Skip to content

SKILL_EXECUTOR_CATALOG.md

Latest commit

 

History

History
1105 lines (793 loc) · 48.3 KB

SKILL_EXECUTOR_CATALOG.md

File metadata and controls

1105 lines (793 loc) · 48.3 KB

Skill Executor Catalog — System Extension (Auto-Generated)

Auto-generated by rails system:skills:generate_catalog on 2026-05-17 13:19 UTC. Source: descriptor() class methods on extensions/system/server/app/services/system/ai/skills/*_executor.rb. Do NOT edit by hand — re-run the rake task instead.

40 executors across 7 categories.

For architecture context (agent bindings, plan vs. execute pattern, invocation surfaces), see SKILL_EXECUTORS.md.

Table of Contents

Devops (26)

  • attach_storage — Provision a cloud volume, attach it to a running NodeInstance, and mount it at the requested path. Composes VolumeManagementService.provision/attach + SshExecutionService for filesystem setup.
  • attribute_failure — Given a failed NodeInstance, rank recent module changes + promotions by likelihood of being the cause
  • capacity_recommend — Recommend instance count or instance-type adjustments for a Template's fleet based on heartbeat health and assignment density
  • configure_sdwan_for_project — Create an SDWAN network for a project, attach the supplied instances as peers, optionally provision a project VIP, and compile the topology preview. Composes Sdwan::Network + Sdwan::PeerEnroller + Sdwan::VirtualIp + Sdwan::TopologyCompiler.
  • deploy_app_code — Deploy a Git repository onto a provisioned NodeInstance via SSH+systemd
  • discover_packages_by_intent — Intent-based package discovery — describe a capability need ('reverse proxy', 'distributed cache') and get ranked packages from accessible repositories. Use system_search_packages instead when you already know the package name and just want filter/browse.
  • docker_provision — Provision a managed Docker daemon on a NodeInstance — auto-registers as a Devops::DockerHost bound to the SDWAN overlay /128
  • drift_remediate — Reconcile a NodeInstance's running modules against its assigned modules; returns a planned action set + estimated disruption %
  • list_package_repositories_summary — Summarize the package repositories configured for the operator's account — counts, kinds (apt/rpm/dnf), visibility (shared vs account), sync status. Use for 'how many package repos', 'what package sources', 'list my repositories', or similar inventory queries.
  • module_compose — Compose a Template draft from a workload description — keyword-matches modules and proposes a composition with conflict checks
  • package_module_create — Materialize an apt/rpm package + transitive dep closure as NodeModule rows + ModuleDependency edges, then dispatch a CI build
  • package_module_refresh — Re-materialize a NodeModule's source package when upstream drifts (replays persisted recommends_chosen for determinism)
  • package_repository_sync — Sync upstream apt/rpm metadata for one package repository (account-scoped or shared)
  • platform_maintenance — Routine platform maintenance — certificate renewal, drift checks, health snapshots. Use this skill when the operator asks about (a) which certs are expiring soon, (b) whether they should rotate something, (c) the current platform health, or (d) whether any instances have drifted from their template.
  • platform_resilience — Platform incident response — drain an instance, scale a deployment up/down, or triage peer/instance health. Use this skill when the operator describes a stress event (instance misbehaving, capacity pressure, peer heartbeats stale) or asks 'what should I do about X'.
  • provision_cluster — Provision N instances of a Template in a region — composes create_node + provision_instance for each
  • provision_full_stack — Provision a full compute+network+storage stack from a template — composes provision_instance + optional storage volume + optional SDWAN topology compile
  • relocate_workload — Relocate a project's compute workload from one region to another via blue/green or drain cutover. Composes ProvisionFullStackExecutor (target) + ProvisioningService.terminate_instance (source).
  • rolling_module_upgrade — Plan a batched rolling upgrade of a NodeModule across all instances of a Template, with circuit-breaker and health gating
  • scale_project — Adapt a provisioning project's footprint — add replicas in-region, plan a vertical resize, or expand into a new region. Composes ProvisionFullStackExecutor + RollingModuleUpgradeExecutor.
  • sdwan_compose_full_topology — Orchestrate the three SDWAN composition primitives (HostBridge, OVN, IPFIX) in one tool call. Composes SdwanHostBridgeComposeExecutor + SdwanOvnComposeTopologyExecutor + SdwanIpfixCollectorComposeExecutor.
  • sdwan_host_bridge_compose — Allocate per-host SDWAN bridges (Linux for lightweight profile, OVS for heavyweight) for a set of NodeInstances. Composes Sdwan::HostBridgeAllocator. Idempotent.
  • sdwan_ipfix_collector_compose — Register an IPFIX collector for an account so the topology compiler can stamp ipfix exporter config onto every heavyweight (ovs-kind) HostBridge in the per-host payload. Idempotent on (account, name). Composes Sdwan::IpfixCollector.
  • sdwan_ovn_apply_acl — Apply OVN ACLs (firewall rules) to a logical switch — heavyweight-profile only. Composes Sdwan::OvnAcl entries scoped to one switch and re-compiles the deployment plan. Idempotent on (switch, acl_name).
  • sdwan_ovn_compose_topology — Compose an OVN logical-network topology (deployment + logical switches + ports) for a heavyweight-profile account, then compile the ovn-nbctl plan. Composes Sdwan::OvnDeployment + Sdwan::OvnLogicalSwitch + Sdwan::OvnLogicalSwitchPort + Sdwan::OvnCompiler.
  • suggest_architectures_for_fleet — Suggest which canonical architectures to materialize a package for, based on the current fleet's NodePlatform coverage and the repository's served architectures.

