What problem does it solve? Setting up persistent, least-privilege Nebius authentication for an AI coding agent requires manual IAM work: creating a service account, granting the right project and tenant roles, generating authorized-key credentials, and binding a CLI profile. This Skill performs that bounded convergence explicitly and safely, with strict fail-closed behavior. ## Core Features & Use Cases - Bounded IAM convergence: Creates or reuses one deterministic tenant-parented group with exactly project admin and tenant viewer permits plus one codex-agent-sa membership, rejecting extra or duplicate permits and members. - Credential and profile lifecycle: Generates identity-checked authorized-key credentials, atomically replaces stale credentials at most once, and rebuilds the project-bound CLI profile without printing or persisting human tokens. - Read-only verification and repair leases: verify checks credential safety, identity binding, project access, and tenant quota listing without mutation; an explicitly requested repair lease authorizes only mode-0600 credential correction and profile rebuild. - Use Case: Before letting a Codex agent run Nebius CLI commands against project-abc123, explicitly invoke the skill to converge the service account, group, credential, and profile in one pass, then verify runtime auth read-only. ## Quick Start Ask the agent to explicitly run agent-nebius-auth-setup with your project ID to converge the service account, IAM group, credential, and CLI profile for that Nebius project.
