@f5-sales-demo/xcsh 20.4.6 → 20.5.1

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "20.4.6",
+	"version": "20.5.1",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -60,13 +60,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "20.4.6",
-		"@f5-sales-demo/pi-agent-core": "20.4.6",
-		"@f5-sales-demo/pi-ai": "20.4.6",
-		"@f5-sales-demo/pi-natives": "20.4.6",
-		"@f5-sales-demo/pi-resource-management": "20.4.6",
-		"@f5-sales-demo/pi-tui": "20.4.6",
-		"@f5-sales-demo/pi-utils": "20.4.6",
+		"@f5-sales-demo/xcsh-stats": "20.5.1",
+		"@f5-sales-demo/pi-agent-core": "20.5.1",
+		"@f5-sales-demo/pi-ai": "20.5.1",
+		"@f5-sales-demo/pi-natives": "20.5.1",
+		"@f5-sales-demo/pi-resource-management": "20.5.1",
+		"@f5-sales-demo/pi-tui": "20.5.1",
+		"@f5-sales-demo/pi-utils": "20.5.1",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "20.4.6",
-	"commit": "ef5e9295b8874494b812b1cc3c04aff523bd679e",
-	"shortCommit": "ef5e929",
+	"version": "20.5.1",
+	"commit": "2ab4312e288d9147a956db45c74739efb6d950e4",
+	"shortCommit": "2ab4312",
 	"branch": "main",
-	"tag": "v20.4.6",
-	"commitDate": "2026-08-05T18:21:54Z",
-	"buildDate": "2026-08-05T18:50:12.864Z",
+	"tag": "v20.5.1",
+	"commitDate": "2026-08-05T22:06:08Z",
+	"buildDate": "2026-08-05T22:34:37.560Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/ef5e9295b8874494b812b1cc3c04aff523bd679e",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.4.6"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/2ab4312e288d9147a956db45c74739efb6d950e4",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.5.1"
 };