Documentation (1)

  • runbook_generate — Generate a markdown operational runbook for a NodeTemplate — boot order, common failure modes, recovery procedures

Federation (1)

  • federation_manager — Survey federation peer + grant + cert health for an account and surface findings the operator (or a future autonomy loop) should action.

Fleet (4)

  • architecture_create — Directly create a custom (non-canonical) architecture. Requires system.architectures.manage; surfaces for operator approval via intervention policy.
  • architecture_delete — Delete a non-canonical architecture. Fails if any NodePlatform still references it. Canonical rows are immutable and return an error.
  • architecture_propose — Propose adding a new architecture to the platform-wide catalog (creates an Ai::AgentProposal for human review).
  • architecture_update — Update a non-canonical architecture's fields. Canonical rows are immutable and return an error.

Sdwan (4)

  • sdwan_bgp_session_remediate — Triage an unhealthy iBGP session; returns a plan with likely cause + recommended next step. v1 does NOT auto-restart FRR.
  • sdwan_failover — Plan an SDWAN hub failover for an unreachable network; identifies promotion candidates without auto-flipping
  • sdwan_peer_remediate — Rotate an SDWAN peer's keypair and force the agent to re-establish its tunnel on next reconcile
  • sdwan_vip_failover — Promote the next failover candidate of a silent-holder Sdwan::VirtualIp. Anycast VIPs return informational only.

Security (3)

  • cve_remediation_orchestration — Orchestrate the full CVE → exposure → rebuild → rolling-upgrade chain for one CVE
  • cve_response — Triage a CVE entry against the fleet — enumerates exposure, scores risk, proposes a remediation plan
  • cve_runbook_generate — Generate a markdown remediation runbook for a CVE — exposed modules, recommended steps, verification commands

System (1)

  • platform_deploy — Deploy a new Powernode platform. Pass mode='standalone' for a sovereign platform or mode='federated' for one that handshakes back with this platform on first boot. With no params, returns a wizard payload describing the form the operator should fill in.

Devops

attach_storage

Provision a cloud volume, attach it to a running NodeInstance, and mount it at the requested path. Composes VolumeManagementService.provision/attach + SshExecutionService for filesystem setup.

  • Class: System::Ai::Skills::AttachStorageExecutor
  • Source: extensions/system/server/app/services/system/ai/skills/attach_storage_executor.rb
  • Category: devops

Inputs

Field Type Required Description
instance_id string Yes System::NodeInstance to attach the volume to
size_gb integer Yes Volume size in GiB (1-16384)
volume_type string No Optional ProviderVolumeType name (e.g. 'gp3'); falls back to provider default when nil
mount_point string No Filesystem mount path on the instance
dry_run boolean No Plan only — no volume creation, no SSH

Outputs

  • dry_run: boolean
  • count: integer
  • planned_actions: array
  • outputs: {:node_instance_ids=>[:string], :storage_volume_ids=>[:string], :mount=>:object}
  • failures: array
  • partial: boolean

    • attribute_failure

    Given a failed NodeInstance, rank recent module changes + promotions by likelihood of being the cause

    • Class: System::Ai::Skills::AttributeFailureExecutor
    • Source: extensions/system/server/app/services/system/ai/skills/attribute_failure_executor.rb
    • Category: devops

    Inputs

    Field Type Required Description
    instance_id string Yes -
    lookback_hours integer No -

    Outputs

    • candidates: array
    • top_candidate: object
    • confidence: decimal
    • reasoning: string

      • capacity_recommend

      Recommend instance count or instance-type adjustments for a Template's fleet based on heartbeat health and assignment density

      • Class: System::Ai::Skills::CapacityRecommendExecutor
      • Source: extensions/system/server/app/services/system/ai/skills/capacity_recommend_executor.rb
      • Category: devops

      Inputs

      Field Type Required Description
      template_id string Yes -
      target_min_active integer No Minimum number of healthy active instances the fleet must maintain

      Outputs

      • template_id: string
      • total_count: integer
      • active_count: integer
      • silent_count: integer
      • errored_count: integer
      • recommendation: object
      • confidence: string

      configure_sdwan_for_project

      Create an SDWAN network for a project, attach the supplied instances as peers, optionally provision a project VIP, and compile the topology preview. Composes Sdwan::Network + Sdwan::PeerEnroller + Sdwan::VirtualIp + Sdwan::TopologyCompiler.

