# Wukongim Chat Lifecycle > Operate the Codex-owned WuKongIM chat-lifecycle laboratory directly from the local repository. Use when the operator explicitly asks to buy temporary Alibaba Cloud servers and start the repair stability run, deploy a committed candidate to the same Lease, start or monitor the bounded long workload, diagnose a stopped live run over SSH, inspect one request, or stop and destroy its exact resources. Only an exact start intent authorizes paid procurement; deploy, run, status, diagnose, stop, explanations, approvals, and next-step questions never buy servers. - Skill: `wukongim/wukongim-chat-lifecycle` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add wukongim/wukongim-chat-lifecycle` - Raw SKILL.md: https://api.skillmd.com/api/skills/wukongim/wukongim-chat-lifecycle/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: wukongim (https://skillmd.com/u/wukongim) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/wukongim/wukongim-chat-lifecycle --- # WuKongIM Chat Lifecycle Direct Lab Codex owns this loop from the local machine. Use repository commands and SSH; do not dispatch a GitHub Action, create a tracking Issue, wait for an Artifact, or destroy healthy hosts between candidate generations. ## Safety boundary - Treat the exact phrase `开始聊天生命周期稳定性长跑`, or an explicit invocation of this Skill that unambiguously asks to purchase temporary servers and start the direct repair lab, as authority for one CNY 300 repair Lease. A higher limit is authorized only when the same explicit start instruction states the exact CNY amount; never carry a higher limit forward from an earlier turn. - Never infer paid authority from `继续`, `同意`, deploy, run, status, diagnose, stop, an explanation, `下一步建议？`, or prior paid runs. - For an explicitly authorized limit above CNY 300, pass the same whole-CNY value through `--budget-cny` and `WK_CHAT_LAB_PAID_BUDGET_CNY`. A mismatch or missing marker must fail before request state or provider contact. The supported safety ceiling is CNY 1500. - `start` additionally requires either short-lived Alibaba STS environment variables or a verified one-hour Alibaba Cloud Shell credential, plus both exact local authorization values. A tokenless credential is accepted only when it is absent from the account's registered AccessKey list and the exact Cloud Shell authorization marker is present. Never use or persist a long-lived AccessKey for this loop. - Reject another paid start until every earlier request has an exact selector-bound zero-inventory proof. - Keep one Lease while diagnosing and deploying committed candidate generations. A failed workload stops within the bounded monitor window but does not release the hosts. Only `stop` destroys the Lease. - Never print or commit STS credentials, SSH private keys, worker tokens, or runtime credential archives. Never place Manager credentials in commands, shell output, logs, commentary, diagnosis/status artifacts, or repository files. - The sole Manager-credential disclosure is the final operator-facing response after the typed deployment readiness gate passes. Read it from the exact request's private `access.json`; never disclose it for a failed deployment or reuse values from another request or generation. Before any operation, read [references/operator-workflow.md](references/operator-workflow.md) completely. ## Route the intent ### Preflight Run `scripts/chat-lifecycle/direct-lab.sh preflight`. It is local and read-only: it must not call Alibaba APIs. Report every missing host tool, temporary credential proof, or exact lifecycle authorization. ### Start Require the paid authority above. Require a clean worktree whose exact candidate is committed, generate a fresh request ID, and execute the reference `start` procedure. Treat a user-specified test duration as the required continuously healthy qualification duration: for example, "test for 72 hours" maps to `--duration 72h`. If the user gives no duration, use the 60-minute default. The tool calculates the workload ceiling and Lease lifetime; do not ask the operator to calculate them. This sequence builds and seals locally before a read-only Quote; Acquire is the last step. Persist the pre-Acquire selector before the paid call. If build, materialization, or Quote fails before that selector exists, finalize the request as not acquired with a local zero-resource proof; do not leave a phantom active request that blocks the next exact start. ### Deploy `deploy` never authorizes procurement. Build the current committed candidate, activate it as the next repair generation on the existing Lease, and require the typed readiness gate. Preserve failed deployment evidence and the Lease for diagnosis; do not purchase replacement hosts. A successful deployment handoff MUST include the exact Manager URL, Manager username, Manager password, and Demo URL from the selector-bound private `access.json`. State that Demo HTTP Basic Authentication uses the same username and password. Validate that the access receipt matches the request, Lease, source SHA, and deployment-plan digest; if it is missing or inconsistent, report the handoff failure and never invent access information. Give this access block before suggesting or starting `run`. ### Run `run` never authorizes procurement. Start the fixed rehearsal-shaped systemd unit and hand it to the bounded stability monitor. The default qualification duration is 60 minutes, and the tool automatically adds a 15-minute control reserve, so the default workload ceiling is 75 minutes. A requested `--duration 72h` therefore runs for at most 72 hours 15 minutes and qualifies after 72 continuous healthy hours. Once active, online loss, insufficient SEND rate, excessive SENDACK backlog, missing SEND/SENDACK progress, or active-phase loss is terminal within 15 seconds. Stop the workload, retain the terminal worker cuts, and mark the request `diagnosis_ready`; do not keep polling a stopped workload. ### Diagnose `diagnose` is read-only and uses the saved SSH config for the exact live Lease. Collect bounded service state, stage journal, Prometheus targets, and all three worker status/snapshot pairs. Diagnose from evidence, fix locally, commit, then `deploy` and `run` again on the same hosts. ### Status `status` is read-only. Resolve an explicit request ID or refuse ambiguity. Report local state, generation, source SHA, Lease identity, last diagnosis, expiry/cost when available, and whether exact zero inventory is proven. ### Stop An explicit request-scoped stop needs no second confirmation. Execute the reference `stop` procedure. It first signals any local monitor, stops the remote workload best-effort, releases only the saved exact selector, and accepts completion only with an authenticated zero-inventory proof for that selector. ## Completion The repair stability run is diagnostic and never official evidence. Keep the local request directory until `stop` has stored `zero-inventory.json`. Report both UTC and Asia/Shanghai timestamps for paid start, diagnosis, qualification, and release. Every successful deploy response must include the validated Manager and Demo access block above. Do not claim cleanup from a successful API delete request alone.