Orcamatrix Generated App Runtime

OrcaMatrix Generated App Runtime Access

Use this skill only after the generated app has provided an external-agent access package. Work from the unpacked package directory so the bundled CLI can read .orcamatrix-app.env.

Load The Package

1. Keep .orcamatrix-app.env local to the package directory.
2. Run node bin/orcamatrix-app diagnose before making runtime calls.
3. Run node bin/orcamatrix-app discover to fetch /api/runtime/manifest and /api/runtime/readiness before business calls.
4. Use node bin/orcamatrix-app get /api/... or node bin/orcamatrix-app post /api/... '{...}'.
5. If a wrapper was installed, use orcamatrix-app discover, orcamatrix-app get /api/..., or orcamatrix-app post /api/... '{...}'; the wrapper delegates back to the package CLI.

Agents must use the packaged CLI for delegated auth and runtime calls. Do not parse .orcamatrix-app.env, do not ask a human for raw delegated keys or raw access tokens, and do not copy env values into prompts, notes, Skill directories, or wrapper scripts.

Discover Operations First

Before calling a business operation, run:

node bin/orcamatrix-app discover

Use the returned capabilities, operations, and readinessStatus to decide which runtime API calls are available. If you need to inspect the raw runtime contract, use the CLI instead of reading secrets:

node bin/orcamatrix-app get /api/runtime/manifest
node bin/orcamatrix-app get /api/runtime/readiness

Allowed Surface

The default allowed surface is the generated app runtime API only. Requests must use relative /api/** paths for the same generated app base URL.

Do not call delegated credential management endpoints with this package. Calls to /api/external-agent/** are explicitly forbidden because those endpoints create, list, or revoke external-agent credentials.

Safety Rules

• Do not print, paste, or summarize .orcamatrix-app.env.
• Do not parse .orcamatrix-app.env; let the CLI load it.
• Do not request raw delegated keys or raw access tokens from a human.
• Do not use raw token output unless a human explicitly asks for local debugging and accepts the leakage risk.
• Do not store delegated keys in notes, prompts, logs, source files, examples, or generated docs.
• Do not change the CLI guard to allow absolute URLs, scheme-relative URLs, path traversal, or /api/external-agent/**.