      • Class: System::Ai::Skills::ConfigureSdwanForProjectExecutor
      • Source: extensions/system/server/app/services/system/ai/skills/configure_sdwan_for_project_executor.rb
      • Category: devops

      Inputs

      Field Type Required Description
      project_id string Yes Ai::Mission id (the provisioning project receiving the overlay)
      instance_ids array Yes System::NodeInstance ids to enroll as peers (1-100)
      network_name string Yes Display name for the new Sdwan::Network
      topology string Yes One of: hub_and_spoke, mesh
      with_vip boolean No When true, provision a project-level VirtualIp held by the first peer
      vip_name string No Optional VIP name (defaults to '<network_name>-vip')
      vip_cidr string No VIP CIDR — required when with_vip is true (operator must provide a /128 in the network's /64)
      dry_run boolean No Plan only — no Sdwan::Network/Peer/VirtualIp rows are persisted

      Outputs

      • dry_run: boolean
      • count: integer
      • topology: string
      • planned_actions: array
      • outputs: {:sdwan_network_id=>:string, :sdwan_peer_ids=>[:string], :virtual_ip_id=>:string, :topology_preview=>[:object]}
      • failures: array
      • partial: boolean

        • deploy_app_code

        Deploy a Git repository onto a provisioned NodeInstance via SSH+systemd

        • Class: System::Ai::Skills::DeployAppCodeExecutor
        • Source: extensions/system/server/app/services/system/ai/skills/deploy_app_code_executor.rb
        • Category: devops

        Inputs

        Field Type Required Description
        node_instance_id string Yes Target System::NodeInstance.id (provisioned earlier in the plan)
        repo_url string Yes Git remote URL (https or ssh)
        branch string No Git branch to deploy
        start_command string No Command to run as the systemd ExecStart (e.g. 'npm start'). Inferred from repo if omitted.
        deploy_key_id string No Secret ID for a private repo deploy key (resolved by CodeDeployService)
        mission_id string No Auto-injected by PlanComposer — the Ai::Mission this deploy belongs to
        dry_run boolean No Plan only — return projected actions without touching the node

        Outputs

        • deployment_id: string
        • commit_sha: string
        • public_url: string

        discover_packages_by_intent

        Intent-based package discovery — describe a capability need ('reverse proxy', 'distributed cache') and get ranked packages from accessible repositories. Use system_search_packages instead when you already know the package name and just want filter/browse.

        • Class: System::Ai::Skills::DiscoverPackagesByIntentExecutor
        • Source: extensions/system/server/app/services/system/ai/skills/discover_packages_by_intent_executor.rb
        • Category: devops

        Inputs

        Field Type Required Description
        intent string Yes Free-text capability description — what the package should do
        repository_ids array No PackageRepository UUIDs to restrict the search to
        kind string No Repository kind filter — apt
        architectures array No Canonical arch names (amd64, arm64) to filter against — cross-kind expanded
        license string No Exact license string to require (e.g. 'MIT', 'Apache-2.0')
        top_k integer No Max results to return (1-50)

        Outputs

        • intent: string
        • results: array
        • seed_count: integer
        • confidence: string

        docker_provision

        Provision a managed Docker daemon on a NodeInstance — auto-registers as a Devops::DockerHost bound to the SDWAN overlay /128

        • Class: System::Ai::Skills::DockerProvisionExecutor
        • Source: extensions/system/server/app/services/system/ai/skills/docker_provision_executor.rb
        • Category: devops

        Inputs

        Field Type Required Description
        node_instance_id string Yes NodeInstance to provision (must already have an Sdwan::Peer with assigned overlay)
        dry_run boolean No Plan-only — return projected actions without creating the DockerHost row

        Outputs

        • dry_run: boolean
        • host_id: string
        • host_status: string
        • api_endpoint: string
        • already_provisioned: boolean
        • plan: object

        drift_remediate

        Reconcile a NodeInstance's running modules against its assigned modules; returns a planned action set + estimated disruption %

        • Class: System::Ai::Skills::DriftRemediateExecutor
        • Source: extensions/system/server/app/services/system/ai/skills/drift_remediate_executor.rb
        • Category: devops

        Inputs

        Field Type Required Description
        instance_id string Yes NodeInstance to reconcile
        max_disruption_pct integer No Disruption threshold above which the skill returns requires_approval=true

        Outputs

        • resolved: boolean
        • requires_approval: boolean
        • disruption_pct: integer
        • planned_actions: {:attach=>[:string], :detach=>[:string], :update=>[:string]}

        list_package_repositories_summary

        Summarize the package repositories configured for the operator's account — counts, kinds (apt/rpm/dnf), visibility (shared vs account), sync status. Use for 'how many package repos', 'what package sources', 'list my repositories', or similar inventory queries.

        • Class: System::Ai::Skills::ListPackageRepositoriesSummaryExecutor
        • Source: extensions/system/server/app/services/system/ai/skills/list_package_repositories_summary_executor.rb
        • Category: devops

        Inputs

        Field Type Required Description
        intent string Yes Free-text query — typically the user's natural-language ask about repositories

        Outputs

        • total: integer
        • by_kind: object
        • by_visibility: object
        • by_sync_status: object
        • repositories: array
        • summary: string

        module_compose

        Compose a Template draft from a workload description — keyword-matches modules and proposes a composition with conflict checks

        • Class: System::Ai::Skills::ModuleComposeExecutor
        • Source: extensions/system/server/app/services/system/ai/skills/module_compose_executor.rb
        • Category: devops

        Inputs

        Field Type Required Description
        description string Yes Free-form workload description, e.g. 'nginx web server with SSL and metrics'
        platform_id string No Restrict the search to modules for a specific NodePlatform
        max_modules integer No -

