sync claude-skills: plugin 1.3.1, s1-secops-mcp 1.3.3

[pmoses-s1]

Syncs the eight skills, the MCP server, docker assets and CLAUDE.md from claude-skills, rebuilds the plugin bundle in this repo, and brings this repo's own docs back in line.

SDL configuration files move to GraphQL

Config files are read and written over POST <console>/sdl/v2/graphql. The legacy REST endpoints are incomplete: measured on a live tenant, listFiles returned 1,914 paths against configFiles' 2,264, and getFile on any of the 350 udoId-addressed dashboards returns success/noSuchFile.

udoId is assigned by namespace. Only /dashboards/ files carry one; /lookups/, /datatables/, /logParsers/ and /automaticLookups are name-addressed. The console displays a dashboard as /dashboards/id/<udoId>/<name>, which is a display string, not a path.

addConfigFile(name:) updates in place for a name-addressed file but creates a duplicate for a dashboard, so sdl_put_file refuses a name-addressed write to an existing dashboard and names the udoIds already holding that name. expectedVersion is enforced on both address forms.

Credentials

One console API token authorises every SDL surface. SDL_XDR_URL and the scoped SDL config and log keys are retired and no longer read.

Plugin 1.3.1

The previously distributed bundles were built before this work, so four skills shipped superseded guidance: the sdl-api SKILL.md inside the bundle still described listFiles and contained no udoId or GraphQL content. Rebuilt from source. The version bump is what makes the corrected skills reach anyone already on 1.3.0.

The sdl-api description used /dashboards/id/<number>/<name> as a trigger phrase; plugin validation reads <number> as an XML tag and rejects the skill, so the placeholders are now braces.

This repo's own docs

docs/ and README.md are structurally adapted copies the sync script deliberately does not overwrite, so they had drifted:

• credentials.md, architecture.md and vm-deployment.md still presented the retired SDL keys as required.
• upgrading.md installed npm 1.3.1 and expected it back, which downgraded the server from the published 1.3.3.
• mcp-tools.md and skills.md omitted the GraphQL surface and the udoId rule.
• docker.md advertised 1.2.3 as the current tag, and the plugin download in README.md and zero-to-hero.md still pointed at v1.2.5.

Verification

Check	Result
MCP test suite (in this tree)	86/86 pass
Python client unit tests	19/19 pass
tools/list	26 tools
Broken links (all 262 tracked .md)	18, unchanged pre-existing baseline; 0 new
Skill frontmatter, all 8	valid, no XML tags in any description
shellcheck	clean
Source-vs-synced content diff	identical except the 3 intentional link-depth rewrites

Pre-existing and out of scope: shfmt -i 2 flags hooks/bootstrap_creds.sh, scripts/build.sh and workflows/community/reorganize-actions.sh on origin/main too; bootstrap_creds.sh is functionally identical to the source copy, differing only in indentation.

---

Update 2026-08-09: skills documentation refresh (plugin still 1.3.1, MCP still 1.3.3)

Documentation-only. No behavioural change, so the plugin was rebuilt at the same version.
Every item below was measured on a live tenant while building and testing the UEBA and
ingest-health deployers.

hyperautomation

• LRQ poll loops need a {{<poll>.status_code}} >= 400 gate routing to an action that ENDS
  the run. A backend-terminated query answers 404 not_found for the rest of the run; HA does not
  treat that as a failed action, so with the JQ counter defaults the loop spins to the workflow
  timeout (17+ iterations observed). continue_on_fail: false does not help — only
  retry_on_status_codes reacts to status, and retrying a dead token is pointless.
• Poll counters via Function.JQ with defaults, plus a stepsTotal > 0 gate — otherwise a
  0/0 first poll counts as complete over an empty result set and writes a stub baseline that
  silently suppresses every detection reading it.
• New pitfalls: an http_request's status is "success" for any response including 404
  (branch on status_code, which sits at the top level, not under .body); and run-now
  executions park at executed_actions: 0 and accumulate, holding scheduler slots.

powerquery

• savelookup REPLACES its table, it does not append — rules out any design where several
  flows write one shared table.

• Union width, not the time window, is what gets a query killed. ~15 steps per block and the
  backend terminates mid-flight:

  union blocks	stepsTotal	outcome
  1	16	always completes
  3	46	completes (139s)
  6	91	killed at step 58

  Shortening the window does not rescue it, and completing standalone via the API proves nothing
  about surviving inside an HA flow.

• Scheduled rules: hard cap lookbackWindowMinutes / runIntervalMinutes <= 96, else HTTP 400
  naming neither field. Clamp rather than failing the deploy. The cadence is also the floor on any
  end-to-end test, since scheduled rules have no run-now.

sdl-api

• The HEC receive-time "shadow copy" defect now lives in the HEC section rather than only in
  the root support-ticket file. Back-dated events index correctly and produce extra copies
  stamped at ingest time carrying no body fields. Documents the impact on synthetic test data (a
  source deliberately left empty will not read as empty, so SILENT-style detections cannot be
  validated that way) and, deliberately, the causes already eliminated so the investigation is
  not repeated: payload shape, isParsed, chunk size, run-tag field name, timestamp recency, and
  concurrency.

mgmt-console-api

• Workflow-listing traps, both of which fail silently as "not found" and cause duplicate
  deploys: the unfiltered list is alphabetical and page-capped, and name__contains returns
  HTTP 502 for any value containing a space. Filter on a whitespace-free token, exact-match
  client-side, and never treat an API error as absence.
• Parked run-now executions and how to clear them.

Verification

• Sync check: no NEW broken links (18 pre-existing excluded), no dangling symlinks.
• Identities consistent: npm 1.3.3, plugin 1.3.1, dist s1-secops-skills-v1.3.1.plugin.
• shfmt and shellcheck clean; markdownlint clean for the edited files (two pre-existing
  MD056 table errors in the powerquery references are unchanged and fail identically at HEAD).
• The three files reported by the stale-names check are false positives: they name the retired SDL
  keys only in order to state that they are retired.