> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Have an Agent Do It

> Use the Claude Code or Codex skill to find, ask about and write your Tensor9 BYOC annotations.

> [!NOTE]
>
> Preview guidance. Review the decisions and proposed changes before applying them to your product.

The `tensor9-byoc-onboarding` skill turns a coding agent into an onboarding assistant for your Terraform. The **Claude Code** and **Codex** editions use the same name and workflow. Install the complete preview package below, including its bundled references and catalog.

The skill:

1. **Finds** places in your Terraform that need one of your decisions: the install's domain, the region, names that must be unique per install, who supplies each secret, endpoints that must stay public, and blocks only your own environments need. It consults its common Terraform mistakes library and shared external-service considerations, then follows relevant application consumers rather than treating a service name as a decision.
2. **Asks you** each decision, one at a time, showing the file, the line, the block and the options. It never guesses an answer and never invents a label, description or reason.
3. **Writes** the [annotations](https://docs.tensor9.com/byoc/onboarding/annotations.md) you choose. It leaves compiler automation to the compiler. Adding a namespace variable and name prefixes requires your agreement. For a common-mistake finding, it traces the resource's absence condition and its consumers, then shows a proposed repair for your review before applying it. Feature configuration and source repairs are separate edits.
4. **Reports** annotations, configuration choices, common-mistake findings and accepted or deferred repairs, existing annotations, and open decisions. It identifies the consideration-data source, version and digest used. Source findings and catalog suggestions are separate from compiler diagnostics, your decisions and verified application behavior.

> [!NOTE]
>
> The skill does not upload your Terraform to Tensor9 or run a compile, publish or deployment. Your coding agent processes files according to its own configuration and data handling. Review that configuration before opening private Terraform.

## Install

Install the complete `tensor9-byoc-onboarding` folder. The refreshed preview package includes:

```text theme={null}
tensor9-byoc-onboarding/
  SKILL.md
  scripts/load_considerations.py
  references/common-terraform-mistakes.md
  references/considerations-usage.md
  references/considerations/
    index.md
    latest.json
    1.0.0/catalog.json
```

Use the public `tensor9` CLI with your vendor profile for current consideration knowledge. The Python 3 helper retains validated data and supports offline lookup. No private Tensor9 source checkout, Kotlin development environment or internal MCP service is required. Keep the mistake reference as well as the consideration files; installing `SKILL.md` alone is incomplete.

The commands below expect the supplied preview archives named below in your Downloads directory. These bundles contain skill source revision `098190675f` and the unchanged consideration catalog `1.0.0`. The filename suffix identifies the skill source revision, not a new catalog version. Earlier preview archives remain separate; verify the exact supplied filename and checksum before installation.

Download the package for your coding agent into your Downloads directory:

* [Claude Code package](https://t9-alpha-aux.s3.us-west-2.amazonaws.com/demos/byoc/onboarding/skills/1.0.0/tensor9-byoc-onboarding-claude-considerations-1.0.0-source-098190675f.tar.gz)
* [Codex package](https://t9-alpha-aux.s3.us-west-2.amazonaws.com/demos/byoc/onboarding/skills/1.0.0/tensor9-byoc-onboarding-codex-considerations-1.0.0-source-098190675f.tar.gz)

Verify the downloaded archive with `shasum -a 256 <archive>` before extraction:

| Package | SHA-256 |
| - | - |
| Claude Code | `4872744674603b3d1d1f9f843d540bbe0b2a0ec1c97b24146600af19edda3cb4` |
| Codex | `7ee8bbc851389490e82835eb0b71ba37b68f217ec921aad53f9fe5a8b24cf711` |

Inspect the archive contents before extracting. If a skill with this name is already installed, review and preserve your existing copy before replacing it.

