| name | orchestrator |
| description | Use this skill as the top-level orchestrator for the Cloud AI agent. Coordinates all other skills to handle complex multi-step tasks. Triggers: any high-level or multi-domain request such as "onboard a new tenant end-to-end", "respond to a P1 incident", "prepare the quarterly business review", "run a full health check", "migrate this environment", or any task requiring more than one skill in sequence.
|
| tools | ["bash","computer"] |
Orchestrator Skill
The master coordination layer for the Cloud AI agent. Decomposes
high-level operator requests into ordered skill invocations, manages state
across skill boundaries, handles failures with retry/rollback logic, and
surfaces a unified result.
Skill Registry
| ID | Skill name | Domain |
|---|
| S01 | terraform-provisioning | Infrastructure lifecycle |
| S02 | cicd-pipeline-monitor | Deployment pipelines |
| S03 | incident-triage-runbook | Incident response |
| S04 | tenant-lifecycle-manager | SaaS tenant operations |
| S05 | compliance-security-scanner | Security & compliance |
| S06 | sla-monitoring-alerting | Reliability & SLOs |
| S07 | deployment-validation | Deployment quality |
| S08 | kpi-report-generator | Metrics & reporting |
| S09 | runbook-documentation-gen | Documentation |
| S10 | stakeholder-comms-drafter | Communications |
| S11 | kubernetes-cluster-manager | Kubernetes operations |
| S12 | cost-optimisation | FinOps |
| S13 | secrets-certificate-manager | Secrets & PKI |
| S14 | workload-migration | Migrations |
| S15 | policy-as-code | Governance |
| S16 | capacity-planning | Forecasting |
| S17 | observability-stack | Monitoring & logging |
| S19 | multi-cloud-networking | VNet / DNS / Firewall |
| S20 | database-operations | DB lifecycle & HA |
| S21 | disaster-recovery | Failover & DR drills |
| S22 | gitops-workflow | ArgoCD / Flux |
| S23 | service-mesh | Istio / mTLS / traffic |
| S24 | container-registry | Image lifecycle & signing |
| S25 | developer-self-service | IDP / Backstage / golden path |
| S26 | audit-siem | Audit logs / Sentinel |
| S27 | change-management | CR governance / CAB |
| S28 | chaos-load-testing | Resilience validation |
Composite Workflows
WORKFLOW-01: Full Tenant Onboarding
Step 1 S16 capacity-planning Check headroom before provisioning
Step 2 S15 policy-as-code Validate tenant config vs policies
Step 3 S01 terraform-provisioning Provision infrastructure
Step 4 S11 kubernetes-cluster-manager Configure namespace + RBAC
Step 5 S13 secrets-certificate-manager Create secrets, TLS cert
Step 6 S17 observability-stack Instrument tenant namespace
Step 7 S04 tenant-lifecycle-manager Register in tenant registry
Step 8 S07 deployment-validation Smoke test the new environment [GATE]
Step 9 S06 sla-monitoring-alerting Activate SLO monitoring
Step 10 S10 stakeholder-comms-drafter Send welcome + ops confirmation
Human gates: Step 1 (capacity approval), Step 8 (smoke test go/no-go).
WORKFLOW-02: P1 Incident Response
Step 1 S03 incident-triage-runbook Classify alert, find runbook
Step 2 S17 observability-stack Pull metrics/logs for context
Step 3 S03 incident-triage-runbook Execute runbook steps
Step 4 S10 stakeholder-comms-drafter Send first notification (< 5 min)
[Loop every 15 min] S10 Update comms until resolved
Step 5 S07 deployment-validation Recent deploy culprit? rollback
Step 6 S03 incident-triage-runbook Confirm resolution
Step 7 S06 sla-monitoring-alerting Assess SLA impact
Step 8 S10 stakeholder-comms-drafter Send resolution notice
Step 9 S09 runbook-documentation-gen Draft post-mortem
WORKFLOW-03: Weekly Compliance Scan
Trigger: Cron Monday 06:00 UTC
Step 1 S05 compliance-security-scanner IaC + container + IAM scan
Step 2 S15 policy-as-code Gatekeeper violation audit
Step 3 S13 secrets-certificate-manager Expiry and rotation audit
Step 4 S06 sla-monitoring-alerting SLA compliance status
Step 5 S08 kpi-report-generator Compile into compliance report
Step 6 S10 stakeholder-comms-drafter Email to security team
WORKFLOW-04: Monthly Executive Report
Trigger: First Monday of each month
Step 1 S08 kpi-report-generator Collect DORA + reliability metrics
Step 2 S06 sla-monitoring-alerting SLA breach log + compliance
Step 3 S12 cost-optimisation Cloud spend summary + savings
Step 4 S16 capacity-planning Next-quarter forecast
Step 5 S05 compliance-security-scanner Security posture score
Step 6 S08 kpi-report-generator Build PPTX/PDF report
Step 7 S10 stakeholder-comms-drafter Email to leadership [GATE]
WORKFLOW-05: Pre-Release Readiness Check
Trigger: "Is the platform ready for the [version] release?"
