# Orcamatrix Generated App Runtime

> Use an OrcaMatrix generated app external-agent access package to call the generated app runtime API through delegated auth.

- Skill: `dolphinai2026/orcamatrix-generated-app-runtime` (Agent Skill)
- Install (CLI): `npx skillmds@latest add dolphinai2026/orcamatrix-generated-app-runtime`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dolphinai2026/orcamatrix-generated-app-runtime/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: dolphinai2026 (https://skillmd.com/u/dolphinai2026)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/dolphinai2026/orcamatrix-generated-app-runtime

---


# OrcaMatrix Generated App Runtime Access

Use this skill only after the generated app has provided an external-agent access package. Work from the unpacked package directory so the bundled CLI can read `.orcamatrix-app.env`.

## Load The Package

1. Keep `.orcamatrix-app.env` local to the package directory.
2. Run `node bin/orcamatrix-app diagnose` before making runtime calls.
3. Run `node bin/orcamatrix-app discover` to fetch `/api/runtime/manifest` and `/api/runtime/readiness` before business calls.
4. Use `node bin/orcamatrix-app get /api/...` or `node bin/orcamatrix-app post /api/... '{...}'`.
5. If a wrapper was installed, use `orcamatrix-app discover`, `orcamatrix-app get /api/...`, or `orcamatrix-app post /api/... '{...}'`; the wrapper delegates back to the package CLI.

Agents must use the packaged CLI for delegated auth and runtime calls. Do not parse `.orcamatrix-app.env`, do not ask a human for raw delegated keys or raw access tokens, and do not copy env values into prompts, notes, Skill directories, or wrapper scripts.

## Discover Operations First

Before calling a business operation, run:

```bash
node bin/orcamatrix-app discover
```

Use the returned `capabilities`, `operations`, and `readinessStatus` to decide which runtime API calls are available. If you need to inspect the raw runtime contract, use the CLI instead of reading secrets:

```bash
node bin/orcamatrix-app get /api/runtime/manifest
node bin/orcamatrix-app get /api/runtime/readiness
```

## Allowed Surface

The default allowed surface is the generated app runtime API only. Requests must use relative `/api/**` paths for the same generated app base URL.

Do not call delegated credential management endpoints with this package. Calls to `/api/external-agent/**` are explicitly forbidden because those endpoints create, list, or revoke external-agent credentials.

## Safety Rules

- Do not print, paste, or summarize `.orcamatrix-app.env`.
- Do not parse `.orcamatrix-app.env`; let the CLI load it.
- Do not request raw delegated keys or raw access tokens from a human.
- Do not use raw token output unless a human explicitly asks for local debugging and accepts the leakage risk.
- Do not store delegated keys in notes, prompts, logs, source files, examples, or generated docs.
- Do not change the CLI guard to allow absolute URLs, scheme-relative URLs, path traversal, or `/api/external-agent/**`.