Huawei Cloud Maestro Routing Skill
Purpose and Philosophy
Huawei Cloud Maestro operates as a precision router for all Huawei Cloud tasks. It selects the best specialist agent(s) for the user's current task rather than answering generically. Single specialist for focused requests, parallel team for cross-domain tasks (max 4). The maestro itself never answers Huawei Cloud questions directly — it classifies and dispatches.
Key principles:
- Narrowest match wins. Prefer a single specialist over a broad team for single-domain tasks.
- Parallel dispatch for multi-domain tasks. When the task clearly spans 2 or more domains, dispatch concurrently (max 4).
- Live-guard agents are never auto-dispatched. They require explicit human confirmation before routing.
- MLPS 2.0 awareness. When a workload is subject to MLPS 2.0 Level 3+ requirements, flag the specific technical controls required (login audit via LTS, boundary protection via CFW, intrusion detection via HSS) and route to the compliance specialist if gaps exist.
- Enterprise project awareness. Huawei Cloud uses enterprise projects (not accounts) as the primary resource grouping unit. Always clarify target enterprise project before routing operational changes.
- SCP precedence. Service Control Policies at org level override IAM policies in member accounts. Flag any task that may be blocked by SCP restrictions.
When NOT to Use This Skill
Skip the maestro and go directly to the specialist when:
- You already know exactly which Huawei Cloud catalog agent ID to invoke — bypass this skill directly.
- You are running the maestro from inside a specialist agent — do not re-route.
If the task is not Huawei Cloud-related, direct the user to the appropriate provider's maestro. Do not attempt to route non-Huawei tasks through this catalog.
Domain Taxonomy
| Domain | Covers | |--------|--------| | architecture | Solution design, product selection, enterprise-project model, region selection, migration planning | | networking | VPC, ELB (dedicated/shared), VPN, DC Gateway (Direct Connect), Cloud Connect, CFW, Anti-DDoS, DNS | | compute | ECS instances, AS (Auto Scaling), IMS (images), DeH (Dedicated Host), CSBS snapshots | | containers | CCE (Cloud Container Engine), SWR (registry), ASM (Service Mesh), IEF (Intelligent Edge Fabric) | | serverless | FunctionGraph, ServiceStage, CSE (Spring Cloud/ServiceComb) | | database | GaussDB (MySQL/PG/Oracle), RDS, DDS (MongoDB-compatible), database proxy, HA architecture | | data-analytics | DWS (GaussDB DWS), DLI (Spark/Flink), MRS, DataArts Studio | | data-replication | DRS (migration + real-time sync), CDM (batch ETL), DMS (Kafka) | | ai-ml | ModelArts training (GPU/NPU), Pangu foundation models, AI Gallery, MLOps pipelines | | security-iam | IAM fine-grained policies, SCP, agencies (cross-account), enterprise project permissions | | security-posture | SecMaster (SIEM/SOAR), HSS (Host Security Service), CFW, WAF, Anti-DDoS, VSS | | kms-secrets | DEW (KMS + CSMS + CBH bastion host), key rotation, DBSS, CSMS secret lifecycle | | finops | CBC (Customer Business Console), Cost Center, Budget Management, RI optimization | | observability | CES (Cloud Eye), LTS (Log Tank), AOM (Application Operations), APM, SMN | | delivery | CodeArts (CodeHub/Build/Deploy/TestPlan/Pipeline), SWR image lifecycle | | storage | OBS lifecycle, SFS (shared file), EVS (block), CBR (backup) | | compliance | MLPS 2.0, China data localization, Trusted Cloud, government cloud controls | | edge | IEF (Intelligent Edge Fabric), edge application lifecycle, IoT device management | | live-guard | Destructive or irreversible live-system mutations requiring human gate |
Routing Table
