[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-temporal-temporal-cloud":3,"mdc-3ekzni-key":34,"related-org-temporal-temporal-cloud":1872,"related-repo-temporal-temporal-cloud":1965},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":25,"mdContent":33},"temporal-cloud","troubleshoot Temporal Cloud connections","Fix Temporal Cloud connection, auth, and config problems. Use when users hit login failures, can't connect to Cloud, get x509\u002FTLS errors, have namespace or endpoint mismatches, paste broken SDK connection snippets, are confused about which endpoint to use, see \"no pollers\" or RESOURCE_EXHAUSTED, struggle with PrivateLink\u002FPSC, or need help setting up a new namespace. Also use for HA namespace failover and DNS issues. Not for worker performance tuning or scaling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"temporal","Temporal","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftemporal.png","temporalio",[13,17,18,21],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":9,"slug":8,"type":16},{"name":19,"slug":20,"type":16},"Cloud","cloud",{"name":22,"slug":23,"type":16},"Debugging","debugging",5,"https:\u002F\u002Fgithub.com\u002Ftemporalio\u002Fskill-temporal-cloud","2026-04-06T18:54:24.441947",null,0,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":32},[],"Agent skill to help with Temporal Cloud connectivity, auth, and other common issues","---\nname: temporal-cloud\ndescription: Fix Temporal Cloud connection, auth, and config problems. Use when users hit login failures, can't connect to Cloud, get x509\u002FTLS errors, have namespace or endpoint mismatches, paste broken SDK connection snippets, are confused about which endpoint to use, see \"no pollers\" or RESOURCE_EXHAUSTED, struggle with PrivateLink\u002FPSC, or need help setting up a new namespace. Also use for HA namespace failover and DNS issues. Not for worker performance tuning or scaling.\n---\n\n# Temporal Cloud Skill\n\nHelp users diagnose and resolve Temporal Cloud connectivity, authentication, and configuration issues using tcld and temporal CLI.\n\n## Core Philosophy\n\nCloud issues are frustrating because they sit at the intersection of configuration, networking, authentication, and Temporal-specific code. Most problems fall into predictable patterns. This skill provides systematic diagnosis to quickly identify root causes and prescribe fixes.\n\n**References:**\n- See `references\u002Fcloud-troubleshooting-reference.md` for full CLI command reference and error codes\n- See `references\u002Fcommon-scenarios.md` for step-by-step setup walkthroughs\n- [Environment configuration docs](https:\u002F\u002Fdocs.temporal.io\u002Fdevelop\u002Fenvironment-configuration) - SDK setup for connecting to Cloud\n- [HA namespace connectivity](https:\u002F\u002Fdocs.temporal.io\u002Fcloud\u002Fhigh-availability\u002Fha-connectivity) - multi-region endpoint and DNS setup\n- [Dev Success troubleshooting guide](https:\u002F\u002Fgithub.com\u002Ftemporalio\u002Fdev-success\u002Fblob\u002Fmain\u002Ftroubleshooting-connection-issues-to-temporal-cloud.md) - companion connection troubleshooting guide\n\n**Out of scope:** Worker performance tuning, scaling, metrics interpretation, SDK-specific config, deployment patterns. Those topics are covered by separate worker-focused skills.\n\n## Issue Classification\n\n| Category | Key Symptoms | First Check |\n|----------|--------------|-------------|\n| **tcld Login** | login failed, token refresh failed, wrong account | `tcld account get` |\n| **Connection\u002FAuth** | can't connect, access denied, handshake failures | Endpoint format + DNS + port connectivity |\n| **Ambiguous Runtime Errors** | `context deadline exceeded`, `workflow is busy` | Identify the operation and layer first |\n| **mTLS\u002FCerts** | x509 errors, unknown authority, expired | `openssl x509 -enddate` |\n| **Namespace** | namespace not found, SNI mismatch | Namespace name format |\n| **HA \u002F Failover** | Failover not working, wrong region, DNS stale | DNS CNAME resolution |\n| **Worker** | Tasks not picked up, stale connections | `temporal task-queue describe` |\n| **Private Connectivity** | PrivateLink\u002FPSC errors | VPC endpoint status |\n| **Rate Limiting** | RESOURCE_EXHAUSTED | APS limits |\n\n## The Process\n\n### Step 1: Identify the Category\n\nAsk the user:\n- **What's the exact error message?** (copy-paste if possible)\n- **What are you trying to do?** (tcld command, starting workers, running workflows)\n- **What changed recently?** (new certs, new namespace, new region)\n\n### Step 2: Gather Context\n\n**For SDK\u002Fclient snippet reviews:**\n- Which auth method are you using: API key or mTLS?\n- Which SDK and version are you using?\n- What exact `HostPort` \u002F address are you using?\n- What exact Namespace are you using?\n- Is this SDK code, `temporal` CLI, or `tcld`?\n\n**For tcld issues:**\n- Can you run `tcld account get`?\n- Multiple Temporal accounts?\n\n**For connection issues:**\n- What's your exact address \u002F `HostPort`?\n- Using mTLS or API keys?\n- Which SDK and version are you using?\n- Any firewall\u002Fproxy between you and Cloud?\n\n**For ambiguous runtime errors:**\n- Where exactly do you see the error: workflow start, signal\u002Fupdate, polling, querying, logs?\n- Is this happening before work starts, while polling, or while workflow code is already running?\n- Are pollers present on the relevant task queue?\n- Did this start after a traffic spike, deploy, or config change?\n\n**For certificate issues:**\n- When were certs generated?\n- What CA was used?\n- Is CA uploaded to namespace?\n\n**For worker issues:**\n- Are workers running? How many?\n- What does `temporal task-queue describe` show?\n- Any errors in worker logs?\n\n### Step 3: Apply Decision Tree\n\nUse the appropriate decision tree based on category (see below).\n\n### Step 4: Provide Fix\n\nGive specific commands to resolve the issue, with verification steps.\n\nAlways include a confidence score for the proposed diagnosis or fix:\n- `Confidence: 9-10\u002F10` when the symptom, operation, and confirming signals line up cleanly\n- `Confidence: 6-8\u002F10` when the evidence is good but one plausible alternative remains\n- `Confidence: 1-5\u002F10` when the issue is still ambiguous and the \"fix\" is really the next discriminating check\n\nIf the problem is ambiguous, say so explicitly and keep the recommendation scoped to the next check rather than presenting a speculative root cause as settled.\n\n## Decision Trees\n\n### tcld Login Issues\n\n```\nSymptom: tcld login not working\n│\n├─ Can `tcld account get` run?