@nuvlore/extension-bds 0.1.1

package/tools/bds_portal_operation_knowledge.mjs

@@ -0,0 +1,212 @@
+export const description = "Summarize BDS Portal-derived operation entry points, environment scopes, and read/write boundaries for routing BDS investigations to the right runbook.";
+
+import { z } from "zod";
+import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+
+const PORTAL_SOURCE = {
+  title: "BDS Portal",
+  pageId: "818177058",
+  url: "https://confluence.workday.com/display/BD/BDS+Portal",
+  observedVersion: 54
+};
+
+export const BDS_PORTAL_OPERATION_CATALOG = [
+  {
+    domain: "portal",
+    title: "BDS Portal",
+    url: "https://confluence.workday.com/display/BD/BDS+Portal",
+    operationType: "navigation",
+    environmentScope: ["all"],
+    writeBoundary: "read-only",
+    notes: [
+      "Landing page for BDS team resources, support channels, dashboards, architecture, customer support, deployment, playbooks, monitoring, tenant management, onboarding, and build/release links.",
+      "Use it as the first Confluence discovery entry before drilling into narrower BDS pages."
+    ]
+  },
+  {
+    domain: "cluster-inventory",
+    title: "BDS Cluster Information",
+    url: "https://confluence.workday.com/display/BD/BDS+Cluster+Information",
+    operationType: "environment-discovery",
+    environmentScope: ["CUST", "ENG"],
+    writeBoundary: "read-only",
+    notes: [
+      "Portal points here for current BDS cluster information.",
+      "Use this with bds_machine_inventory and dashboard/link tools when mapping cluster names to hosts or operational surfaces."
+    ]
+  },
+  {
+    domain: "infrastructure-operations",
+    title: "BDS - Infrastructure Operations",
+    url: "https://confluence.workday.com/display/BD/BDS+-+Infrastructure+Operations",
+    operationType: "runbook-index",
+    environmentScope: ["CUST", "ENG", "NPRD", "PROD"],
+    writeBoundary: "mixed",
+    notes: [
+      "Infrastructure operations links to the new-cluster build procedure and current cluster facilities.",
+      "New-cluster build steps include INF/DC coordination, Chef role/org selection, rack info, LDAP, CNames, firewall validation, EDB/EMS data, BDS config repos, BDM init, patch, refresh_config, and Confluence page creation."
+    ]
+  },
+  {
+    domain: "cluster-build",
+    title: "Creating New BDS Cluster",
+    url: "https://confluence.workday.com/display/BD/Creating+New+BDS+Cluster",
+    operationType: "buildout-runbook",
+    environmentScope: ["ENG", "NPRD", "PROD"],
+    writeBoundary: "write-heavy",
+    notes: [
+      "Chef organizations differ by environment: ENG uses dev-style BDS service orgs, while PROD uses prod-style BDS service orgs.",
+      "BDS config changes go to the appropriate bds-config repo and BDM/BDS mapping files before init.",
+      "Init, patch, and refresh_config are BDM-host curl operations and are not safe read-only probes.",
+      "Kubernetes cluster creation is called out as a separate playbook path and may not work during init state."
+    ]
+  },
+  {
+    domain: "deployment",
+    title: "BDS End To End Deployment Process",
+    url: "https://confluence.workday.com/display/BD/BDS+End+To+End+Deployment+Process",
+    operationType: "deployment-runbook",
+    environmentScope: ["CUST", "ENG"],
+    writeBoundary: "write-heavy",
+    notes: [
+      "Deployment is staged as pre-deployment, INF preparation, BDS initialization, patching, tenant validation, and post-deployment.",
+      "CUST decommissioning requires a long maintenance-window lead time and explicit cleanup of Chef entries.",
+      "Validation topics include firewall checks, host hardware/OS/Chef checks, BDA/Prism standalone tenant tests, cloned tenant tests, mirroring, and DR."
