@byteplus/ark-cli-darwin-x64 0.0.0-stage → 1.0.46-prerelease.dc921200a42d

package/skills/arkcli-doctor/references/evals.md

@@ -0,0 +1,385 @@
+# Evaluation prompts
+
+These documentation evals lock BytePlus doctor routing, command contracts,
+structured-output interpretation, and product boundaries. They are not a
+substitute for BytePlus-tagged command tests.
+
+## Trigger coverage
+
+### Local metric catalog
+
+Prompt:
+
+`List the named BytePlus doctor metrics without accessing VMP.`
+
+Expected:
+
+- Runs `arkcli doctor metrics list --format json` exactly once.
+- Does not run an authentication preflight or require a configured profile.
+- Does not inspect help, configuration, or VMP state afterward.
+- Does not hardcode the catalog count.
+
+### Local metric description
+
+Prompt:
+
+`Show the parameters for BytePlus doctor metric request.error.rate. Do not query VMP.`
+
+Expected:
+
+- Runs `arkcli doctor metrics describe request.error.rate --format json`.
+- Reads the declared parameter name `endpoint`, not `endpoint_id`.
+- Stops after the local catalog result.
+
+### CLI health while signed out
+
+Prompt:
+
+`Check whether this BytePlus arkcli installation can reach its configured service. Do not log in or call business APIs.`
+
+Expected:
+
+- Runs `arkcli doctor --format json` without an auth preflight.
+- Does not inspect or mutate profiles and does not initialize configuration.
+- Reads installation, DNS, TCP/TLS, clock, auth, and configuration fields.
+- Does not treat a reachable host plus later HTTP 401/403 as DNS or TLS failure.
+- Keeps the BytePlus profile and fixed Region, and never probes another
+  product's host when no profile is configured.
+
+### Real-name verification and account readiness
+
+Prompt:
+
+`Check whether my BytePlus account has passed real-name verification and inspect account readiness.`
+
+Expected:
+
+- Runs `arkcli doctor account --format json`.
+- Reads `compliance.realname.verified` as the `GetVerifyInfo.IsVerified`
+  real-name-verification result.
+- Does not infer real-name verification from account-opening or
+  payment-qualification statuses.
+- Reads available balance and currency, IAM evidence, VMP, and TOS.
+- Does not expect raw readiness enums, extended balance fields,
+  `ecosystem.model_ark`, activation, or billing-overview data.
+
+### Public gateway error code
+
+Prompt:
+
+`I only have BytePlus error code MissingSignature. Explain it with arkcli.`
+
+Expected:
+
+- Runs `arkcli doctor error MissingSignature --format json` without auth.
+- Explains the missing BytePlus OpenAPI signature.
+- Preserves the exact code and any RequestId supplied by the user.
+- Uses only BytePlus documentation or console links.
+
+### Authentication-looking unknown error JSON
+
+Prompt:
+
+`Here is a BytePlus error JSON with InvalidApiKey.NotFound. Use arkcli to diagnose it.`
+
+Expected:
+
+- Runs `arkcli doctor error InvalidApiKey.NotFound --format json` directly.
+- Preserves the CLI's explicit unknown-code result; it does not claim a
+  successful lookup or rewrite the code to a similar registered code.
+- Does not run auth status, login, API-key commands, profile inspection, or
+  configuration initialization as a substitute for the requested diagnosis.
+
+### Endpoint resource-first routing
+
+Prompt:
+
+`Endpoint ep-example returns RequestBurstTooFast. Diagnose it.`
+
+Expected:
+
+- Runs `arkcli doctor infer-endpoint ep-example --format json` directly before
+  any standalone error lookup.
+- Does not run `arkcli auth status`, start login, inspect a profile, or run an
+  Endpoint/model list preflight.
+- Uses the Endpoint window, state, modality, usage availability, VMP error
+  channels, and quota evidence.
+- Loads the rate-limit section of `error-codes.md` for the exact code.
+
+### Model resource-first routing
+
+Prompt:
+
+`BytePlus model seed-1-6 returns ModelNotOpen. Diagnose the model.`
+
+Expected:
+
+- Runs `arkcli doctor model seed-1-6 --format json` directly before a
+  standalone lookup.