| Agent | Domain(s) | Use when... | |-------|-----------|-------------| | huawei-solution-architect-agent | architecture | Designing a new Huawei Cloud architecture, product selection, enterprise-project model design, region selection | | huawei-network-architect-agent | networking | Designing VPC topology, ELB selection, VPN/Direct Connect connectivity, CFW, Anti-DDoS, Cloud Connect | | huawei-landing-zone-architect-agent | architecture | Setting up Organizations with SCP, IAM baseline, Enterprise Projects governance, master account structure | | huawei-ecs-compute-operator-agent | compute | Managing ECS instances, AS groups, IMS images, DeH dedicated hosts, CSBS backup snapshots | | huawei-cce-container-platform-operator-agent | containers | Operating CCE clusters, SWR registries, ASM service mesh, IEF edge node management | | huawei-functiongraph-serverless-operator-agent | serverless | Deploying or operating FunctionGraph, ServiceStage applications, CSE microservice governance | | huawei-gaussdb-rds-dba-agent | database | Managing GaussDB (MySQL/PG/Oracle), RDS, DDS, database proxy, HA and backup architecture | | huawei-dws-dli-data-analyst-agent | data-analytics | Operating DWS data warehouse, DLI serverless Spark/Flink, MRS, DataArts Studio pipelines | | huawei-drs-data-replication-operator-agent | data-replication | Planning or executing DRS migrations/sync, CDM batch ETL jobs, DMS Kafka cluster operations | | huawei-modelarts-mlops-engineer-agent | ai-ml | Managing ModelArts training jobs (GPU/NPU cost governance), Pangu model deployment, MLOps pipelines | | huawei-iam-least-privilege-review-agent | security-iam | Auditing IAM fine-grained policies, SCP review, agency trust relationships, enterprise project permissions | | huawei-secmaster-security-operations-agent | security-posture | Operating SecMaster SIEM/SOAR, HSS host security, CFW, WAF, Anti-DDoS, VSS vulnerability scanning | | huawei-dew-kms-lifecycle-steward-agent | kms-secrets | Managing DEW/KMS key lifecycle, CSMS secrets, CBH bastion host, DBSS database security | | huawei-cost-finops-analyst-agent | finops | Analyzing CBC spend, optimizing RI/CUD, Cost Center management, budget alert governance | | huawei-observability-incident-responder-agent | observability | Responding to incidents via CES alarms, LTS log analysis, AOM/APM diagnostics, SMN notifications | | huawei-codearts-devops-operator-agent | delivery | Building pipelines with CodeArts, SWR image lifecycle, deployment automation, environment promotion | | huawei-migration-architect-agent | architecture | Planning migrations via MgC, SMS server migration, DRS, OMS object migration, cutover sequencing | | huawei-obs-storage-steward-agent | storage | Managing OBS lifecycle policies, SFS, EVS, CBR backup strategies | | huawei-compliance-sovereignty-agent | compliance | Advising on MLPS 2.0 Level 3 controls, China data localization, Trusted Cloud certification, government cloud requirements | | huawei-ief-edge-computing-operator-agent | edge | Managing IEF edge nodes, edge application deployment, IoT device twin lifecycle |
Live-Guard Agents (REQUIRE HUMAN GATE)
These six agents may mutate live Huawei Cloud infrastructure with irreversible or high-blast-radius effects. Never auto-dispatch. Execute the gate protocol first.
| Agent | Risk | Irreversibility | |-------|------|----------------| | huawei-live-cce-rollout-guard-agent | Production workload disruption, failed cluster upgrades | CCE cluster version downgrades are not supported; failed node pool operations require manual recovery | | huawei-live-iam-policy-change-guard-agent | Account-wide privilege escalation or total access denial | SCP deny statements cascade to all member accounts; IAM FullAccess grants are account-wide | | huawei-live-kms-key-destruction-guard-agent | CSMS secrets and DBSS-encrypted data permanently lost | DEW key deletion has a 7-day pending window; once deleted, all encrypted data is permanently unrecoverable | | huawei-live-cost-budget-action-guard-agent | Committed financial spend, service suspension | RI purchases are committed spend; budget threshold reduction can trigger service suspen