\n│  ├─ Yes → Login is valid; continue with account verification\n│  └─ No → Run `tcld login`\n│\n├─ Token refresh failed?\n│  └─ tcld logout && tcld login\n│\n├─ Wrong organization\u002Faccount?\n│  ├─ tcld account get\n│  └─ Verify the expected namespace appears in `tcld namespace list`\n│\n└─ \"unauthorized\" or auth errors?\n   └─ tcld logout && tcld login\n```\n\n### Connection Failures\n\n**Docs:** [Environment configuration](https:\u002F\u002Fdocs.temporal.io\u002Fdevelop\u002Fenvironment-configuration) - SDK connection options\n\n**Endpoint check before network debugging:**\n\n| Use case | Recommended endpoint | Notes |\n|----------|---------------------|-------|\n| Workers & clients (all auth) | `\u003Cnamespace>.\u003Caccount>.tmprl.cloud:7233` | **Namespace Endpoint** - works for both mTLS and API key auth. Recommended for all namespaces. |\n| Multi-region HA (advanced) | `\u003Cregion>.\u003Ccloud_provider>.api.temporal.io:7233` | Regional Endpoint - only needed for advanced HA routing. See [namespace access docs](https:\u002F\u002Fdocs.temporal.io\u002Fcloud\u002Fnamespaces#access-namespaces). |\n| tcld \u002F Cloud Ops API | `saas-api.tmprl.cloud` | Control plane |\n\n**Exception:** Namespaces using Flexible Auth (pre-release) cannot use Namespace Endpoints yet.\n\n```\nSymptom: Can't connect to Temporal Cloud\n│\n├─ Check: Using Namespace Endpoint?\n│  ├─ Using regional endpoint (`*.api.temporal.io`) without HA need?\n│  │  └─ Switch to Namespace Endpoint (`\u003Cns>.\u003Cacct>.tmprl.cloud:7233`)\n│  ├─ Using old\u002Fstale endpoint format?\n│  │  └─ Switch to Namespace Endpoint\n│  └─ Endpoint looks correct → Continue\n│\n├─ Check: DNS resolution\n│  └─ nslookup \u003Chost-from-address>\n│     ├─ Fails → DNS issue (check network, VPN)\n│     └─ Succeeds → Continue\n│\n├─ Check: Port connectivity\n│  └─ nc -zv \u003Chost-from-address> 7233\n│     ├─ Fails → Firewall blocking port 7233\n│     └─ Succeeds → Continue\n│\n├─ Check: TLS handshake\n│  └─ openssl s_client -connect \u003Caddress>\n│     ├─ Fails → Certificate issue (see mTLS tree)\n│     └─ Succeeds → Continue\n│\n└─ Check: Temporal CLI test\n   └─ temporal workflow list --limit 1 --address ...\n      ├─ PERMISSION_DENIED → Check namespace name format\n      ├─ UNAUTHENTICATED → Certificate not accepted\n      └─ Works → Connection OK, issue elsewhere\n```\n\n### Ambiguous Runtime Errors\n\nDo not assume these are pure connectivity failures. Classify them by operation first.\n\n| Error text | Common interpretations | First discriminator |\n|------------|------------------------|---------------------|\n| `context deadline exceeded` | wrong endpoint, network timeout, oversized payload, blocked execution path, client-side timeout | Where in the flow does it occur? |\n| `workflow is busy` \u002F `RESOURCE_EXHAUSTED: Workflow is busy` | operation-level contention, workload pressure, confusing user-facing error semantics | Which operation returned it? |\n| `no pollers` | no connected workers, workers present but misconfigured, stale\u002Fmisleading metrics | Does `temporal task-queue describe` show pollers? |\n\nUse this decision sequence:\n\n```\nSymptom: ambiguous runtime error\n│\n├─ Check: Which operation returned the error?\n│  ├─ start \u002F signal \u002F update \u002F query request\n│  ├─ poll loop \u002F worker logs\n│  └─ UI \u002F metrics only\n│\n├─ Check: Is work reaching a task queue?\n│  ├─ No pollers listed\n│  │  └─ Treat as worker connectivity \u002F config until proven otherwise\n│  ├─ Pollers listed, backlog growing\n│  │  └─ Worker capacity \u002F tuning issue (out of scope for this skill)\n│  └─ Pollers listed, no backlog issue\n│     └─ Continue\n│\n├─ For `context deadline exceeded`\n│  ├─ Happens before any work starts\n│  │  └─ Check endpoint format, auth, proxy, DNS, firewall\n│  ├─ Happens on workflow start with large payloads\n│  │  └─ Consider payload size \u002F client timeout path\n│  └─ Happens during local execution \u002F queries\n│     └─ Consider blocked execution path, local activity, or client-side timeout\n│\n└─ For `workflow is busy`\n   ├─ Identify exact API \u002F operation\n   ├─ Check whether user is conflating this with a generic workflow failure\n   └─ Explain that the error class is operation-specific before prescribing fixes\n```\n\nIf the operation and surrounding signals still do not make the error interpretable, label it as ambiguous and gather more context before prescribing a fix.\n\nWhen responding, attach a confidence score from 1-10 to the proposed diagnosis or next step. Ambiguous cases should carry a low-confidence score and a narrow next check rather than a broad claimed fix.\n\n### SDK Snippet Review\n\nWhen the user pastes SDK config, validate the config itself before suggesting lower-level networking checks.\n\n**Review in this order:**\n1. Auth method: API key vs mTLS\n2. Address \u002F `HostPort`: should be Namespace Endpoint (`\u003Cns>.\u003Cacct>.tmprl.cloud:7233`) for most cases\n3. Namespace: full Cloud namespace format (`\u003Cnamespace>.\u003Caccount-id>`)\n4. TLS config: empty `tls.Config{}` is normal for API key auth; client cert\u002Fkey required for mTLS\n5. Environment config: prefer `TEMPORAL_ADDRESS`, `TEMPORAL_NAMESPACE`, `TEMPORAL_API_KEY`, `TEMPORAL_TLS_CLIENT_CERT_PATH`, `TEMPORAL_TLS_CLIENT_KEY_PATH`\n\n**Common snippet diagnoses:**\n- Using regional endpoint (`*.api.temporal.io`) when Namespace Endpoint would work → simplify to `\u003Cns>.\u003Cacct>.tmprl.cloud:7233`\n- Empty `HostPort` + Cloud namespace\u002Fauth → missing explicit Cloud endpoint\n- API key without TLS enabled by the SDK\u002Fruntime → check SDK-specific Cloud guidance\n- Old endpoint format (stale docs\u002Fexamples) → update to current Namespace Endpoint\n\nIf the snippet is wrong, fix that first. Do not lead with DNS\u002FTLS debugging until the endpoint and namespace are plausible.\n\n### Certificate Errors\n\n```\nSymptom: x509 certificate errors\n│\n├─ \"certificate signed by unknown authority\"\n│  ├─ Is CA uploaded to namespace?\n│  │  └─ tcld namespace accepted-client-ca list --namespace \u003Cns>\n│  │     ├─ CA not listed → Add it:\n│  │     │  tcld namespace accepted-client-ca add \\\n│  │     │    --namespace \u003Cns> --ca-certificate-file ca.pem\n│  │     └─ CA listed → Cert not signed by that CA\n│  │        └─ Verify: openssl verify -CAfile ca.pem client.pem\n│  │\n│  └─ Self-signed cert without CA?