**Claude Code**

Install for yourself, in every project:

```bash theme={null}
tar -tzf "$HOME/Downloads/tensor9-byoc-onboarding-claude-considerations-1.0.0-source-098190675f.tar.gz"
mkdir -p "$HOME/.claude/skills"
tar -xzf "$HOME/Downloads/tensor9-byoc-onboarding-claude-considerations-1.0.0-source-098190675f.tar.gz" -C "$HOME/.claude/skills"
```

Or install for everyone working in one repository, by committing it to that repository:

```bash theme={null}
mkdir -p .claude/skills
tar -xzf "$HOME/Downloads/tensor9-byoc-onboarding-claude-considerations-1.0.0-source-098190675f.tar.gz" -C .claude/skills
```

Either destination contains `skills/tensor9-byoc-onboarding/SKILL.md`. Start a new Claude Code session to load it.

**Codex**

Install for yourself:

```bash theme={null}
tar -tzf "$HOME/Downloads/tensor9-byoc-onboarding-codex-considerations-1.0.0-source-098190675f.tar.gz"
mkdir -p "$HOME/.agents/skills"
tar -xzf "$HOME/Downloads/tensor9-byoc-onboarding-codex-considerations-1.0.0-source-098190675f.tar.gz" -C "$HOME/.agents/skills"
```

The destination is `~/.agents/skills/tensor9-byoc-onboarding/SKILL.md`. To install only for the current repository instead:

```bash theme={null}
mkdir -p .agents/skills
tar -xzf "$HOME/Downloads/tensor9-byoc-onboarding-codex-considerations-1.0.0-source-098190675f.tar.gz" -C .agents/skills
```

Start Codex in that repository and use `$tensor9-byoc-onboarding`. Codex detects skill changes automatically;
restart if it does not appear. These are the current [official local skill locations](https://learn.chatgpt.com/docs/build-skills#where-codex-loads-local-skills).
Review any existing copy before installation so the same skill name is not installed in several places.

## Run it

Open your agent at the root of your Terraform repository and invoke the skill, optionally with the path to your Terraform root module. Without a path it uses the current directory.

**Claude Code**

```text theme={null}
/tensor9-byoc-onboarding ./terraform
```

You can also just ask, for example "prepare my Terraform for Tensor9 BYOC". Claude Code loads the skill when the request matches it.

**Codex**

```text theme={null}
$tensor9-byoc-onboarding ./terraform
```

You can also pick it from `/skills`, or just ask, for example "prepare my Terraform for Tensor9 BYOC".

## Refresh and look up considerations

Both editions obtain maintained considerations from your vendor controller (VCtrl) through the public
`tensor9` CLI. Use the controller profile that [setting up your control plane](https://docs.tensor9.com/byoc/fundamentals/install.md)
created: `tensor9 vendor setup` prints its name and makes it your default profile. These examples call it
`my-vendor`; replace that name with your own. Leave `T9_API_KEY` unset: your
[API key](https://docs.tensor9.com/byoc/getting-started/api-key.md) is not a controller credential, and a sandbox-connected profile is
separate exploration access. Do not substitute either for your controller profile or use a profile for a
different development install.

```bash theme={null}
tensor9 prepare considerations -profile my-vendor -json
tensor9 prepare considerations -profile my-vendor -id stripe -json
tensor9 prepare considerations -profile my-vendor -id metronome -json
tensor9 prepare considerations -profile my-vendor -search billing -json
```

> [!NOTE]
>
> This preview requires a CLI and VCtrl that support consideration lookup. The direct CLI commands above report an error when lookup fails. The Python helper below retains labelled cache/bundle fallback if the CLI is missing, the controller is unavailable, authentication fails or the command is unsupported. That fallback is not a successful VCtrl response or proof of the latest catalog. A generic failure does not establish that a controller is old or authentication failed. The helper never switches profiles, logs in or upgrades automatically.

Lookup sends no Terraform or application source and needs no imported workspace. The CLI uses its normal authentication; the skill does not ask for credential values. Responses identify the serving vendor, catalog version and digest. Only reusable guidance is returned; your stack-specific findings and decisions remain separate.

