sap-live-readonly-landscape-discovery

name	sap-live-readonly-landscape-discovery
description	Enumerate and export SAP BTP and S/4HANA landscape configuration using read-only list, get, describe, and export operations only. Use when read-only discovery of subaccounts, service instances, entitlements, destinations, ABAP system landscape objects, or transport routes is needed as evidence for advisory, audit, or compliance purposes. Requires pre-authorized read-only credentials. Never creates, updates, deletes, deploys, assigns, rotates, imports, or triggers any change.
allowed-tools	Read Grep Glob WebSearch WebFetch Bash
metadata	{"author":"github: Raishin","version":"0.1.0","updated":"2026-06-19","category":"platform","lifecycle":"experimental","execution_tier":"read-only-runtime"}

SAP Live Read-Only Landscape Discovery

Purpose

Enumerate SAP BTP and S/4HANA landscape configuration using strictly read-only operations to produce structured evidence for advisory, audit, compliance, or architecture review purposes. Every action taken by this skill must appear on the allowed-actions list below. This skill never changes state.

When to use

Use this skill when the user needs to:

• list BTP subaccounts, directories, entitlements, service instances, service bindings, or destinations,
• describe ABAP system landscape objects (RFC destinations, transport routes, system definitions) in read-only mode,
• export landscape configuration as structured evidence for a clean core review, transport planning, compliance audit, or architecture assessment,
• enumerate trust configurations, identity providers, or role collections in read-only mode,
• gather landscape facts needed as input to sap-clean-core-debt-review or pre-flight facts for sap-guarded-transport-import.

When not to use

• When any creation, update, deletion, deployment, assignment, rotation, import, or trigger is needed — use sap-guarded-transport-import for transport-scoped mutations with its full 17-step guarded sequence.
• When no live access has been authorized by the user — operate in advisory mode only and state that no live evidence was gathered.
• When the user has not confirmed credential scope is read-only — refuse until confirmed.

Lean operating rules

• Read-only absolute. Every CLI invocation must be on the allowed-actions list. Do not construct commands that write, modify, or trigger state changes even if such commands exist in the tool.
• Credential scope first. Before any live command, confirm with the user that the credential in scope carries only read permissions. Do not proceed if write permissions cannot be excluded.
• Least privilege. Request the minimum scope needed for the specific discovery task. Never request administrator-level credentials for a read-only enumeration.
• Evidence labeling. Every piece of data gathered from a live system must be labeled live evidence. Data from docs alone is documentation-based. Describe the source and timestamp for all live evidence.
• Audit trail. Log every command executed, its output summary, and the timestamp. Return the full command log as part of the response.
• No credential echo. Do not echo, log, or include credential values, client secrets, API keys, OAuth tokens, or service key JSON in any output or reference file.
• No scope creep. If a discovery query returns data beyond what was requested (e.g., a list call returns service key values), redact the excess before including in output.

Allowed actions (read-only)

The following action classes are permitted:

• list — enumerate resources (subaccounts, entitlements, instances, destinations, routes, roles, identity providers)
• get / describe — retrieve the current configuration of a named resource
• export — export configuration in structured format (JSON, YAML, CSV) without modifying the source
• status — read the current status of a resource without triggering state transitions

Forbidden actions (absolute prohibition)

The following action classes are unconditionally forbidden regardless of user request:

• create — create any resource
• update / modify / patch — change any resource configuration
• delete / remove / purge — remove any resource
• deploy / push / apply — deploy any artifact
• assign / bind / entitle — assign entitlements, roles, or service bindings
• rotate / regenerate — rotate or regenerate credentials
• import — import any transport request, configuration, or object
• trigger / execute / run (non-read) — trigger any workflow, job, or state transition
• approve — approve any pending request or transport

If a user asks to combine a read step with a write step in one sequence, refuse and redirect the write step to the appropriate skill.

Evidence rules

Label all data with one of:

• live evidence — directly observed from a live SAP system in this session (include command, output summary, timestamp)
• documentation-based — grounded in SAP official docs (no live system access)
• user-provided evidence — stated or supplied by the user in this session
• inference — derived reasoning not directly confirmed by live data or official docs

Live-environment rules

Allowed:

• Read-only BTP CLI commands (btp list, btp get, btp export)
• Read-only CF CLI commands (cf apps, cf services, cf service-instances, cf env with redaction of secret values)
• Read-only Kyma CLI or kubectl read operations (kubectl get, kubectl describe) on authorized clusters
• Read-only ABAP RFC/HTTP calls that enumerate landscape objects (system list, transport routes, RFC destinations) — only via pre-authorized read RFC user

Forbidden:

• Any CLI command with a write, delete, create, deploy, assign, rotate, import, or trigger verb
• Any ABAP call that changes table data, creates objects, or triggers background jobs
• Any BTP API call using POST, PUT, PATCH, or DELETE HTTP methods

Least-privilege credential rules:

• BTP CLI: use a subaccount viewer or global account viewer role only
• CF: use SpaceAuditor or OrgAuditor role; never SpaceDeveloper or OrgManager for discovery
• Kyma/kubectl: use a read-only ClusterRole or namespaced Role bound to get, list, watch verbs only
• ABAP: use a display-only user (authorization objects S_TCODE limited to display transactions, no S_DEVELOP change authorization)

Approval gate: Before executing any live command, confirm:

1. The user has authorized live read-only access for this session.
2. The credential in scope is confirmed read-only (viewer/auditor role or equivalent).
3. The target system and scope are explicitly identified by the user.

Rollback: This skill makes no changes; rollback is not applicable. However, if a command unexpectedly triggers a state change (e.g., a CLI bug or misconfigured tool), stop immediately and escalate to the user without continuing.

Post-change / post-discovery:

• Return a command log with all commands executed and a summary of evidence gathered.
• Redact any credential values, service keys, or sensitive tokens from output.
• Label all gathered data as live evidence with source command and timestamp.

Audit evidence:

• Every response that includes live evidence must include the full command log.
• Audit evidence format: [COMMAND] [TIMESTAMP_UTC] [SYSTEM] [SUMMARY_OF_OUTPUT]

References

Load only when needed:

• Workflow and output contract — discovery workflow, command patterns, output format.
• Safety checklist — non-negotiables, forbidden action verification, credential rules.
• Official sources — SAP BTP CLI, CF CLI, Kyma, ABAP landscape docs.
• Live environment access — credential setup, role requirements, audit log format, redaction rules.

Response minimum

Return, at minimum:

• Problem classification: what landscape data is needed and why.
• Evidence used: live evidence (with command log) / documentation-based / user-provided / inference.
• Risk level: none — this skill is read-only.
• Recommended action: which list/get/describe commands to run and in what order.
• Refusal / escalation triggers: refuse if any requested action is on the forbidden list; escalate to the appropriate skill.
• Business impact: what decisions depend on this landscape data; what is the cost of incomplete discovery.
• Next verification step: confirm credential scope with the user before the first live command.