • replacement_instance_id: string
  • reattached_volume_ids: array
  • enrolled_peer_ids: array
  • moved_virtual_ip_ids: array
  • rehomed_sdwan_service_ids: array
  • replayed_steps: array
  • pool_ready_count: integer
  • blocked: boolean
  • failures: array
  • partial: boolean
  • reaped: boolean
  • reap_decision: string

  ---

  Governance

  governance_gap_propose

  File (or update) the one reviewable improvement offer for a governance gap the fleet tick detected — a declared category nobody owns, an agent without skills, a lane bound to no skill, an executor without a catalog row, a missing lineage edge or delegation policy — and materialise the runtime-closable ones under the Platform Architect's gates

  • Class: System::Ai::Skills::GovernanceGapProposeExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/governance_gap_propose_executor.rb
  • Category: governance

  Inputs

  Field	Type	Required	Description
  gap	object	Yes	GovernanceGapSensor payload: gap_kind, subject, recommendation_type, summary, files, materialization
  fingerprint	string	Yes	The signal's fingerprint — the offer's dedup key
  severity	string	No	Signal severity (low
  dry_run	boolean	No	Report the plan; file and materialise nothing

  Outputs

  • offer_id: string
  • deduped: boolean
  • recommendation_type: string
  • materialization: object

  ---

  Sdwan

  sdwan_bgp_session_remediate

  Triage an unhealthy iBGP session; returns a plan with likely cause + recommended next step. v1 does NOT auto-restart FRR.

  • Class: System::Ai::Skills::SdwanBgpSessionRemediateExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/sdwan_bgp_session_remediate_executor.rb
  • Category: sdwan

  Inputs

  Field	Type	Required	Description
  bgp_session_id	string	No	-
  peer_id	string	No	Local peer (resolves session via peer_id + neighbor_address)
  neighbor_address	string	No	-
  dry_run	boolean	No	-

  Outputs

  • resolved: boolean
  • session_id: string
  • state: string
  • likely_cause: string
  • recommended_action: string

  sdwan_credential_refresh

  Re-issue an SDWAN peer's expiring membership credential server-side, without touching the WireGuard keypair

  • Class: System::Ai::Skills::SdwanCredentialRefreshExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/sdwan_credential_refresh_executor.rb
  • Category: sdwan

  Inputs

  Field	Type	Required	Description
  peer_id	string	Yes	Sdwan::Peer whose membership credential is expiring
  dry_run	boolean	No	Plan-only mode — report the current credential and whether a refresh would issue

  Outputs

  • resolved: boolean
  • membership_credential_id: string
  • revision: integer
  • not_after: string

  sdwan_failover

  Plan an SDWAN hub failover for an unreachable network; identifies promotion candidates without auto-flipping

  • Class: System::Ai::Skills::SdwanFailoverExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/sdwan_failover_executor.rb
  • Category: sdwan

  Inputs

  Field	Type	Required	Description
  network_id	string	Yes	-
  dry_run	boolean	No	v1 only supports dry_run=true — auto-promotion deferred

  Outputs

  • resolved: boolean
  • network_id: string
  • current_hub_count: integer
  • candidates: {:peer_id=>:string, :endpoint_host=>:string, :endpoint_port=>:integer, :last_handshake_at=>:string}

  sdwan_peer_remediate

  Rotate an SDWAN peer's keypair and force the agent to re-establish its tunnel on next reconcile

  • Class: System::Ai::Skills::SdwanPeerRemediateExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/sdwan_peer_remediate_executor.rb
  • Category: sdwan

  Inputs

  Field	Type	Required	Description
  peer_id	string	Yes	Sdwan::Peer to remediate
  dry_run	boolean	No	Plan-only mode — return what would happen without rotating keys

  Outputs

  • resolved: boolean
  • rotated_from_key_id: string
  • new_key_id: string
  • new_public_key: string

  sdwan_vip_failover

  Promote the next failover candidate of a silent-holder Sdwan::VirtualIp. Anycast VIPs return informational only.

