t-cloud-public

name	t-cloud-public
description	Read T Cloud Public (formerly Open Telekom Cloud) infrastructure inventory and prepare guarded DevOps operations through gateway-managed OTC API signing.
user-invocable	true
requires	{"bins":["node"]}
credentials	[{"id":"otc-access-key-id","kind":"header","required":true,"secret_ref":{"source":"store","id":"OTC_ACCESS_KEY_ID"},"scope":"T Cloud Public / Open Telekom Cloud AK/SK request signing","how_to_obtain":"Create an OTC access key in My Credentials > Access Keys. Set `OTC_ACCESS_KEY_ID` through browser admin at the active `/admin/secrets` route; if browser admin is unavailable, use `/secret set OTC_ACCESS_KEY_ID \"<access-key-id>\"` in browser `/chat` or TUI; local console fallback: `hybridclaw secret set OTC_ACCESS_KEY_ID \"<access-key-id>\"`. Use a least-privilege IAM user for inventory work."},{"id":"otc-secret-access-key","kind":"header","required":true,"secret_ref":{"source":"store","id":"OTC_SECRET_ACCESS_KEY"},"scope":"T Cloud Public / Open Telekom Cloud AK/SK request signing","how_to_obtain":"Save the Secret Access Key from the OTC access key CSV. Set `OTC_SECRET_ACCESS_KEY` through browser admin at the active `/admin/secrets` route; if browser admin is unavailable, use `/secret set OTC_SECRET_ACCESS_KEY \"<secret-access-key>\"` in browser `/chat` or TUI; local console fallback: `hybridclaw secret set OTC_SECRET_ACCESS_KEY \"<secret-access-key>\"`. Never paste it into chat or project files."},{"id":"otc-project-id","kind":"header","required":true,"secret_ref":{"source":"store","id":"OTC_PROJECT_ID"},"scope":"T Cloud Public / Open Telekom Cloud regional project paths","how_to_obtain":"Copy the target regional project ID from My Credentials > API Credentials. Set `OTC_PROJECT_ID` through browser admin at the active `/admin/secrets` route; if browser admin is unavailable, use `/secret set OTC_PROJECT_ID \"<project-id>\"` in browser `/chat` or TUI; local console fallback: `hybridclaw secret set OTC_PROJECT_ID \"<project-id>\"`."},{"id":"otc-enterprise-dashboard-token","kind":"header","required":false,"secret_ref":{"source":"store","id":"OTC_ENTERPRISE_DASHBOARD_TOKEN"},"scope":"T Cloud Public Enterprise Dashboard consumption and spend data","how_to_obtain":"Create an Enterprise Dashboard API key with Admin security level in organization settings. Set `OTC_ENTERPRISE_DASHBOARD_TOKEN` through browser admin at the active `/admin/secrets` route; if browser admin is unavailable, use `/secret set OTC_ENTERPRISE_DASHBOARD_TOKEN \"<enterprise-dashboard-api-token>\"` in browser `/chat` or TUI; local console fallback: `hybridclaw secret set OTC_ENTERPRISE_DASHBOARD_TOKEN \"<enterprise-dashboard-api-token>\"`."}]
metadata	{"hybridclaw":{"category":"infrastructure","short_description":"T Cloud Public infrastructure inventory, readiness checks, and guarded operation planning.","tags":["t-cloud-public","open telekom cloud","t-systems","devops","infrastructure","otc","production"],"stakes_tiers":{"green":"[Truncated]","amber":"[Truncated]","red":"[Truncated]"},"escalation":{"writes":"confirm-each","route":"f14"},"cost_measurement":{"system":"UsageTotals","sub_limit_key":"t-cloud-public"}}}

T Cloud Public

Use this skill for T Cloud Public, formerly Open Telekom Cloud, infrastructure inventory, deployment-readiness checks, incident summaries, and guarded DevOps request planning. Invoke it as t-cloud-public. The helper path uses the current product name; credential names intentionally keep established OTC_* identifiers because the public API docs, domains, and customer terminology still use OTC/Open Telekom Cloud names.

Default Workflow

1. Start with read-only inventory or plan. V1 helper operations are read/list/describe only.
2. Treat t_cloud_public.cjs as the API wrapper. Do not handcraft OTC API URLs, service endpoints, signing metadata, request tiers, or SecretRefs from memory.
3. For prompt/user testing, stop after plan or helper http-request payload generation. Do not call helper run or the built-in http_request tool.
4. For real user requests that need live OTC data, use helper run. The helper constructs an allowlisted request and sends it through the HybridClaw gateway http_request route. For IaaS/API inventory, the gateway resolves OTC_ACCESS_KEY_ID, OTC_SECRET_ACCESS_KEY, optional OTC_SECURITY_TOKEN, and OTC_PROJECT_ID, then signs the request server-side.
5. Use http-request only to inspect the generated gateway payload or when the active runtime cannot give the helper gateway access.
6. If a live helper run or http_request call returns 401, 403, or a signature/authentication failure, stop after that first failed call. Do not retry or fan out to more OTC endpoints. Ask the operator to verify credentials, project ID, region, IAM permissions, and clock skew.
7. If a live call returns 429, stop fan-out and report retry guidance from Retry-After or rate-limit response headers when present.
8. For account billing, current spend, charges, and consumption, use the documented Enterprise Dashboard API v2 through helper operations billing-daily-consumption and billing-hourly-consumption. These calls use https://api-enterprise-dashboard.otc-service.com/, bearer secret OTC_ENTERPRISE_DASHBOARD_TOKEN, and NDJSON responses from /v2/daily/consumption/ or /v2/hourly/consumption/.
9. Mutating actions are outside v1 execution. For create/delete/reboot, network/security group, volume/backup restore, DNS/load-balancer, IAM/KMS, database, or container mutations, produce a plan with exact region, project, resource IDs, intended action, rollback, blast radius, and the required F8/F14 operator approval text. Do not execute the mutation.