@nuvlore/extension-bds 0.1.1

package/workflows/bds-oncall-followup.js

@@ -0,0 +1,112 @@
+export const meta = {
+  name: "bds-oncall-followup",
+  description: "Prepare and verify BDS on-call Confluence handoff rows and BDS follow-up Jira drafts for BDS-owned issues.",
+  whenToUse: "Use when a BDS on-call issue should be added to the current handoff page, especially when follow-up Jira tracking is needed.",
+  phases: ["Plan", "Evidence", "Draft", "Verify"],
+};
+
+phase("Plan");
+const plan = await agent(
+  [
+    "Extract BDS-owned summary, description, evidence links, RCA, impact, follow-up need, existing follow-up Jira, and short code pointer.",
+    "If source is a Slack incident thread, keep the Slack thread as source/narrative anchor; do not turn the main Jira into the Issue title unless Jira is the source.",
+    "Call bds_oncall_followup_payload_draft first. It computes the two-week report range, standard report title, Confluence row draft, and BDS Jira draft.",
+    "Keep BDS-only; exclude DB, MTP, TAR, rsync, or customer workflow detail unless it explains a BDS code/workflow gap.",
+    "Preserve paragraph intent: split timeline, evidence, RCA, recovery, impact, and links when available.",
+    "If the issue came from an alert, include concrete tenant, cluster, alert name, and source keywords so the Evidence phase can search for existing Jira follow-ups.",
+    "For bas_dr_sla_miss or DR copy SLA, extract affected tenants, stale mirror snapshot time, bad worker, zombie/node runtime evidence, approved actions, verification snapshot, BAS lag below 3600s, immediate Jira, and DC follow-up Jira.",
+    "Requester-facing Confluence or Jira content must not mention Codex or internal thread/source names.",
+    "Do not create or update Confluence or Jira in this phase.",
+  ].join("\n"),
+  {
+    label: "bds-oncall-followup-plan",
+    phase: "Plan",
+    tools: "mcp__devops_tool__bds_oncall_followup_payload_draft",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Evidence");
+const evidence = await agent(
+  [
+    "Find and read the current BDS on-call Confluence handoff page from the title and page ids in the plan.",
+    "If an existing follow-up Jira key or URL is present, read it before deciding whether another Jira is needed.",
+    "If a main Jira key is present, read its summary, status, and issuelinks. Prefer a linked monitor/product follow-up Jira for the Follow-up Jira field instead of using the main incident Jira.",
+    "Search Jira for existing follow-ups using tenant, cluster, alert, and issue keywords before drafting or creating a new ticket.",
+    "Classify rows as exact match, partial/mixed issue row, or unrelated row. Preserve unrelated rows and identify mixed rows that must be split.",
+    "If the page or Jira cannot be read, report the exact evidence gap and continue with draft-only output.",
+    "",
+    "Plan:",
+    plan,
+  ].join("\n"),
+  {
+    label: "bds-oncall-followup-evidence",
+    phase: "Evidence",
+    tools: "mcp__devops_tool__confluence_search_read,mcp__devops_tool__confluence_content_read,mcp__devops_tool__jira_api_read",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Draft");
+const draft = await agent(
+  [
+    "Prepare the final BDS-only Confluence row text and Jira-ready ticket fields from the plan and evidence.",
+    "If evidence shows an existing matching Jira, use that Jira as the follow-up link and prepare a comment/update instead of a duplicate Jira draft.",
+    "If evidence shows Slack thread plus main Jira plus linked follow-up Jira, put Slack in Issue/Slack-Jira refs, main Jira as context, and linked follow-up Jira in Follow-up Jira.",
+    "For mixed rows, preserve the old issue as its own row and add/update the new issue separately.",
+    "For bas_dr_sla_miss, separate read-only evidence from approved operator actions: cordon, force-delete stale pods, healthy-worker replacements, BAS recovery, and bad node remaining cordoned pending DC follow-up.",
+    "Render every Confluence issue row in paragraph format. Do not emit dense one-paragraph table cells for description, RCA, impact, or links.",