        Outputs

        • draft_template: object
        • conflicts: array
        • candidate_count: integer
        • reasoning: string

          • package_module_create

          Materialize an apt/rpm package + transitive dep closure as NodeModule rows + ModuleDependency edges, then dispatch a CI build

          • Class: System::Ai::Skills::PackageModuleCreateExecutor
          • Source: extensions/system/server/app/services/system/ai/skills/package_module_create_executor.rb
          • Category: devops

          Inputs

          Field Type Required Description
          repository_id string Yes -
          package_name string Yes -
          architectures array No Defaults to repository.architectures if omitted
          recommends_selected array No Per-edge recommends opt-in list (defaults to none)
          category_id string No -

          Outputs

          • top_level_module_id: string
          • dependency_count: integer
          • recommends_count: integer
          • build_dispatches: array
          • warnings: array

          package_module_refresh

          Re-materialize a NodeModule's source package when upstream drifts (replays persisted recommends_chosen for determinism)

          • Class: System::Ai::Skills::PackageModuleRefreshExecutor
          • Source: extensions/system/server/app/services/system/ai/skills/package_module_refresh_executor.rb
          • Category: devops

          Inputs

          Field Type Required Description
          package_module_link_id string Yes PackageModuleLink.id of the module to refresh
          force boolean No -

          Outputs

          • enqueued: boolean
          • package_module_link_id: string

          package_repository_sync

          Sync upstream apt/rpm metadata for one package repository (account-scoped or shared)

          • Class: System::Ai::Skills::PackageRepositorySyncExecutor
          • Source: extensions/system/server/app/services/system/ai/skills/package_repository_sync_executor.rb
          • Category: devops

          Inputs

          Field Type Required Description
          repository_id string Yes PackageRepository.id

          Outputs

          • ok: boolean
          • upserted: integer
          • obsoleted: integer
          • package_count: integer
          • error: string

          platform_maintenance

          Routine platform maintenance — certificate renewal, drift checks, health snapshots. Use this skill when the operator asks about (a) which certs are expiring soon, (b) whether they should rotate something, (c) the current platform health, or (d) whether any instances have drifted from their template.

          • Class: System::Ai::Skills::PlatformMaintenanceExecutor
          • Source: extensions/system/server/app/services/system/ai/skills/platform_maintenance_executor.rb
          • Category: devops

          Inputs

          Field Type Required Description
          action string Yes One of: cert_status, cert_rotate, drift_check, health_check
          certificate_id string No Cert id (only for cert_rotate of a specific row; omit to rotate all expiring)
          deployment_id string No PlatformDeployment id (for drift_check; omit to scan all deployments)
          renewal_window_days integer No How many days ahead to consider a cert 'expiring soon' (cert_status / cert_rotate)

          Outputs

          • action: string
          • data: object
          • recommendations: array

          platform_resilience

          Platform incident response — drain an instance, scale a deployment up/down, or triage peer/instance health. Use this skill when the operator describes a stress event (instance misbehaving, capacity pressure, peer heartbeats stale) or asks 'what should I do about X'.

          • Class: System::Ai::Skills::PlatformResilienceExecutor
          • Source: extensions/system/server/app/services/system/ai/skills/platform_resilience_executor.rb
          • Category: devops

          Inputs

          Field Type Required Description
          action string Yes One of: drain_instance, scale, failover_check
          instance_id string No NodeInstance id (required for drain_instance)
          timeout_seconds integer No Drain timeout for in-flight work (drain_instance only)
          deployment_id string No PlatformDeployment id (required for scale)
          direction string No scale direction: set
          target_replicas integer No When direction=set, the new target_replicas value

          Outputs

          • action: string
          • data: object
          • recommendations: array

          provision_cluster

          Provision N instances of a Template in a region — composes create_node + provision_instance for each

          • Class: System::Ai::Skills::ProvisionClusterExecutor
          • Source: extensions/system/server/app/services/system/ai/skills/provision_cluster_executor.rb
          • Category: devops

          Inputs

          Field Type Required Description
          template_id string Yes -
          count integer Yes Number of nodes/instances to spin up (1-50)
          provider_region_id string Yes -
          provider_instance_type_id string Yes -
          name_prefix string No Prefix for node names (default: "node")
          dry_run boolean No Plan only — return projected actions without creating resources

          Outputs

          • dry_run: boolean
          • count: integer
          • created_nodes: array
          • provisioned: array
          • failures: array

            provision_full_stack

            Provision a full compute+network+storage stack from a template — composes provision_instance + optional storage volume + optional SDWAN topology compile

            • Class: System::Ai::Skills::ProvisionFullStackExecutor
            • Source: extensions/system/server/app/services/system/ai/skills/provision_full_stack_executor.rb
            • Category: devops

            Inputs

            Field Type Required Description
            template_id string Yes System::NodeTemplate to instantiate
            count integer Yes Number of node instances to provision (1-50)
            provider_region_id string Yes System::ProviderRegion target
            provider_instance_type_id string Yes System::ProviderInstanceType for each instance
            network_id string No Sdwan::Network — when present, the SDWAN topology is compiled and the resulting peer ids are returned for downstream attach
            with_storage_gb integer No When present, provision a per-instance ProviderVolume of this size
            dry_run boolean No Plan only — return projected actions without creating any cloud resources

            Outputs

            • dry_run: boolean
            • count: integer
            • planned_actions: array
            • outputs: {:node_ids=>[:string], :node_instance_ids=>[:string], :sdwan_peer_ids=>[:string], :storage_volume_ids=>[:string]}
            • failures: array
            • partial: boolean

              • relocate_workload

              Relocate a project's compute workload from one region to another via blue/green or drain cutover. Composes ProvisionFullStackExecutor (target) + ProvisioningService.terminate_instance (source).