\n│     └─ Must use CA-signed certs for Cloud\n│\n├─ \"certificate has expired\"\n│  ├─ Check expiry: openssl x509 -enddate -noout -in cert.pem\n│  └─ Generate new cert:\n│     tcld generate-certificates end-entity-certificate \\\n│       --organization \u003Corg> --validity-period 365d \\\n│       --ca-certificate-file ca.pem --ca-key-file ca.key \\\n│       --certificate-file client.pem --key-file client.key\n│\n├─ \"private key does not match\"\n│  └─ Wrong key file - verify match:\n│     openssl x509 -modulus -noout -in cert.pem | md5\n│     openssl rsa -modulus -noout -in key.pem | md5\n│\n└─ \"bad certificate\" from server\n   └─ Server rejected cert - CA not in accepted list\n      └─ tcld namespace accepted-client-ca list --namespace \u003Cns>\n```\n\n### Namespace Issues\n\n```\nSymptom: namespace not found or access denied\n│\n├─ Check: Namespace name format\n│  ├─ Format: \u003Cnamespace-name>.\u003Caccount-id>\n│  ├─ Example: my-namespace.a1b2c3\n│  └─ Wrong format → Use full namespace name\n│\n├─ Check: Namespace exists\n│  └─ tcld namespace list\n│     └─ Not listed → Wrong account, or namespace not created\n│\n├─ Check: Address format\n│  ├─ Namespace Endpoint (recommended): \u003Cnamespace>.\u003Caccount>.tmprl.cloud:7233\n│  ├─ Regional Endpoint (HA only): \u003Cregion>.\u003Ccloud_provider>.api.temporal.io:7233\n│  └─ Using wrong or stale endpoint? → switch to Namespace Endpoint\n│\n└─ Check: User permissions\n   └─ tcld user list\n      └─ Verify user has access to namespace\n```\n\n### Worker Issues\n\nThis skill diagnoses **Cloud connectivity issues** for workers. Worker performance tuning, scaling, and deployment patterns are out of scope.\n\n**Docs:** [Environment configuration](https:\u002F\u002Fdocs.temporal.io\u002Fdevelop\u002Fenvironment-configuration) - SDK connection setup\n\n```\nSymptom: Workers not picking up tasks\n│\n├─ Check: Are workers running?\n│  └─ Verify worker process is up, check logs for errors\n│\n├─ Check: Task queue status\n│  └─ temporal task-queue describe --task-queue \u003Cqueue>\n│     ├─ No pollers listed → Workers not connected (Cloud issue)\n│     │  ├─ Check task queue name matches\n│     │  ├─ Check namespace in worker config\n│     │  ├─ Verify SDK connection options (see env config docs)\n│     │  └─ Check for connection errors in logs\n│     │\n│     │  Note: if only metrics or dashboards say \"no pollers\", verify with CLI or another direct surface before concluding workers are absent.\n│     │\n│     ├─ Pollers listed but backlog growing\n│     │  └─ NOT a Cloud issue (worker scaling\u002Ftuning problem)\n│     │\n│     └─ Pollers listed, no backlog\n│        └─ Workers healthy, issue is elsewhere\n│\n├─ Check: DNS caching (common in K8s)\n│  └─ Stale DNS can cause workers to connect to wrong endpoint\n│     └─ Restart workers to refresh DNS\n│\n└─ Check: Rate limiting\n   └─ RESOURCE_EXHAUSTED in logs?\n      └─ See Rate Limiting section\n```\n\n**Scope clarification:**\n\n| Issue Type | In Scope? |\n|------------|-----------|\n| tcld login, certs, namespace, private connectivity | Yes |\n| Worker scaling, metrics, tuning, deployment | No |\n| \"Workers not picking up tasks\" | Yes - diagnose, hand off if not a Cloud issue |\n\n### HA Namespace Connectivity\n\n**Docs:** [HA namespace connectivity](https:\u002F\u002Fdocs.temporal.io\u002Fcloud\u002Fhigh-availability\u002Fha-connectivity)\n\nHA (multi-region) namespaces use a hierarchical DNS structure:\n- Namespace endpoint: `\u003Cns>.\u003Cacct>.tmprl.cloud` (CNAME to active region)\n- Regional endpoint: `\u003Cregion>.region.tmprl.cloud`\n- During failover, CNAME switches regions (15s TTL, ~30s convergence)\n\n```\nSymptom: HA namespace connectivity or failover issues\n│\n├─ Check: DNS resolution\n│  └─ nslookup \u003Cnamespace>.tmprl.cloud\n│     ├─ Should return CNAME → \u003Cregion>.region.tmprl.cloud\n│     └─ Then resolve to IP address\n│\n├─ Symptom: Clients not failing over\n│  ├─ Check: DNS caching\n│  │  ├─ TTL is 15s - clients should converge within 30s\n│  │  ├─ Some DNS resolvers cache longer\n│  │  └─ Fix: Restart workers to refresh DNS\n│  │\n│  └─ Check: SDK connection caching\n│     └─ Some SDKs cache connections - may need restart\n│\n├─ Symptom: PrivateLink not working after failover\n│  ├─ Check: Regional DNS override configured?\n│  │  └─ Need Route 53 private hosted zone for region.tmprl.cloud\n│  │     mapping regional endpoints to VPC endpoint IPs\n│  │\n│  └─ Check: Inter-region connectivity\n│     └─ Workers need Transit Gateway or VPC Peering to reach\n│        VPC endpoints in both regions\n│\n├─ Symptom: GCP Private Service Connect not working\n│  └─ NOT SUPPORTED: Private connectivity not yet offered for\n│     GCP Multi-region Namespaces\n│\n└─ Symptom: sa-east-1 region issues\n   └─ NOT SUPPORTED: sa-east-1 not available for Multi-region namespaces (because there are no other regions on the continent)\n```\n\n**Worker placement for HA:**\n- Option A: Run workers in both regions continuously\n- Option B: Single region + Transit Gateway\u002FVPC Peering for failover access\n\n### Private Connectivity Issues\n\n```\nSymptom: PrivateLink or Private Service Connect not working\n│\n├─ AWS PrivateLink\n│  ├─ Check: VPC endpoint status\n│  │  └─ AWS Console → VPC → Endpoints → Status = available\n│  │\n│  ├─ Check: Security groups\n│  │  └─ Allow outbound to endpoint on port 7233\n│  │\n│  ├─ Check: DNS resolution\n│  │  └─ Should resolve to private IP (10.x or 172.x)\n│  │\n│  └─ Check: Connectivity rules\n│     ├─ tcld connectivity-rule list --namespace \u003Cns>\n│     └─ If needed, attach rules with:\n│        tcld namespace set-connectivity-rules --namespace \u003Cns> --connectivity-rule-ids \u003Cid>\n│\n├─ GCP Private Service Connect\n│  ├─ Check: PSC endpoint status\n│  │  └─ GCP Console → Network Services → Private Service Connect\n│  │\n│  ├─ Check: Firewall rules\n│  │  └─ Allow egress to PSC endpoint\n│  │\n│  └─ Check: DNS configuration\n│     └─ Cloud DNS zone for tmprl.cloud pointing to PSC\n│\n└─ General\n   └─ Verify rule details:\n      tcld connectivity-rule get --connectivity-rule-id \u003Cid>\n```\n\n### Rate Limiting\n\n```\nSymptom: RESOURCE_EXHAUSTED errors\n│\n├─ Check: Which operation is limited?\n│  └─ Error message indicates operation type\n│\n├─ \"namespace write ops\" exceeded\n│  ├─ Too many workflow starts\n│  ├─ Too many signals\u002Fupdates\n│  └─ Fix: Add backoff, batch operations\n│\n├─ \"namespace read ops\" exceeded\n│  ├─ Too many list\u002Fquery operations\n│  └─ Fix: Add caching, reduce polling frequency\n│\n└─ Poll operations rate limited\n   ├─ Too many pollers across workers\n   └─ Fix: Reduce MaxConcurrentPollers settings\n```\n\n## Common Scenarios\n\nSee `references\u002Fcommon-scenarios.md` for step-by-step walkthroughs:\n- API key connectivity setup\n- New namespace setup (mTLS)\n- Certificate rotation\n- Switching from mTLS to API keys\n\n## Common Pitfalls\n\n| Pitfall | Why It Happens | Fix |\n|---------|----------------|-----|\n| Wrong namespace format | Using short name instead of `name.account-id` | Use full namespace from `tcld namespace list` |\n| Self-signed certs | Trying to use self-signed without CA | Generate CA first, sign certs with it, upload CA |\n| Regional endpoint when unnecessary | Using `*.api.temporal.io` when Namespace Endpoint works | Switch to `\u003Cnamespace>.