+    ]
+  },
+  {
+    domain: "scylla-oncall",
+    title: "BDS on Scylla On-call Playbook",
+    url: "https://confluence.workday.com/display/BD/BDS+on+Scylla+On-call+Playbook",
+    operationType: "oncall-runbook",
+    environmentScope: ["Scylla", "SPC", "FedRamp", "AWS", "GCP"],
+    writeBoundary: "mixed",
+    notes: [
+      "Production Scylla access is routed through SPC production access guidance.",
+      "Read-only triage areas include K8s pod list/describe/logs, tenant data replication/encryption checks, YARN/HDFS status, and common incident patterns.",
+      "Restarting containers/pods, scaling, upgrading, reset, DR failover, S3 object encryption updates, and mapping updates are write/remediation operations and must not be run from read-only investigation tools."
+    ]
+  },
+  {
+    domain: "tenant-workflow",
+    title: "BDS Split Tenant Workflow in DC",
+    url: "https://confluence.workday.com/display/BD/BDS+Split+Tenant+Workflow+in+DC+v3",
+    operationType: "tenant-runbook",
+    environmentScope: ["DC", "ASH", "ATL", "PDX", "DUB"],
+    writeBoundary: "write-heavy",
+    notes: [
+      "BDS tenant copy should follow OMS tenant copy promptly and no later than the documented window.",
+      "Same-region split uses WMU clonePrismForTenantSplitAware from the target environment.",
+      "Cross-region split needs manual firewall coordination and Kraken key export/import plus BDS re-encryption.",
+      "WMU commands and EMS tag changes are write operations; read-only support should only inspect prerequisites and collect evidence."
+    ]
+  },
+  {
+    domain: "tenant-workflow",
+    title: "BDS Transfer Tenant Workflow in DC",
+    url: "https://confluence.workday.com/display/BD/BDS+Transfer+Tenant+Workflow+in+DC",
+    operationType: "tenant-runbook",
+    environmentScope: ["DC"],
+    writeBoundary: "write-heavy",
+    notes: [
+      "Transfer tenant differs from split tenant: ownership changes without tenant clone.",
+      "The workflow includes Kraken customer/key setup, Prism group changes, BDS SPLIT tag use, encryption-zone update, re-encrypt, and final verifyPrism.",
+      "HDFS encryption-zone setfattr and WMU re-encryption are write operations; read-only investigation should stop at namespace lookup and current-zone evidence."
+    ]
+  },
+  {
+    domain: "build-release",
+    title: "BDS PR Merge to Pass Integration Test Process",
+    url: "https://confluence.workday.com/display/BD/BDS+PR+Merge+to+Pass+Integration+Test+Process",
+    operationType: "ci-verification",
+    environmentScope: ["Bamboo", "TeamCity", "Jenkins", "BDS K8", "Scylla"],
+    writeBoundary: "read-only",
+    notes: [
+      "After PR merge, verify master/trunk build status and make sure integration-test builds passed with the PR commits or Jira issue association.",
+      "BDS K8 integration covers airflow and migration-services; Scylla routes include BDM, service-proxy, and SHS.",
+      "Cookbook and bds-service parcel release checks include Jenkins cookbook and parcel master builds."
+    ]
+  },
+  {
+    domain: "onboarding",
+    title: "BDS - Onboarding",
+    url: "https://confluence.workday.com/display/BD/BDS+-+Onboarding",
+    operationType: "learning-index",
+    environmentScope: ["DC", "Scylla"],
+    writeBoundary: "read-only",
+    notes: [
+      "Onboarding links architecture, BDS DevOps overview, Workday environment/tenant management, DC clusters, Scylla clusters, production access, repos, Bamboo plans, Chef development, and cookbook change procedures.",
+      "Use this page to route unknown BDS questions to the correct narrower runbook."