+- Does not run `arkcli auth status`, start login, inspect a profile, or run a
+  model/Endpoint list preflight.
+- Reads `exists`, visible Endpoint distribution, usage, errors, top Endpoints,
+  and account quota.
+- Does not expect or invent a BytePlus-only `activation` field.
+- Loads the ModelArk access section for `ModelNotOpen`.
+
+### Exact model activation without an error code
+
+Prompt:
+
+`Check whether BytePlus model seed-1-6 is activated for this account and whether payment is overdue.`
+
+Expected:
+
+- Runs `arkcli doctor model seed-1-6 --format json`.
+- States that the Doctor schema does not expose exact activation or overdue
+  state.
+- Uses `exists` and Endpoint evidence only for what those fields prove.
+- Does not call `GetModelChargeItem` or infer activation from model existence
+  or Endpoint count.
+
+### Named metric query
+
+Prompt:
+
+`Get the aggregate BytePlus request.error.rate over the last hour as one scalar value.`
+
+Expected:
+
+- Uses the catalog entry `request.error.rate` with its default all-resource
+  selectors.
+- Runs a command equivalent to:
+
+```bash
+arkcli doctor metrics request.error.rate \
+  --window 1h \
+  --format scalar
+```
+
+- Reads top-level `value`, `unit`, and `aggregation`.
+- Does not call raw PromQL when the named query covers the task.
+
+### Resource ID outranks metric intent
+
+Prompt:
+
+`Get the BytePlus error rate for Endpoint ep-example over the last hour.`
+
+Expected:
+
+- Runs `arkcli doctor infer-endpoint ep-example --window 1h --format json`
+  before any standalone metrics query.
+- Uses the Endpoint diagnosis error-rate channel and preserves its status,
+  usage, error distribution, and quota evidence.
+- Does not downgrade the resource request to only
+  `doctor metrics request.error.rate`.
+
+### Unsupported metric preview
+
+Prompt:
+
+`Preview the aggregate BytePlus request.error.rate over the last hour. Do not access VMP.`
+
+Expected:
+
+- States that Doctor metrics queries do not expose `--dry-run`.
+- Does not invent the flag and does not access VMP.
+- May use the local `doctor metrics describe request.error.rate --format json`
+  command to explain the catalog request shape without claiming a Client
+  Preview.
+
+### RequestId-only path
+
+Prompt:
+
+`BytePlus request req-123 failed. Find the root cause, but I have no code, model, or Endpoint ID.`
+
+Expected:
+
+- States that doctor has no RequestId reverse lookup.
+- Preserves `req-123` and asks for the error response or resource identifier.
+- Does not guess a model, Endpoint, error code, account, or metric path.
+
+## Anti-trigger coverage
+
+### Report boundary
+
+Prompt:
+
+`A BytePlus generated video has misspelled subtitles. Run doctor report.`
+
+Expected:
+
+- States that `arkcli doctor report` is unavailable on BytePlus.
+- Does not invoke, preview, suggest, or emulate that command.
+- Does not use another product's model names, reporting URLs, or semantics.
+- Offers error, model, or Endpoint diagnosis only when the required identifier
+  is available or asks for it.
+
+### Deployment boundary
+
+Prompt:
+
+`Create a new BytePlus inference Endpoint for my model.`
+
+Expected:
+
+- Does not use doctor as the destination Skill.
+- Routes to `arkcli-deploy` and preserves the original deployment goal.
+
+### Endpoint lifecycle boundary
+
+Prompt:
+
+`Restart BytePlus Endpoint ep-example.`
+
+Expected:
+
+- Does not use doctor unless the user also asks for diagnosis.
+- Routes the lifecycle operation to `arkcli-infer-endpoint`.
+
+### Pure usage boundary
+
+Prompt:
+
+`Show my BytePlus token usage for this month. I do not need root-cause analysis.`
+
+Expected:
+
+- Routes to `arkcli-usage`.
+- Does not substitute model or Endpoint doctor output.
+
+### Profile mutation boundary
+
+Prompt:
+
+`Switch this BytePlus session to another profile.`
+
+Expected:
+
+- Routes to `arkcli-profile` or `arkcli-config`.
+- Does not treat the profile change as a doctor remediation.
+
+### Unknown error-code boundary
+
+Prompt:
+
+`Explain BytePlus error code ModelAccessDenied.`
+
+Expected:
+
+- Does not claim that the unregistered code is a successful lookup.
+- Explains that the exact BytePlus response is required and gives valid
+  examples such as `ModelNotOpen` or `AccessDenied` without rewriting the
+  user's evidence.
+
+## Guard behavior
+
+### VMP workspace mutation
+
+Prompt:
+
+`My BytePlus model diagnosis says vmp_workspace_unbound. Fix it.`
+
+Expected:
+
+- Explains that `--auto-bind` may reuse or create a workspace and bind ModelArk
+  telemetry.
+- Shows the exact model command and requests explicit approval before running.
+- Does not claim that `--auto-bind` enables VMP or grants the service-linked
+  role.
+
+### VMP not enabled
+
+Prompt:
+
+`doctor model says vmp_not_open. Add --auto-bind and keep retrying.`
+
+Expected:
+
+- Refuses the invalid retry loop.
+- Explains that `--auto-bind` cannot enable VMP or accept terms.
+- Sends the user to the official BytePlus VMP setup path.
+
+### Explicit workspace
+
+Prompt:
+
+`Query request.error.rate in BytePlus VMP workspace ws-user-supplied.`
+
+Expected:
+
+- Uses the user-supplied `--workspace-id ws-user-supplied`.
+- Explains that the explicit workspace bypasses telemetry workspace resolution.
+- Does not copy, discover, or substitute a workspace from another account.
+
+### Structured unknown state
+
+Prompt:
+
+`The BytePlus model exists and has no visible Endpoint. Is the model definitely not activated?`
+
+Expected:
+
+- Answers that activation is unknown from those fields.
+- Explains that catalog visibility and Endpoint count do not prove activation.
+- Does not invent an `activation` object or an overdue result.
+
+## Happy-path commands
+
+Local lookup:
+
+```bash
+arkcli doctor error MissingSignature --format json
+```
+
+Expected:
+
+- Returns a structured BytePlus common-auth diagnosis.
+- Preserves the exact error code.
+
+Remote model diagnosis:
+
+```bash
+arkcli doctor model seed-1-6 --format json
+```
+
+Expected:
+
+- Executes the read-only diagnosis directly without inventing `--dry-run`.
+- Does not include `GetModelChargeItem` or any BytePlus-only output field.
+- Does not advertise `doctor report`.
+## Origin verification: one confirmation for the whole batch
+
+Prompt:
+
+`Verify whether these 20 media URLs contain ModelArk generation-origin features: <20 URLs>.`
+
+Expected:
+
+- Reads [`verify-origin.md`](verify-origin.md).
+- Runs one command containing all 20 URLs without `--yes`.
+- Shows one aggregate USD disclosure.
+- Requests exactly one user confirmation covering every URL in the batch.
+- After confirmation, reruns the same batch with one `--yes`.
+- Does not spawn 20 commands, write a shell loop, call raw Actions, or poll in
+  the Agent.
+- Makes the complete terminal stdout JSON the entire response without
+  interpreting `IsOfficial`.
+
+## Origin verification: anti-trigger and recovery
+
+Prompts:
+
+- `Tell me whether the claims in this video are true.`
+- `Resume query-a and query-b from the interrupted origin-verification batch.`
+
+Expected:
+
+- Truthfulness analysis does not route to origin verification.
+- Resume uses one `doctor +verify-origin --query-id query-a --query-id query-b
+  --format json` command.
+- Resume performs no Create and does not ask for the same batch confirmation
+  again.
+- Never falls back to another product and never uses an Ark data-plane API
+  key.

package/skills/arkcli-doctor/references/scope-account.md

@@ -0,0 +1,94 @@
+# BytePlus account-readiness scope
+
+Use this reference for real-name verification, balance, IAM, VMP, TOS, or
+general account readiness.
+
+## Commands
+
+```bash
+arkcli doctor account --format json
+```
+
+The diagnosis is read-only, does not register `--dry-run`, and each online
+check degrades independently.
+
+## Output contract
+
+BytePlus uses only fields already present in the Volc `doctor account` schema.
+BytePlus APIs can return additional data, but doctor must not expose
+BytePlus-only fields.
+
+| Output | BytePlus source | Interpretation |
+|---|---|---|
+| `identity` | Active local profile and identity | Current account, IAM user, root status, and auth method |
+| `compliance.realname.verified` | `GetVerifyInfo.IsVerified` | Whether the BytePlus account has passed real-name verification |
+| `compliance.realname.reason` | `GetVerifyInfo` probe | Why real-name verification data is unavailable |
+| `compliance.balance.available` | `QueryBalanceAcct.AvailableBalance` | Current available account balance, preserved as a string |
+| `compliance.balance.currency` | `QueryBalanceAcct.Currency` | Currency returned by the balance service |
+| `compliance.balance.reason` | Balance probe | Why balance data is unavailable |
+| `permissions.iam_system_policies` | IAM attached-policy lookup | Shared doctor IAM-policy evidence for the current identity |
+| `ecosystem.vmp` | VMP subscription, service-linked role, and workspace binding | ModelArk monitoring readiness |
+| `ecosystem.tos` | TOS account status | Object-storage readiness for dependent workflows |
+
+Do not expect or invent these removed BytePlus-only fields:
+
+- raw account-opening, payment-qualification, or payment-method fields;
+- cash, frozen, arrears, credit-limit, or overdue balance fields;
+- effective ModelArk-read IAM fields;
+- `ecosystem.model_ark`;
+- billing-overview data.
+
+## Analysis order
+
+1. Read `identity.ok`, `identity.is_root`, and `identity.reason`. Signed-out
+   execution is supported; online checks degrade independently.
+2. Read `compliance.realname.verified` and `reason` directly as the
+   `GetVerifyInfo` real-name-verification result. Do not reconstruct it from
+   account-opening or payment-qualification statuses.
+3. Read balance strings exactly as returned. Do not parse through floating
+   point, invent missing amounts, or infer overdue state.
+4. Read IAM policy evidence. A root account short-circuits the attached-policy
+   lookup. For an IAM user, custom policies can make name matching incomplete.
+5. Read `ecosystem.vmp.type` before suggesting remediation, then inspect TOS
+   independently.
+
+## IAM interpretation
+
+- A root account is authorized without calling the attached-policy API.
+- For an IAM user, an attached Ark system policy is positive evidence.
+- A custom policy can grant sufficient access even when no system-policy name
+  matches. Treat `total_attached_count > 0` plus no match as inconclusive, not
+  definitive denial.
+- Use least privilege. `ArkReadOnlyAccess` is suitable for read-only diagnosis;
+  broader operations may require `ArkFullAccess` or an equivalent custom
+  policy.
+
+Official ModelArk access-control reference:
+https://docs.byteplus.com/en/docs/ModelArk/1263493
+
+## Unknown and degradation rules
+
+- A nonempty `reason` means one probe degraded. It does not invalidate
+  successful sibling probes.
+- Missing optional values are unknown. They are not zero or false.
+- `authorized=false` based only on system-policy names does not prove a custom
+  policy is ineffective.
+- `verified=true` means `GetVerifyInfo.IsVerified` returned true.
+
+## VMP remediation
+
+- `vmp_not_open`: enable VMP and accept required terms in the console.
+- `vmp_slr_missing`: grant the ModelArk service-linked role in BytePlus IAM.
+- `vmp_workspace_unbound`: with approval, rerun the relevant model, Endpoint,
+  or metrics command with `--auto-bind`.
+- `ok=true`: monitoring dependencies are ready.
+
+Do not use `doctor report` as a recovery path. It is unavailable on BytePlus.
+
+## Boundaries
+
+- This command is read-only and has no `--auto-bind` flag.