              • Class: System::Ai::Skills::RelocateWorkloadExecutor
              • Source: extensions/system/server/app/services/system/ai/skills/relocate_workload_executor.rb
              • Category: devops

              Inputs

              Field Type Required Description
              project_id string Yes Ai::Mission id (the provisioning project being relocated)
              from_region_id string Yes System::ProviderRegion the workload is leaving (audit hint, no lookup)
              to_region_id string Yes System::ProviderRegion the workload is moving to (target for new stack)
              cutover_strategy string Yes One of: blue_green, drain
              template_id string Yes System::NodeTemplate to instantiate at the target region
              provider_instance_type_id string Yes Instance type for the target stack
              count integer Yes Number of new instances to bring up at the target (1-50)
              source_instance_ids array Yes System::NodeInstance ids in the source region to terminate during cutover
              network_id string No Sdwan::Network — when present, target instances are wired into the SDWAN topology and peer ids returned
              with_storage_gb integer No When present, provision a per-instance ProviderVolume of this size at the target
              dry_run boolean No Plan only — return projected actions without provisioning or terminating

              Outputs

              • dry_run: boolean
              • count: integer
              • cutover_strategy: string
              • planned_actions: array
              • outputs: {:node_ids=>[:string], :node_instance_ids=>[:string], :sdwan_peer_ids=>[:string], :storage_volume_ids=>[:string], :terminated_instance_ids=>[:string]}
              • failures: array
              • partial: boolean

                • rolling_module_upgrade

                Plan a batched rolling upgrade of a NodeModule across all instances of a Template, with circuit-breaker and health gating

                • Class: System::Ai::Skills::RollingModuleUpgradeExecutor
                • Source: extensions/system/server/app/services/system/ai/skills/rolling_module_upgrade_executor.rb
                • Category: devops

                Inputs

                Field Type Required Description
                template_id string Yes -
                module_id string Yes -
                target_version_id string Yes -
                batch_pct integer No Percent of fleet to upgrade per batch (1-100). Smaller = safer + slower.
                max_consecutive_failures integer No Trip the circuit-breaker after this many consecutive batch failures
                health_timeout_sec integer No How long to wait for a batch to report healthy heartbeats before marking failed

                Outputs

                • total_instances: integer
                • batch_size: integer
                • batch_count: integer
                • estimated_total_seconds: integer
                • circuit_breaker: object
                • batches: array

                  scale_project

                  Adapt a provisioning project's footprint — add replicas in-region, plan a vertical resize, or expand into a new region. Composes ProvisionFullStackExecutor + RollingModuleUpgradeExecutor.

                  • Class: System::Ai::Skills::ScaleProjectExecutor
                  • Source: extensions/system/server/app/services/system/ai/skills/scale_project_executor.rb
                  • Category: devops

                  Inputs

                  Field Type Required Description
                  project_id string Yes Ai::Mission id (the provisioning project being scaled)
                  target_count integer Yes Number of new instances (add_replicas / add_region) — bounded 1..50. Ignored for vertical_resize.
                  scaling_strategy string Yes One of: add_replicas, vertical_resize, add_region
                  template_id string No System::NodeTemplate to instantiate (add_replicas / add_region) or whose fleet is being resized (vertical_resize)
                  provider_region_id string No Region for new instances (add_replicas: same as project; add_region: NEW region)
                  provider_instance_type_id string No Instance type for new instances
                  module_id string No vertical_resize: System::NodeModule whose target_version replaces in-place
                  target_version_id string No vertical_resize: target System::NodeModuleVersion id
                  network_id string No add_region: optional Sdwan::Network to attach new instances to
                  with_storage_gb integer No add_region: optional per-instance volume size
                  dry_run boolean No Plan only — return projected actions without creating any cloud resources

                  Outputs

                  • dry_run: boolean
                  • count: integer
                  • scaling_strategy: string
                  • planned_actions: array
                  • outputs: {:node_ids=>[:string], :node_instance_ids=>[:string], :sdwan_peer_ids=>[:string], :storage_volume_ids=>[:string], :rolling_upgrade_plan=>:object}
                  • failures: array
                  • partial: boolean

                    • sdwan_compose_full_topology

                    Orchestrate the three SDWAN composition primitives (HostBridge, OVN, IPFIX) in one tool call. Composes SdwanHostBridgeComposeExecutor + SdwanOvnComposeTopologyExecutor + SdwanIpfixCollectorComposeExecutor.

