Menu
This skill should be used when provisioning scoped Cloudflare API tokens for tenant deploys.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
This skill should be used when auditing the recurring per-Anthropic-model-release checklist (model IDs, claude-code-action pin freshness, pricing drift, tier-map re-evaluation): it auto-fixes stale model-ID swaps into a CI-gated PR and flags the rest.
This skill should be used when performing exhaustive code reviews using multi-agent analysis, ultra-thinking, and worktrees.
This skill should be used when designing agent-native applications where agents are first-class citizens: architecting autonomous agents, creating MCP tools, building apps where features are agent-driven outcomes.
This skill should be used when working with DSPy.rb, a Ruby framework for type-safe, composable LLM applications.
This skill provides a promptfoo eval harness that measures whether a Soleur skill or agent edit actually improves behavior, comparing a skill arm against a baseline control arm.
This skill should be used when resolving all TODO comments in the codebase using parallel processing. It analyzes dependencies, creates a resolution plan with a mermaid flow diagram, and spawns parallel resolver agents.
| name | provision-cloudflare |
| description | This skill should be used when provisioning scoped Cloudflare API tokens for tenant deploys. |
Create a scoped Cloudflare API token via Terraform cloudflare_api_token with least-privilege permissions for a tenant's deploy pipeline.
MUST run on the operator's local machine. MUST NOT run in CI. Bootstrap credentials are accepted via read -s (interactive terminal only) and never persisted to disk, env exports, or CLI args.
soleur:provision-cloudflare <tenant-slug> <cf-zone-id> <cf-account-id> [--dry-run]
| Argument | Required | Description |
|---|---|---|
tenant-slug | Yes | Canonical tenant identifier (kebab-case) |
cf-zone-id | Yes | Cloudflare zone ID for the tenant's domain |
cf-account-id | Yes | Cloudflare account ID |
--dry-run | No | Print TF plan + smoke-test commands without executing |
bash plugins/soleur/skills/provision-cloudflare/scripts/provision-cloudflare.sh <slug> <zone-id> <account-id> [--dry-run]
The script:
cloudflare.tf already exists)provisioning/<slug>/cloudflare.tf with 4 permission groups + sensitive outputterraform apply compound command with credential re-entryIf this run provisions a cloudflare_r2_bucket for the tenant, R2 has no encryption attribute
either -- it is provider-managed at rest, and a bare "the provider handles it" is not an
acceptable declaration. Do not complete the run without adding a row to
encryption-posture-ledger.json (repo-root scripts/): at_rest.mechanism: provider-managed:<named attestation>, at_rest.evidence (attestation name + URL + retrieval date, plus the bucket's
location/jurisdiction field in the .tf), at_rest.does_not_defend, at_rest.disclosed_as,
and at_rest.live_verification. This run provisions a scoped API token, not a bucket, so the
step is normally a no-op -- it applies only when a bucket enters scope.
terraform output -raw piped to a subshell to avoid terminal scrollback exposure.~> 4.0; upgrade when Soleur's main root upgrades.User Details:Read or Account Settings:Read (least-privilege).