+    ]
+  },
+  {
+    domain: "monitoring",
+    title: "BDS Prod Cluster Critical Services Health Dashboard",
+    url: "https://confluence.workday.com/display/BD/BDS+Prod+Cluster+Critical+Services+Health+Dashboard",
+    operationType: "dashboard-index",
+    environmentScope: ["PROD"],
+    writeBoundary: "read-only",
+    notes: [
+      "Portal points to service health and cluster-level usage dashboards.",
+      "Use bds_dashboard_links, bds_dashboard_query_read, and pharos read tools for current evidence instead of relying on stale Confluence snapshots."
+    ]
+  }
+];
+
+function normalize(value) {
+  return String(value || "").trim().toLowerCase();
+}
+
+function matchesFilter(entry, input) {
+  const domain = normalize(input.domain);
+  if (domain && normalize(entry.domain) !== domain) return false;
+  const scope = normalize(input.environmentScope);
+  if (scope && !entry.environmentScope.some((item) => normalize(item) === scope)) return false;
+  const operationType = normalize(input.operationType);
+  if (operationType && normalize(entry.operationType) !== operationType) return false;
+  return true;
+}
+
+export class BdsPortalOperationKnowledgeService {
+  async invoke(input = {}) {
+    const entries = BDS_PORTAL_OPERATION_CATALOG.filter((entry) => matchesFilter(entry, input));
+    return JSON.stringify({
+      mode: "bds-portal-operation-knowledge",
+      provider: "confluence-bds-portal-derived",
+      source: PORTAL_SOURCE,
+      filters: {
+        domain: input.domain ?? "",
+        environmentScope: input.environmentScope ?? "",
+        operationType: input.operationType ?? ""
+      },
+      count: entries.length,
+      entries
+    }, null, 2);
+  }
+}
+
+const defaultService = new BdsPortalOperationKnowledgeService();
+
+export default defineReadOnlyTool({
+  name: "bds_portal_operation_knowledge",
+  description: "Summarize BDS Portal-derived operation entry points, environment scopes, and read/write boundaries for routing BDS investigations to the right runbook.",
+  inputSchema: {
+    domain: z.string().trim().min(1).max(80).optional(),
+    environmentScope: z.string().trim().min(1).max(80).optional(),
+    operationType: z.string().trim().min(1).max(80).optional()
+  },
+  async handler(input) {
+    try {
+      return ok(await defaultService.invoke(input));
+    } catch (error) {
+      return fail(error);
+    }
+  }
+});
+
+export const __test = {
+  PORTAL_SOURCE,
+  BDS_PORTAL_OPERATION_CATALOG,
+  BdsPortalOperationKnowledgeService,
+  matchesFilter
+};

package/tools/bds_prism_clone_status_links.mjs

@@ -0,0 +1,129 @@
+export const description = "Generate read-only Confluence Prism Clone Status Dashboard links for BDS on-call clone monitoring.";
+
+import { z } from "zod";
+import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+
+const DEFAULT_PAGE_ID = "1662698439";
+const DEFAULT_ENVS = ["WD2-IMPL", "WD3-IMPL", "WD5-IMPL"];
+const DEFAULT_CHECK_WINDOW = {
+  cadence: "weekly",
+  dayOfWeek: "Friday",
+  localTime: "19:30",
+  timezone: "America/Los_Angeles",
+  description: "Open around Friday 7:30 PM during BDS on-call to check clone status."
