/alibabacloud-flink-ai-ops

name: alibabacloud-flink-ai-ops
description: >
  Use when users of Alibaba Cloud Realtime Compute for Apache Flink (阿里云实时计算Flink版)
  want to use the cloud AI assistant (云端AI智能助手) for Q&A (问答), intelligent
  job diagnosis (智能诊断), multi-turn conversation (多轮会话), or responding to
  pending approvals (审批续接). Also use to query and modify scheduled patrol
  configuration (定时巡检配置), manually trigger a patrol (手动触发巡检), list and
  query patrol reports (查询巡检报告), wait for and interpret patrol reports
  (等待并解读巡检报告), or validate assistant and patrol inputs locally.
  Out of scope are regular or strictly read-only job diagnosis, SQL, job and
  session cluster operations, instance management, AI service enablement and
  disablement, IM channels, cloud-side skill management, and other cloud products.
license: Apache-2.0
metadata:
  domain: aiops
  requirements: Python 3.10+, official Ververica SDK 1.14.0, default credential chain, and network access to the development console OpenAPI

Alibaba Cloud Flink AI Intelligent Operations

1. Scenario Description

Two categories of AI-powered operations work through the Alibaba Cloud Realtime Compute for Apache Flink development console (Ververica OpenAPI):

1. **AI assistant (ChatAiAgent)**: natural-language Q&A, job diagnosis suggestions, multi-turn conversation, and HITL (Human-in-the-Loop) approval continuation before write operations. 2. **Intelligent patrol**: query and modify scheduled patrol configuration, manually trigger a patrol, and boundedly wait for and interpret risk reports.

Trigger phrases: the user explicitly asks for the "AI assistant / intelligent assistant analysis", "patrol / scheduled patrol configuration", "patrol report", etc.; explicitly running `scripts/flink_ai_ops_cli.py` also triggers this skill. Regular job diagnosis, SQL, job or session cluster operations, and strictly read-only diagnosis are routed to `alibabacloud-flink-workspace-ops`; instance management is routed to `alibabacloud-flink-instance-manage`.

**Architecture**: `Flink development console OpenAPI (ververica 2022-07-18) + ChatAiAgent (SSE streaming conversation + HITL approval) + intelligent patrol (5 APIs for configuration / trigger / report) + Python Common SDK (alibabacloud-ververica20220718 1.14.0) + local CLI wrapper (scripts/flink_ai_ops_cli.py)`

flowchart LR
    U["User request"] --> C["Local CLI wrapper<br/>scripts/flink_ai_ops_cli.py"]
    C -->|"SDK signed request"| A["ChatAiAgent<br/>SSE streaming + HITL approval"]
    C -->|"SDK signed request"| P["Intelligent patrol<br/>config / trigger / report"]
    A --> R["Event aggregation / approval continuation / read-only recheck"]
    P --> W["Bounded wait / report evidence interpretation"]
    R --> J["Unified JSON envelope output"]
    W --> J

2. Installation

Create a local virtual environment with Python 3.10 or later in the skill root and install the dependencies. The Python SDK handles all cloud requests independently of the Alibaba Cloud CLI and its plugins.

python3 -m venv .venv
.venv/bin/python -m pip install -r assets/requirements.txt
.venv/bin/python -m pip check

`assets/requirements.txt` pins the official SDK to `alibabacloud-ververica20220718==1.14.0`. Run `scripts/flink_ai_ops_cli.py` with `.venv/bin/python`, or run `source .venv/bin/activate` before using the `python3` examples below. Copy the entire skill directory when installing and resolve relative paths from its root. The SDK uses its default credential chain. See [Command and Auth](references/command-and-auth.md).

3. Environment Variables

| Variable | Required | Description | | --- | --- | --- | | `ALIBABA_CLOUD_ACCESS_KEY_ID` | Credential chain fallback | Alibaba Cloud AccessKey ID. Reading, echoing, or asking for the real value in the session is forbidden | | `ALIBABA_CLOUD_ACCESS_KEY_SECRET` | Credential chain fallback | AccessKey Secret. Same rule | | `ALIBABA_CLOUD_SECURITY_TOKEN` | STS only | STS temporary credential token | | `SKILL_SESSION_ID` | Yes | Freshly generated 32-char lowercase hexadecimal tracking ID for this session; see [SDK Request Tracing](#7-sdk-request-tracing) | | `SKILL_VERSION` | Yes | Taken from the top-level `version` field of this skill's manifest; see [SDK Request Tracing](#7-sdk-request-tracing) |

Credentials may also come from the local credential file, a RAM role, or OIDC (resolved automatically by the default credential chain); the environment-variable path is not mandatory.

4. Authentication

• Use the SDK default credential chain; do not conclude credentials are missing merely because environment variables are unset. Only guide configuration when credential resolution ultimately fails (`MissingCredentials`).
• **Security rules**: never read, echo, or print any AK/SK value; commands such as `echo $ALIBABA_CLOUD_ACCESS_KEY_ID` are forbidden; never ask the user for plaintext credentials in the session or on the command line.
• When credentials are missing, the user configures them in the terminal where the execution process is started (placeholders below are redacted and must not be executed as-is):

export ALIBABA_CLOUD_ACCESS_KEY_ID='***REDACTED***'
export ALIBABA_CLOUD_ACCESS_KEY_SECRET='***REDACTED***'
export ALIBABA_CLOUD_SECURITY_TOKEN='***REDACTED***'   # required only for STS temporary credentials

The executing process must inherit the new environment; exporting in another terminal does not update an already-started process. Configuration methods and official docs are in [Command and Auth](references/command-and-auth.md). Insufficient permissions or expired credentials keep their real error codes; do not relabel them as missing credentials.

5. RAM Permissions

The target workspace needs access to Flink AI features before using the assistant or intelligent patrol. The [RAM permission reference](references/ram-policies.md) lists the published `stream:` actions and identifies the patrol write operations whose actions are unpublishe