Step 1 S05 compliance-security-scanner Scan all new container images
Step 2 S07 deployment-validation Pre-flight checks across all envs
Step 3 S06 sla-monitoring-alerting Check error budget remaining
Step 4 S16 capacity-planning Confirm headroom for release traffic
Step 5 S13 secrets-certificate-manager Verify all certs valid 30+ days
Step 6 S15 policy-as-code No open policy violations
Step 7 S17 observability-stack Confirm dashboards + alerts live
Output: GO / NO-GO with reasons for any blockers.
WORKFLOW-06: Quarterly Business Review Prep
Trigger: "Prepare the Q[N] QBR for Cloud AI"
Step 1 S08 kpi-report-generator 90-day DORA + reliability trends
Step 2 S12 cost-optimisation Quarter spend + savings delivered
Step 3 S16 capacity-planning Next quarter resource + cost forecast
Step 4 S06 sla-monitoring-alerting SLA compliance + breach summary
Step 5 S05 compliance-security-scanner Quarter security improvements
Step 6 S09 runbook-documentation-gen Roadmap milestone status doc
Step 7 S08 kpi-report-generator Assemble full QBR PPTX deck
Step 8 S10 stakeholder-comms-drafter Draft QBR email invite + agenda
WORKFLOW-07: New Cluster Provisioning
Trigger: "Provision a new [env] cluster in [region]"
Step 1 S27 change-management Raise and score change request [GATE]
Step 2 S16 capacity-planning Confirm quota + cost headroom
Step 3 S19 multi-cloud-networking Provision VNet / VPC / spoke / peering / DNS
Step 4 S01 terraform-provisioning Provision AKS / EKS / GKE cluster
Step 5 S11 kubernetes-cluster-manager Harden node pools, RBAC, network policy
Step 6 S13 secrets-certificate-manager Bootstrap cluster secrets + cert-manager
Step 7 S15 policy-as-code Deploy Gatekeeper + OPA policy bundle
Step 8 S22 gitops-workflow Bootstrap Argo CD / Flux on cluster
Step 9 S23 service-mesh Install Istio, enforce mTLS
Step 10 S24 container-registry Grant AcrPull to cluster identity
Step 11 S17 observability-stack Deploy Prometheus / Loki / Grafana stack
Step 12 S06 sla-monitoring-alerting Activate SLO alert rules
Step 13 S26 audit-siem Enable K8s audit log → Sentinel
Step 14 S07 deployment-validation Smoke test cluster readiness [GATE]
Step 15 S09 runbook-documentation-gen Auto-generate cluster runbook
Step 16 S10 stakeholder-comms-drafter Notify teams cluster is ready
Human gates: Step 1 (change approval), Step 14 (GO/NO-GO).
WORKFLOW-08: Security Incident Response
Trigger: Sentinel alert HIGH/CRITICAL, security scanner critical finding, or "investigate security event"
Step 1 S26 audit-siem Pull full audit trail for the event
Step 2 S03 incident-triage-runbook Classify severity, find security runbook
Step 3 S05 compliance-security-scanner Scan affected resources for additional IOCs
Step 4 S10 stakeholder-comms-drafter Notify security team + management [GATE]
Step 5 S15 policy-as-code Apply emergency isolation policy if needed
Step 6 S13 secrets-certificate-manager Rotate any potentially compromised secrets
Step 7 S26 audit-siem Continuous audit tail until resolved
Step 8 S03 incident-triage-runbook Confirm containment, close incident
Step 9 S09 runbook-documentation-gen Draft security incident post-mortem
Step 10 S05 compliance-security-scanner Full re-scan to confirm clean posture
Human gates: Step 4 (confirm scope before action), Step 5 (isolation approval).
WORKFLOW-09: Disaster Recovery Drill
Trigger: "Run DR drill for [tier/tenant]" or scheduled quarterly
Step 1 S27 change-management Raise change request for drill window [GATE]
Step 2 S10 stakeholder-comms-drafter Pre-drill notice to affected teams
Step 3 S21 disaster-recovery Execute backup integrity validation
Step 4 S20 database-operations Verify geo-replica lag within RPO target
Step 5 S21 disaster-recovery Execute full failover to DR region [GATE]
Step 6 S17 observability-stack Confirm observability in DR region
Step 7 S06 sla-monitoring-alerting Measure RTO — compare to target
Step 8 S21 disaster-recovery Execute failback to primary region
Step 9 S06 sla-monitoring-alerting Confirm SLOs restored after failback
Step 10 S08 kpi-report-generator Record RTO/RPO actuals vs targets
Step 11 S09 runbook-documentation-gen Update DR runbook with drill findings
Step 12 S10 stakeholder-comms-drafter Send drill results to leadership
Human gates: Step 1 (change approval), Step 5 (confirm initiate failover).
WORKFLOW-10: New Team Platform Onboarding
Trigger: "Onboard the [team name] engineering team to the platform"
Step 1 S25 developer-self-service Create team in Backstage catalog
Step 2 S15 policy-as-code Validate team config vs RBAC policies
Step 3 S01 terraform-provisioning Provision dev + staging namespaces
Step 4 S11 kubernetes-cluster-manager Configure namespace RBAC for team
Step 5 S22 gitops-workflow Create ArgoCD project + ApplicationSet
Step 6 S13 secrets-certificate-manager Bootstrap team secrets namespace
Step 7 S19 multi-cloud-networking Create private endpoints if required
Step 8 S17 observability-stack Provision team dashboards in Grafana
Step 9 S24 container-registry Grant team AcrPush to dev registry
Step 10 S26 audit-siem Enable audit logging for team namespace
Step 11 S25 developer-self-service Generate and deliver onboarding checklist
Step 12 S08 kpi-report-generator Add team to platform adoption metrics
Step 13 S10 stakeholder-comms-drafter Send welcome email + portal link
Human gates: None for standard teams. Step 3 requires approval for enterprise-scale resource requests.
Scheduling
schedules:
- workflow: compliance-scan
cron: "0 6 * * 1"
- workflow: cert-expiry-check
cron: "0 9 * * *"
- workflow: capacity-check
cron: "0 10 * * 1"
- workflow: monthly-exec-report
cron: "0 7 1 * *"
- workflow: sla-error-budget
cron: "*/30 * * * *"
- workflow: dr-drill
cron: "0 10 15 */3 *"
- workflow: chaos-experiment
cron: "0 14 * * 3"
- workflow: audit-siem-review
cron: "0 8 * * 1"
- workflow: change-calendar
cron: "0 7 * * 5"
Escalation Policy
| Workflow | Escalate to | Channel |
|---|
| Tenant onboarding | on-call | PagerDuty P3 |
| P1 incident | lead + CTO | PagerDuty P1 |
| Security incident | CISO + lead | PagerDuty P1 |
| Compliance scan | Compliance | Slack + Teams |
| Executive report | manager | Slack + Teams |
| Migration failure | lead | PagerDuty P2 |
| DR drill failure | lead + architects | PagerDuty P2 |
| Change freeze violation | manager + CISO | Slack + Teams |
| Chaos experiment SLO abort | on-call | PagerDuty P3 |
| Cluster provisioning fail | lead | PagerDuty P2 |
Run State Schema
{
"run_id": "RUN-20250601-0142",
"workflow": "WORKFLOW-01",
"status": "success|running|failed|pending_approval",
"started_at": "ISO8601",
"completed_at": "ISO8601",
"steps_completed": 0,
"steps_total": 0,
"human_gates": [],
"errors": []
}
Examples
- "Onboard a new enterprise tenant Acme Corp in East US — full workflow"
- "Run a complete health check across all environments"
- "We have a P1 — take over incident response for the AKS/EKS/GKE degradation alert"
- "Is the infrastructure ready to release v2.4 to production?"
- "Prepare everything needed for the Q3 QBR deck"
- "Run the weekly compliance scan and email the security team"
- "Provision a new staging cluster in West Europe"
- "Sentinel fired a critical alert on the payments namespace — investigate"
- "Run the quarterly DR drill for all enterprise tenants"
- "Onboard the new checkout engineering team to the system"