The loader refreshes automatically when its cache is missing or older than 24 hours. Use `--refresh` to force a refresh and `--no-refresh` for an offline query. To refresh the retained copy and then query it offline, choose its installation folder. For example, with the personal Codex installation:

```bash theme={null}
SKILL_DIR="$HOME/.agents/skills/tensor9-byoc-onboarding"
python3 "$SKILL_DIR/scripts/load_considerations.py" --refresh --profile my-vendor --index
python3 "$SKILL_DIR/scripts/load_considerations.py" --no-refresh --profile my-vendor --id stripe
python3 "$SKILL_DIR/scripts/load_considerations.py" --no-refresh --profile my-vendor --id metronome
```

For Claude Code, use `SKILL_DIR="$HOME/.claude/skills/tensor9-byoc-onboarding"`; project installations use their `.claude/skills` or `.agents/skills` folder. Refresh invokes the CLI's read-only snapshot command and validates its exact versioned bytes before replacing cached data. Queries without either refresh flag may perform the bounded automatic refresh; `--no-refresh` keeps them offline. After a failed automatic refresh, the loader waits 10 minutes before another automatic attempt; `--refresh` still tries. Inspect the reported refresh status and cache age, and do not describe a cache or bundle fallback as a successful controller response. Inspect the reported source, original serving vendor/profile, version, digest and any fallback reason. Profile names can be reconfigured and vendor IDs are scoped to a stage; an old cached receipt does not establish the identity of a currently selected controller.

Refreshing knowledge does not reinstall the skill or change its permissions. An incompatible data format may require a newer skill package. Catalog guidance does not authorize edits, deployments or credentials access.

The initial catalog covers 96 service entries across 12 categories. These are consideration prompts and research cues, not a list of verified Tensor9 service adapters or a promise that every application integration has been examined. Read the [general external-service guide](https://docs.tensor9.com/byoc/onboarding/external-services.md), [Stripe guide](https://docs.tensor9.com/byoc/onboarding/stripe.md) and [Metronome guide](https://docs.tensor9.com/byoc/onboarding/metronome.md) for the corresponding vendor decisions and checks.

## What a session looks like

The agent works through the decisions one at a time. A typical exchange:

```text theme={null}
terraform/variables.tf:42  variable "domain_name"

Each install serves its own domain. Which variable holds that domain?
Every host the install exposes should derive from it.

  1. domain_name (this variable)
  2. A different variable
  3. Not sure - leave it open
```

When you answer, it writes the annotation:

```terraform theme={null}
#@vanity_domain_root()
variable "domain_name" {
  description = "Domain the application is served from"
  type        = string
}
```

Questions that share one answer, such as ten API keys your customer supplies, are grouped so you answer once. If you are unsure, say so: the agent leaves the block unannotated and lists it as an open decision.

At the end you get a summary:

```text theme={null}
Annotations added
  terraform/variables.tf:42   #@vanity_domain_root()     on var.domain_name
  terraform/variables.tf:6     #@region(cloud='aws')      on var.aws_region
  terraform/secrets.tf:12      #@secret(ownership='buyer', ...)  on data.aws_secretsmanager_secret.stripe_key
Configuration choices accepted
  terraform/terraform.tfvars:220   ClickHouse PrivateLink disabled with an empty service name
Common-mistake findings and repairs
  terraform/dashboard.tf:18   optional-resource consumer assumes clickhouse[0] exists
    accepted repair: guard ClickHouse widgets with the endpoint creation condition
Open decisions
  terraform/cognito.tf:32   confirm the email sender and required cloud setup
```

## After the agent finishes

1. Review the diff. Check annotations separately from accepted name prefixes, feature settings and common-mistake repairs. For external services, review your behavior/ownership decisions and the full application, data, job and callback changes. Review deferred findings before installing.
2. Run `terraform validate` and `terraform plan` against an appropriate environment. Annotations alone leave the plan unchanged; configuration and repair effects need their own review.
3. Resolve any open decisions, by hand or by running the skill again.
4. Continue with [compile and install](https://docs.tensor9.com/byoc/onboarding/overview.md#the-flow-annotate-compile-install).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.