# Pattern: entry-preflight

Run this pattern at skill entry **before** any toolkit call or `diag-*`
Procedure.

## 1. Minimum context

| Target domain | Hard required | May ask |
|---------------|---------------|---------|
| `diag-cluster` | `cluster_id` (or equivalent unique Dedicated cluster id) | `env` if multi-env; one-line symptom (optional → Health checklist) |
| `diag-appbox` / `diag-vpc` / `diag-vpcpeering` / `diag-privatelinkservice` | Object `name` **or** enough to derive it (`cluster_id` + object-graph edge) plus plane/region clues required by toolkit | `provider` (may come from CR later); symptom |

Rules:

1. If a hard identifier is missing: list missing fields, ask the user, **do not**
   call toolkit, **do not** guess ids.
2. After the user supplies them, resume from this preflight in the same session.
3. Symptom may be absent → later run the domain Health checklist.

Emit a preflight step card: `intent=entry-preflight`, `judgment=continue` or
blocked on missing fields.

## 2. Scope check (product / responsibility)

After ids are present (or immediately if clearly wrong):

Treat as **out of scope** when:

- Not Dedicated infra-provider CR lifecycle (e.g. Serverless, other product line)
- Request is TiKV/TiDB/PD/TiCDC deep performance, slow query, or component oncall
- Request is change/fix execution only (ops); this skill is read-only diagnosis

Action:

1. Emit `judgment=out-of-scope` (or final `Conclusion=out_of_scope`).
2. Briefly state: not infra CR / resource lifecycle diagnosis.
3. Optionally echo user-provided ids/summary for their next step elsewhere.
4. **Stop.** Do **not** call toolkit. Do **not** recommend another diagnosis
   skill by name.

## 3. Oral intent → `diag-*`

| Oral / signal | Route |
|---------------|-------|
| Cluster create/stuck/scale; components not up (infra/CR view) | `diag-cluster` |
| APPBox / dataplane K8s / node pool not ready | `diag-appbox` |
| VPC / subnet / network container | `diag-vpc` |
| Peering | `diag-vpcpeering` |
| PrivateLink / PLS | `diag-privatelinkservice` |
| "Cannot connect" without layer | Ask layer, or start `diag-cluster` then Gate; do not claim root cause |

This step only picks the domain inside this skill. Cross-domain Gates stay in
Procedure.

## Flow

```text
request
  → hard ids present?
       ├─ no → ask; stop toolkit
       └─ yes → in scope?
                 ├─ no → out-of-scope; stop
                 └─ yes → route diag-* → Procedure
```