                    • Class: System::Ai::Skills::SdwanComposeFullTopologyExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_compose_full_topology_executor.rb
                    • Category: devops

                    Inputs

                    Field Type Required Description
                    host_node_instance_ids array Yes System::NodeInstance ids — passed through to host_bridge_compose
                    kind string No Optional explicit bridge kind override (linux
                    ovn_topology object No Optional OVN composition payload: {nb_db_endpoint, sb_db_endpoint, northd_host?, switches} — when supplied, runs sdwan_ovn_compose_topology
                    ipfix_collector object No Optional IPFIX collector payload: {name, host, port, sampling_rate?} — when supplied, runs sdwan_ipfix_collector_compose
                    dry_run boolean No Plan only — invokes each sub-skill in dry_run mode

                    Outputs

                    • dry_run: boolean
                    • planned_actions: array
                    • outputs: {:host_bridges=>:object, :ovn=>:object, :ipfix=>:object}
                    • failures: array
                    • partial: boolean

                      • sdwan_host_bridge_compose

                      Allocate per-host SDWAN bridges (Linux for lightweight profile, OVS for heavyweight) for a set of NodeInstances. Composes Sdwan::HostBridgeAllocator. Idempotent.

                    • Class: System::Ai::Skills::SdwanHostBridgeComposeExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_host_bridge_compose_executor.rb
                    • Category: devops

                      • Inputs

                      Field Type Required Description
                      host_node_instance_ids array Yes System::NodeInstance ids to allocate bridges for (1-100)
                      kind string No Optional explicit bridge kind override: linux
                      dry_run boolean No Plan only — no Sdwan::HostBridge rows are persisted

                      Outputs

                    • dry_run: boolean
                    • bridge_count: integer
                    • planned_actions: array
                    • outputs: {:host_bridge_ids=>[:string], :allocations=>[:object]}
                    • failures: array
                    • partial: boolean

                      • sdwan_ipfix_collector_compose

                      Register an IPFIX collector for an account so the topology compiler can stamp ipfix exporter config onto every heavyweight (ovs-kind) HostBridge in the per-host payload. Idempotent on (account, name). Composes Sdwan::IpfixCollector.

                    • Class: System::Ai::Skills::SdwanIpfixCollectorComposeExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_ipfix_collector_compose_executor.rb
                    • Category: devops

                      • Inputs

                      Field Type Required Description
                      name string Yes Display name for the collector — unique per account; reused on re-execution
                      host string Yes Collector host (IPv4, IPv6, or hostname). IPv6 addresses are bracketed automatically when emitted to ovs-vsctl.
                      port integer Yes Collector UDP port (1-65535)
                      sampling_rate integer No Sampling rate (1 = export every flow). Ignored when re-using an existing collector.
                      dry_run boolean No Plan only — no Sdwan::IpfixCollector row is persisted

                      Outputs

                    • dry_run: boolean
                    • planned_actions: array
                    • outputs: {:ipfix_collector_id=>:string, :created=>:boolean, :name=>:string, :target_endpoint=>:string, :sampling_rate=>:integer, :state=>:string, :is_winning_collector=>:boolean}
                    • failures: array
                    • partial: boolean

                      • sdwan_ovn_apply_acl

                      Apply OVN ACLs (firewall rules) to a logical switch — heavyweight-profile only. Composes Sdwan::OvnAcl entries scoped to one switch and re-compiles the deployment plan. Idempotent on (switch, acl_name).

                    • Class: System::Ai::Skills::SdwanOvnApplyAclExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_ovn_apply_acl_executor.rb
                    • Category: devops

                      • Inputs

                      Field Type Required Description
                      logical_switch_id string Yes Sdwan::OvnLogicalSwitch id the ACLs apply to (must belong to the executing account)
                      acls array Yes Array of {name, direction, priority?, match, action} (1-100). direction: from-lport
                      dry_run boolean No Plan only — no Sdwan::OvnAcl rows are persisted

                      Outputs

                    • dry_run: boolean
                    • acl_count: integer
                    • planned_actions: array
                    • outputs: {:logical_switch_id=>:string, :ovn_acl_ids=>[:string], :allocations=>[:object], :compiled_plan=>:object}
                    • failures: array
                    • partial: boolean

                      • sdwan_ovn_compose_topology

                      Compose an OVN logical-network topology (deployment + logical switches + ports) for a heavyweight-profile account, then compile the ovn-nbctl plan. Composes Sdwan::OvnDeployment + Sdwan::OvnLogicalSwitch + Sdwan::OvnLogicalSwitchPort + Sdwan::OvnCompiler.

                    • Class: System::Ai::Skills::SdwanOvnComposeTopologyExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_ovn_compose_topology_executor.rb
                    • Category: devops

                      • Inputs

                      Field Type Required Description
                      switches array Yes Array of {name, cidr?, ports: [{name, kind, addresses?, host_node_instance_id?}]} (1-50)
                      nb_db_endpoint string No OVN NB DB endpoint (e.g., tcp:127.0.0.1:6641) — required only when the account has no OvnDeployment yet
                      sb_db_endpoint string No OVN SB DB endpoint (e.g., tcp:127.0.0.1:6642) — required only when the account has no OvnDeployment yet
                      northd_host string No Advisory hint for which host runs ovn-northd — only used when creating a new deployment
                      dry_run boolean No Plan only — no Sdwan rows are persisted

                      Outputs

                    • dry_run: boolean
                    • switch_count: integer
                    • port_count: integer
                    • planned_actions: array
                    • outputs: {:ovn_deployment_id=>:string, :created_deployment=>:boolean, :logical_switch_ids=>[:string], :logical_switch_port_ids=>[:string], :compiled_plan=>:object}
                    • failures: array
                    • partial: boolean

                      • suggest_architectures_for_fleet

                      Suggest which canonical architectures to materialize a package for, based on the current fleet's NodePlatform coverage and the repository's served architectures.