\u003Caccount>.tmprl.cloud:7233` |\n| Old endpoint docs | Following stale examples from before Namespace Endpoints were universal | Use Namespace Endpoint: `\u003Cns>.\u003Cacct>.tmprl.cloud:7233` |\n| Expired certs | Not monitoring expiry | Set up alerts, rotate before expiry |\n| tcld wrong account | Logged into different org | Use `tcld account get`, then verify the namespace in `tcld namespace list` |\n| Stale tcld login | Cached auth state is no longer valid | `tcld logout && tcld login` |\n| DNS caching | K8s pods caching old DNS | Restart pods after endpoint changes |\n| Missing port | Firewall blocks 7233 | Ensure egress allowed on port 7233 |\n\n## Tips\n\n- **Always get the exact error message** - Copy-paste, don't paraphrase\n- **Check the simple things first** - DNS, port connectivity, cert expiry\n- **Use Namespace Endpoint by default** - `\u003Cns>.\u003Cacct>.tmprl.cloud:7233` works for both mTLS and API key auth\n- **Use openssl for cert issues** - It gives clearer error messages than SDKs\n- **tcld account get is your friend** - Shows the current account context\n- **Namespace names are case-sensitive** - Match exactly\n- **API keys are easier than mTLS** - Consider for simpler setups\n- **Point users to env config docs** - [Environment configuration](https:\u002F\u002Fdocs.temporal.io\u002Fdevelop\u002Fenvironment-configuration) covers all SDK connection options\n",{"data":35,"body":36},{"name":4,"description":6},{"type":37,"children":38},"root",[39,48,54,61,66,75,144,154,160,406,412,419,424,457,463,471,522,530,549,557,585,593,616,624,642,650,675,681,686,692,697,702,738,743,749,755,767,773,791,799,906,916,925,930,935,1041,1046,1055,1060,1065,1071,1076,1084,1178,1186,1229,1234,1240,1249,1255,1264,1270,1282,1297,1306,1314,1375,1381,1394,1399,1431,1440,1448,1461,1467,1476,1481,1490,1496,1507,1530,1536,1770,1776],{"type":40,"tag":41,"props":42,"children":44},"element","h1",{"id":43},"temporal-cloud-skill",[45],{"type":46,"value":47},"text","Temporal Cloud Skill",{"type":40,"tag":49,"props":50,"children":51},"p",{},[52],{"type":46,"value":53},"Help users diagnose and resolve Temporal Cloud connectivity, authentication, and configuration issues using tcld and temporal CLI.",{"type":40,"tag":55,"props":56,"children":58},"h2",{"id":57},"core-philosophy",[59],{"type":46,"value":60},"Core Philosophy",{"type":40,"tag":49,"props":62,"children":63},{},[64],{"type":46,"value":65},"Cloud issues are frustrating because they sit at the intersection of configuration, networking, authentication, and Temporal-specific code. Most problems fall into predictable patterns. This skill provides systematic diagnosis to quickly identify root causes and prescribe fixes.",{"type":40,"tag":49,"props":67,"children":68},{},[69],{"type":40,"tag":70,"props":71,"children":72},"strong",{},[73],{"type":46,"value":74},"References:",{"type":40,"tag":76,"props":77,"children":78},"ul",{},[79,94,106,120,132],{"type":40,"tag":80,"props":81,"children":82},"li",{},[83,85,92],{"type":46,"value":84},"See ",{"type":40,"tag":86,"props":87,"children":89},"code",{"className":88},[],[90],{"type":46,"value":91},"references\u002Fcloud-troubleshooting-reference.md",{"type":46,"value":93}," for full CLI command reference and error codes",{"type":40,"tag":80,"props":95,"children":96},{},[97,98,104],{"type":46,"value":84},{"type":40,"tag":86,"props":99,"children":101},{"className":100},[],[102],{"type":46,"value":103},"references\u002Fcommon-scenarios.md",{"type":46,"value":105}," for step-by-step setup walkthroughs",{"type":40,"tag":80,"props":107,"children":108},{},[109,118],{"type":40,"tag":110,"props":111,"children":115},"a",{"href":112,"rel":113},"https:\u002F\u002Fdocs.temporal.io\u002Fdevelop\u002Fenvironment-configuration",[114],"nofollow",[116],{"type":46,"value":117},"Environment configuration docs",{"type":46,"value":119}," - SDK setup for connecting to Cloud",{"type":40,"tag":80,"props":121,"children":122},{},[123,130],{"type":40,"tag":110,"props":124,"children":127},{"href":125,"rel":126},"https:\u002F\u002Fdocs.temporal.io\u002Fcloud\u002Fhigh-availability\u002Fha-connectivity",[114],[128],{"type":46,"value":129},"HA namespace connectivity",{"type":46,"value":131}," - multi-region endpoint and DNS setup",{"type":40,"tag":80,"props":133,"children":134},{},[135,142],{"type":40,"tag":110,"props":136,"children":139},{"href":137,"rel":138},"https:\u002F\u002Fgithub.com\u002Ftemporalio\u002Fdev-success\u002Fblob\u002Fmain\u002Ftroubleshooting-connection-issues-to-temporal-cloud.md",[114],[140],{"type":46,"value":141},"Dev Success troubleshooting guide",{"type":46,"value":143}," - companion connection troubleshooting guide",{"type":40,"tag":49,"props":145,"children":146},{},[147,152],{"type":40,"tag":70,"props":148,"children":149},{},[150],{"type":46,"value":151},"Out of scope:",{"type":46,"value":153}," Worker performance tuning, scaling, metrics interpretation, SDK-specific config, deployment patterns. Those topics are covered by separate worker-focused skills.",{"type":40,"tag":55,"props":155,"children":157},{"id":156},"issue-classification",[158],{"type":46,"value":159},"Issue Classification",{"type":40,"tag":161,"props":162,"children":163},"table",{},[164,188],{"type":40,"tag":165,"props":166,"children":167},"thead",{},[168],{"type":40,"tag":169,"props":170,"children":171},"tr",{},[172,178,183],{"type":40,"tag":173,"props":174,"children":175},"th",{},[176],{"type":46,"value":177},"Category",{"type":40,"tag":173,"props":179,"children":180},{},[181],{"type":46,"value":182},"Key Symptoms",{"type":40,"tag":173,"props":184,"children":185},{},[186],{"type":46,"value":187},"First Check",{"type":40,"tag":189,"props":190,"children":191},"tbody",{},[192,218,239,272,297,318,339,364,385],{"type":40,"tag":169,"props":193,"children":194},{},[195,204,209],{"type":40,"tag":196,"props":197,"children":198},"td",{},[199],{"type":40,"tag":70,"props":200,"children":201},{},[202],{"type":46,"value":203},"tcld Login",{"type":40,"tag":196,"props":205,"children":206},{},[207],{"type":46,"value":208},"login failed, token refresh