+    "Use neutral wording such as Discussion for references; generated content must not mention Codex or internal assistant/thread provenance.",
+    "Use confluence_handoff_page_draft only for handoff page body drafting.",
+    "Use jira_ticket_draft only for Jira-ready local text.",
+    "Do not over-specify implementation; point to current code/workflow problems and leave the fix to the assignee.",
+    "Do not include Mermaid sequence diagrams or unsupported Jira formatting.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Evidence:",
+    evidence,
+  ].join("\n"),
+  {
+    label: "bds-oncall-followup-draft",
+    phase: "Draft",
+    tools: "mcp__devops_tool__confluence_handoff_page_draft,mcp__devops_tool__jira_ticket_draft",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Verify");
+const verify = await agent(
+  [
+    "If Confluence or Jira writes have already happened through an approved external path, read back the updated page and ticket.",
+    "Confirm the on-call row contains the issue and follow-up Jira link when one exists.",
+    "For Slack-sourced incidents, confirm the row contains the Slack thread URL, the main Jira reference, and the linked follow-up monitor/product Jira when present.",
+    "Confirm the Confluence page version advanced after an approved write path.",
+    "Confirm unrelated Confluence rows and issue titles that existed before the update are still present; do not accept a result that accidentally removed an earlier issue.",
+    "Confirm each issue row uses paragraph-formatted cells for description, RCA/evidence, impact, and links.",
+    "Confirm requester-facing page and Jira text do not contain Codex or internal provenance wording.",
+    "For bas_dr_sla_miss rows, confirm affected tenants, zombie/node runtime evidence, DC follow-up Jira, verification snapshot/success marker, and BAS lag below 3600s; Slack/PagerDuty clear alone is not recovery evidence.",
+    "Confirm the Jira is in BDS, uses a BDS-owned scope, and does not contain non-BDS implementation detail or Mermaid diagrams.",
+    "If no approved write path was used, return the draft-only result and the exact manual verification checklist.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Draft:",
+    draft,
+  ].join("\n"),
+  {
+    label: "bds-oncall-followup-verify",
+    phase: "Verify",
+    tools: "mcp__devops_tool__confluence_content_read,mcp__devops_tool__jira_api_read",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+return {
+  plan,
+  evidence,
+  draft,
+  verify,
+};

package/workflows/bds-prism-service-proxy-timeout-investigation.js

@@ -0,0 +1,69 @@
+export const meta = {
+  name: "bds-prism-service-proxy-timeout-investigation",
+  description: "Investigate Prism Spark on K8s BdsCipherClient read timeouts against BDS bds-service-proxy with read-only Jira and Kubernetes evidence.",
+  whenToUse: "Use when PRISM/Chiron/Slack shows BdsCipherClient.generateKey, SocketTimeoutException, KMSClientException: Read timed out, or Delta commit aborts while calling bds-service-proxy.",
+  phases: ["Plan", "Evidence", "Reply"],
+};
+
+phase("Plan");
+const plan = await agent(
+  [
+    "Extract Jira key, cluster, tenant, CID, Spark appId, Prism pod label, activity id, and incident UTC.",
+    "Use the skill flow as the procedure; call only mcp__devops_tool__bds_prism_service_proxy_timeout_query_pack to normalize fields and produce read-only Jira/Kubernetes query inputs.",
+    "Do not use Bash, browser access, WebFetch, WebSearch, or any mutating tool in this phase.",
+    "Return parsed fields, query/command-pack output, and missing fields.",
+  ].join("\n"),
+  {
+    label: "bds-prism-service-proxy-timeout-plan",
+    phase: "Plan",
+    tools: "mcp__devops_tool__bds_prism_service_proxy_timeout_query_pack",
+    disallowedTools: "Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Evidence");
+const evidence = await agent(
+  [
+    "Collect read-only evidence from Jira and the target Kubernetes cluster.",
+    "Use jira_api_read to read issue metadata, comments, and bounded Chiron attachment snippets. If Jira auth is missing, report the missing secret route and stop; never print credentials.",
+    "Use kubernetes_status_snapshot and remote_readonly_command only for explicit read-only kubectl/spc evidence after operator connection or allowed path.",
+    "Verify AWS_PROFILE=sso-cust SPC context, kubectl current-context, auth whoami, and auth can-i before reading pod evidence.",
+    "For bds-service-proxy, read deployment/pod/service/endpoints state, restart count, kubectl log retention, and pod-local /opt/bds-service-proxy/log/*.log when Kubernetes logs do not cover the incident window.",
+    "Check Prism/OMS namespace RBAC before trying to inspect Prism pod logs or OMS dump files. If RBAC denies access, mark direct Prism/OMS inspection blocked.",
+    "Do not run mutating kubectl commands, copy logs, download files, or write local artifacts.",
+    "",
+    "Plan:",
+    plan,
+  ].join("\n"),
+  {
+    label: "bds-prism-service-proxy-timeout-evidence",
+    phase: "Evidence",
+    tools: "mcp__devops_tool__jira_api_read,mcp__devops_tool__kubernetes_status_snapshot,mcp__devops_tool__remote_readonly_command",
+    disallowedTools: "WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Reply");
+const reply = await agent(
+  [
+    "Draft a concise Slack-ready response from the evidence only.",
+    "State the system boundary as Prism Spark on K8s driver -> BdsCipherClient -> BDS bds-service-proxy.",
+    "Separate Prism driver timeout evidence from BDS service-proxy service-side errors or clean same-window traffic.",
+    "If BDS service-proxy logs are clean, ask Prism to inspect why the Spark driver timed out waiting for the bds-service-proxy response, especially driver/network/socket timeout behavior during Delta commit.",
+    "Mention any RBAC or log-retention gaps briefly.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Evidence:",
+    evidence,
+  ].join("\n"),
+  {
+    label: "bds-prism-service-proxy-timeout-reply",
+    phase: "Reply",
+    tools: "",
+    disallowedTools: "Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+return reply;

package/workflows/bds-scylla-tenant-bucket-investigation.js

@@ -0,0 +1,139 @@
+export const meta = {
+  name: "bds-scylla-tenant-bucket-investigation",
+  description: "Investigate Scylla BDS tenant health and tenant bucket state with read-only kcsb, bucketdetails-config, BDM pod, and hadoop fs S3A evidence.",
+  whenToUse: "Use when Slack/PagerDuty reports bds_bdm_tenant_tenant_health_status_alert, a Scylla tenant is unhealthy, or BDM tenant bucket paths need read-only verification.",
+  phases: ["Plan", "Source", "Cluster", "Bucket", "RCA"],
+};
+
+phase("Plan");
+const plan = await agent(
+  [
+    "Extract alertName, cluster, namespace, source pod, environment, tenant, severity, and alert time.",
+    "Use the skill flow as the procedure; call only mcp__devops_tool__bds_scylla_tenant_bucket_command_pack to normalize fields and produce read-only source/Kubernetes/S3A command inputs.",
+    "No Bash, browser, WebFetch, local reproduction, hdfs, aws s3, hadoop fs -get, or mutating commands.",
+    "Return parsed alert fields, command-pack output, and missing fields.",
+  ].join("\n"),
+  {
+    label: "bds-scylla-tenant-plan",
+    phase: "Plan",
+    tools: "mcp__devops_tool__bds_scylla_tenant_bucket_command_pack",
+    disallowedTools: "Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Source");
+const source = await agent(
+  [
+    "Read BDM tenant-health source code before interpreting bucket data.",
+    "Use bitbucket_api_read against https://bitbucket.workday.com/projects/BDS/repos/sirius/browse or the equivalent /rest/api/latest/projects/BDS/repos/sirius endpoints.",
+    "For deeper grep, use a human-reviewed local cache clone/pull outside this workflow, then git_repo_read and repo_text_index only.",
+    "Search for tenant health, TenantHealth, tenant_health, unhealthy, brokenDsInfo, consistency_check, and operationsLog.",
+    "Return source paths, function/class names, predicates, and expected data paths/object content.",
+    "Do not infer unhealthy status from directory shape until source predicates are known.",
+    "",
+    "Plan:",
+    plan,
+  ].join("\n"),
+  {
+    label: "bds-scylla-tenant-source",
+    phase: "Source",
+    tools: "mcp__devops_tool__bitbucket_api_read,mcp__devops_tool__git_repo_read,mcp__devops_tool__repo_text_index",
+    disallowedTools: "Bash,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Cluster");
+const cluster = await agent(
+  [
+    "Collect read-only Kubernetes context after operator login and SPC connect.",
+    "Use kubernetes_status_snapshot for pod context; remote_readonly_command only for kcsb get pod, kcsb get cm bucketdetails-config -o yaml, or kubeconfig-backed kubectl reads.",
+    "Do not retry login flows. If auth is missing, report that operator login is required.",
+    "Never run kubectl or kcsb apply, delete, patch, edit, scale, set, rollout restart, or exec commands in this phase.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Source:",
+    source,
+  ].join("\n"),
+  {
+    label: "bds-scylla-tenant-cluster",
+    phase: "Cluster",
+    tools: "mcp__devops_tool__kubernetes_status_snapshot,mcp__devops_tool__remote_readonly_command",
+    disallowedTools: "WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Bucket");
+const bucket = await agent(
+  [
+    "Collect only read-only S3A bucket evidence from a BDM pod.",
+    "Use the tenant folder rule data/tenants/<ENV_NAME>.<tenantName>; expected path-shape children can include operationsLog.csv, ted, and tmp.",
+    "Count active BDS tenants separately from bucket tenant folders. Prefer BDM metrics with isActiveTenant=\"true\" for active tenant evidence; treat bucket folder count as path inventory only.",
+    "Use remote_readonly_command against the Kubernetes BDM pod only for hadoop fs read commands: -ls, -cat, -head, -du, -count, -stat, -test, or -text.",
+    "For decrypt failures, capture timestamped BDM read errors and bds-service-proxy authenticated SIR key-fetch/decrypt errors. Look for Response code 503, Response status: 503, BdsCipherClient Error in decrypt, and KMSClientException.",
+    "For SIR key-fetch 503, verify SIR front-door DNS/HTTP reachability from bds-service-proxy; label unauthenticated curl 401 as reachability/auth-boundary only and note curl -k applies only to HTTPS.",
+    "Check kubectl auth can-i before trying to inspect sir, galahad, ors, or oms namespaces. If RBAC denies access, report backend pod/log inspection as blocked rather than making an availability claim.",
+    "When available, compare with another active tenant that successfully reads the same predefined file path.",
+    "Use hadoop fs, not hdfs. Do not use aws s3 inside BDS pods.",
+    "Never run hadoop fs -get, -put, -rm, -mkdir, -touchz, -mv, -cp, -chmod, -chown, or local redirection, except status-only redirection to /dev/null when explicitly used to avoid printing decrypted contents.",
+    "Return raw observations, command labels, path checked, and timestamps. Mark failures as evidence gaps.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Source:",
+    source,
+    "",
+    "Cluster:",
+    cluster,
+  ].join("\n"),
+  {
+    label: "bds-scylla-tenant-bucket",
+    phase: "Bucket",
+    tools: "mcp__devops_tool__remote_readonly_command",
+    disallowedTools: "WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("RCA");
+const rca = await agent(
+  [
+    "Draft a concise Markdown RCA from the collected evidence only.",
+    "Include Summary, Evidence table, Timeline, Current State, and Next Read-Only Checks.",
+    "State root cause or hypothesis with confidence and distinguish evidence from inference.",
+    "Include a Code-to-Data Comparison table mapping each source predicate to S3A evidence and pass/fail/unknown status.",
+    "Include active BDS tenant count separately from bucket folder count; state envops/test versus customer tenants based only on evidence.",
+    "Include concrete error log lines for key/decrypt failures, not just summarized errors.",
+    "Keep SIR front-door reachability separate from authenticated key-fetch 503; state whether Galahad/OMS/ORS inspection was RBAC-blocked.",
+    "If the environment is customer-like but only envops/test BDS tenants are observed, state both facts and do not claim direct customer data impact without evidence.",
+    "Include bucket ConfigMap source, BDM pod, hadoop fs path, tenant path, and consistency-check file result when available.",
+    "List remediation only as manual human-reviewed recommendations, not executed actions.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Source:",
+    source,
+    "",
+    "Cluster:",
+    cluster,
+    "",
+    "Bucket:",
+    bucket,
+  ].join("\n"),
+  {
+    label: "bds-scylla-tenant-rca",
+    phase: "RCA",
+    tools: "",
+    disallowedTools: "Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+return {
+  plan,
+  source,
+  cluster,
+  bucket,
+  rca,
+};

package/workflows/bds-tenant-data-operation-log-investigation.js

@@ -0,0 +1,189 @@
+export const meta = {
+  name: "bds-tenant-data-operation-log-investigation",
+  description: "Investigate BDS tenant data operation logs and PRISM path shape with read-only TSS, source, and HDFS evidence.",
+  whenToUse: "Use when a tenant is released but BDS/PRISM data or operationsLog.csv may be missing, incomplete, or inconsistent with preview/gold tenants.",
+  phases: ["Plan", "Source", "State", "ResolveHost", "Access", "HDFS", "RCA"],
+};
+
+phase("Plan");
+const plan = await agent(
+  [
+    "Extract cluster, datanode, HDFS authority, environment, tenant, and comparison tenants.",
+    "Use the skill flow as the procedure; call only mcp__devops_tool__bds_tenant_data_operation_log_command_pack to normalize fields and produce read-only HDFS/source command inputs.",
+    "Do not use Bash, browser access, WebFetch, local reproduction, HDFS writes, Keychain reads, or sudo in this phase.",
+    "Return parsed fields, command-pack output, and missing fields.",
+  ].join("\n"),
+  {
+    label: "bds-tenant-data-operation-log-plan",
+    phase: "Plan",
+    tools: "mcp__devops_tool__bds_tenant_data_operation_log_command_pack",
+    disallowedTools: "Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Source");
+const source = await agent(
+  [
+    "Confirm operation-log semantics from Sirius BDM source when needed.",
+    "Use bitbucket_api_read against https://bitbucket.workday.com/projects/BDS/repos/sirius/browse or equivalent /rest/api/latest/projects/BDS/repos/sirius endpoints.",
+    "For deeper grep, use a human-reviewed local cache clone/pull outside this workflow, then git_repo_read and repo_text_index only.",
+    "Search for operationLog, operationLogPath, getOperationLogRaw, /api/v3/bds/log, /v2/bds/log, and TenantDataManager.",
+    "Return source paths, functions/classes, and path rules.",
+    "",
+    "Plan:",
+    plan,
+  ].join("\n"),
+  {
+    label: "bds-tenant-data-operation-log-source",
+    phase: "Source",
+    tools: "mcp__devops_tool__bitbucket_api_read,mcp__devops_tool__git_repo_read,mcp__devops_tool__repo_text_index",
+    disallowedTools: "Bash,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("State");
+const state = await agent(
+  [
+    "Collect tenant TSS/OMS state only as a separate evidence domain.",
+    "Use available read-only HTTP/API tools, or report that tenant status API must be checked manually.",
+    "Do not infer BDS or PRISM data readiness from RELEASED/OK.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Source:",
+    source,
+  ].join("\n"),
+  {
+    label: "bds-tenant-data-operation-log-state",
+    phase: "State",
+    tools: "mcp__devops_tool__remote_readonly_command",
+    disallowedTools: "WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("ResolveHost");
+const resolvedHost = await agent(
+  [
+    "Resolve the concrete BDS host for HDFS read-only evidence before Boundary login or remote commands.",
+    "If the plan includes a datanodeHost, confirm it against BDS host lookup/inventory for the cluster instead of assuming it is current.",
+    "If no datanodeHost is provided, use mcp__devops_tool__bds_environment_host_lookup with roles=[\"datanode\",\"bdm\",\"namenode\"] and choose the narrowest host that can read the HDFS tenant path.",
+    "Keep datanodeHost, BDM host, cluster, HDFS authority, environmentName, tenantName, and comparison tenants as separate fields.",
+    "Do not invent host tools such as workday_host_info, host_info, host_query, or bds_enterprise_host_lookup.",
+    "Do not use grep, ls, Read, Glob, repository search, local /hadoop paths, local hdfs, or local curl as a substitute for host lookup.",
+    "If the exact host lookup MCP tool is unavailable or fails, stop and report the exact tool error as a tooling/access gap.",
+    "Return hdfsEvidenceHost, host role, cluster, lookup evidence, stale host exclusions, and ambiguity.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "State:",
+    state,
+  ].join("\n"),
+  {
+    label: "bds-tenant-data-operation-log-resolve-host",
+    phase: "ResolveHost",
+    tools: "mcp__devops_tool__bds_environment_host_lookup,mcp__devops_tool__bds_machine_inventory",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion,mcp__devops_tool__workday_boundary_login,mcp__devops_tool__remote_readonly_command",
+  },
+);
+
+phase("Access");
+const access = await agent(
+  [
+    "Check Boundary/DC readiness for the resolved hdfsEvidenceHost; use workday_boundary_login action=status unless login was explicitly approved.",
+    "Private cloud uses bauth init plus ordinary ssh to the explicit host.",
+    "Confirm hostname, UTC clock, user, command -v hdfs, and Kerberos cache state with remote_readonly_command.",
+    "If sudo/root HDFS access is required, use only mcp__devops_tool__workday_private_cloud_sudo_readonly_command; never ask for, print, or directly read LDAP password or Keychain JSON.",
+    "If remote_readonly_command is denied or unavailable, report the exact evidence gap and do not pivot to local HDFS, repo search, or guessed host metadata.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "ResolvedHost:",
+    resolvedHost,
+  ].join("\n"),
+  {
+    label: "bds-tenant-data-operation-log-access",
+    phase: "Access",
+    tools: "mcp__devops_tool__workday_boundary_login,mcp__devops_tool__remote_readonly_command",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("HDFS");
+const hdfs = await agent(
+  [
+    "Collect read-only HDFS evidence from the resolved hdfsEvidenceHost, approved datanode, or BDM pod.",
+    "Use remote_readonly_command only for single read commands that are already allowed: hostname, id, command -v hdfs, klist, hdfs crypto -listZones, hdfs dfs -ls, -du, -test, -tail, -cat, -count, or -stat.",
+    "Credential setup through Keychain/sudo must be operator-approved and must never print passwords, tokens, raw JSON, or sudo stdin.",
+    "Check data/tenants/<ENV_NAME>.<tenantName>/operationsLog.csv and provided preview/gold/numbered tenants.",
+    "Never run hdfs dfs -get, -put, -rm, -mkdir, -touchz, -cp, -mv, -chmod, or -chown.",
+    "Return observations, command labels, checked path, and timestamps. Mark missing files as evidence, not tool failure.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Source:",
+    source,
+    "",
+    "State:",
+    state,
+    "",
+    "ResolvedHost:",
+    resolvedHost,
+    "",
+    "Access:",
+    access,
+  ].join("\n"),
+  {
+    label: "bds-tenant-data-operation-log-hdfs",
+    phase: "HDFS",
+    tools: "mcp__devops_tool__remote_readonly_command",
+    disallowedTools: "WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("RCA");
+const rca = await agent(
+  [
+    "Draft a concise Markdown RCA from collected evidence only.",
+    "Include Scope, State Domains, Evidence table, Path-shape comparison, Operation log timeline, Conclusion, and Next Read-Only Checks.",
+    "Separate direct evidence from inference. State confidence explicitly.",
+    "Manual remediation notes are allowed only as recommendations and must be marked not executed.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Source:",
+    source,
+    "",
+    "State:",
+    state,
+    "",
+    "ResolvedHost:",
+    resolvedHost,
+    "",
+    "Access:",
+    access,
+    "",
+    "HDFS:",
+    hdfs,
+  ].join("\n"),
+  {
+    label: "bds-tenant-data-operation-log-rca",
+    phase: "RCA",
+    tools: "",
+    disallowedTools: "Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+return {
+  plan,
+  source,
+  state,
+  resolvedHost,
+  access,
+  hdfs,
+  rca,
+};