菜单
This skill should be used when provisioning Hetzner sub-projects and tokens for tenant infrastructure.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
This skill should be used when auditing the recurring per-Anthropic-model-release checklist (model IDs, claude-code-action pin freshness, pricing drift, tier-map re-evaluation): it auto-fixes stale model-ID swaps into a CI-gated PR and flags the rest.
This skill should be used when performing exhaustive code reviews using multi-agent analysis, ultra-thinking, and worktrees.
This skill should be used when designing agent-native applications where agents are first-class citizens: architecting autonomous agents, creating MCP tools, building apps where features are agent-driven outcomes.
This skill should be used when working with DSPy.rb, a Ruby framework for type-safe, composable LLM applications.
This skill provides a promptfoo eval harness that measures whether a Soleur skill or agent edit actually improves behavior, comparing a skill arm against a baseline control arm.
This skill should be used when resolving all TODO comments in the codebase using parallel processing. It analyzes dependencies, creates a resolution plan with a mermaid flow diagram, and spawns parallel resolver agents.
| name | provision-hetzner |
| description | This skill should be used when provisioning Hetzner sub-projects and tokens for tenant infrastructure. |
Guide the operator through Hetzner Console project creation, accept a project-scoped API token, and run a write-class smoke-test to verify scope.
MUST run on the operator's local machine. MUST NOT run in CI. The Hetzner token is accepted via read -s (interactive terminal only) and never persisted to disk, env exports, or CLI args.
soleur:provision-hetzner <tenant-slug> [--dry-run]
| Argument | Required | Description |
|---|---|---|
tenant-slug | Yes | Canonical tenant identifier (kebab-case) |
--dry-run | No | Print Console guidance + smoke-test commands without executing |
bash plugins/soleur/skills/provision-hetzner/scripts/provision-hetzner.sh <slug> [--dry-run]
The script:
hcloud CLI)read -s and runs write-class smoke-test (create + delete cx11)probe-provision-<slug>) so orphans are findableIf this run provisions a persistent volume for the tenant, hcloud_volume carries no
encrypted attribute -- encryption means the guest-side LUKS apparatus (random_password ->
dedicated Doppler config -> cryptsetup luksFormat -> /dev/mapper/* mount; see
terraform-architect's Hetzner/Cloudflare requirements). Do not complete the run without adding a
row to encryption-posture-ledger.json (repo-root scripts/) for the new volume: at_rest.mechanism
(luks or a named plaintext-exception with tracking_issue + expires_on),
at_rest.evidence, at_rest.does_not_defend, at_rest.disclosed_as, and
at_rest.live_verification. This run provisions sub-projects and tokens, not volumes, so the
step is normally a no-op -- it applies only when a volume enters scope.
hr-never-label-any-step-as-manual-without) — do not treat it as permanently-manual.hcloud server delete fails, the probe server must be deleted manually via Console.