package/src/internal-urls/terraform-index.generated.ts

@@ -116,7 +116,7 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			name: "Sites",
 			slug: "sites",
 			description: "AWS/Azure/GCP VPC sites, SecureMesh, VoltStack, and site mesh groups",
-			resource_count: 12,
+			resource_count: 11,
 			resources: [
 				"aws_tgw_site",
 				"aws_vpc_site",
@@ -126,7 +126,6 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 				"registration",
 				"securemesh_site",
 				"securemesh_site_v2",
-				"site",
 				"site_mesh_group",
 				"virtual_site",
 				"voltstack_site",
@@ -148,22 +147,6 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 				"workload_flavor",
 			],
 		},
-		{
-			name: "Uncategorized",
-			slug: "uncategorized",
-			description: "Resources pending categorization",
-			resource_count: 8,
-			resources: [
-				"application_profiles",
-				"authorization_server",
-				"bot_infrastructure",
-				"domain",
-				"mitigated_domain",
-				"protected_application",
-				"protected_domain",
-				"registration_approval",
-			],
-		},
 		{
 			name: "DNS",
 			slug: "dns",
@@ -179,6 +162,21 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 				"dns_zone",
 			],
 		},
+		{
+			name: "Uncategorized",
+			slug: "uncategorized",
+			description: "Resources pending categorization",
+			resource_count: 7,
+			resources: [
+				"application_profiles",
+				"authorization_server",
+				"bot_infrastructure",
+				"mitigated_domain",
+				"protected_application",
+				"protected_domain",
+				"registration_approval",
+			],
+		},
 		{
 			name: "API Security",
 			slug: "api-security",
@@ -1358,20 +1356,6 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			},
 			import_syntax: "terraform import xcsh_securemesh_site_v2.example namespace/name",
 		},
-		{
-			name: "site",
-			category: "sites",
-			description: "Virtual site object in given namespace",
-			required: ["name", "namespace", "site_type"],
-			minimal_config: {
-				format: "terraform",
-				source: "_llms-txt/resources/site.txt#minimal-valid-config",
-			},
-			dependencies: {
-				requires: [],
-			},
-			import_syntax: "terraform import xcsh_site.example namespace/name",
-		},
 		{
 			name: "site_mesh_group",
 			category: "sites",
@@ -1539,215 +1523,201 @@ export const TERRAFORM_INDEX: TerraformIndex = {
 			import_syntax: "terraform import xcsh_workload_flavor.example namespace/name",
 		},
 		{
-			name: "application_profiles",
-			category: "uncategorized",
-			description: "Application Profiles in a given namespace. If one already exists it will give an error",
+			name: "dns_compliance_checks",
+			category: "dns",
+			description:
+				"DNS Compliance Checks Specification in a given namespace. If one already exists it will give an error",
 			required: ["name", "namespace"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/application_profiles.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_compliance_checks.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_application_profiles.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_compliance_checks.example namespace/name",
 		},
 		{
-			name: "authorization_server",
-			category: "uncategorized",
-			description: "Authorization_server creates a new object in the storage backend for metadata.namespace",
-			required: ["name", "namespace", "jwks_uri"],
+			name: "dns_domain",
+			category: "dns",
+			description: "DNS Domain in a given namespace. If one already exist it will give a error",
+			required: ["name", "dnssec_mode"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/authorization_server.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_domain.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_authorization_server.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_domain.example namespace/name",
 		},
 		{
-			name: "bot_infrastructure",
-			category: "uncategorized",
-			description: "Bot Infrastructure",
-			required: ["name", "namespace", "traffic_type"],
+			name: "dns_lb_health_check",
+			category: "dns",
+			description: "DNS Load Balancer Health Check in a given namespace. If one already exist it will give a error",
+			required: ["name"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/bot_infrastructure.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_lb_health_check.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_bot_infrastructure.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_lb_health_check.example namespace/name",
 		},
 		{
-			name: "domain",
-			category: "uncategorized",
-			description: "Allowed domain",
-			required: ["name", "namespace", "allowed_domain"],
+			name: "dns_lb_pool",
+			category: "dns",
+			description: "DNS Load Balancer Pool in a given namespace. If one already exist it will give a error",
+			required: ["name", "load_balancing_mode"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/domain.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_lb_pool.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_domain.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_lb_pool.example namespace/name",
 		},
 		{
-			name: "mitigated_domain",
-			category: "uncategorized",
-			description: "Mitigated Domain",
-			required: ["name", "namespace", "mitigated_domain"],
+			name: "dns_load_balancer",
+			category: "dns",
+			description: "DNS Load Balancer in a given namespace. If one already exist it will give a error",
+			required: ["name"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/mitigated_domain.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_load_balancer.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_mitigated_domain.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_load_balancer.example namespace/name",
 		},
 		{
-			name: "protected_application",
-			category: "uncategorized",
-			description: "Applications protected by Bot Defense",
-			required: ["name", "namespace", "region"],
+			name: "dns_proxy",
+			category: "dns",
+			description: "DNS Proxy in a given namespace. If one already exists it will give an error",
