{
    "pack": "shc-operator-pack-universal",
    "version": "2.4.15",
    "title": "SHC Operator Skills",
    "moat": "A VPS your AI already knows how to run.",
    "start_here": "get-access",
    "start_here_note": "Run the get-access skill FIRST -- it gets you permission to the user's account. Every other skill needs it. If any SHC call returns 401, run get-access again.",
    "base_url": "https://blesta.sovereignhybridcompute.com/agent-skills",
    "lean_entrypoint": "https://blesta.sovereignhybridcompute.com/agent-skills/router.json",
    "lean_entrypoint_note": "Point your agent at router.json (compact routing table), NOT this full index. index.json is full metadata, not the prompt payload.",
    "discipline": "https://blesta.sovereignhybridcompute.com/agent-skills/discipline.md",
    "human_index": "https://blesta.sovereignhybridcompute.com/agent-skills/INDEX.md",
    "adapters": {
        "router": "https://blesta.sovereignhybridcompute.com/agent-skills/router.json (LEAN DEFAULT -- the routing table to keep resident)",
        "router_md": "https://blesta.sovereignhybridcompute.com/agent-skills/router.md (human twin of router.json)",
        "claude_code": "https://blesta.sovereignhybridcompute.com/agent-skills/adapters/claude/<skill>/SKILL.md (lean stubs; one per skill)",
        "claude_full": "https://blesta.sovereignhybridcompute.com/agent-skills/adapters/claude-full/<skill>/SKILL.md (full bodies, large-context)",
        "codex": "https://blesta.sovereignhybridcompute.com/agent-skills/adapters/codex/AGENTS.md (one file, all skills)",
        "mcp_resources": "https://blesta.sovereignhybridcompute.com/agent-skills/adapters/mcp/resources.json (lists pack/router as default)",
        "raw_universal": "https://blesta.sovereignhybridcompute.com/agent-skills/skills/<skill>/<skill>.md (fetch into any agent's context)"
    },
    "result_contract_note": "Each skill prints STATUS: ready (done) | provisioning (still coming up, wait and re-run) | failed (do the NEXT_ACTION it gives you).",
    "api_contract": {
        "base_url": "https://blesta.sovereignhybridcompute.com/user-api/v2",
        "openapi_url": "https://blesta.sovereignhybridcompute.com/user-api/openapi.json",
        "info_version": "2.4.15",
        "note": "This pack targets the user-api /v2 2.4.15 contract. VM routes use /vm/{serviceId}; the separate 2.5 clean-break surface uses different paths and is not this pack's target.",
        "version": "2.4.15",
        "operation_count": 177,
        "tool_count": 177,
        "contractFingerprint": "e8f7ccc12336fb4925893ce3582b03782b182638dc460d952d046a36c1c20e14"
    },
    "workflows_index": "https://blesta.sovereignhybridcompute.com/agent-skills/workflows.json",
    "intent_routes": [
        {
            "intent": "orders",
            "when": "List/read orders, pay an order invoice, or cancel an unpaid unprovisioned order.",
            "domain": "ordering",
            "doc": "workflows/ordering.arazzo.yaml",
            "workflows": [
                "track-order-and-pay",
                "cancel-pending-order"
            ],
            "operations": [
                "listOrders",
                "getOrder",
                "cancelPendingOrder"
            ],
            "fetch": "https://blesta.sovereignhybridcompute.com/agent-skills/workflows/ordering.arazzo.yaml"
        },
        {
            "intent": "documents-downloads",
            "when": "Fetch client documents or entitlement-gated Download Manager files.",
            "domain": "account",
            "doc": "workflows/account.arazzo.yaml",
            "workflows": [
                "fetch-client-document",
                "browse-and-download-files"
            ],
            "operations": [
                "listClientDocuments",
                "downloadClientDocument",
                "listDownloadFiles",
                "downloadDownloadFile"
            ],
            "fetch": "https://blesta.sovereignhybridcompute.com/agent-skills/workflows/account.arazzo.yaml"
        },
        {
            "intent": "nostr-identity",
            "when": "Link, name, or unlink the account's Nostr identity.",
            "domain": "account",
            "doc": "workflows/account.arazzo.yaml",
            "workflows": [
                "link-nostr-identity",
                "set-nostr-nip05",
                "unlink-nostr-identity"
            ],
            "operations": [
                "getNostrLinkChallenge",
                "linkNostrIdentity",