                    • Class: System::Ai::Skills::SuggestArchitecturesForFleetExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/suggest_architectures_for_fleet_executor.rb
                    • Category: devops

                      • Inputs

                      Field Type Required Description
                      repository_id string Yes PackageRepository.id whose architectures bound the suggestion set
                      max_suggestions integer No Cap on the number of suggested arches (1-7)

                      Outputs

                    • repository_id: string
                    • suggested: array
                    • rationale: array
                    • fallback: boolean
                    • confidence: string

                      • Documentation

                      runbook_generate

                      Generate a markdown operational runbook for a NodeTemplate — boot order, common failure modes, recovery procedures

                    • Class: System::Ai::Skills::RunbookGenerateExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/runbook_generate_executor.rb
                    • Category: documentation

                      • Inputs

                      Field Type Required Description
                      template_id string Yes -
                      persist_as_page boolean No Save the result as a Pages document so it's reachable via list_pages

                      Outputs

                    • runbook_markdown: string
                    • section_count: integer
                    • persisted_page_id: string
                    • source_artifacts: object

                      • Federation

                      federation_manager

                      Survey federation peer + grant + cert health for an account and surface findings the operator (or a future autonomy loop) should action.

                    • Class: System::Ai::Skills::FederationManagerExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/federation_manager_executor.rb
                    • Category: federation

                      • Outputs

                    • account_id: string
                    • ran_at: string
                    • cert_rotation_candidates: array
                    • grants_approaching_expiry: array
                    • grants_overdue_for_review: array
                    • broad_scope_grants: array
                    • capability_drift: array
                    • finding_count: integer

                      • Fleet

                      architecture_create

                      Directly create a custom (non-canonical) architecture. Requires system.architectures.manage; surfaces for operator approval via intervention policy.

                    • Class: System::Ai::Skills::ArchitectureCreateExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/architecture_create_executor.rb
                    • Category: fleet

                      • Inputs

                      Field Type Required Description
                      name string Yes -
                      family string Yes -
                      apt_name string No -
                      rpm_name string No -
                      display_name string No -
                      description string No -
                      enabled boolean No -
                      public boolean No -

                      Outputs

                    • architecture: object

                      • architecture_delete

                      Delete a non-canonical architecture. Fails if any NodePlatform still references it. Canonical rows are immutable and return an error.

                    • Class: System::Ai::Skills::ArchitectureDeleteExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/architecture_delete_executor.rb
                    • Category: fleet

                      • Inputs

                      Field Type Required Description
                      architecture_id string Yes -

                      Outputs

                    • deleted: boolean
                    • architecture_id: string

                      • architecture_propose

                      Propose adding a new architecture to the platform-wide catalog (creates an Ai::AgentProposal for human review).

                    • Class: System::Ai::Skills::ArchitectureProposeExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/architecture_propose_executor.rb
                    • Category: fleet

                      • Inputs

                      Field Type Required Description
                      name string Yes Canonical lowercase name (e.g. loongarch64, mips64el)
                      family string Yes One of: x86, arm, power, z, risc-v, mips, other
                      apt_name string No apt-style name (e.g. amd64 for x86_64)
                      rpm_name string No rpm-style name (matches name for most arches)
                      display_name string No -
                      description string No -
                      justification string No Why this arch is needed — surfaces in the approval UI

                      Outputs

                    • proposal_id: string
                    • status: string
                    • review_deadline: datetime

                      • architecture_update

                      Update a non-canonical architecture's fields. Canonical rows are immutable and return an error.

                    • Class: System::Ai::Skills::ArchitectureUpdateExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/architecture_update_executor.rb
                    • Category: fleet

                      • Inputs

                      Field Type Required Description
                      architecture_id string Yes -
                      attributes object Yes Allowed: name, family, apt_name, rpm_name, display_name, description, kernel_options, enabled, public

                      Outputs

                    • architecture: object

                      • Sdwan

                      sdwan_bgp_session_remediate

                      Triage an unhealthy iBGP session; returns a plan with likely cause + recommended next step. v1 does NOT auto-restart FRR.