+};
+const STATUS_OPTIONS = ["", "RUNNING", "FAILED", "SUCCEEDED", "CANCELED"];
+
+const inputSchema = {
+  envs: z.array(z.string().trim().min(1).max(64)).max(12).default(DEFAULT_ENVS),
+  status: z.enum(STATUS_OPTIONS).default(""),
+  tenantName: z.string().trim().max(128).default(""),
+  excludeTenant: z.string().trim().max(128).default(""),
+  pageId: z.string().trim().min(1).max(128).default(DEFAULT_PAGE_ID),
+  format: z.enum(["json", "markdown"]).default("json")
+};
+
+function normalizeEnv(value) {
+  return String(value ?? "").trim().toUpperCase();
+}
+
+function dashboardUrl({ envName, status, tenantName, excludeTenant, pageId }) {
+  const url = new URL("https://confluence.workday.com/display/PCDE/Prism+Clone+Status+Dashboard");
+  url.searchParams.set("pageId", pageId || DEFAULT_PAGE_ID);
+  url.searchParams.set("run_1_ENVNAME", normalizeEnv(envName));
+  url.searchParams.set("run_1_STATUS", status || "");
+  url.searchParams.set("run_1_TENANT_NAME", tenantName || "");
+  url.searchParams.set("run_1_EXCLUDE_TENANT", excludeTenant || "");
+  url.searchParams.set("run_1", "run");
+  return url.toString();
+}
+
+function buildDashboards(input = {}) {
+  const envs = (input.envs?.length ? input.envs : DEFAULT_ENVS)
+    .map(normalizeEnv)
+    .filter(Boolean);
+  const uniqueEnvs = [...new Set(envs)];
+  return uniqueEnvs.map((envName) => ({
+    envName,
+    url: dashboardUrl({
+      envName,
+      status: input.status || "",
+      tenantName: input.tenantName || "",
+      excludeTenant: input.excludeTenant || "",
+      pageId: input.pageId || DEFAULT_PAGE_ID
+    })
+  }));
+}
+
+function bdsPrismCloneStatusLinks(input = {}) {
+  const dashboards = buildDashboards(input);
+  const result = {
+    mode: "read-only-links",
+    remoteRead: "not_executed",
+    pageTitle: "Prism Clone Status Dashboard",
+    pageId: input.pageId || DEFAULT_PAGE_ID,
+    filters: {
+      status: input.status || "",
+      tenantName: input.tenantName || "",
+      excludeTenant: input.excludeTenant || ""
+    },
+    suggestedCheckWindow: DEFAULT_CHECK_WINDOW,
+    dashboards,
+    oncallNotes: [
+      "Open each environment dashboard around Friday 7:30 PM America/Los_Angeles during BDS on-call clone monitoring.",
+      "Use tenantName when checking a single tenant; otherwise keep it empty to scan all active clone rows.",
+      "If a clone looks stuck or failed, collect the dashboard row fields before starting deeper Bamboo, Airflow, or BDS log investigation.",
+      "This tool only generates Confluence dashboard links; it does not read or mutate Confluence state."
+    ]
+  };
+  return input.format === "markdown" ? renderMarkdown(result) : JSON.stringify(result, null, 2);
+}
+
+function renderMarkdown(result) {
+  return [
+    "# Prism Clone Status Dashboard Links",
+    "",
+    `Mode: ${result.mode}`,
+    `Remote read: ${result.remoteRead}`,
+    `Page ID: ${result.pageId}`,
+    `Suggested check: ${result.suggestedCheckWindow.dayOfWeek} ${result.suggestedCheckWindow.localTime} ${result.suggestedCheckWindow.timezone}`,
+    "",
+    "## Dashboards",
+    ...result.dashboards.map((dashboard) => `- ${dashboard.envName}: ${dashboard.url}`),
+    "",
+    "## On-call Notes",
+    ...result.oncallNotes.map((item) => `- ${item}`)
+  ].join("\n");
+}
+
+export class BdsPrismCloneStatusLinksService {
+  invoke(input) {
+    return bdsPrismCloneStatusLinks(input);
+  }
+}
+
+const defaultService = new BdsPrismCloneStatusLinksService();
+
+export default defineReadOnlyTool({
+  name: "bds_prism_clone_status_links",
+  description: "Generate read-only Confluence Prism Clone Status Dashboard links for BDS on-call clone monitoring.",