  • Class: System::Ai::Skills::SdwanVipFailoverExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/sdwan_vip_failover_executor.rb
  • Category: sdwan

  Inputs

  Field	Type	Required	Description
  virtual_ip_id	string	Yes	-
  dry_run	boolean	No	-

  Outputs

  • resolved: boolean
  • virtual_ip_id: string
  • previous_holder_peer_id: string
  • new_holder_peer_id: string
  • anycast: boolean

  ---

  Security

  cve_remediation_orchestration

  Orchestrate the full CVE → exposure → rebuild → rolling-upgrade chain for one CVE

  • Class: System::Ai::Skills::CveRemediationOrchestrationExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/cve_remediation_orchestration_executor.rb
  • Category: security

  Inputs

  Field	Type	Required	Description
  cve_id	string	Yes	Canonical CVE id, e.g. CVE-2026-12345
  severity	string	No	critical
  affected_module_ids	array	No	Optional pre-resolved list of module ids — when omitted, derived from CveExposure rows
  exposure_ids	array	No	Optional list of CveExposure ids to transition to remediating

  Outputs

  • cve_id: string
  • triage: object
  • refresh_dispatches: array
  • rolling_upgrade_plans: array
  • exposures_remediating: integer
  • remediation_dispatched: boolean
  • skipped_modules: array
  • skipped_reason: string

  cve_response

  Triage a CVE entry against the fleet — enumerates exposure, scores risk, proposes a remediation plan

  • Class: System::Ai::Skills::CveResponseExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/cve_response_executor.rb
  • Category: security

  Inputs

  Field	Type	Required	Description
  cve_id	string	Yes	Canonical CVE id, e.g. CVE-2026-12345
  severity	string	Yes	critical
  affected_packages	array	Yes	[{name: 'openssl', version: '<3.1.4'}, ...]
  summary	string	No	-
  persist	boolean	No	Persist computed CveExposure rows instead of only returning the keyword-overlap stub (IMP-702d27f2d384 — was accepted by #perform but missing here)

  Outputs

  • cve_id: string
  • severity: string
  • risk_score: integer
  • exposed_modules: array
  • exposed_instance_count: integer
  • remediation_plan: object
  • requires_approval: boolean

  cve_runbook_generate

  Generate a markdown remediation runbook for a CVE — exposed modules, recommended steps, verification commands

  • Class: System::Ai::Skills::CveRunbookGenerateExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/cve_runbook_generate_executor.rb
  • Category: security

  Inputs

  Field	Type	Required	Description
  cve_id	string	Yes	Canonical CVE id, e.g. CVE-2026-12345
  persist_as_page	boolean	No	Save the runbook as a Pages document so it's reachable via list_pages

  Outputs

  • runbook_markdown: string
  • cve_id: string
  • exposed_module_count: integer
  • exposed_instance_count: integer
  • risk_score: integer
  • requires_approval: boolean
  • persisted_page_id: string

  ---

  System

  platform_deploy

  Deploy a new Powernode platform. Pass mode='standalone' for a sovereign platform. With no params, returns a wizard payload describing the form the operator should fill in. mode='federated' is NOT available here — it mints a single-use acceptance token that this surface cannot deliver; operators deploy federated platforms over POST /api/v1/system/platform/deployments, which reveals the token once in its HTTP response.

  • Class: System::Ai::Skills::PlatformDeployExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/platform_deploy_executor.rb
  • Category: system

  Inputs

  Field	Type	Required	Description
  mode	string	No	Deployment mode: standalone. Omit to receive a wizard payload. 'federated' is refused here with the operator path to use instead.
  name	string	No	Human-readable name for the new platform / deployment.
  template_slug	string	No	NodeTemplate slug to use (default: powernode-hub).
  parent_url	string	No	Federated-only — reachable URL of THIS platform that the child posts back to. Supply it on the operator API path; federated mode is refused here.
  spawn_mode	string	No	Federated-only — one of: managed_child, autonomous_peer, cluster_member. Supply it on the operator API path; federated mode is refused here.
  region	string	No	Optional provider region preference.
  instance_size	string	No	Optional provider instance type preference.
  service_role	string	No	Service role for the PlatformDeployment row (default: api).
  public_dns_hostname	string	No	Optional public DNS hostname for the new platform.

  Outputs

  • ok: boolean
  • card: object
  • deployment: object

  ---