failed, wrong account",{"type":40,"tag":196,"props":210,"children":211},{},[212],{"type":40,"tag":86,"props":213,"children":215},{"className":214},[],[216],{"type":46,"value":217},"tcld account get",{"type":40,"tag":169,"props":219,"children":220},{},[221,229,234],{"type":40,"tag":196,"props":222,"children":223},{},[224],{"type":40,"tag":70,"props":225,"children":226},{},[227],{"type":46,"value":228},"Connection\u002FAuth",{"type":40,"tag":196,"props":230,"children":231},{},[232],{"type":46,"value":233},"can't connect, access denied, handshake failures",{"type":40,"tag":196,"props":235,"children":236},{},[237],{"type":46,"value":238},"Endpoint format + DNS + port connectivity",{"type":40,"tag":169,"props":240,"children":241},{},[242,250,267],{"type":40,"tag":196,"props":243,"children":244},{},[245],{"type":40,"tag":70,"props":246,"children":247},{},[248],{"type":46,"value":249},"Ambiguous Runtime Errors",{"type":40,"tag":196,"props":251,"children":252},{},[253,259,261],{"type":40,"tag":86,"props":254,"children":256},{"className":255},[],[257],{"type":46,"value":258},"context deadline exceeded",{"type":46,"value":260},", ",{"type":40,"tag":86,"props":262,"children":264},{"className":263},[],[265],{"type":46,"value":266},"workflow is busy",{"type":40,"tag":196,"props":268,"children":269},{},[270],{"type":46,"value":271},"Identify the operation and layer first",{"type":40,"tag":169,"props":273,"children":274},{},[275,283,288],{"type":40,"tag":196,"props":276,"children":277},{},[278],{"type":40,"tag":70,"props":279,"children":280},{},[281],{"type":46,"value":282},"mTLS\u002FCerts",{"type":40,"tag":196,"props":284,"children":285},{},[286],{"type":46,"value":287},"x509 errors, unknown authority, expired",{"type":40,"tag":196,"props":289,"children":290},{},[291],{"type":40,"tag":86,"props":292,"children":294},{"className":293},[],[295],{"type":46,"value":296},"openssl x509 -enddate",{"type":40,"tag":169,"props":298,"children":299},{},[300,308,313],{"type":40,"tag":196,"props":301,"children":302},{},[303],{"type":40,"tag":70,"props":304,"children":305},{},[306],{"type":46,"value":307},"Namespace",{"type":40,"tag":196,"props":309,"children":310},{},[311],{"type":46,"value":312},"namespace not found, SNI mismatch",{"type":40,"tag":196,"props":314,"children":315},{},[316],{"type":46,"value":317},"Namespace name format",{"type":40,"tag":169,"props":319,"children":320},{},[321,329,334],{"type":40,"tag":196,"props":322,"children":323},{},[324],{"type":40,"tag":70,"props":325,"children":326},{},[327],{"type":46,"value":328},"HA \u002F Failover",{"type":40,"tag":196,"props":330,"children":331},{},[332],{"type":46,"value":333},"Failover not working, wrong region, DNS stale",{"type":40,"tag":196,"props":335,"children":336},{},[337],{"type":46,"value":338},"DNS CNAME resolution",{"type":40,"tag":169,"props":340,"children":341},{},[342,350,355],{"type":40,"tag":196,"props":343,"children":344},{},[345],{"type":40,"tag":70,"props":346,"children":347},{},[348],{"type":46,"value":349},"Worker",{"type":40,"tag":196,"props":351,"children":352},{},[353],{"type":46,"value":354},"Tasks not picked up, stale connections",{"type":40,"tag":196,"props":356,"children":357},{},[358],{"type":40,"tag":86,"props":359,"children":361},{"className":360},[],[362],{"type":46,"value":363},"temporal task-queue describe",{"type":40,"tag":169,"props":365,"children":366},{},[367,375,380],{"type":40,"tag":196,"props":368,"children":369},{},[370],{"type":40,"tag":70,"props":371,"children":372},{},[373],{"type":46,"value":374},"Private Connectivity",{"type":40,"tag":196,"props":376,"children":377},{},[378],{"type":46,"value":379},"PrivateLink\u002FPSC errors",{"type":40,"tag":196,"props":381,"children":382},{},[383],{"type":46,"value":384},"VPC endpoint status",{"type":40,"tag":169,"props":386,"children":387},{},[388,396,401],{"type":40,"tag":196,"props":389,"children":390},{},[391],{"type":40,"tag":70,"props":392,"children":393},{},[394],{"type":46,"value":395},"Rate Limiting",{"type":40,"tag":196,"props":397,"children":398},{},[399],{"type":46,"value":400},"RESOURCE_EXHAUSTED",{"type":40,"tag":196,"props":402,"children":403},{},[404],{"type":46,"value":405},"APS limits",{"type":40,"tag":55,"props":407,"children":409},{"id":408},"the-process",[410],{"type":46,"value":411},"The Process",{"type":40,"tag":413,"props":414,"children":416},"h3",{"id":415},"step-1-identify-the-category",[417],{"type":46,"value":418},"Step 1: Identify the Category",{"type":40,"tag":49,"props":420,"children":421},{},[422],{"type":46,"value":423},"Ask the user:",{"type":40,"tag":76,"props":425,"children":426},{},[427,437,447],{"type":40,"tag":80,"props":428,"children":429},{},[430,435],{"type":40,"tag":70,"props":431,"children":432},{},[433],{"type":46,"value":434},"What's the exact error message?",{"type":46,"value":436}," (copy-paste if possible)",{"type":40,"tag":80,"props":438,"children":439},{},[440,445],{"type":40,"tag":70,"props":441,"children":442},{},[443],{"type":46,"value":444},"What are you trying to do?",{"type":46,"value":446}," (tcld command, starting workers, running workflows)",{"type":40,"tag":80,"props":448,"children":449},{},[450,455],{"type":40,"tag":70,"props":451,"children":452},{},[453],{"type":46,"value":454},"What changed recently?",{"type":46,"value":456}," (new certs, new namespace, new region)",{"type":40,"tag":413,"props":458,"children":460},{"id":459},"step-2-gather-context",[461],{"type":46,"value":462},"Step 2: Gather Context",{"type":40,"tag":49,"props":464,"children":465},{},[466],{"type":40,"tag":70,"props":467,"children":468},{},[469],{"type":46,"value":470},"For SDK\u002Fclient snippet reviews:",{"type":40,"tag":76,"props":472,"children":473},{},[474,479,484,497,502],{"type":40,"tag":80,"props":475,"children":476},{},[477],{"type":46,"value":478},"Which auth method are you using: API key or mTLS?",{"type":40,"tag":80,"props":480,"children":481},{},[482],{"type":46,"value":483},"Which SDK and version are you using?",{"type":40,"tag":80,"props":485,"children":486},{},[487,489,495],{"type":46,"value":488},"What exact ",{"type":40,"tag":86,"props":490,"children":492},{"className":491},[],[493],{"type":46,"value":494},"HostPort",{"type":46,"value":496}," \u002F address are you using?",{"type":40,"tag":80,"props":498,"children":499},{},[500],{"type":46,"value":501},"What exact Namespace are you using?",{"type":40,"tag":80,"props":503,"children":504},{},[505,507,512,514,520],{"type":46,"value":506},"Is this SDK code, ",{"type":40,"tag":86,"props":508,"children":510},{"className":509},[],[511],{"type":46,"value":8},{"type":46,"value":513}," CLI, or ",{"type":40,"tag":86,"props":515,"children":517},{"className":516},[],[518],{"type":46,"value":519},"tcld",{"type":46,"value":521},"?",{"type":40,"tag":49,"props":523,"children":524},{},[525],{"type":40,"tag":70,"props":526,"children":527},{},[528],{"type":46,"value":529},"For tcld issues:",{"type":40,"tag":76,"props":531,"children":532},{},[533,544],{"type":40,"tag":80,"props":534,"children":535},{},[536,538,543],{"type":46,"value":537},"Can you run ",{"type":40,"tag":86,"props":539,"children":541},{"className":540},[],[542],{"type":46,"value":217},{"type":46,"value":521},{"type":40,"tag":80,"props":545,"children":546},{},[547],{"type":46,"value":548},"Multiple Temporal accounts?",{"type":40,"tag":49,"props":550,"children":551},{},[552],{"type":40,"tag":70,"props":553,"children":554},{},[555],{"type":46,"value":556},"For connection issues:",{"type":40,"tag":76,"props":558,"children":559},{},[560,571,576,580],{"type":40,"tag":80,"props":561,"children":562},{},[563,565,570],{"type":46,"value":564},"What's your exact address \u002F ",{"type":40,"tag":86,"props":566,"children":568},{"className":567},[],[569],{"type":46,"value":494},{"type":46,"value":521},{"type":40,"tag":80,"props":572,"children":573},{},[574],{"type":46,"value":575},"Using mTLS or API keys?",{"type":40,"tag":80,"props":577,"children":578},{},[579],{"type":46,"value":483},{"type":40,"tag":80,"props":581,"children":582},{},[583],{"type":46,"value":584},"Any firewall\u002Fproxy between you and Cloud?",{"type":40,"tag":49,"props":586,"children":587},{},[588],{"type":40,"tag":70,"props":589,"children":590},{},[591],{"type":46,"value":592},"For ambiguous runtime errors:",{"type":40,"tag":76,"props":594,"children":595},{},[596,601,606,611],{"type":40,"tag":80,"props":597,"children":598},{},[599],{"type":46,"value":600},"Where exactly do you see the error: workflow start, signal\u002Fupdate, polling, querying, logs?",{"type":40,"tag":80,"props":602,"children":603},{},[604],{"type":46,"value":605},"Is this happening before work starts, while polling, or while workflow code is already running?",{"type":40,"tag":80,"props":607,"children":608},{},[609],{"type":46,"value":610},"Are pollers present on the relevant task queue?",{"type":40,"tag":80,"props":612,"children":613},{},[614],{"type":46,"value":615},"Did this start after a traffic spike, deploy, or config change?",{"type":40,"tag":49,"props":617,"children":618},{},[619],{"type":40,"tag":70,"props":620,"children":621},{},[622],{"type":46,"value":623},"For certificate issues:",{"type":40,"tag":76,"props":625,"children":626},{},[627,632,637],{"type":40,"tag":80,"props":628,"children":629},{},[630],{"type":46,"value":631},"When were certs generated?",{"type":40,"tag":80,"props":633,"children":634},{},[635],{"type":46,"value":636},"What CA was used?",{"type":40,"tag":80,"props":638,"children":639},{},[640],{"type":46,"value":641},"Is CA uploaded to namespace?",{"type":40,"tag":49,"props":643,"children":644},{},[645],{"type":40,"tag":70,"props":646,"children":647},{},[648],{"type":46,"value":649},"For worker issues:",{"type":40,"tag":76,"props":651,"children":652},{},[653,658,670],{"type":40,"tag":80,"props":654,"children":655},{},[656],{"type":46,"value":657},"Are workers running? How many?",{"type":40,"tag":80,"props":659,"children":660},{},[661,663,668],{"type":46,"value":662},"What does ",{"type":40,"tag":86,"props":664,"children":666},{"className":665},[],[667],{"type":46,"value":363},{"type":46,"value":669}," show?",{"type":40,"tag":80,"props":671,"children":672},{},[673],{"type":46,"value":674},"Any errors in worker logs?",{"type":40,"tag":413,"props":676,"children":678},{"id":677},"step-3-apply-decision-tree",[679],{"type":46,"value":680},"Step 3: Apply Decision Tree",{"type":40,"tag":49,"props":682,"children":683},{},[684],{"type":46,"value":685},"Use the appropriate decision tree based on category (see below).",{"type":40,"tag":413,"props":687,"children":689},{"id":688},"step-4-provide-fix",[690],{"type":46,"value":691},"Step 4: Provide Fix",{"type":40,"tag":49,"props":693,"children":694},{},[695],{"type":46,"value":696},"Give specific commands to resolve the issue, with verification steps.",{"type":40,"tag":49,"props":698,"children":699},{},[700],{"type":46,"value":701},"Always include a confidence score for the proposed diagnosis or fix:",{"type":40,"tag":76,"props":703,"children":704},{},[705,716,727],{"type":40,"tag":80,"props":706,"children":707},{},[708,714],{"type":40,"tag":86,"props":709,"children":711},{"className":710},[],[712],{"type":46,"value":713},"Confidence: 9-10\u002F10",{"type":46,"value":715}," when the symptom, operation, and confirming signals line up cleanly",{"type":40,"tag":80,"props":717,"children":718},{},[719,725],{"type":40,"tag":86,"props":720,"children":722},{"className":721},[],[723],{"type":46,"value":724},"Confidence: 6-8\u002F10",{"type":46,"value":726}," when the evidence is good but one plausible alternative remains",{"type":40,"tag":80,"props":728,"children":729},{},[730,736],{"type":40,"tag":86,"props":731,"children":733},{"className":732},[],[734],{"type":46,"value":735},"Confidence: 1-5\u002F10",{"type":46,"value":737}," when the issue is still ambiguous and the \"fix\" is really the next discriminating check",{"type":40,"tag":49,"props":739,"children":740},{},[741],{"type":46,"value":742},"If the problem is ambiguous, say so explicitly and keep the recommendation scoped to the next check rather than presenting a speculative root cause as settled.",{"type":40,"tag":55,"props":744,"children":746},{"id":745},"decision-trees",[747],{"type":46,"value":748},"Decision Trees",{"type":40,"tag":413,"props":750,"children":752},{"id":751},"tcld-login-issues",[753],{"type":46,"value":754},"tcld Login Issues",{"type":40,"tag":756,"props":757,"children":761},"pre",{"className":758,"code":760,"language":46},[759],"language-text","Symptom: tcld login not working\n│\n├─ Can `tcld account get` run?\n│  ├─ Yes → Login is valid; continue with account verification\n│  └─ No → Run `tcld login`\n│\n├─ Token refresh failed?\n│  └─ tcld logout && tcld login\n│\n├─ Wrong organization\u002Faccount?\n│  ├─ tcld account get\n│  └─ Verify the expected namespace appears in `tcld namespace list`\n│\n└─ \"unauthorized\" or auth errors?