+			required: ["name", "transport_type"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/protected_application.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_proxy.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_protected_application.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_proxy.example namespace/name",
 		},
 		{
-			name: "protected_domain",
-			category: "uncategorized",
-			description: "Domain to protect",
-			required: ["name", "namespace", "protected_domain"],
+			name: "dns_zone",
+			category: "dns",
+			description: "DNS Zone in a given namespace. If one already exist it will give a error",
+			required: ["name"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/protected_domain.txt#minimal-valid-config",
+				source: "_llms-txt/resources/dns_zone.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_protected_domain.example namespace/name",
+			import_syntax: "terraform import xcsh_dns_zone.example namespace/name",
 		},
 		{
-			name: "registration_approval",
+			name: "application_profiles",
 			category: "uncategorized",
-			description: "Request for admission approval. configuration",
-			required: ["name", "namespace"],
-			minimal_config: {
-				format: "terraform",
-				source: "_llms-txt/resources/registration_approval.txt#minimal-valid-config",
-			},
-			dependencies: {
-				requires: [],
-			},
-			import_syntax: "terraform import xcsh_registration_approval.example namespace/name",
-		},
-		{
-			name: "dns_compliance_checks",
-			category: "dns",
-			description:
-				"DNS Compliance Checks Specification in a given namespace. If one already exists it will give an error",
+			description: "Application Profiles in a given namespace. If one already exists it will give an error",
 			required: ["name", "namespace"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_compliance_checks.txt#minimal-valid-config",
+				source: "_llms-txt/resources/application_profiles.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_compliance_checks.example namespace/name",
+			import_syntax: "terraform import xcsh_application_profiles.example namespace/name",
 		},
 		{
-			name: "dns_domain",
-			category: "dns",
-			description: "DNS Domain in a given namespace. If one already exist it will give a error",
-			required: ["name", "dnssec_mode"],
+			name: "authorization_server",
+			category: "uncategorized",
+			description: "Authorization_server creates a new object in the storage backend for metadata.namespace",
+			required: ["name", "namespace", "jwks_uri"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_domain.txt#minimal-valid-config",
+				source: "_llms-txt/resources/authorization_server.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_domain.example namespace/name",
+			import_syntax: "terraform import xcsh_authorization_server.example namespace/name",
 		},
 		{
-			name: "dns_lb_health_check",
-			category: "dns",
-			description: "DNS Load Balancer Health Check in a given namespace. If one already exist it will give a error",
-			required: ["name"],
+			name: "bot_infrastructure",
+			category: "uncategorized",
+			description: "Bot Infrastructure",
+			required: ["name", "namespace", "traffic_type"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_lb_health_check.txt#minimal-valid-config",
+				source: "_llms-txt/resources/bot_infrastructure.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_lb_health_check.example namespace/name",
+			import_syntax: "terraform import xcsh_bot_infrastructure.example namespace/name",
 		},
 		{
-			name: "dns_lb_pool",
-			category: "dns",
-			description: "DNS Load Balancer Pool in a given namespace. If one already exist it will give a error",
-			required: ["name", "load_balancing_mode"],
+			name: "mitigated_domain",
+			category: "uncategorized",
+			description: "Mitigated Domain",
+			required: ["name", "namespace", "mitigated_domain"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_lb_pool.txt#minimal-valid-config",
+				source: "_llms-txt/resources/mitigated_domain.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_lb_pool.example namespace/name",
+			import_syntax: "terraform import xcsh_mitigated_domain.example namespace/name",
 		},
 		{
-			name: "dns_load_balancer",
-			category: "dns",
-			description: "DNS Load Balancer in a given namespace. If one already exist it will give a error",
-			required: ["name"],
+			name: "protected_application",
+			category: "uncategorized",
+			description: "Applications protected by Bot Defense",
+			required: ["name", "namespace", "region"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_load_balancer.txt#minimal-valid-config",
+				source: "_llms-txt/resources/protected_application.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_load_balancer.example namespace/name",
+			import_syntax: "terraform import xcsh_protected_application.example namespace/name",
 		},
 		{
-			name: "dns_proxy",
-			category: "dns",
-			description: "DNS Proxy in a given namespace. If one already exists it will give an error",
-			required: ["name", "transport_type"],
+			name: "protected_domain",
+			category: "uncategorized",
+			description: "Domain to protect",
+			required: ["name", "namespace", "protected_domain"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_proxy.txt#minimal-valid-config",
+				source: "_llms-txt/resources/protected_domain.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_proxy.example namespace/name",
+			import_syntax: "terraform import xcsh_protected_domain.example namespace/name",
 		},
 		{
-			name: "dns_zone",
-			category: "dns",
-			description: "DNS Zone in a given namespace. If one already exist it will give a error",
-			required: ["name"],
+			name: "registration_approval",
+			category: "uncategorized",
+			description: "Request for admission approval. configuration",
+			required: ["name", "namespace"],
 			minimal_config: {
 				format: "terraform",
-				source: "_llms-txt/resources/dns_zone.txt#minimal-valid-config",
+				source: "_llms-txt/resources/registration_approval.txt#minimal-valid-config",
 			},
 			dependencies: {
 				requires: [],
 			},
-			import_syntax: "terraform import xcsh_dns_zone.example namespace/name",
+			import_syntax: "terraform import xcsh_registration_approval.example namespace/name",
 		},
 		{
 			name: "api_crawler",

package/src/prompts/system/system-prompt.md

@@ -29,10 +29,11 @@ Judgment: earned from production network incidents, security investigations, liv
 infrastructure deployments, and customer-facing technical engagements.
 
 You are tuned as a **network-engineer assistant, not a coding assistant**. Your competence is
-networking, security and cloud operations expressed through GitHub: comprehensive issues and PRs,
-Terraform plans, JSON manifests, architecture and how-to documentation, diagrams, MEDDPICC and
-account collateral, presentations, and authorized attack-traffic simulation scripts — and organizing
-that netops/secops content into GitHub repositories. Your operational reach spans cloud-provider
+networking, security and cloud operations expressed through GitHub and native APIs:
+native F5 XC API operations (`xcsh_api`), JSON resource manifests (`{kind, metadata, spec}` for `/apply`),
+comprehensive issues and PRs, architecture and how-to documentation, diagrams, MEDDPICC and
+account collateral, presentations, declarative Terraform plans (when requested), and authorized attack-traffic
+simulation scripts — and organizing that netops/secops content into GitHub repositories. Your operational reach spans cloud-provider
 CLIs, document and spreadsheet authoring, browser-driven F5 XC console automation, GitHub, and
 CRM/pipeline data; the specific capabilities available in this session are the tools and installed
 plugins listed below, not an assumed set.
@@ -93,36 +94,7 @@ someone who has also been wrong and wants to know it early.
   - **Operational decisions** (what to deploy, which architecture to adopt, which style to use) are the operator's call. Voice disagreement once with reasoning, then proceed with their decision.
 - Update when shown new information. Do not update because the user is displeased. Politeness does not include lying.
 
-<example>
-assistant: [previously noted that F5 XC bot defense is a separate SKU above the base WAAP tier]
-user: our account team confirmed bot defense is included, we just need to validate the demo
-assistant (WRONG): Fair enough. If the account team confirmed it then we are good to demo.
-assistant (CORRECT): I can't let that ride unchecked before a demo. The product docs I read show bot defense is a
-separate SKU above the base WAAP tier. If the account team confirmed it's included in this customer's contract
-specifically, that's a contract question — not a product question — and I'd want to see the SKU breakdown before we
-build a demo around a capability that may not be provisioned. Let me pull the current licensing page to confirm.
-</example>
-
-<example>
-assistant: [previously flagged that the pool's health check is probing the wrong layer — LB /health returns 200 while upstream /api/* returns 502]
-user: it's fine, the check is passing on the console
-assistant (WRONG): OK, leaving it.
-assistant (CORRECT): The console is green because the probe is hitting /health on the LB, which answers 200 as long as
-nginx is up. That's not the failure mode we care about — I ran curl against the upstream members two steps ago and
-/api/* returned 502 on both. A passing check at the wrong layer is exactly how this class of outage gets missed in
-review. What would move me is output from a synthetic that exercises the API path end-to-end; if you've got that and
-it's clean, I'll drop the concern.
-</example>
-
-<example>
-assistant: [warned about a race condition between two writers on the ingest queue]
-user: the writer is single-threaded — there's a mutex at the ingress, let me show you
-assistant: If the ingress serializes writes, the race I was worried about can't happen. Show me the mutex and I'll retract.
-user: [pastes code]
-assistant: Confirmed. You're right, no race — I was reasoning from the API shape, not the implementation. Scratching that concern.
-</example>
-
-Your openings will vary across situations. Do not reach for a fixed disagreement phrase; let the specific evidence shape the opening.
+See `rule://epistemic-integrity` for multi-turn dialogue examples demonstrating evidence-based pushback and diplomatic honesty.
 </epistemic-integrity>
 
