temporal-ops

Administer and diagnose Temporal Cloud and self-hosted Temporal environments via CLI.

5.3k|765|Updated Mar 4, 2026
One-click install
npx skills add https://github.com/openai/plugins --skill temporal-ops
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: temporal-ops
Source: https://github.com/openai/plugins/tree/main/plugins/temporal/skills/temporal-ops
Command: npx skills add https://github.com/openai/plugins --skill temporal-ops

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Operating and troubleshooting a running Temporal environment requires knowing dozens of temporal and tcld commands, and misdiagnosing errors like RESOURCE_EXHAUSTED or x509 failures wastes hours. This Skill routes operational intents and failure symptoms to the correct commands and a layered diagnostic process.

Core Features & Use Cases

  • Operations routing: Maps intents like namespace CRUD, API-key rotation, mTLS cert rotation, capacity/APS management, billing, audit logs, Terraform, SAML/SCIM, and migration to the exact tcld or temporal command references.
  • Bottom-up diagnosis: Walks a seven-layer ladder (DNS, TCP, TLS, auth, gRPC, namespace/workers, workflow code) with confidence scores to root-cause stuck workflows, non-determinism, no-poller task queues, HA failover issues, and payload size limits.
  • Destructive-operation safeguards: Requires blast-radius counts, explicit user approval, and verification before running irreversible commands like batch terminate or namespace failover.
  • Use Case: A worker fleet stops polling after a cert rotation. The Skill checks TLS with openssl s_client, inspects the accepted-client-CA set via tcld, identifies the expired CA, and guides a zero-downtime rollover.

Quick Start

Ask the assistant to diagnose why your Temporal workflow is stuck or to rotate an expiring Temporal Cloud API key, stating whether you use Temporal Cloud or a self-hosted cluster.

Frequently Asked Questions about temporal-ops

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I diagnose a stuck Temporal workflow?

Run `temporal workflow describe --workflow-id <id>` to inspect pending activities, timers, child workflows, or signals, then review the Event History with `temporal workflow show`. The Skill routes the symptom to recovery commands like signal, cancel, terminate, or reset.

How do I rotate a Temporal Cloud API key without downtime?

Create a new key with `tcld apikey create`, verify both keys authenticate, switch clients to the new key, then delete the old one. Deleting or disabling a key in use immediately breaks worker connections, so order matters.

Does this work with self-hosted Temporal clusters?

Yes. Self-hosted admin uses `temporal operator` commands for cluster health, namespace CRUD, search attributes, and Nexus endpoints, while data-plane commands like `temporal workflow` work on both Cloud and self-hosted. Helm, Kubernetes, and database administration are out of scope.

Why does my Temporal client return RESOURCE_EXHAUSTED?

RESOURCE_EXHAUSTED can mean account-limit throttling or per-workflow lock contention (BusyWorkflow). Split the resource-exhausted metric by its `operation` or `resource_exhausted_cause` label to identify which limit fired before applying a fix.

What causes x509 certificate errors with Temporal Cloud mTLS?

Common causes are expired leaf or CA certificates, an untrusted CA missing from the namespace's accepted-client-ca set, certificate filter mismatches, or hostname mismatches when connecting through PrivateLink or PSC endpoints. Verify locally with `openssl verify` and `openssl s_client` before changing namespace trust settings.

When should I not use this Skill for Temporal work?

Do not use it for writing workflows, activities, or SDK application code, which belongs to the temporal-developer skill, or for worker performance tuning and capacity sizing, which belongs to temporal-workertuning. It also excludes generic TLS or gRPC errors unrelated to Temporal.