\n   └─ tcld logout && tcld login\n",[762],{"type":40,"tag":86,"props":763,"children":765},{"__ignoreMap":764},"",[766],{"type":46,"value":760},{"type":40,"tag":413,"props":768,"children":770},{"id":769},"connection-failures",[771],{"type":46,"value":772},"Connection Failures",{"type":40,"tag":49,"props":774,"children":775},{},[776,781,783,789],{"type":40,"tag":70,"props":777,"children":778},{},[779],{"type":46,"value":780},"Docs:",{"type":46,"value":782}," ",{"type":40,"tag":110,"props":784,"children":786},{"href":112,"rel":785},[114],[787],{"type":46,"value":788},"Environment configuration",{"type":46,"value":790}," - SDK connection options",{"type":40,"tag":49,"props":792,"children":793},{},[794],{"type":40,"tag":70,"props":795,"children":796},{},[797],{"type":46,"value":798},"Endpoint check before network debugging:",{"type":40,"tag":161,"props":800,"children":801},{},[802,823],{"type":40,"tag":165,"props":803,"children":804},{},[805],{"type":40,"tag":169,"props":806,"children":807},{},[808,813,818],{"type":40,"tag":173,"props":809,"children":810},{},[811],{"type":46,"value":812},"Use case",{"type":40,"tag":173,"props":814,"children":815},{},[816],{"type":46,"value":817},"Recommended endpoint",{"type":40,"tag":173,"props":819,"children":820},{},[821],{"type":46,"value":822},"Notes",{"type":40,"tag":189,"props":824,"children":825},{},[826,853,884],{"type":40,"tag":169,"props":827,"children":828},{},[829,834,843],{"type":40,"tag":196,"props":830,"children":831},{},[832],{"type":46,"value":833},"Workers & clients (all auth)",{"type":40,"tag":196,"props":835,"children":836},{},[837],{"type":40,"tag":86,"props":838,"children":840},{"className":839},[],[841],{"type":46,"value":842},"\u003Cnamespace>.\u003Caccount>.tmprl.cloud:7233",{"type":40,"tag":196,"props":844,"children":845},{},[846,851],{"type":40,"tag":70,"props":847,"children":848},{},[849],{"type":46,"value":850},"Namespace Endpoint",{"type":46,"value":852}," - works for both mTLS and API key auth. Recommended for all namespaces.",{"type":40,"tag":169,"props":854,"children":855},{},[856,861,870],{"type":40,"tag":196,"props":857,"children":858},{},[859],{"type":46,"value":860},"Multi-region HA (advanced)",{"type":40,"tag":196,"props":862,"children":863},{},[864],{"type":40,"tag":86,"props":865,"children":867},{"className":866},[],[868],{"type":46,"value":869},"\u003Cregion>.\u003Ccloud_provider>.api.temporal.io:7233",{"type":40,"tag":196,"props":871,"children":872},{},[873,875,882],{"type":46,"value":874},"Regional Endpoint - only needed for advanced HA routing. See ",{"type":40,"tag":110,"props":876,"children":879},{"href":877,"rel":878},"https:\u002F\u002Fdocs.temporal.io\u002Fcloud\u002Fnamespaces#access-namespaces",[114],[880],{"type":46,"value":881},"namespace access docs",{"type":46,"value":883},".",{"type":40,"tag":169,"props":885,"children":886},{},[887,892,901],{"type":40,"tag":196,"props":888,"children":889},{},[890],{"type":46,"value":891},"tcld \u002F Cloud Ops API",{"type":40,"tag":196,"props":893,"children":894},{},[895],{"type":40,"tag":86,"props":896,"children":898},{"className":897},[],[899],{"type":46,"value":900},"saas-api.tmprl.cloud",{"type":40,"tag":196,"props":902,"children":903},{},[904],{"type":46,"value":905},"Control plane",{"type":40,"tag":49,"props":907,"children":908},{},[909,914],{"type":40,"tag":70,"props":910,"children":911},{},[912],{"type":46,"value":913},"Exception:",{"type":46,"value":915}," Namespaces using Flexible Auth (pre-release) cannot use Namespace Endpoints yet.",{"type":40,"tag":756,"props":917,"children":920},{"className":918,"code":919,"language":46},[759],"Symptom: Can't connect to Temporal Cloud\n│\n├─ Check: Using Namespace Endpoint?\n│  ├─ Using regional endpoint (`*.api.temporal.io`) without HA need?\n│  │  └─ Switch to Namespace Endpoint (`\u003Cns>.\u003Cacct>.tmprl.cloud:7233`)\n│  ├─ Using old\u002Fstale endpoint format?\n│  │  └─ Switch to Namespace Endpoint\n│  └─ Endpoint looks correct → Continue\n│\n├─ Check: DNS resolution\n│  └─ nslookup \u003Chost-from-address>\n│     ├─ Fails → DNS issue (check network, VPN)\n│     └─ Succeeds → Continue\n│\n├─ Check: Port connectivity\n│  └─ nc -zv \u003Chost-from-address> 7233\n│     ├─ Fails → Firewall blocking port 7233\n│     └─ Succeeds → Continue\n│\n├─ Check: TLS handshake\n│  └─ openssl s_client -connect \u003Caddress>\n│     ├─ Fails → Certificate issue (see mTLS tree)\n│     └─ Succeeds → Continue\n│\n└─ Check: Temporal CLI test\n   └─ temporal workflow list --limit 1 --address ...\n      ├─ PERMISSION_DENIED → Check namespace name format\n      ├─ UNAUTHENTICATED → Certificate not accepted\n      └─ Works → Connection OK, issue elsewhere\n",[921],{"type":40,"tag":86,"props":922,"children":923},{"__ignoreMap":764},[924],{"type":46,"value":919},{"type":40,"tag":413,"props":926,"children":928},{"id":927},"ambiguous-runtime-errors",[929],{"type":46,"value":249},{"type":40,"tag":49,"props":931,"children":932},{},[933],{"type":46,"value":934},"Do not assume these are pure connectivity failures. Classify them by operation first.",{"type":40,"tag":161,"props":936,"children":937},{},[938,959],{"type":40,"tag":165,"props":939,"children":940},{},[941],{"type":40,"tag":169,"props":942,"children":943},{},[944,949,954],{"type":40,"tag":173,"props":945,"children":946},{},[947],{"type":46,"value":948},"Error text",{"type":40,"tag":173,"props":950,"children":951},{},[952],{"type":46,"value":953},"Common interpretations",{"type":40,"tag":173,"props":955,"children":956},{},[957],{"type":46,"value":958},"First discriminator",{"type":40,"tag":189,"props":960,"children":961},{},[962,983,1012],{"type":40,"tag":169,"props":963,"children":964},{},[965,973,978],{"type":40,"tag":196,"props":966,"children":967},{},[968],{"type":40,"tag":86,"props":969,"children":971},{"className":970},[],[972],{"type":46,"value":258},{"type":40,"tag":196,"props":974,"children":975},{},[976],{"type":46,"value":977},"wrong endpoint, network timeout, oversized payload, blocked execution path, client-side timeout",{"type":40,"tag":196,"props":979,"children":980},{},[981],{"type":46,"value":982},"Where in the flow does it occur?",{"type":40,"tag":169,"props":984,"children":985},{},[986,1002,1007],{"type":40,"tag":196,"props":987,"children":988},{},[989,994,996],{"type":40,"tag":86,"props":990,"children":992},{"className":991},[],[993],{"type":46,"value":266},{"type":46,"value":995}," \u002F ",{"type":40,"tag":86,"props":997,"children":999},{"className":998},[],[1000],{"type":46,"value":1001},"RESOURCE_EXHAUSTED: Workflow is busy",{"type":40,"tag":196,"props":1003,"children":1004},{},[1005],{"type":46,"value":1006},"operation-level contention, workload pressure, confusing user-facing error semantics",{"type":40,"tag":196,"props":1008,"children":1009},{},[1010],{"type":46,"value":1011},"Which operation returned it?",{"type":40,"tag":169,"props":1013,"children":1014},{},[1015,1024,1029],{"type":40,"tag":196,"props":1016,"children":1017},{},[1018],{"type":40,"tag":86,"props":1019,"children":1021},{"className":1020},[],[1022],{"type":46,"value":1023},"no pollers",{"type":40,"tag":196,"props":1025,"children":1026},{},[1027],{"type":46,"value":1028},"no connected workers, workers present but misconfigured, stale\u002Fmisleading metrics",{"type":40,"tag":196,"props":1030,"children":1031},{},[1032,1034,1039],{"type":46,"value":1033},"Does ",{"type":40,"tag":86,"props":1035,"children":1037},{"className":1036},[],[1038],{"type":46,"value":363},{"type":46,"value":1040}," show pollers?",{"type":40,"tag":49,"props":1042,"children":1043},{},[1044],{"type":46,"value":1045},"Use this decision sequence:",{"type":40,"tag":756,"props":1047,"children":1050},{"className":1048,"code":1049,"language":46},[759],"Symptom: ambiguous runtime error\n│\n├─ Check: Which operation returned the error?