[swkeever]

Summary

• The platform skill now attaches custom domains with volcano cloud frontends domain create --tls managed (feat(frontends): attach and switch custom domains with managed TLS volcano-cli#332, CLI 0.50) and prefers managed TLS unless the user supplies a certificate.
• It covers the in-place switch between BYOC and managed TLS. If the manifest declares tls.mode, the agent changes it there too; otherwise the next config deploy switches the domain back or fails.

Verification

• node scripts/check-skills.mjs: OK (15 skills, 22 trigger cases)

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

AI review: no P0-P2 findings

Reviewed a13c83c. Run log

Docs-only change to volcano-platform/SKILL.md. It teaches agents to attach custom domains with volcano cloud frontends domain create --tls managed (CLI 0.50+). It adds a marked manifest example for older CLIs and explains how to switch an active domain between BYOC and managed TLS in place, including the need to keep the manifest's tls.mode in sync. The text matches the existing custom-domain, manifest, and snippet-gate rules, and I found no defects. The risk is low.

Not checked: The AI review read the diff, the code, and the PR's text; it ran no tests or builds and read nothing outside this repository.

• Whether CLI 0.50.0 (feat(frontends): attach and switch custom domains with managed TLS volcano-cli#332) really accepts domain create <frontend> --domain <host> --tls managed, switches TLS mode in place, and prints the _acme-challenge CNAME.
• Whether the new marked # volcano-config.yaml managed-TLS snippet passes Hosting's TestSkillManifestSnippetsCloudE2E dry-run (plan certificate limits, unverified example.com).
• Whether a later config deploy really reverts a mode switch, or fails for byoc without certificate fields, when the manifest still declares the old tls.mode.
• Confirm in feat(frontends): attach and switch custom domains with managed TLS volcano-cli#332 that CLI 0.50.0 supports the documented TLS switching behavior and emits DNS challenge records as described.

Human review: not needed

[github-actions]

⚪ P3: "Prefer managed TLS (--tls managed)" omits the CLI 0.50 requirement and gives no fallback for older CLIs

The opening paragraph tells agents to prefer --tls managed. The example block runs domain create ... --tls managed without any version note. The only mention of "needs CLI 0.50 or later" sits at the end of the unverified-managed bullet (line 627). Elsewhere this skill gates commands such as volcano deploy on 0.46.0. Many users will be on 0.46–0.49, and an agent there that follows the preference will hit an unknown-flag error. Nothing tells it what to do next: use manifest frontends[].custom_domain with tls.mode: managed through config deploy, which the same section says works, or suggest an upgrade as AGENTS.md prescribes for version gaps. Fix: put the 0.50 requirement in the "Prefer managed TLS" sentence and name the manifest route for older CLIs. Optionally write the version as 0.50.0 to match the rest of the file.

_{Found by claude-opus-5-5}

[github-actions]

⚪ P3: Older-CLI fallback tells agents to write a custom_domain manifest entry the skill never shows

Agents on a CLI older than 0.50 are now told to "declare custom_domain with tls.mode: managed and run volcano cloud config deploy". No skill in the repo shows what a frontends[].custom_domain entry looks like: the hostname key, how tls nests, or the certificate fields for byoc. An agent following this path has to guess the YAML or detour through volcano docs search, and a wrong guess fails the cloud config deploy. Adding a short marked # volcano-config.yaml example with version: 1, frontends: - name: web and its custom_domain entry would close the gap. Hosting's snippet gate (the CloudE2E test named in scripts/check-skills.mjs) would then dry-run the example.

_{Found by claude-opus-5-5}

[github-actions]

⚪ P3: Inserted sentence was not re-wrapped, leaving a ~120-character line

The second commit added "on an older CLI, declare custom_domain ... volcano cloud config deploy. Verified domains belong to the account," as one line. The paragraph around it, and the rest of the section, wraps at about 78 columns. It renders fine, but it breaks the section's formatting and makes later diffs of this paragraph harder to read. Re-wrap the paragraph.

_{Found by claude-opus-5-5}

[github-actions]

⚪ P3: Manifest fallback snippet skips the # volcano-config.yaml marker and version: 1, so Hosting's snippet gate never dry-runs it

Every other volcano-config.yaml example in this skill starts with # volcano-config.yaml and version: 1. scripts/check-skills.mjs says Hosting's staging gate (TestSkillManifestSnippetsCloudE2E) dry-runs only marked blocks, and "an unmarked manifest is never checked". This new block is the only frontends[].custom_domain example in the repo, and it is the only managed-TLS path for agents on CLIs older than 0.50. If its shape is wrong (for example the domain: key under custom_domain), nothing catches it, and those agents fail at volcano cloud config deploy. An agent that copies the block into a new volcano-config.yaml would also miss the required version: 1, which the Hard rules list a few sections up. Fix: make it a whole marked manifest (# volcano-config.yaml, version: 1, then the frontends entry) so the gate validates it. The gate project already has the web frontend that other marked snippets use.

_{Found by claude-opus-5-5}

[github-actions]

⚪ P3: Switch-to-managed bullet doesn't tell agents to relay the certificate validation CNAME

The new bullet says that after a BYOC→managed domain create, the uploaded certificate keeps serving until the managed one does, and Serving certificate reads uploaded in the meantime. It never says that the managed certificate won't serve until the user publishes the validation CNAME that domain get lists. The managed-attach bullet above mentions that CNAME, but only for an unverified attach. An agent following the switch bullet can report "switched to managed TLS" while the BYOC certificate is still serving. If the user then stops renewing their uploaded certificate, the domain breaks when it expires. Suggested fix: add one sentence telling agents to run volcano cloud frontends domain get <frontend> after the switch and relay any certificate validation record until Serving certificate no longer reads uploaded.

_{Found by claude-opus-5-5}