                "updateNip05",
                "unlinkNostrIdentity"
            ],
            "related_skill": "nostr-operate-lane",
            "fetch": "https://blesta.sovereignhybridcompute.com/agent-skills/workflows/account.arazzo.yaml",
            "related_skill_fetch": "https://blesta.sovereignhybridcompute.com/agent-skills/skills/nostr-operate-lane/nostr-operate-lane.md"
        },
        {
            "intent": "support-attachments-feedback",
            "when": "Download a ticket attachment or submit feedback for a closed ticket.",
            "domain": "support",
            "doc": "workflows/support.arazzo.yaml",
            "workflows": [
                "fetch-ticket-attachment",
                "rate-closed-ticket"
            ],
            "operations": [
                "getSupportTicketAttachment",
                "submitSupportTicketFeedback"
            ],
            "fetch": "https://blesta.sovereignhybridcompute.com/agent-skills/workflows/support.arazzo.yaml"
        },
        {
            "intent": "invoice-electronic",
            "when": "Download a machine-readable electronic invoice document.",
            "domain": "billing",
            "doc": "workflows/billing.arazzo.yaml",
            "workflows": [
                "fetch-invoice-document"
            ],
            "operations": [
                "getInvoiceElectronic"
            ],
            "fetch": "https://blesta.sovereignhybridcompute.com/agent-skills/workflows/billing.arazzo.yaml"
        },
        {
            "intent": "contacts-managers",
            "when": "Update a contact or adjust an account manager's permissions.",
            "domain": "account",
            "doc": "workflows/account.arazzo.yaml",
            "workflows": [
                "update-contact",
                "adjust-manager-permissions"
            ],
            "operations": [
                "updateContact",
                "updateAccountManager"
            ],
            "fetch": "https://blesta.sovereignhybridcompute.com/agent-skills/workflows/account.arazzo.yaml"
        },
        {
            "intent": "vm-term-change",
            "when": "Preview and commit a VM billing-term change.",
            "domain": "ordering",
            "doc": "workflows/ordering.arazzo.yaml",
            "workflows": [
                "change-billing-term"
            ],
            "operations": [
                "getVirtualMachineTermOptions",
                "previewVirtualMachineTermChange",
                "changeVirtualMachineTerm"
            ],
            "fetch": "https://blesta.sovereignhybridcompute.com/agent-skills/workflows/ordering.arazzo.yaml"
        },
        {
            "intent": "quotation-approval",
            "when": "Approve a pending quotation and pay the resulting invoice.",
            "domain": "billing",
            "doc": "workflows/billing.arazzo.yaml",
            "workflows": [
                "accept-quotation"
            ],
            "operations": [
                "approveQuotation"
            ],
            "fetch": "https://blesta.sovereignhybridcompute.com/agent-skills/workflows/billing.arazzo.yaml"
        }
    ],
    "operation_inventory": [
        {
            "operationId": "listOrders",
            "method": "GET",
            "path": "/orders",
            "domain": "ordering",
            "workflow": "track-order-and-pay"
        },
        {
            "operationId": "getOrder",
            "method": "GET",
            "path": "/orders/{orderId}",
            "domain": "ordering",
            "workflow": "track-order-and-pay"
        },
        {
            "operationId": "cancelPendingOrder",
            "method": "POST",
            "path": "/orders/{orderId}/cancel",
            "domain": "ordering",
            "workflow": "cancel-pending-order"
        },
        {
            "operationId": "listClientDocuments",
            "method": "GET",
            "path": "/documents",
            "domain": "account",
            "workflow": "fetch-client-document"
        },
        {
            "operationId": "downloadClientDocument",
            "method": "GET",
            "path": "/documents/{documentId}/download",
            "domain": "account",
            "workflow": "fetch-client-document"
        },
        {
            "operationId": "listDownloadFiles",
            "method": "GET",
            "path": "/downloads",
            "domain": "account",
            "workflow": "browse-and-download-files"
        },
        {
            "operationId": "downloadDownloadFile",
            "method": "GET",
            "path": "/downloads/{fileId}/download",
            "domain": "account",
            "workflow": "browse-and-download-files"
        },
        {
            "operationId": "getNostrLinkChallenge",
            "method": "GET",
            "path": "/account/nostr/link-challenge",
            "domain": "account",
            "workflow": "link-nostr-identity"
        },
        {
            "operationId": "linkNostrIdentity",
            "method": "POST",
            "path": "/account/nostr/link",
            "domain": "account",
            "workflow": "link-nostr-identity"
        },
        {
            "operationId": "unlinkNostrIdentity",
            "method": "POST",
            "path": "/account/nostr/unlink",
            "domain": "account",
            "workflow": "unlink-nostr-identity"
        },
        {
            "operationId": "updateNip05",
            "method": "PATCH",
            "path": "/account/nostr/nip05",
            "domain": "account",
            "workflow": "set-nostr-nip05"
        },
        {
            "operationId": "getSupportTicketAttachment",
            "method": "GET",
            "path": "/support/tickets/{ticketId}/attachments/{attachmentId}",
            "domain": "support",
            "workflow": "fetch-ticket-attachment"
        },
        {
            "operationId": "submitSupportTicketFeedback",
            "method": "POST",
            "path": "/support/tickets/{ticketId}/feedback",
            "domain": "support",
            "workflow": "rate-closed-ticket"
        },
        {
            "operationId": "getInvoiceElectronic",
            "method": "GET",
            "path": "/invoices/{invoiceId}/electronic",
            "domain": "billing",
            "workflow": "fetch-invoice-document"
        },
        {
            "operationId": "updateContact",
            "method": "PATCH",
            "path": "/contacts/{contactId}",
            "domain": "account",
            "workflow": "update-contact"
        },
        {
            "operationId": "updateAccountManager",
            "method": "PATCH",
            "path": "/managers/{ref}",
            "domain": "account",
            "workflow": "adjust-manager-permissions"
        },
        {
            "operationId": "getVirtualMachineTermOptions",
            "method": "GET",
            "path": "/vm/{serviceId}/term-options",
            "domain": "ordering",
            "workflow": "change-billing-term"
        },
        {
            "operationId": "previewVirtualMachineTermChange",
            "method": "POST",
            "path": "/vm/{serviceId}/term/preview",
            "domain": "ordering",
            "workflow": "change-billing-term"
        },
        {
            "operationId": "changeVirtualMachineTerm",
            "method": "PATCH",
            "path": "/vm/{serviceId}/term",
            "domain": "ordering",
            "workflow": "change-billing-term"
        },
        {
            "operationId": "approveQuotation",
            "method": "POST",
            "path": "/quotations/{quotationId}/approve",
            "domain": "billing",
            "workflow": "accept-quotation"
        }
    ],
    "recipe_library": [
        {
            "app": "btcpay",
            "status": "ready",
            "recipe": "core/recipes/btcpay.md",
            "upstream": "github.com/btcpayserver/btcpayserver-docker",
            "provides": "a Bitcoin payment store"
        },
        {
            "app": "nextcloud",
            "status": "spec",
            "recipe": "core/recipes/nextcloud.md",
            "upstream": "github.com/nextcloud/all-in-one",
            "provides": "a private cloud"
        }
    ],
    "skills": [
        {
            "name": "get-access",
            "status": "ready",
            "operator": true,
            "client_side": true,
            "danger": "low",
            "what": "The FIRST skill -- run before any other. Creates the user's SHC account via one anonymous API call (no website) and returns an operate-scoped key. Never prints or asks for a password.",
            "when_to_use": "Run this FIRST, before anything else, the moment the user asks you to do anything with SHC (a server, a Bitcoin store, a cloud). ALSO run it any time an SHC call returns 401 or says \"unauthorized\" or \"authentication required\" -- that means you do not have a key yet.",
            "provides": [
                "shc_access_key",
                "user_api_key_operate"
            ],
            "requires": [],
            "fetch": {
                "universal_markdown": "https://blesta.sovereignhybridcompute.com/agent-skills/skills/get-access/get-access.md",
                "claude_skill_md": "https://blesta.sovereignhybridcompute.com/agent-skills/adapters/claude/get-access/SKILL.md"
            }
        },
        {
            "name": "shc-deploy-app",
            "status": "ready",
            "operator": true,
            "client_side": false,
            "danger": "low",
            "what": "Deploy a self-hosted app onto a fresh SHC VPS end to end via the verified-deploy loop (check the app's docs, install once, prove it with a live healthcheck). The agent does every step over SSH.",
            "when_to_use": "The user asks their agent to \"deploy X on my server\", \"set up a self-hosted X\", \"make me a Bitcoin payment store\", \"give me my own private cloud\", or names any app in the recipe library. Use this whenever the goal is to stand up a real service on an SHC VPS the agent has SSH to.",
            "provides": [
                "deployed_app"
            ],
            "requires": [
                "ssh_root_or_sudo",
                "public_dns_a_record",
                "vps_ready"
            ],
            "fetch": {
                "universal_markdown": "https://blesta.sovereignhybridcompute.com/agent-skills/skills/shc-deploy-app/shc-deploy-app.md",
                "claude_skill_md": "https://blesta.sovereignhybridcompute.com/agent-skills/adapters/claude/shc-deploy-app/SKILL.md"
            }
        },
        {
            "name": "nostr-operate-lane",
            "status": "ready",
            "operator": true,
            "client_side": true,
            "danger": "low",
            "what": "A customer authorizes YOU (a specific AI agent) to operate ONE of their SHC VMs by signing a Nostr grant. You exchange that grant for a short-TTL, service-scoped, cannot-spend operate Bearer and use it against that one VM only. No password, no website, no broad key.",
            "when_to_use": "Use when a customer wants to hand YOU operation of ONE specific VM service over Nostr (NIP-07/NIP-46 keys), instead of giving you an account-wide API key. Trigger: the customer offers a signed kind:30078 operate grant, OR you need to act on a single VM the customer owns and they would rather sign a scoped grant than share a key. ALSO re-run this any time your operate Bearer returns 401 (expired/used-up) -- mint a fresh one; the grant is re-usable until it expires.",
            "provides": [
                "user_api_key_operate"
            ],
            "requires": [],
            "fetch": {
                "universal_markdown": "https://blesta.sovereignhybridcompute.com/agent-skills/skills/nostr-operate-lane/nostr-operate-lane.md",
                "claude_skill_md": "https://blesta.sovereignhybridcompute.com/agent-skills/adapters/claude/nostr-operate-lane/SKILL.md"
            }
        },
        {
            "name": "shc-pay",
            "status": "ready",
            "operator": true,
            "client_side": true,
            "danger": "low",
            "what": "Present an SHC account-credit top-up as a no-dependency scannable QR plus copy/paste fallbacks, and confirm payment only after a real balance re-read. Never auto-pays. Runs in the agent's own shell.",
            "when_to_use": "The user wants to add prepaid credit to their SHC account (\"put $25 on my account so my servers keep running\"), OR a deploy/order step reports it needs funds. Use after someone has called POST /account/credit and you hold the returned JSON; this skill turns that JSON into a friendly \"here is how to pay\".",
            "provides": [
                "payment_qr"
            ],
            "requires": [
                "user_api_key_operate"
            ],
            "fetch": {
                "universal_markdown": "https://blesta.sovereignhybridcompute.com/agent-skills/skills/shc-pay/shc-pay.md",
                "claude_skill_md": "https://blesta.sovereignhybridcompute.com/agent-skills/adapters/claude/shc-pay/SKILL.md"
            }
        },
        {
            "name": "wait-until-ready",
            "status": "ready",
            "operator": true,
            "client_side": false,
            "danger": "low",