\n│  ├─ start \u002F signal \u002F update \u002F query request\n│  ├─ poll loop \u002F worker logs\n│  └─ UI \u002F metrics only\n│\n├─ Check: Is work reaching a task queue?\n│  ├─ No pollers listed\n│  │  └─ Treat as worker connectivity \u002F config until proven otherwise\n│  ├─ Pollers listed, backlog growing\n│  │  └─ Worker capacity \u002F tuning issue (out of scope for this skill)\n│  └─ Pollers listed, no backlog issue\n│     └─ Continue\n│\n├─ For `context deadline exceeded`\n│  ├─ Happens before any work starts\n│  │  └─ Check endpoint format, auth, proxy, DNS, firewall\n│  ├─ Happens on workflow start with large payloads\n│  │  └─ Consider payload size \u002F client timeout path\n│  └─ Happens during local execution \u002F queries\n│     └─ Consider blocked execution path, local activity, or client-side timeout\n│\n└─ For `workflow is busy`\n   ├─ Identify exact API \u002F operation\n   ├─ Check whether user is conflating this with a generic workflow failure\n   └─ Explain that the error class is operation-specific before prescribing fixes\n",[1051],{"type":40,"tag":86,"props":1052,"children":1053},{"__ignoreMap":764},[1054],{"type":46,"value":1049},{"type":40,"tag":49,"props":1056,"children":1057},{},[1058],{"type":46,"value":1059},"If the operation and surrounding signals still do not make the error interpretable, label it as ambiguous and gather more context before prescribing a fix.",{"type":40,"tag":49,"props":1061,"children":1062},{},[1063],{"type":46,"value":1064},"When responding, attach a confidence score from 1-10 to the proposed diagnosis or next step. Ambiguous cases should carry a low-confidence score and a narrow next check rather than a broad claimed fix.",{"type":40,"tag":413,"props":1066,"children":1068},{"id":1067},"sdk-snippet-review",[1069],{"type":46,"value":1070},"SDK Snippet Review",{"type":40,"tag":49,"props":1072,"children":1073},{},[1074],{"type":46,"value":1075},"When the user pastes SDK config, validate the config itself before suggesting lower-level networking checks.",{"type":40,"tag":49,"props":1077,"children":1078},{},[1079],{"type":40,"tag":70,"props":1080,"children":1081},{},[1082],{"type":46,"value":1083},"Review in this order:",{"type":40,"tag":1085,"props":1086,"children":1087},"ol",{},[1088,1093,1113,1126,1139],{"type":40,"tag":80,"props":1089,"children":1090},{},[1091],{"type":46,"value":1092},"Auth method: API key vs mTLS",{"type":40,"tag":80,"props":1094,"children":1095},{},[1096,1098,1103,1105,1111],{"type":46,"value":1097},"Address \u002F ",{"type":40,"tag":86,"props":1099,"children":1101},{"className":1100},[],[1102],{"type":46,"value":494},{"type":46,"value":1104},": should be Namespace Endpoint (",{"type":40,"tag":86,"props":1106,"children":1108},{"className":1107},[],[1109],{"type":46,"value":1110},"\u003Cns>.\u003Cacct>.tmprl.cloud:7233",{"type":46,"value":1112},") for most cases",{"type":40,"tag":80,"props":1114,"children":1115},{},[1116,1118,1124],{"type":46,"value":1117},"Namespace: full Cloud namespace format (",{"type":40,"tag":86,"props":1119,"children":1121},{"className":1120},[],[1122],{"type":46,"value":1123},"\u003Cnamespace>.\u003Caccount-id>",{"type":46,"value":1125},")",{"type":40,"tag":80,"props":1127,"children":1128},{},[1129,1131,1137],{"type":46,"value":1130},"TLS config: empty ",{"type":40,"tag":86,"props":1132,"children":1134},{"className":1133},[],[1135],{"type":46,"value":1136},"tls.Config{}",{"type":46,"value":1138}," is normal for API key auth; client cert\u002Fkey required for mTLS",{"type":40,"tag":80,"props":1140,"children":1141},{},[1142,1144,1150,1151,1157,1158,1164,1165,1171,1172],{"type":46,"value":1143},"Environment config: prefer ",{"type":40,"tag":86,"props":1145,"children":1147},{"className":1146},[],[1148],{"type":46,"value":1149},"TEMPORAL_ADDRESS",{"type":46,"value":260},{"type":40,"tag":86,"props":1152,"children":1154},{"className":1153},[],[1155],{"type":46,"value":1156},"TEMPORAL_NAMESPACE",{"type":46,"value":260},{"type":40,"tag":86,"props":1159,"children":1161},{"className":1160},[],[1162],{"type":46,"value":1163},"TEMPORAL_API_KEY",{"type":46,"value":260},{"type":40,"tag":86,"props":1166,"children":1168},{"className":1167},[],[1169],{"type":46,"value":1170},"TEMPORAL_TLS_CLIENT_CERT_PATH",{"type":46,"value":260},{"type":40,"tag":86,"props":1173,"children":1175},{"className":1174},[],[1176],{"type":46,"value":1177},"TEMPORAL_TLS_CLIENT_KEY_PATH",{"type":40,"tag":49,"props":1179,"children":1180},{},[1181],{"type":40,"tag":70,"props":1182,"children":1183},{},[1184],{"type":46,"value":1185},"Common snippet diagnoses:",{"type":40,"tag":76,"props":1187,"children":1188},{},[1189,1207,1219,1224],{"type":40,"tag":80,"props":1190,"children":1191},{},[1192,1194,1200,1202],{"type":46,"value":1193},"Using regional endpoint (",{"type":40,"tag":86,"props":1195,"children":1197},{"className":1196},[],[1198],{"type":46,"value":1199},"*.api.temporal.io",{"type":46,"value":1201},") when Namespace Endpoint would work → simplify to ",{"type":40,"tag":86,"props":1203,"children":1205},{"className":1204},[],[1206],{"type":46,"value":1110},{"type":40,"tag":80,"props":1208,"children":1209},{},[1210,1212,1217],{"type":46,"value":1211},"Empty ",{"type":40,"tag":86,"props":1213,"children":1215},{"className":1214},[],[1216],{"type":46,"value":494},{"type":46,"value":1218}," + Cloud namespace\u002Fauth → missing explicit Cloud endpoint",{"type":40,"tag":80,"props":1220,"children":1221},{},[1222],{"type":46,"value":1223},"API key without TLS enabled by the SDK\u002Fruntime → check SDK-specific Cloud guidance",{"type":40,"tag":80,"props":1225,"children":1226},{},[1227],{"type":46,"value":1228},"Old endpoint format (stale docs\u002Fexamples) → update to current Namespace Endpoint",{"type":40,"tag":49,"props":1230,"children":1231},{},[1232],{"type":46,"value":1233},"If the snippet is wrong, fix that first. