Perform fault diagnosis and confirmation-based recovery for applications deployed by qianwenai-deploy on the Alibaba Cloud China site. Diagnosis is read-only and requires no confirmation; any action that changes cloud resources or the application's running state must be explicitly confirmed.
Interaction flow
识别应用和资源
→ 最小诊断（只读）
→ 给出原因、证据、建议动作
→ 展示影响并请求确认
→ 执行一个恢复动作
→ 验证应用、ECS、RDS
→ 返回结果和审计信息
→ 提议经 qianwenai-observe 重新评分（恢复前 → 恢复后）
Interaction form
- Read-only information(diagnosis, cause, evidence, verification result): plain text, with one line of evidence (metric, status, RequestId) after each judgment.
- State-changing actions(any write call such as starting/stopping ECS, restarting the application, reloading Nginx): first use AskUserQuestion, and the question must clearly state what to do · impact(downtime/irreversible) · how to verify, do not execute before confirmation; propose only one recovery action at a time.
- Proactive discipline: after recovery, if the result is normal, wrap up quietly; only when risks remain or recovery has not succeeded, proactively offer next steps and let the user choose.
Scope
| In scope | Out of scope |
|---|---|
Applications deployed by qianwenai-deploy (state file exists) |
No .qianwenai-deploy applications with a state file |
| Single ECS, or ECS + RDS MySQL 8.0 | Other topologies / self-managed servers |
| Diagnosis + confirmation-based recovery (start ECS, restart application, reload Nginx) | Data-destructive operations, scaling, configuration refactoring |
| Locate application-layer errors (which layer is broken, what error was reported) | Source code review, finding bugs/vulnerabilities, determining which line of code is wrong, modifying code |
| Alibaba Cloud China site | International site → use qwencloud-operate |
Code issues are out of scope
This skill handles infrastructure and runtime faults; it does not perform source code review, defect localization, or code modification. Diagnosis can locate "application-layer errors, what error was reported" to help users narrow down the scope, but it does not determine which specific line of code is problematic, nor does it modify code.
When code is involved, clearly inform the user: modifying code is outside the capability of this skill, and the user must decide and perform it themselves, bearing the corresponding consequences. Do not include any code changes in recovery actions.
Prerequisites
Aliyun CLI：
aliyun version(requires 3.x). All commands use the native camelCase form to connect directly to OpenAPI, without relying on plugins. Credentials are only used withaliyun configure listto view status.Neverread, echo, print, or ask for AK/SK/Token. No valid profile → stop and ask the user to configure credentials outside this session. Seereferences/cli_installation_guide.md。
How to do it
- Identify the application — from
.qianwenai-deployidentify the application. See workflow。 - Diagnosis(read-only, no confirmation required) — find out which layer is broken, the possible cause, the evidence, and how to handle it. See diagnose。
- Recover only one thing at a time, and confirm first. Select the action that matches the diagnosis, show the user the impact and obtain consent, then execute that one thing and only that one thing:
- Start a stopped server → recover-ecs
- Restart a hung server → recover-reboot
- Restart the application service → recover-app
nginx -tAfter approval, reload Nginx → recover-nginx- Unbind and rebind the EIP → recover-eip
- Allow inbound traffic on ports 80 / 443 in the security group → recover-securitygroup
- Database-related issues → recover-rds
- Root partition about to fill up / still insufficient after cleanup and needs expansion → recover-disk
- Verifywhether the application has recovered, thenrecordwhat was done. See workflow。
A few rules for ensuring recovery safety
- Diagnosis is read-only; recovery uses only a small set of known-safe commands.
- Any action that changes state is confirmed with the user first; if canceled, nothing is changed.
- One action at a time, verify before deciding the next step—never combine multiple recovery steps together.
- Recovery actions can be safely repeated.
- When encountering a timeout, permission error, or unexpected state change, stop before the next change.
- Passwords, Tokens, or full connection strings must never appear in audit records or conversations.
Before any change, the confirmation message must tell the user: which resource is being operated on, what action will be performed, whether the application will be briefly interrupted, whether the version will change, whether new charges will be incurred, and how you will verify (and what to do if it fails).
Required permissions
See references/ram_policies.md. Read-only:ecs:DescribeInstances、ecs:DescribeInvocations、
ecs:DescribeSecurityGroupAttribute、ecs:DescribeDisks、vpc:DescribeEipAddresses, RDS describe/performance/slow logs. Write (recovery):ecs:StartInstance、ecs:RebootInstance、
ecs:AuthorizeSecurityGroup、ecs:ResizeDisk、vpc:AssociateEipAddress、
ecs:RunCommand(whitelisted recovery commands only).
More details
Step-by-step guides are linked above in "How to do it". There are also two configuration references:
- CLI configuration — installation and credential checks.
- CLI pitfalls quick reference — parameter forms, time formats, and common response parsing mistakes.
- RAM permissions — the permissions required by this skill.