            "what": "Block until a fresh SHC VPS is operable -- confirm the server is up and the agent's SSH + sudo work before any deploy touches it. The first thing every VPS-side operator skill depends on.",
            "when_to_use": "Right after ordering/provisioning a VPS, before running any deploy (shc-deploy-app), point-a-domain, harden-ssh, or nightly-backup. Use it as the gate: call it, walk away, proceed only once the VPS is ready.",
            "provides": [
                "vps_ready"
            ],
            "requires": [
                "user_api_key_operate"
            ],
            "fetch": {
                "universal_markdown": "https://blesta.sovereignhybridcompute.com/agent-skills/skills/wait-until-ready/wait-until-ready.md",
                "claude_skill_md": "https://blesta.sovereignhybridcompute.com/agent-skills/adapters/claude/wait-until-ready/SKILL.md"
            }
        },
        {
            "name": "point-a-domain",
            "status": "ready",
            "operator": true,
            "client_side": false,
            "danger": "low",
            "what": "Make a domain or subdomain resolve to the VPS public IP (A/AAAA), then verify it globally, so automatic TLS (Let's Encrypt) can validate. Prerequisite for any HTTPS service the agent deploys.",
            "when_to_use": "Before deploying any app that serves HTTPS (BTCPay, Nextcloud, anything with a web UI). The user picked a hostname; this makes it point at their VPS and confirms it resolves before the deploy's TLS step runs.",
            "provides": [
                "public_dns_a_record"
            ],
            "requires": [
                "vps_ready"
            ],
            "fetch": {
                "universal_markdown": "https://blesta.sovereignhybridcompute.com/agent-skills/skills/point-a-domain/point-a-domain.md",
                "claude_skill_md": "https://blesta.sovereignhybridcompute.com/agent-skills/adapters/claude/point-a-domain/SKILL.md"
            }
        },
        {
            "name": "harden-ssh",
            "status": "ready",
            "operator": true,
            "client_side": false,
            "danger": "medium",
            "what": "Lock down a fresh SHC VPS -- key-only SSH, unattended security upgrades, and a default-deny firewall opening only the ports the services need. Verifies it can still reconnect before committing (no lockout). Idempotent.",
            "when_to_use": "After a deploy (so you know which ports the app needs), or any time the user asks to \"secure / lock down / harden my server\". Safe to re-run.",
            "provides": [
                "hardened_host"
            ],
            "requires": [
                "ssh_root_or_sudo",
                "vps_ready"
            ],
            "fetch": {
                "universal_markdown": "https://blesta.sovereignhybridcompute.com/agent-skills/skills/harden-ssh/harden-ssh.md",
                "claude_skill_md": "https://blesta.sovereignhybridcompute.com/agent-skills/adapters/claude/harden-ssh/SKILL.md"
            }
        },
        {
            "name": "nightly-backup",
            "status": "ready",
            "operator": true,
            "client_side": false,
            "danger": "low",
            "what": "Install a nightly encrypted backup of a deployed app's data + database to a destination the user controls, with a mandatory verify-restore drill so \"your data is safe\" is a verified claim, not a hope.",
            "when_to_use": "After deploying an app the user cares about (BTCPay store, Nextcloud), or any time the user asks to \"back up my server / set up backups\". Pairs with shc-deploy-app.",
            "provides": [
                "nightly_backup"
            ],
            "requires": [
                "ssh_root_or_sudo",
                "vps_ready"
            ],
            "fetch": {
                "universal_markdown": "https://blesta.sovereignhybridcompute.com/agent-skills/skills/nightly-backup/nightly-backup.md",
                "claude_skill_md": "https://blesta.sovereignhybridcompute.com/agent-skills/adapters/claude/nightly-backup/SKILL.md"
            }
        }
    ],
    "operation_count": 177,
    "tool_count": 177,
    "contractFingerprint": "e8f7ccc12336fb4925893ce3582b03782b182638dc460d952d046a36c1c20e14",
    "x-shc-release": {
        "version": "2.4.15",
        "op_fingerprint": "183a4a0282542d671d799f08044f6717182932f9fa1ef5205dfca45a030cefaa",
        "op_count": 177,
        "contractFingerprint": "e8f7ccc12336fb4925893ce3582b03782b182638dc460d952d046a36c1c20e14"
    }
}