| name | wukongim-chat-lifecycle |
| description | Operate the Codex-owned WuKongIM chat-lifecycle laboratory directly from the local repository. Use when the operator explicitly asks to buy temporary Alibaba Cloud servers and start the repair stability run, deploy a committed candidate to the same Lease, start or monitor the bounded long workload, diagnose a stopped live run over SSH, inspect one request, or stop and destroy its exact resources. Only an exact start intent authorizes paid procurement; deploy, run, status, diagnose, stop, explanations, approvals, and next-step questions never buy servers. |
WuKongIM Chat Lifecycle Direct Lab
Codex owns this loop from the local machine. Use repository commands and SSH;
do not dispatch a GitHub Action, create a tracking Issue, wait for an Artifact,
or destroy healthy hosts between candidate generations.
Safety boundary
- Treat the exact phrase
开始聊天生命周期稳定性长跑, or an explicit invocation
of this Skill that unambiguously asks to purchase temporary servers and start
the direct repair lab, as authority for one CNY 300 repair Lease. A higher
limit is authorized only when the same explicit start instruction states the
exact CNY amount; never carry a higher limit forward from an earlier turn.
- Never infer paid authority from
继续, 同意, deploy, run, status, diagnose,
stop, an explanation, 下一步建议？, or prior paid runs.
- For an explicitly authorized limit above CNY 300, pass the same whole-CNY
value through
--budget-cny and
WK_CHAT_LAB_PAID_BUDGET_CNY. A mismatch or missing marker must fail before
request state or provider contact. The supported safety ceiling is CNY 1500.
start additionally requires either short-lived Alibaba STS environment
variables or a verified one-hour Alibaba Cloud Shell credential, plus both
exact local authorization values. A tokenless credential is accepted only
when it is absent from the account's registered AccessKey list and the exact
Cloud Shell authorization marker is present. Never use or persist a
long-lived AccessKey for this loop.- Reject another paid start until every earlier request has an exact
selector-bound zero-inventory proof.
- Keep one Lease while diagnosing and deploying committed candidate
generations. A failed workload stops within the bounded monitor window but
does not release the hosts. Only
stop destroys the Lease.
- Never print or commit STS credentials, SSH private keys, worker tokens, or
runtime credential archives. Never place Manager credentials in commands,
shell output, logs, commentary, diagnosis/status artifacts, or repository files.
- The sole Manager-credential disclosure is the final operator-facing response
after the typed deployment readiness gate passes. Read it from the exact
request's private
access.json; never disclose it for a failed deployment or
reuse values from another request or generation.
Before any operation, read
references/operator-workflow.md completely.
Route the intent
Preflight
Run scripts/chat-lifecycle/direct-lab.sh preflight. It is local and read-only:
it must not call Alibaba APIs. Report every missing host tool, temporary
credential proof, or exact lifecycle authorization.
Start
Require the paid authority above. Require a clean worktree whose exact candidate
is committed, generate a fresh request ID, and execute the reference start
procedure. Treat a user-specified test duration as the required continuously
healthy qualification duration: for example, "test for 72 hours" maps to
--duration 72h. If the user gives no duration, use the 60-minute default.
The tool calculates the workload ceiling and Lease lifetime; do not ask the
operator to calculate them. This sequence builds and seals locally before a
read-only Quote; Acquire is the last step. Persist the pre-Acquire selector before the paid call.
If build, materialization, or Quote fails before that selector exists, finalize
the request as not acquired with a local zero-resource proof; do not leave a
phantom active request that blocks the next exact start.
Deploy
deploy never authorizes procurement. Build the current committed candidate,
activate it as the next repair generation on the existing Lease, and require the
typed readiness gate. Preserve failed deployment evidence and the Lease for
diagnosis; do not purchase replacement hosts. A successful deployment handoff
MUST include the exact Manager URL, Manager username, Manager password, and Demo
URL from the selector-bound private access.json. State that Demo HTTP Basic
Authentication uses the same username and password. Validate that the access
receipt matches the request, Lease, source SHA, and deployment-plan digest; if
it is missing or inconsistent, report the handoff failure and never invent access
information. Give this access block before suggesting or starting run.
Run
run never authorizes procurement. Start the fixed rehearsal-shaped systemd
unit and hand it to the bounded stability monitor. The default qualification duration is 60 minutes,
and the tool automatically adds a 15-minute control reserve, so the default
workload ceiling is 75 minutes. A requested --duration 72h therefore runs for
at most 72 hours 15 minutes and qualifies after 72 continuous healthy hours.
Once active, online loss,
insufficient SEND rate, excessive SENDACK backlog, missing SEND/SENDACK
progress, or active-phase loss is terminal within 15 seconds. Stop the
workload, retain the terminal worker cuts, and mark the request
diagnosis_ready; do not keep polling a stopped workload.
Diagnose
diagnose is read-only and uses the saved SSH config for the exact live Lease.
Collect bounded service state, stage journal, Prometheus targets, and all three
worker status/snapshot pairs. Diagnose from evidence, fix locally, commit, then
deploy and run again on the same hosts.
Status
status is read-only. Resolve an explicit request ID or refuse ambiguity.
Report local state, generation, source SHA, Lease identity, last diagnosis,
expiry/cost when available, and whether exact zero inventory is proven.
Stop
An explicit request-scoped stop needs no second confirmation. Execute the
reference stop procedure. It first signals any local monitor, stops the remote
workload best-effort, releases only the saved exact selector, and accepts
completion only with an authenticated zero-inventory proof for that selector.
Completion
The repair stability run is diagnostic and never official evidence. Keep the local
request directory until stop has stored zero-inventory.json. Report both UTC
and Asia/Shanghai timestamps for paid start, diagnosis, qualification, and
release. Every successful deploy response must include the validated Manager and
Demo access block above. Do not claim cleanup from a successful API delete request
alone.