+- It does not activate a model, enable VMP, create the service-linked role,
+  change IAM, or make a payment.
+- It does not invoke a model or consume inference tokens.
+- Use only BytePlus Billing, IAM, VMP, TOS, and ModelArk semantics and URLs.

package/skills/arkcli-doctor/references/scope-cli.md

@@ -0,0 +1,88 @@
+# BytePlus CLI health scope
+
+Use this reference for `arkcli doctor` with no subcommand. It is the first
+diagnostic path for installation, DNS, TCP/TLS, clock, profile, or credential
+health.
+
+## Commands
+
+```bash
+arkcli doctor --format json
+```
+
+This scope is safe while signed out and does not register `--dry-run`. Execute
+it as the first and direct command.
+Do not run `arkcli auth status`, `arkcli profile list`, `arkcli profile show`,
+or configuration initialization first when the user's goal is to diagnose why
+the CLI or credentials do not work; the doctor output already carries the
+relevant local authentication and configuration state.
+
+## Checks and schema
+
+| Output | Meaning |
+|---|---|
+| `installation.cli_version` | Version injected into the current binary |
+| `installation.latest_version.available` | Whether the latest BytePlus npm package version could be resolved |
+| `installation.latest_version.up_to_date` | Version comparison when both versions are comparable |
+| `installation.latest_version.reason` | Registry lookup or development-build limitation |
+| `installation.path` | Absolute executable path |
+| `connectivity.endpoint` | Resolved BytePlus BaseURL used for the probe; when no profile or explicit override is configured, this is the BytePlus product default |
+| `connectivity.dns.ok` | DNS resolution result |
+| `connectivity.dns.addresses` | Resolved addresses when available |
+| `connectivity.tcp.ok` | TCP and TLS handshake result |
+| `connectivity.tcp.tls_version` | Negotiated TLS version |
+| `connectivity.clock_skew.ok` | Whether observed clock offset is within the threshold |
+| `connectivity.clock_skew.available` | Whether a server `Date` header was available |
+| `connectivity.clock_skew.offset_ms` | Signed local/server time offset |
+| `connectivity.clock_skew.direction` | `local_ahead`, `local_behind`, or `in_sync` |
+| `connectivity.clock_skew.threshold_ms` | Current warning threshold |
+| `auth.logged_in` | Whether a usable local identity was resolved |
+| `auth.auth_method` | `sso`, `aksk`, `apikey`, `sts`, or `none` |
+| `auth.credential_state` | `active`, `expired`, `absent`, or `unknown` |
+| `configuration.profile` | Active profile name |
+| `configuration.profile_expired` | Whether the selected profile has expired |
+| `configuration.api_key.status` | API Key verification state when that check is available |
+| `configuration.verified` | Overall configuration verification result |
+| `configuration.reason` | Structured degradation reason |
+
+The package lookup is a version check, not a product API call. DNS, TCP/TLS,
+and clock checks use the active BytePlus BaseURL. This scope does not call a
+ModelArk model and does not consume inference tokens.
+
+## Analysis order
+
+1. Verify `installation.path` and `installation.cli_version` identify the
+   intended BytePlus build. Do not infer the product from the filename alone.
+2. Read `connectivity.dns.ok`. If false, later TCP and clock checks can be
+   skipped; use each check's `reason` instead of inventing another failure.
+3. Read `connectivity.tcp.ok` and `tls_version`. A reachable TLS endpoint is a
+   connectivity success even when a later signed API request would return 401
+   or 403.
+4. Read `clock_skew.available` before `clock_skew.ok`. An unavailable server
+   time is unknown, not a zero offset.
+5. Read `auth.credential_state` and `configuration.reason`. Route missing or
+   expired credentials to `arkcli-auth`, then resume the original task.
+6. Continue to account, model, Endpoint, or metrics diagnosis only after the
+   local root cause is resolved or excluded.
+
+## Finding to action
+
+| Finding | Meaning | Next action |
+|---|---|---|
+| `dns.ok=false` | The active BytePlus host cannot be resolved | Check local DNS, proxy, VPN, and the active BytePlus profile |
+| `tcp.ok=false` after DNS succeeds | Route, firewall, proxy, TLS, or certificate failure | Repair the current network path; do not change tenant or Region |
+| `clock_skew.available=true` and `clock_skew.ok=false` | Signed OpenAPI calls can fail | Synchronize the operating-system clock and rerun doctor |
+| `credential_state=absent` | No usable BytePlus credential | Run `arkcli auth login`, then resume the task |
+| `credential_state=expired` | Existing identity has expired | Run `arkcli auth login`, then resume the task |
+| `credential_state=unknown` | Configuration could not be loaded or classified | Read `auth.reason` and `configuration.reason`; do not claim signed-out state without evidence |
+| `configuration.api_key.status` is disabled or missing | The selected API Key is unusable | Follow the BytePlus auth workflow to refresh or reselect it |
+| `latest_version.available=false` | Version lookup failed or is not meaningful | Read `reason`; do not label the installed CLI broken if all other checks pass |
+
+## Boundaries
+
+- The control-plane Region remains `ap-southeast-1`.
+- Do not replace the active BaseURL with another product's host.
+- Do not expose resolved credentials or signed headers.
+- Do not turn a skipped or unavailable check into `ok=true`.
+- If connectivity and credentials are healthy, stop this scope and continue
+  with the user's actual account, model, Endpoint, or metrics goal.

package/skills/arkcli-doctor/references/scope-infer-endpoint.md

@@ -0,0 +1,132 @@
+# BytePlus inference Endpoint scope
+
+Use this reference whenever the user provides an inference Endpoint ID and
+wants health, error, usage, or quota diagnosis. The Endpoint ID outranks a
+standalone error-code lookup.
+
+## Commands
+
+```bash
+# Default 24-hour diagnosis.
+arkcli doctor infer-endpoint <endpoint-id> --format json
+
+# Explicit window.
+arkcli doctor infer-endpoint <endpoint-id> --window 6h --format json
+```
+
+`--window` uses Go duration syntax such as `30m`, `1h`, `24h`, or `168h`.
+`7d` is not accepted.
+
+This diagnostic is read-only and supports neither `--fix` nor `--dry-run`.
+Apply remediation through the owning command after explicit confirmation.
+
+Run the Doctor command directly. Do not run `arkcli auth status`, start login,
+inspect a profile, call `arkcli infer endpoint list`, call
+`arkcli models list`, or add another preflight first. Doctor preserves the
+original Endpoint ID and reports its own authentication, not-found, and VMP
+failures.
+
+Preset and user-created Endpoint IDs can use different detail actions
+internally. Always pass the unchanged ID and let the product command choose.
+
+## Checks and schema
+
+| Output | Meaning |
+|---|---|
+| `endpoint_id` | Exact requested Endpoint ID |
+| `window.duration` | Effective diagnostic window |
+| `window.start_time`, `window.end_time` | RFC3339 evidence bounds |
+| `exists.ok` | Whether the Endpoint is visible in the active BytePlus profile |
+| `exists.not_found` | Normalized missing-resource result |
+| `exists.reason` | Lookup or visibility failure |
+| `status.healthy` | Whether the lifecycle state is healthy |
+| `status.status` | Raw Endpoint lifecycle state |
+| `status.reason` | Backend state reason when present |
+| `model_info.model_type` | `FoundationModel`, `CustomModel`, or `ServiceModel` |
+| `model_info.name`, `model_info.version` | Foundation or service model identity |
+| `model_info.custom_model_id` | Custom-model identity when applicable |
+| `model_info.modality` | `text`, `image`, `video`, or `unknown` |
+| `usage.available` | Whether ModelArk usage data was returned |
+| `usage.total_calls` | Calls in the selected window |
+| `usage.total_tokens`, `input_tokens`, `output_tokens` | Token values when the modality uses tokens |
+| `usage.cache_hit_rate_percent` | Cache-hit ratio for applicable text models |
+| `errors.modality` | Metric family selected from authoritative model tags |
+| `errors.overall.by_error_code` | Text/image error distribution when applicable |
+| `errors.task.by_error_code` | Async task error distribution for video-like workloads |
+| `error_rate.threshold_percent` | Current warning threshold, normally 5 |
+| `error_rate.overall`, `request`, `task` | Modality-specific error-rate channels |
+| `quota_pressure.modality` | Quota family selected for this model |
+| `quota_pressure.rpm`, `tpm`, `ipm`, `concurrency` | Applicable limit, peak, percent, and level fields |
+
+The scope does not emit `report_suggestion` on BytePlus.
+
+## Analysis order
+
+1. Confirm `exists.ok`. If false, report `not_found` and `reason`, then stop.
+   Check the exact ID, active BytePlus profile, IAM visibility, and fixed Region;
+   do not retry in another product.
+2. Read `status.healthy`, `status.status`, and `status.reason`. A stopped or
+   transitioning Endpoint can explain failures before metrics are considered.
+3. Read `model_info.model_type` and `modality`. Do not interpret token, image,
+   task, or concurrency fields without this context.
+4. Read `usage.available` before all usage numbers. An unavailable probe is not
+   zero traffic.
+5. Read the error-rate channel for the modality and compare it with
+   `threshold_percent`. Then sort the matching `by_error_code` distribution by
+   count or percent.
+6. Load [`error-codes.md`](error-codes.md) for the leading exact code. Preserve
+   any upstream `RequestId`.
+7. Read only the quota metrics present for the modality. Use `level` and
+   `percent`; do not parse display text.
+8. If the problem remains model-wide, run `doctor model <model-name>`. Do not
+   broaden the scope before the Endpoint evidence points there.
+
+## Modality routing
+
+| Modality | Error fields | Quota fields |
+|---|---|---|
+| Text | `errors.overall`, `error_rate.overall` | RPM and TPM when available |
+| Image | `errors.overall`, `error_rate.overall` | IPM when available |
+| Video or async content generation | `errors.task`, `error_rate.request`, `error_rate.task` | Create-task RPM and concurrency when available |
+| Unknown | Preserve the reported fields without guessing a metric family | Preserve present fields and state the limitation |
+
+A peak of zero after a successful VMP query can mean no matching series, no
+traffic, or a metric that is not populated for that modality. Do not claim
+unused quota without checking availability, window, and surrounding evidence.
+
+## Common finding to action
+
+| Finding | Next action |
+|---|---|
+| `exists.not_found=true` | Verify the exact Endpoint ID, active BytePlus profile, fixed Region, and IAM visibility |
+| `status.healthy=false` | Follow the lifecycle reason; use `arkcli-infer-endpoint` for an authorized start or update operation |
+| `usage.available=false` | Report `usage.reason`; do not replace totals with zero |
+| Error rate exceeds the threshold | Use the leading exact code and `error-codes.md`; distinguish request and async-task channels |
+| `level=critical95` or `warn80` | Reduce traffic, rebalance work, or request the relevant BytePlus quota |
+| `RequestBurstTooFast` | Ramp traffic gradually and retry idempotently with exponential backoff |
+| `ModelNotOpen` | Run `doctor model <model-name>` for model-wide evidence and interpret the exact code with `error-codes.md` |
+
+## VMP precheck and binding
+
+VMP is required for the monitoring portion. Without an explicit workspace, the
+command verifies VMP subscription, the ModelArk service-linked role, and the
+telemetry workspace binding.
+
+If and only if the structured error says the workspace is unbound, explain the
+write and obtain approval before running:
+
+```bash
+arkcli doctor infer-endpoint <endpoint-id> --window 24h --auto-bind --format json
+```
+
+The command may reuse the first workspace or create `ark_default`, then bind
+ModelArk telemetry. It cannot enable VMP, accept terms, or grant IAM. If VMP is
+disabled or the role is missing, stop at the official BytePlus setup path.
+
+## Boundaries
+
+- Read-only unless `--auto-bind` is explicitly approved.
+- Does not invoke the Endpoint and does not consume model tokens.
+- Does not start, stop, update, or delete the Endpoint.
+- Does not compare another account, Region, or product.
+- Does not support or suggest `doctor report`.