check-approve

Skill: check-approve

WHAT

Purpose and context

• Purpose: When a DMS request "hangs after pressing approve" / it's unclear whether the approval command reached BE, the user needs 1 command on 1 line to paste onto product server (ubuntu@hcm-bonbon-sv03) — the agent does NOT have SSH to product so does NOT run it itself, only generates the command ([[feedback_product_server_debug]]). This skill pre-generates the BE + FE commands, writes them to file .sh (to avoid line-break errors when copying) and prints them inline.
• Trigger (when to use):
  • /check-approve <REQ-CODE> [--since 120m]
  • User: "write a check (approve) command", "request approve hangs", "don't see the approval command in the log", "check approve on be/fe"
• Non-goals: no SSH/running commands on product, no fixing the approve bug (incidents needing repro/fix → /orca-issue), no tracing on local by default.

Mental model

REQ-CODE (+ SUM-ID, since, container, user) → template BE + FE → one-liner 1 dòng → file .sh + in inline → user tự chạy trên product → đọc kết quả (có POST approve hay không).

Input and output contract

	Field	Required?	Meaning
In	<REQ-CODE>	yes	request code, e.g. BAF-CTD-26050043; missing → ask the user
In	--since	no	docker logs range, default 120m
In	--be-container / --user	no	missing → use placeholder <BE_CONTAINER> / <FE_USER>
In	SUM-ID	no	narrower filter, ask the user if needed
Out	scratchpad/check-approve-<REQ-CODE>.sh	yes	2 BE + FE one-liners (or the path specified by the user)
Out	command inline in the answer	yes	so the user can copy quickly; "done" = the user has a runnable command, NOT that the agent has run it

Rules and capabilities

• RULE-01 (MUST): Do NOT SSH/run commands on product yourself — only generate the command ([[feedback_product_server_debug]]).
• RULE-02 (MUST): By default trace on product (hcm-bonbon-sv03), not local.
• RULE-03 (MUST): Each command stays on 1 line (no line breaks).
• RULE-04 (MUST): If the user says "write to the wiki log folder" → write .sh/.txt, NOT .md (to avoid the OKF frontmatter hook).
• Capabilities: write the command file locally; no server access, no network.

Failure boundaries

• Missing <REQ-CODE> → clarify, do not generate a command with a guessed code.
• Unknown container/user → partial is valid: generate the command with a placeholder, tell the user to replace it with docker ps.
• User asks the agent to run it on product itself → blocked per RULE-01, only provide the command.

HOW

Main workflow

Step	Type	Inputs	Action	Outputs/exit	Failure/next
W01	judgment	user message	Resolve parameters, leave the rest as placeholders	parameter set	missing REQ-CODE → clarify
W02	deterministic	parameters	Generate 2 one-liners BE + FE per template, 1 line	2 commands	—
W03	effect	commands	Write to scratchpad/check-approve-<REQ-CODE>.sh (or user-specified path)	file .sh	—
W04	deterministic	commands	Show inline; do NOT run automatically	user has the commands	—

Details of each step (source of truth for W01–W04):

1. Resolve — get <REQ-CODE>, --since, container/user if the user provides them; leave the rest as placeholders for the user to fill in.
2. Generate — build 2 one-liners (BE + FE) per the template below, keep on 1 line (no line breaks).
3. Write — write to scratchpad/check-approve-<REQ-CODE>.sh (or user-specified path). If the user says "write to the wiki log folder" → write .sh/.txt, NOT .md (to avoid the OKF frontmatter hook).
4. Show — print both commands inline in the response so the user can copy quickly. Do NOT run automatically on product.

Input

Parameter	Meaning	Default
<REQ-CODE>	Request code, e.g. BAF-CTD-26050043	required
--since	Docker logs time range	120m
--be-container	Backend container (if the user knows it)	placeholder <BE_CONTAINER>
--user	FE username to filter proxy logs	placeholder <FE_USER> (e.g. trangntt)

<REQ-CODE> usually tied to SUM-ID (e.g. 1010228) — ask the user if narrower filtering is needed.

Branches

ID	Kind	Guard	Behavior	Skip / failure	Rejoin
B01	user_optional	the user says "write to the wiki log folder"	write .sh/.txt there instead of scratchpad/, not .md	says nothing → default path	W04
B02	user_optional	the user only needs to filter by request code	use the concise BE version instead of the combined version	—	W03

Validation and stopping

Visual check: each command is exactly 1 line, the request code is replaced in the right place, remaining placeholders are clearly stated. Stop after W04 — the log-reading step belongs to the user (the "Reading the results" section is used when the user pastes the log back).

Examples

• Positive: /check-approve BAF-CTD-26050043 --since 6h → writes scratchpad/check-approve-BAF-CTD-26050043.sh containing the BE + FE commands --since 6h, container for <BE_CONTAINER>/<FE_CONTAINER>, printed inline, not executed.
• Boundary/failure: "check approve is hanging, ssh in yourself to look" has no request code → ask for the request code; refuse to SSH, only generate commands.

Reference — Command templates

BE (docker logs on product) — command aggregating the approve endpoints:

docker logs <BE_CONTAINER> --since 120m 2>&1 | grep -i -B2 -A2 -e BAF-CTD-26050043 -e <SUM_ID> | grep -i -e POST -e Action -e Approve -e Reject -e Return -e UpdateGenTask -e GetGenTaskById -e UpdateTask -e "ApproveSummary/Approve" -e QuickApprove -e UpdateRequestByApproveGroup

BE — compact version (filter by request code only):

docker logs <BE_CONTAINER> --since 120m 2>&1 | grep -i -e POST -e approve -e UpdateGenTask -e ApproveSummary -e UpdateRequestByApproveGroup -e BAF-CTD-26050043

FE (dms-proxy log) — filter by user + request:

docker logs <FE_CONTAINER> --since 120m 2>&1 | grep -i -e "dms-proxy" -e BAF-CTD-26050043 -e <FE_USER> -e Approve -e Action

Replace <BE_CONTAINER> / <FE_CONTAINER> with the real container (docker ps). Change --since if the approval was a while ago (e.g. 6h). Change BAF-CTD-26050043 to the request code to check.

Reference — Reading the results

• There is POST /api/ApproveSummary/Approve (or UpdateGenTask, UpdateRequestByApproveGroup) with the request code → the approve command HAS reached the BE.
• There is no POST line even though the FE reports it was pressed → the request is stuck at the FE / proxy, has not called the BE → keep investigating [[concepts/approve-action-flow]] and the proxy.
• Per-module endpoint, see [[entities/dms-modules]] (BAF/VEN01/CashAdv… differ).

Reference — Limits

• Do NOT SSH/run commands on product yourself — only generate commands ([[feedback_product_server_debug]]).
• Default trace on product (hcm-bonbon-sv03), not local.

Origin

• Raw: distilled from session 6902c846 / c2f1149e (2026-06-25, debug approve hanging BAF-CTD-26050043/30/26060030)
• Generated by: /orca-eval finding #3 (250626-eval-report)