+  inputSchema,
+  annotations: { openWorldHint: false },
+  async handler(input) {
+    try {
+      return ok(defaultService.invoke(input));
+    } catch (error) {
+      return fail(error);
+    }
+  }
+});
+
+export const __test = {
+  DEFAULT_CHECK_WINDOW,
+  DEFAULT_ENVS,
+  DEFAULT_PAGE_ID,
+  BdsPrismCloneStatusLinksService,
+  bdsPrismCloneStatusLinks,
+  buildDashboards,
+  dashboardUrl
+};

package/tools/bds_prism_service_proxy_timeout_query_pack.mjs

@@ -0,0 +1,224 @@
+export const description = "Generate a atomic-helper, read-only Jira/Kubernetes query pack for Prism Spark on K8s BdsCipherClient timeouts against BDS bds-service-proxy; does not call Jira, Kubernetes, or SPC.";
+
+import { z } from "zod";
+import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+import { ReadOnlyStep } from "@nuvlore/extension-read-only-toolkit/read-only-command-pack";
+
+const DEFAULT_CLUSTER = "s0109";
+const DEFAULT_NAMESPACE = "bds";
+const DEFAULT_BDS_SERVICE_PROXY = "bds-service-proxy";
+const DEFAULT_JIRA_BASE_URL = "https://jira2.workday.com";
+const LEGACY_KEYCHAIN_ALIAS = ["wal", "lee"].join("");
+
+const clusterSchema = z.string().min(1).max(64).regex(/^[A-Za-z0-9_.:-]+$/);
+const namespaceSchema = z.string().min(1).max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/);
+const jiraKeySchema = z.string().min(1).max(32).regex(/^[A-Z][A-Z0-9]+-[0-9]+$/).optional();
+const cidSchema = z.string().min(1).max(128).regex(/^[A-Za-z0-9_|:-]+$/).optional();
+const tenantSchema = z.string().min(1).max(128).regex(/^[A-Za-z0-9_.-]+$/).optional();
+const appIdSchema = z.string().min(1).max(160).regex(/^[A-Za-z0-9_.:-]+$/).optional();
+const timestampSchema = z.string().min(1).max(64).optional();
+
+const SAFETY_RULES = [
+  "read-only only: Jira GET, spc connect, kubectl get/describe/logs/exec for ls/grep/head/tail only, and auth can-i checks",
+  "never print Jira, Keychain, AWS, LDAP, or Kubernetes credentials",
+  "use AWS_PROFILE=sso-cust for cust SPC sessions; refresh with sso-cli aws --force --profile sso-cust --region us-east-1 when ExpiredToken appears",
+  "verify kubectl context, auth whoami, and auth can-i before drawing conclusions from missing pods or logs",
+  "treat kubectl logs retention as incomplete when the returned timestamps start after the incident window",
+  "prefer bds-service-proxy local log files under /opt/bds-service-proxy/log when kubectl logs misses historical incident windows",
+  "separate Prism Spark driver client-side timeout evidence from bds-service-proxy service-side error evidence",
+  "check Prism/OMS namespace RBAC before claiming those pod logs or dump files are unavailable"
+];
+
+class BdsPrismServiceProxyTimeoutQueryPack {
+  constructor(input) {
+    this.cluster = input.cluster ?? DEFAULT_CLUSTER;
+    this.namespace = input.namespace ?? DEFAULT_NAMESPACE;
+    this.serviceProxy = input.serviceProxy ?? DEFAULT_BDS_SERVICE_PROXY;
+    this.jiraKey = input.jiraKey;
+    this.cid = input.cid;
+    this.tenant = input.tenant;
+    this.appId = input.appId;
+    this.incidentUtc = input.incidentUtc;
+  }
+
+  grepPattern() {
+    return [
+      this.tenant,
+      this.cid,
+      this.appId,
+      "BdsCipherClient",
+      "generateKey",
+      "generatedek",
+      "KMSClientException",
+      "SocketTimeout",
+      "Read timed out",
+      "503",
+      "ERROR",
+      "WARN"
+    ].filter(Boolean).join("|");
+  }
+
+  incidentWindowPattern() {
+    if (!this.incidentUtc) return "<YYYY-MM-DDTHH:MM>";
+    const match = this.incidentUtc.match(/^(\d{4}-\d{2}-\d{2})[T\s](\d{2}):(\d{2})/);
+    if (!match) return "<YYYY-MM-DDTHH:MM>";
+    return `${match[1]}T${match[2]}:${match[3]}`;
