hal

Deploy the local Terraform demo environment in hal. Use to provision and initialize Terraform lab resources.

Route Terraform lab requests to deploy, destroy, inspect status, and manage workspace automation in hal.

Deploy local Vault in hal. Use when the user asks to start Vault, initialize the local control plane, or recover from Vault being offline.

Route user intent to the right Vault lab skill in hal, including CE versus Enterprise constraints, observability wiring, and full-stack scenario guidance.

Deploy, verify, and troubleshoot the Vault JWT auth lab in hal. Use this skill when the user asks to enable JWT auth, configure CI/CD authentication with Vault, debug bound claims, test GitLab or pipeline logins, or reset the JWT demo. Triggers include "enable jwt", "configure jwt", "gitlab vault auth", "pipeline auth", "bound claims", and "hal vault jwt".

Deploy, verify, and troubleshoot the Vault OIDC lab in hal. Use this skill when the user asks to enable OIDC, set up human SSO, debug browser login redirects, inspect Authentik-backed roles, reset the OIDC demo, or configure SCIM provisioning. Triggers include "enable oidc", "Vault SSO", "Authentik", "OIDC callback", "configure oidc", "hal vault oidc", "enable scim", and "vault scim".

Deploy, verify, and troubleshoot the TFE SAML lab in hal. Use this skill when the user asks to enable SAML SSO for TFE, set up TFE single sign-on, debug SAML redirects or attribute mapping, configure SCIM provisioning for TFE teams, or reset the TFE SSO demo. Triggers include "enable saml", "TFE SSO", "TFE SAML", "Authentik TFE", "SAML callback", "configure saml", "hal tf saml", "tfe scim", "tfe teams scim", and "saml sso tfe".

Enable, disable, verify, and explain Vault audit devices in the local hal lab. Use this skill when the user asks to enable audit logging, stream Vault logs to Loki/Grafana, find where audit logs are stored, reset audit devices, or troubleshoot why Vault is blocking on audit writes. Triggers include "enable audit", "vault logging", "stream to loki", "where are the audit logs", "hal vault audit", and "reset audit device".

Deploy, verify, and troubleshoot the Vault database secrets lab in hal. Use this skill when the user asks to enable the database secrets engine, generate dynamic DB credentials, debug database leases, rotate the root connection, or reset the local database demo. Triggers include "enable database", "dynamic db credentials", "Vault database engine", "rotate root", and "hal vault database".

Deploy, verify, and troubleshoot the Vault Kubernetes auth lab in hal. Use this skill when the user asks to enable k8s auth, test pod authentication, wire Vault Secrets Operator to a local cluster, use native Kubernetes auth or JWT mode, or reset the KinD demo. Triggers include "enable k8s auth", "vault kubernetes", "vault secrets operator", "kind", "pod identity", and "hal vault k8s".

Deploy, verify, and troubleshoot the Vault LDAP auth plus LDAP secrets engine lab in hal. Use when the user asks for LDAP login, directory-backed auth, dynamic/static/library LDAP secrets, or LDAP lab reset.

Deploy, verify, and troubleshoot the Vault PKI CA chain and demo scenarios in hal. Use this skill when the user asks to set up a Root CA or Intermediate CA, issue leaf certificates, deploy cert-manager K8s integration, run the Vault ACME + Caddy live auto-renewal demo, or reset PKI engines. Triggers include "vault pki", "Root CA", "Intermediate CA", "cert-manager", "ACME", "Caddy renewal", "PKI certificate", and "hal vault pki".

Manage the hal-health sidecar container that serves live ecosystem state snapshots to HAL Plus and other consumers. Use when the user asks to refresh the status snapshot, recreate the health container, or troubleshoot HAL Plus product state.

Manage Boundary observability artifacts in hal — Prometheus scrape targets and Grafana dashboards. Use when the user asks to wire Boundary metrics into the obs stack or manage Boundary monitoring artifacts.

Route Boundary requests to the correct hal boundary skill for control plane deploy, target setup, access checks, and cleanup.

Show local container engine capacity and HAL deployment estimates. Use when the user asks about available resources, whether there is headroom for a new stack, or what is currently deployed and how heavy it is.

Manage Consul observability artifacts in hal — Prometheus scrape targets and Grafana dashboards. Use when the user asks to wire Consul metrics into the obs stack or manage Consul monitoring artifacts.

Route Consul requests to deploy, verify, or destroy the local Consul control plane in hal.

Manage the HAL MCP server lifecycle and AI client configuration. Use when the user asks to start MCP, configure an AI client (Copilot, Claude), check MCP health, or understand the MCP transport options.

Manage Nomad observability artifacts in hal — Prometheus scrape targets and Grafana dashboards. Use when the user asks to wire Nomad metrics into the obs stack or manage Nomad monitoring artifacts.

Route Nomad requests to deploy, inspect, run jobs, and destroy the local Nomad lab in hal.

Manage Terraform Enterprise observability artifacts in hal — Prometheus scrape targets and Grafana dashboards. Use when the user asks to wire TFE metrics into the obs stack or manage Terraform monitoring artifacts.

Manage a second local Terraform Enterprise instance (twin) alongside the primary in hal. Use for `--target twin` flags or `hal tf bis` aliases on terraform lifecycle commands.

Manage Vault observability artifacts in hal — Prometheus scrape targets and Grafana dashboards. Use when the user asks to wire Vault metrics into the obs stack, import the Vault dashboard, or remove Vault monitoring artifacts.

Configure a Terraform VCS-driven workspace automation lab with local GitLab reuse in hal. Use for `hal terraform vcs-workflow`, `hal tf vcs`, `hal tf ws`, or `hal tf workspace` commands.

Deploy, verify, update, and destroy the standalone HAL observability stack (Grafana, Prometheus, Loki, Promtail). Use when the user asks to set up monitoring, wire dashboards, or check the health of the observability stack.

Deploy, configure, and operate HAL Plus — the local AI-powered web UI layer for HAL. Use when the user asks to start HAL Plus, switch models, check its health, or understand how it connects to Ollama and HAL MCP.

Deploy the local Boundary control plane in hal. Use when the user asks to start Boundary, bootstrap controller and worker, or initialize control plane dependencies.

Destroy the local Boundary environment in hal. Use when the user asks to remove Boundary resources or reset the control plane.

Deploy or remove the Boundary MariaDB target lab in hal. Use when the user asks for database target access through Boundary.

Run the Boundary setup helper workflow in hal. Use when the user explicitly asks for boundary setup orchestration.

Deploy or remove the Boundary SSH target lab in hal. Use when the user asks for Linux VM SSH access through Boundary.

Check Boundary and target ecosystem status in hal. Use when the user asks if Boundary, MariaDB target, or SSH target is up.

Deploy local Consul in hal. Use for starting the Consul control plane.

Destroy local Consul resources in hal. Use for teardown and reset.

Inspect local Consul status in hal. Use to confirm health and connectivity.

Deploy local Nomad in hal. Use for starting Nomad server and client resources.

Destroy local Nomad resources in hal. Use for cleanup and reset.

Manage Nomad jobs in hal. Use for running, inspecting, or stopping sample workloads.

Inspect local Nomad status in hal. Use to verify scheduler and workload readiness.