/alibabacloud-opc-deploy

name: alibabacloud-opc-deploy
description: "Provision a one-person company's Alibaba Cloud setup: once a package (SKU) is chosen, create and configure all the cloud resources the user needs, explaining progress at every step. WHEN TO USE: the user asks to provision / deploy / create their cloud resources, names a package directly, or continues right after the advisor's recommendation. Creating cloud resources costs money — never trigger without explicit user confirmation. 触发词（中文）：帮我开通 / 帮我部署 / 帮我创建资源 / 开始部署；直接报 SKU 名（如\"帮我开一个 lite_seed\"）；advisor 推荐完接下来怎么办。输出用中文。"

Alibaba Cloud OPC Deploy

Create all cloud resources for an OPC package step-by-step via the Aliyun CLI. After receiving the SKU prescription from `alibabacloud-opc-advisor`, follow the Phase flow to create / tag / verify / tear down resources via the Aliyun CLI. The AI assistant explains as it goes, showing progress at every step — white-box, companion-style deployment built for non-technical OPC users.

All user-facing output MUST be in **Chinese (zh-CN)**.

<!-- cli_meta: see references/cli-meta.md -->

When to Use This Skill

Activate this skill when any of the following holds:

• The user already has a SKU recommendation from `alibabacloud-opc-advisor` and explicitly says "help me provision / create / confirm purchase / start deployment"
• The user names a SKU directly (e.g., "help me spin up a lite_seed")
• The user asks "the advisor finished recommending — what's next?"

**Self-sufficient operation:** the only hard dependency of this skill is the **SKU name** — use the advisor prescription (structured fields) when present; when absent (a new session where the user names the SKU directly / advisor not installed) it still runs via built-in defaults (image family, starter fallback config, and capability boundaries are all built in). Never error out or relax safety boundaries just because advisor context is missing.

**Never auto-trigger:** creating cloud resources is a money-spending action and requires explicit user confirmation.

**BLOCKING RULE (no SKU = no action):** If the user's message does not contain a recognized SKU name (one of the 7 below) AND no advisor prescription is in context, the agent MUST NOT proceed to any Phase. It must immediately output the advisor-install guidance and STOP. Inferring, guessing, or self-selecting a SKU is a critical violation (see the SKU GATE in Hard Gates).

Supported 7 SKUs

| SKU | Resources involved | Complexity | |---|---|---| | starter_webui (main path, ¥99/yr promo hit) | ECS economy-e + ESA Free | ⭐ | | starter_webui (fallback: pay-by-traffic ¥284.99/yr when promo missed) | ECS economy-e PayByTraffic 100Mbps + ESA + CloudMonitor traffic alarm | ⭐ | | starter_app | ECS economy-e + [Token Plan manual] + [PDS manual] (shares fallback with webui) | ⭐⭐ | | lite_seed | SWAS swas.s.c2m4s50b1.linux (OpenClaw) + ECS c9i.large + RDS mysql.n2e.small.1 + OSS + [Token Plan manual] | ⭐⭐⭐ | | lite_growth | same as above, RDS upgraded to mysql.n2.medium.1 | ⭐⭐⭐ | | lite_traction | same, ECS upgraded to c9i.xlarge + RDS to mysql.n2.large.1 | ⭐⭐⭐ | | pro_steady | SWAS + ECS×2 + RDS HA mysql.n2.large.2c + OSS + ALB + ESA medium + [Token Plan manual] | ⭐⭐⭐⭐ | | pro_burst | same as pro_steady + ESS auto-scaling | ⭐⭐⭐⭐⭐ |

Iron Rules + Credential Safety

See `references/iron-rules.md` (33 iron rules + credential safety rules).

Core principles (summary):

• User confirmation before spending money + a second confirmation before payment
• AK/SK never enter the conversation; credential SETUP is RamRoleArn-only, and an already-configured credential is USED as-is (see iron-rule #16)
• Step-by-step execution + step-by-step reporting; never fail silently
• The state file must be written; sensitive files are chmod 600
• SKU product CLI-reachability static gate (Phase -1.5 precondition)
• Image selection is centrally resolved in Phase 0 + permanently bound in state

---

Execution Flow

See `references/execution-phases.md`.

| Phase | Name | Summary | |-------|------|------| | -1 | Pre-checks | Confirm Alibaba Cloud account + real-name verification + desktop AI tool | | -1.5 | CLI reachability gate (**MANDATORY standalone** — run before Phase 0; do NOT merge into Phase 0/2 or skip) | For every product this SKU touches, determine CLI reachability by **STATIC table lookup in `references/cli_capability_matrix.md` ONLY — do NOT run any aliyun CLI command to probe/verify reachability at this phase (iron-rule #25; the first real CLI call is in Phase 0)**. On any console-only product (e.g. Token Plan = console-only, no CLI path), your user-facing summary MUST explicitly name it as a manual console step and take the fallback BEFORE proceeding — never omit it or list only the CLI-reachable products. | | 0 | Env + auth | CLI install (fully automated) + credential config (RamRoleArn) + centralized image resolution (exact ImageFamily from advisor, else default Linux 3 2104 LTS; Linux 4 is experimental and forbidden for production) | | 1 | SKU + confirm | Identify SKU (strong-signal fast-path) + price inquiry (starter dual-tier) + resource list + component-removal opt-out + second payment confirmation + pre-execution hard-gate self-check | | 2 | Network infra | VPC (reuse-first) + VSwitch + security group. Whether you CREATE or REUSE the security group, you MUST call `authorize-security-group` to tighten SSH (port 22) to `${MY_IP}/32` for the current user — never skip it on reuse or assume an existing group's rules are correct (HTTP 80 / HTTPS 443 stay 0.0.0.0/0). | | 3 | Create resources | Execute in order per `references/sku-params/<sku>.yaml` steps. AFTER EACH create call: (a) call TagResources to attach `opc:managed=true` + `opc:sku=<sku>`; (b) write the resource ID + status to the state file. Both are mandatory before proceeding to the next step. | | 4 | Verify + wrap-up | Status verification + summary card + "what's next" + renewal reminder + emergency three-step incident card + state save +