+  }
+
+  commands() {
+    const kube = "AWS_PROFILE=sso-cust kubectl --kubeconfig=$HOME/.kube/spc-config";
+    const serviceSelector = `app=${this.serviceProxy}`;
+    const incidentMinute = this.incidentWindowPattern();
+    const grepPattern = this.grepPattern();
+    return [
+      new ReadOnlyStep({
+        id: "00-jira-evidence",
+        purpose: "Read the Prism ticket and Chiron attachments without exposing Jira credentials.",
+        command: [
+          this.jiraKey
+            ? `jira_api_read /rest/api/2/issue/${this.jiraKey}?fields=summary,status,comment,attachment,labels,description`
+            : "jira_api_read /rest/api/2/issue/<PRISM-issue>?fields=summary,status,comment,attachment,labels,description",
+          `If the default devops-tool Jira Keychain account is absent, check the legacy alias service=${LEGACY_KEYCHAIN_ALIAS} account=${LEGACY_KEYCHAIN_ALIAS}.jira and use it only as a secret source; never print the token.`,
+          "For Chiron attachments, fetch only bounded snippets around BdsCipherClient, generateKey, KMSClientException, SocketTimeoutException, DeltaCommitCommandOptions, manifest, appId, cid, and OMS dump paths."
+        ].join("\n"),
+        expectedEvidence: "PRISM issue labels, Spark appId, tenant, cluster, Chiron log/json attachment ids, Delta commit path, manifest, and OMS dump file references"
+      }),
+      new ReadOnlyStep({
+        id: "01-spc-connect",
+        purpose: "Open the customer cluster tunnel with the right AWS profile and verify the Kubernetes identity.",
+        command: [
+          "sso-cli aws --force --profile sso-cust --region us-east-1   # only when AWS STS is expired",
+          `AWS_PROFILE=sso-cust spc connect cust ${this.cluster}`,
+          `${kube} config current-context`,
+          `${kube} auth whoami`,
+          `${kube} auth can-i get pods -n ${this.namespace}`,
+          `${kube} auth can-i get pods/log -n ${this.namespace}`,
+          `${kube} auth can-i create pods/exec -n ${this.namespace}`
+        ].join("\n"),
+        expectedEvidence: "context points to the requested cluster, authenticated user/groups, and namespace-level permissions"
+      }),
+      new ReadOnlyStep({
+        id: "02-service-proxy-state",
+        purpose: "Confirm current bds-service-proxy pod readiness, image, endpoints, starts, and restarts.",
+        command: [
+          `${kube} get deploy,pods,svc,endpoints -n ${this.namespace} -l ${serviceSelector} -o wide`,
+          `${kube} describe pod -n ${this.namespace} <old-service-proxy-pod> | sed -n '1,220p'`,
+          `${kube} get pod -n ${this.namespace} <old-service-proxy-pod> -o jsonpath='{.status.containerStatuses[?(@.name=="${this.serviceProxy}")].restartCount}{"\\n"}{.status.containerStatuses[?(@.name=="${this.serviceProxy}")].state.running.startedAt}{"\\n"}{.status.containerStatuses[?(@.name=="${this.serviceProxy}")].lastState}{"\\n"}'`
+        ].join("\n"),
+        expectedEvidence: "pod covering the incident window, restart count, image tag, service ClusterIP, endpoints, and node placement"
+      }),
+      new ReadOnlyStep({
+        id: "03-kubectl-log-retention-check",
+        purpose: "Check whether kubectl logs actually contains the incident window before using it as negative evidence.",
+        command: [
+          `${kube} logs -n ${this.namespace} <old-service-proxy-pod> -c ${this.serviceProxy} --since-time=<incident-start-utc> --timestamps --limit-bytes=20000 | sed -n '1,25p'`,
+          "If the first returned timestamp is after the incident window, do not claim the incident window had no service-proxy errors from kubectl logs alone."