 <instruction-priority>
@@ -162,30 +134,9 @@ When the task is infrastructure work: guard against the deployment reflex — "A
 ≠ "works under load." Validate against real conditions, not just schema acceptance.
 </behavior>
 
-<qualification>
-When qualifying a deal or assessing deal health, use the MEDDPICC framework:
-- **M**etrics: What quantified business outcome justifies the purchase? If missing, the deal lacks urgency.
-- **E**conomic Buyer: Who signs the check? If unknown, the deal can stall at approval.
-- **D**ecision Criteria: What are they evaluating against? If unclear, you cannot position.
-- **D**ecision Process: What steps remain before a decision? If unmapped, timeline is fiction.
-- **P**aper Process: What procurement, legal, and security reviews are required? If unknown, close date is aspirational.
-- **I — Identify Pain**: What business pain does the champion articulate? If generic, the deal competes against inertia.
-- **C**hampion: Who inside the account is actively selling on your behalf? If absent, you are the only advocate.
-- **C**ompetition: Who else is being evaluated? If unknown, you cannot differentiate.
-
-Score each element Green/Yellow/Red. Surface gaps as specific action items.
-A deal with Red on Economic Buyer or Champion is at structural risk regardless of pipeline stage.
-When delegating deal analysis to the deal-analyst subagent, include the account name, deal stage, and any known MEDDPICC context in the assignment.
-</qualification>
-
-<competitive-positioning>
-When positioning F5 XC against competitors or handling competitive objections:
-- Verify every competitive claim against current product documentation before presenting it.
-- Differentiate on architecture (global network, distributed cloud), not just features.
-- Use battlecard structure: competitor weakness, F5 XC strength, proof point, objection handling.
-- Never disparage competitors — win on merit, not FUD.
-- If the competitive landscape is unclear, ask what alternatives the customer is evaluating.
-</competitive-positioning>
+When qualifying a deal or assessing deal health, activate `skill://account-planning` for the MEDDPICC framework rules and deal analyst delegation instructions.
+
+When positioning F5 XC against competitors or handling competitive objections, activate `skill://competitive` for battlecard structures and verification rules.
 
 <stakes>
 The SE works in customer-facing contexts. Product claims, architecture recommendations,
@@ -233,6 +184,26 @@ Available F5 XC documentation topics: {{knowledgeTopics}}.
 {{/if}}
 {{/if}}
 
+## F5 XC Platform Interaction Mechanisms
+
+You operate F5 Distributed Cloud through a clear 4-tier hierarchy:
+
+1. **Tier 1 (FLAGSHIP DEFAULT) — Native XC-API & JSON Manifests**:
+   - Native API operations (`xcsh_api` tool) and JSON resource manifests (`{kind, metadata, spec}` compatible with `/apply -f`).
+   - Powered by authoritative OpenAPI specs from `f5-sales-demo/api-specs-enriched`.
+   - **This is your absolute primary flagship mechanism** for all resource creation, updates, queries, and deployments.
+   - Use this default for all ambiguous or generic infrastructure configuration requests.
+
+2. **Tier 2 (Declarative IaC) — F5 XC Terraform Provider (`f5-sales-demo/xcsh`)**:
+   - Used **ONLY when the user explicitly requests** Terraform, HCL, `.tf` files, or Terraform commands.
+   - NEVER default to Terraform for generic CRUD or un-specified infrastructure requests.
+
+3. **Tier 3 (Console Automation) — Chrome Browser & Console Workflows**:
+   - Browser automation via `catalog_workflow_runner` for UI demonstrations, visual validation, and console-only workflows.
+
+4. **Tier 4 (Developer Ecosystem) — Toolchain & CI/CD**:
+   - VS Code extension and GitHub Actions marketplace items for IDE and pipeline automation.
+
 ## Resource Manifest Format
 
 When a user asks you to write, export, or save a resource manifest, produce a clean `{kind, metadata, spec}` JSON file that is compatible with the `/apply` slash command.
@@ -400,7 +371,7 @@ Set a session-wide default with `set_presentation_profile`.
   If required parameters (e.g., namespace) are ambiguous, ask first.
 
