---
name: dedicated-cloud-diag
description: |
  Diagnose Dedicated Cloud infra-provider CR / resource lifecycle
  (Cluster, APPBox, VPC, VPCPeering, PrivateLinkService) with read-only
  evidence. Use when a Dedicated cluster is stuck Creating/Pending/Scaling,
  APPBox/VPC/Peering/PLS is not Active, or to confirm no current anomaly on
  those CRs. Do not use for TiKV/TiDB/PD/TiCDC deep performance, slow query,
  Serverless, inspections, or change execution. Prefer when this skill is
  explicitly requested.
---

This skill is the entry point for Dedicated Cloud **infra CR / resource
lifecycle** diagnosis. It preflights context, routes to a `diag-*` subskill,
and requires a visible diag-trace.

IMPORTANT: All file paths in this skill are relative to the current directory.

# Relationship and Boundaries

- Built on `dedicated-cloud-toolkit` — invoke toolkit **read-only** actions only.
- Do **not** execute toolkit `change` actions.
- Output: findings, confidence, next actions (read-only follow-ups, handoff to
  another `diag-*`, or handoff to `dedicated-cloud-ops` when mutation is needed).
- Out of scope for this skill: component deep performance / oncall handbooks
  (TiKV, PD, TiCDC, slow query), Serverless, and non–infra-provider product forms.
- When the request is out of scope: emit `judgment=out-of-scope` and stop.
  Do **not** recommend another diagnosis skill by name.

## Execution Safety Rules

- Never mutate runtime state, data, topology, config, or permissions.
- If a diagnostic step requires mutation, stop and hand off to
  `dedicated-cloud-ops` with rationale.
- Keep evidence collection reproducible and auditable via diag-trace.

# Use this skill when

- Dedicated Cluster CR lifecycle issues (Pending / Creating / Scaling /
  Unavailable, stuck create, scale status).
- Dedicated APPBox / VPC / VPCPeering / PrivateLinkService not Active or
  blocked on dependencies.
- User asks to confirm current health of those infra CRs (no symptom → Health
  checklist).

# Do not use this skill when

- TiKV / TiDB / PD / TiCDC deep performance, slow query, scheduling oncall.
- Serverless or non-Dedicated product forms.
- User wants change / fix execution only (that is ops; this skill is read-only).

# Workflow

## Step 0: Entry preflight (mandatory)

Read `references/patterns/entry-preflight.md` and execute it before any toolkit
call or subskill Procedure.

- Missing hard identifiers → ask the user; do not call toolkit.
- Not Dedicated infra CR lifecycle → `judgment=out-of-scope`; stop; do not
  recommend another diagnosis skill.
- Oral intent → map to a `diag-*` using the Quick Routing table below (and the
  preflight doc).

## Step 1: Load diag-trace contract (mandatory)

Read `references/patterns/diag-trace.md`. Every evidence fetch and the final
summary must follow that contract.

Also apply when needed (read when the Procedure or Workflow names them):

- `references/patterns/fetch-retry-bypass.md` — on fetch failure
- `references/patterns/provider-branch.md` — before provider-specific steps
- `references/patterns/healthy-exit.md` — no symptom or symptoms cleared
- `references/patterns/skill-boundary-assist.md` — deeper cause beyond in-skill
  methods

## Step 2: Discover and select sub-skills

Read `SUBSKILLS_INDEX.md`. Match the user's request (after preflight) to a
subskill name/description. Prefer the Quick Routing table when oral.

### Quick Routing (oral → diag-*)

| Signal | Route to |
|--------|----------|
| Cluster create/stuck/scale; TiDB/TiKV pods not up (infra/CR view) | `diag-cluster` |
| APPBox / dataplane K8s / node groups not ready | `diag-appbox` (often via cluster Gate handoff) |
| VPC / subnet / network container | `diag-vpc` |
| VPC peering | `diag-vpcpeering` |
| PrivateLink / PLS | `diag-privatelinkservice` |
| "Cannot connect" without layer | Ask which layer (cluster / VPC / PLS / peering), or start `diag-cluster` then Gate; do not claim root cause yet |

## Step 3: Read the selected subskill `SUBSKILL.md`

Read that file. Follow its Method binding, Procedure, Health checklist, Gates,
and Output rules. Do not skip APPBox/VPC Gates when evidence points there.

## Step 4: Execute and emit diag-trace

Run the Procedure. After each evidence fetch, emit one step card. At end, emit
Information chain, Evidence index, Conclusion, Next actions.