+        ].join("\n"),
+        expectedEvidence: "earliest returned log timestamp and whether Kubernetes log retention covers the incident minute"
+      }),
+      new ReadOnlyStep({
+        id: "04-local-service-proxy-log-window",
+        purpose: "Use pod-local rotated logs for historical service-side evidence when kubectl logs is truncated or rotated.",
+        command: [
+          `${kube} exec -n ${this.namespace} <old-service-proxy-pod> -c ${this.serviceProxy} -- sh -lc 'ls -lah /opt/bds-service-proxy/log /var/log/bds-service-proxy 2>/dev/null || true'`,
+          `${kube} exec -n ${this.namespace} <old-service-proxy-pod> -c ${this.serviceProxy} -- sh -lc "grep -n '${incidentMinute}' /opt/bds-service-proxy/log/bds-service-proxy.log | grep -Ei '${grepPattern}' | head -200"`,
+          `${kube} exec -n ${this.namespace} <old-service-proxy-pod> -c ${this.serviceProxy} -- sh -lc "grep -n '${this.tenant ?? "<tenant>"}' /opt/bds-service-proxy/log/bds-service-proxy-audit.log | grep '${incidentMinute}' | head -160"`
+        ].join("\n"),
+        expectedEvidence: "timestamped service-proxy request/audit lines for the tenant and incident minute, including service-side duration and any ERROR/WARN/503/timeout signals"
+      }),
+      new ReadOnlyStep({
+        id: "05-prism-and-oms-rbac-boundary",
+        purpose: "Verify whether Prism Spark pod logs or OMS dump files can be inspected directly, instead of assuming they are absent.",
+        command: [
+          "for ns in prism oms bds; do for r in pods pods/log pods/exec; do kubectl --kubeconfig=$HOME/.kube/spc-config auth can-i get \"$r\" -n \"$ns\" 2>/dev/null || kubectl --kubeconfig=$HOME/.kube/spc-config auth can-i create \"$r\" -n \"$ns\" 2>/dev/null; done; done",
+          `${kube} get pod -n prism <prism-pod-from-jira-label> -o wide`,
+          `${kube} exec -n prism <prism-or-oms-pod> -- sh -lc "ls -lah /usr/local/workday-oms/logs/dumps && grep -n '${this.cid ?? "<cid>"}' /usr/local/workday-oms/logs/dumps/<dump-file> | head -80"`
+        ].join("\n"),
+        expectedEvidence: "RBAC yes/no for Prism/OMS namespaces, Spark pod availability if permitted, and whether OMS dump paths are directly readable"
+      })
+    ];
+  }
+
+  toMarkdown() {
+    return [
+      "# BDS Prism Service-Proxy Timeout Read-Only Query Pack",
+      "",
+      `Cluster: ${this.cluster}`,
+      `Namespace: ${this.namespace}`,
+      `Service proxy: ${this.serviceProxy}`,
+      this.jiraKey ? `Jira: ${this.jiraKey}` : "",
+      this.tenant ? `Tenant: ${this.tenant}` : "",
+      this.cid ? `CID: ${this.cid}` : "",
+      this.appId ? `Spark appId: ${this.appId}` : "",
+      this.incidentUtc ? `Incident UTC: ${this.incidentUtc}` : "",
+      "",
+      "## System Boundary",
+      "",
+      "Prism Spark on K8s calls `BdsCipherClient` in the Spark driver. The driver calls BDS `bds-service-proxy`; `bds-service-proxy` then performs the tenant key/decrypt flow such as SIR key fetches. A Prism driver `SocketTimeoutException` proves the client waited too long for a response, but does not by itself prove a service-proxy outage.",
+      "",
+      "## Safety Boundary",
+      "",
+      ...SAFETY_RULES.map((rule) => `- ${rule}`),
+      "",
+      "## Read-Only Commands",
+      "",
+      ...this.commands().map((command) => command.toMarkdown()),
+      "",
+      "Procedure, interpretation, and reply shape live in the `bds-prism-service-proxy-timeout-investigation` skill and runbook."
