Menu
This skill should be used when provisioning scoped Cloudflare API tokens for tenant deploys.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
This skill should be used when auditing the recurring per-Anthropic-model-release checklist (model IDs, claude-code-action pin freshness, pricing drift, tier-map re-evaluation): it auto-fixes stale model-ID swaps into a CI-gated PR and flags the rest.
This skill should be used when performing exhaustive code reviews using multi-agent analysis, ultra-thinking, and worktrees.
This skill should be used when designing agent-native applications where agents are first-class citizens: architecting autonomous agents, creating MCP tools, building apps where features are agent-driven outcomes.
This skill should be used when working with DSPy.rb, a Ruby framework for type-safe, composable LLM applications.
This skill provides a promptfoo eval harness that measures whether a Soleur skill or agent edit actually improves behavior, comparing a skill arm against a baseline control arm.
This skill should be used when resolving all TODO comments in the codebase using parallel processing. It analyzes dependencies, creates a resolution plan with a mermaid flow diagram, and spawns parallel resolver agents.
| name | provision-cloudflare |
| description | This skill should be used when provisioning scoped Cloudflare API tokens for tenant deploys. |
Create a scoped Cloudflare API token via Terraform cloudflare_api_token with least-privilege permissions for a tenant's deploy pipeline.
MUST run on the operator's local machine. MUST NOT run in CI. Bootstrap credentials are accepted via read -s (interactive terminal only) and never persisted to disk, env exports, or CLI args.
soleur:provision-cloudflare <tenant-slug> <cf-zone-id> <cf-account-id> [--dry-run]
| Argument | Required | Description |
|---|---|---|
tenant-slug | Yes | Canonical tenant identifier (kebab-case) |
cf-zone-id | Yes | Cloudflare zone ID for the tenant's domain |
cf-account-id | Yes | Cloudflare account ID |
--dry-run | No | Print TF plan + smoke-test commands without executing |
bash plugins/soleur/skills/provision-cloudflare/scripts/provision-cloudflare.sh <slug> <zone-id> <account-id> [--dry-run]
The script:
cloudflare.tf already exists)provisioning/<slug>/cloudflare.tf with 4 permission groups + sensitive outputterraform apply compound command with credential re-entryIf this run provisions a cloudflare_r2_bucket for the tenant, R2 has no encryption attribute
either -- it is provider-managed at rest, and a bare "the provider handles it" is not an
acceptable declaration. Do not complete the run without adding a row to
encryption-posture-ledger.json (repo-root scripts/): at_rest.mechanism: provider-managed:<named attestation>, at_rest.evidence (attestation name + URL + retrieval date, plus the bucket's
location/jurisdiction field in the .tf), at_rest.does_not_defend, at_rest.disclosed_as,
and at_rest.live_verification. This run provisions a scoped API token, not a bucket, so the
step is normally a no-op -- it applies only when a bucket enters scope.
terraform output -raw piped to a subshell to avoid terminal scrollback exposure.~> 4.0; upgrade when Soleur's main root upgrades.User Details:Read or Account Settings:Read (least-privilege).