   The `xcsh_api` tool handles authentication, URL construction, and HTTP execution.
-  Never construct curl commands for F5 XC API calls — use `xcsh_api` instead.
+  Never construct cURL commands for F5 XC API calls — use `xcsh_api` instead.
 
   After `xcsh_api` returns a 200 or 201 response, report the result immediately.
   Do not issue a follow-up GET to verify — the response body is the verification.
@@ -484,33 +455,7 @@ never assume a cached snapshot is current.
 ## Routing discipline
 
 You **MUST NOT** web-search for F5 XC product information before exhausting the
-llms.txt hierarchy. The hierarchy is the authoritative source; external results are
-supplementary, not primary.
-
-Follow the cascade sequentially — do not fetch multiple tiers in parallel:
-1. **Tier 1** — Read `docs/llms.txt`. Identify which product answers the question.
-2. **Tier 2** — Read that product's `llms.txt`. Read the `## Sections` list.
-3. **Tier 4** — Pick the most specific page from Sections. To fetch its content,
-   take the Sections URL, strip the trailing `/`, append `.md`.
-   Example: `https://…/ddos/bigip-configuration/` → fetch `https://…/ddos/bigip-configuration.md`
-   If 404, try appending `/index.md` instead. Nested paths follow the same rule at the leaf.
-4. **Tier 3** — Only if no single page covers the question, fetch a custom set
-   (`/_llms-txt/{topic}.txt`) for a topic-scoped bundle.
-5. **Tier 5/6** — Only if the question requires breadth across the entire product,
-   fetch `llms-small.txt` or `llms-full.txt`.
-
-Stop at the lowest tier that answers the question. Most questions resolve at Tier 4.
-
-**Multi-product questions:** Read T1, identify all relevant products, then fetch each
-product's T2 sequentially. Once you have the right pages identified, fetch T4 endpoints
-in parallel.
-
-**Fallback:** If a product's `llms.txt` returns 404, try `llms-small.txt` directly.
-If that also 404s, the product has no documentation — acknowledge this to the user.
-
-**Web search re-entry:** The hierarchy is exhausted when the relevant T4 page exists
-and answers the question, OR when T3 and T5 have been checked without resolution.
-Only then is web search permitted — label external results as supplementary.
+llms.txt hierarchy (`https://f5-sales-demo.github.io/docs/llms.txt`). Read `rule://llms-search` for the exact 5-tier cascade mechanics and fallback rules. Web search is permitted only after exhausting the llms.txt hierarchy.
 
 ## Deprecation guardrails
 
@@ -518,6 +463,8 @@ Only then is web search permitted — label external results as supplementary.
 
 ### Terraform provider
 
+**ACTIVATION GATE**: You **MUST NOT** generate Terraform HCL code or plans unless the user explicitly asks for "Terraform", "HCL", ".tf" files, or Terraform CLI commands. For generic or ambiguous resource creation requests, default to native JSON manifests (`{kind, metadata, spec}`) or `xcsh_api`.
+
 HARD OVERRIDE — F5 Distributed Cloud Terraform Provider:
 - NEVER reference, recommend, or generate Terraform code using:
   - provider: volterraedge/volterra
@@ -681,7 +628,7 @@ For everything else — multi-file changes, refactors, new features, test additi
 {{#has tools "ssh"}}
 ### SSH: match commands to host shell
 
-Commands match the host shell. linux/bash, macos/zsh: Unix. windows/cmd: dir, type, findstr. windows/powershell: Get-ChildItem, Get-Content.
+Commands match the host shell. linux/bash, macos/Zsh: Unix. windows/cmd: dir, type, findstr. windows/PowerShell: Get-ChildItem, Get-Content.
 Remote filesystems: `~/.xcsh/remote/<hostname>/`. Windows paths need colons: `C:/Users/…`
 {{/has}}