+    ].filter(Boolean).join("\n");
+  }
+
+  toJson() {
+    return {
+      cluster: this.cluster,
+      namespace: this.namespace,
+      serviceProxy: this.serviceProxy,
+      jiraKey: this.jiraKey,
+      tenant: this.tenant,
+      cid: this.cid,
+      appId: this.appId,
+      incidentUtc: this.incidentUtc,
+      systemBoundary: "Prism Spark on K8s driver -> BdsCipherClient -> bds-service-proxy -> tenant key/decrypt backend",
+      safetyBoundary: SAFETY_RULES,
+      keychainFallbacks: ["devops-tool/devops-tool.jira", `${LEGACY_KEYCHAIN_ALIAS}/${LEGACY_KEYCHAIN_ALIAS}.jira`],
+      spcAccess: ["sso-cli aws --force --profile sso-cust --region us-east-1", `AWS_PROFILE=sso-cust spc connect cust ${this.cluster}`],
+      historicalLogPaths: ["/opt/bds-service-proxy/log/bds-service-proxy.log", "/opt/bds-service-proxy/log/bds-service-proxy-audit.log"],
+      commands: this.commands().map((command) => command.toJson())
+    };
+  }
+}
+
+function buildResponse(input) {
+  const commandPack = new BdsPrismServiceProxyTimeoutQueryPack(input);
+  return input.format === "json" ? JSON.stringify(commandPack.toJson(), null, 2) : commandPack.toMarkdown();
+}
+
+export default defineReadOnlyTool({
+  name: "bds_prism_service_proxy_timeout_query_pack",
+  description: "Generate a atomic-helper, read-only Jira/Kubernetes query pack for Prism Spark on K8s BdsCipherClient timeouts against BDS bds-service-proxy; does not call Jira, Kubernetes, or SPC.",
+  inputSchema: {
+    cluster: clusterSchema.default(DEFAULT_CLUSTER),
+    namespace: namespaceSchema.default(DEFAULT_NAMESPACE),
+    serviceProxy: namespaceSchema.default(DEFAULT_BDS_SERVICE_PROXY),
+    jiraKey: jiraKeySchema.describe("Optional Prism Jira key, for example PRISM-229374."),
+    cid: cidSchema.describe("Optional common id such as DSP|4016D3FA|19E985A1."),
+    tenant: tenantSchema.describe("Optional tenant name."),
+    appId: appIdSchema.describe("Optional Spark app id."),
+    incidentUtc: timestampSchema.describe("Optional incident time in UTC, for example 2026-06-05T15:38:02Z."),
+    format: z.enum(["markdown", "json"]).default("markdown")
+  },
+  annotations: { openWorldHint: true },
+  async handler(input) {
+    try {
+      return ok(buildResponse(input));
+    } catch (error) {
+      return fail(error);
+    }
+  }
+});
+
+export const __test = {
+  BdsPrismServiceProxyTimeoutQueryPack,
+  SAFETY_RULES,
+  buildResponse
+};

package/tools/bds_public_cloud_pod_log_read.mjs

@@ -0,0 +1,18 @@
+export const description = "Read public-cloud Kubernetes pod, deployment, statefulset, or sidecar logs with kubectl after SPC login; does not use k9s.";
+
+import { createPublicCloudPodLogReadTool } from "../src/bds-atomic-log-tools.mjs";
+
+const sharedTool = createPublicCloudPodLogReadTool({
+  toolName: "bds_public_cloud_pod_log_read",
+  description: "Read public-cloud Kubernetes pod, deployment, statefulset, or sidecar logs with kubectl after SPC login; does not use k9s."
+});
+
+export default {
+  name: sharedTool.name,
+  description,
+  inputSchema: sharedTool.inputSchema,
+  meta: sharedTool.meta,
+  annotations: sharedTool.annotations,
+  invoke: sharedTool.invoke,
+  handler: sharedTool.handler
+};