                    • Class: System::Ai::Skills::SdwanBgpSessionRemediateExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_bgp_session_remediate_executor.rb
                    • Category: sdwan

                      • Inputs

                      Field Type Required Description
                      bgp_session_id string No -
                      peer_id string No Local peer (resolves session via peer_id + neighbor_address)
                      neighbor_address string No -
                      dry_run boolean No -

                      Outputs

                    • resolved: boolean
                    • session_id: string
                    • state: string
                    • likely_cause: string
                    • recommended_action: string

                      • sdwan_failover

                      Plan an SDWAN hub failover for an unreachable network; identifies promotion candidates without auto-flipping

                    • Class: System::Ai::Skills::SdwanFailoverExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_failover_executor.rb
                    • Category: sdwan

                      • Inputs

                      Field Type Required Description
                      network_id string Yes -
                      dry_run boolean No v1 only supports dry_run=true — auto-promotion deferred

                      Outputs

                    • resolved: boolean
                    • network_id: string
                    • current_hub_count: integer
                    • candidates: {:peer_id=>:string, :endpoint_host=>:string, :endpoint_port=>:integer, :last_handshake_at=>:string}

                      • sdwan_peer_remediate

                      Rotate an SDWAN peer's keypair and force the agent to re-establish its tunnel on next reconcile

                    • Class: System::Ai::Skills::SdwanPeerRemediateExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_peer_remediate_executor.rb
                    • Category: sdwan

                      • Inputs

                      Field Type Required Description
                      peer_id string Yes Sdwan::Peer to remediate
                      dry_run boolean No Plan-only mode — return what would happen without rotating keys

                      Outputs

                    • resolved: boolean
                    • rotated_from_key_id: string
                    • new_key_id: string
                    • new_public_key: string

                      • sdwan_vip_failover

                      Promote the next failover candidate of a silent-holder Sdwan::VirtualIp. Anycast VIPs return informational only.

                    • Class: System::Ai::Skills::SdwanVipFailoverExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/sdwan_vip_failover_executor.rb
                    • Category: sdwan

                      • Inputs

                      Field Type Required Description
                      virtual_ip_id string Yes -
                      dry_run boolean No -

                      Outputs

                    • resolved: boolean
                    • virtual_ip_id: string
                    • previous_holder_peer_id: string
                    • new_holder_peer_id: string
                    • anycast: boolean

                      • Security

                      cve_remediation_orchestration

                      Orchestrate the full CVE → exposure → rebuild → rolling-upgrade chain for one CVE

                    • Class: System::Ai::Skills::CveRemediationOrchestrationExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/cve_remediation_orchestration_executor.rb
                    • Category: security

                      • Inputs

                      Field Type Required Description
                      cve_id string Yes Canonical CVE id, e.g. CVE-2026-12345
                      severity string No critical
                      affected_module_ids array No Optional pre-resolved list of module ids — when omitted, derived from CveExposure rows
                      exposure_ids array No Optional list of CveExposure ids to transition to remediating

                      Outputs

                    • cve_id: string
                    • triage: object
                    • refresh_dispatches: array
                    • rolling_upgrade_plans: array
                    • exposures_remediating: integer
                    • skipped_reason: string

                      • cve_response

                      Triage a CVE entry against the fleet — enumerates exposure, scores risk, proposes a remediation plan

                    • Class: System::Ai::Skills::CveResponseExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/cve_response_executor.rb
                    • Category: security

                      • Inputs

                      Field Type Required Description
                      cve_id string Yes Canonical CVE id, e.g. CVE-2026-12345
                      severity string Yes critical
                      affected_packages array Yes [{name: 'openssl', version: '<3.1.4'}, ...]
                      summary string No -

                      Outputs

                    • cve_id: string
                    • severity: string
                    • risk_score: integer
                    • exposed_modules: array
                    • exposed_instance_count: integer
                    • remediation_plan: object
                    • requires_approval: boolean

                      • cve_runbook_generate

                      Generate a markdown remediation runbook for a CVE — exposed modules, recommended steps, verification commands

                    • Class: System::Ai::Skills::CveRunbookGenerateExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/cve_runbook_generate_executor.rb
                    • Category: security

                      • Inputs

                      Field Type Required Description
                      cve_id string Yes Canonical CVE id, e.g. CVE-2026-12345
                      persist_as_page boolean No Save the runbook as a Pages document so it's reachable via list_pages

                      Outputs

                    • runbook_markdown: string
                    • cve_id: string
                    • exposed_module_count: integer
                    • exposed_instance_count: integer
                    • risk_score: integer
                    • requires_approval: boolean
                    • persisted_page_id: string

                      • System

                      platform_deploy

                      Deploy a new Powernode platform. Pass mode='standalone' for a sovereign platform or mode='federated' for one that handshakes back with this platform on first boot. With no params, returns a wizard payload describing the form the operator should fill in.

                    • Class: System::Ai::Skills::PlatformDeployExecutor
                    • Source: extensions/system/server/app/services/system/ai/skills/platform_deploy_executor.rb
                    • Category: system

                      • Inputs

                      Field Type Required Description
                      mode string No Deployment mode: standalone
                      name string No Human-readable name for the new platform / deployment.
                      template_slug string No NodeTemplate slug to use (default: powernode-hub).
                      parent_url string No Required for federated mode — reachable URL of THIS platform that the child posts back to.
                      spawn_mode string No Required for federated mode — one of: managed_child, autonomous_peer, cluster_member.
                      region string No Optional provider region preference.
                      instance_size string No Optional provider instance type preference.
                      service_role string No Service role for the PlatformDeployment row (default: api).
                      public_dns_hostname string No Optional public DNS hostname for the new platform.
                      token_ttl_seconds integer No Acceptance-token TTL for federated spawns (default: 7 days).

                      Outputs

                    • ok: boolean
                    • card: object
                    • deployment: object
                    • acceptance_token: string
                    • spawn_payload: object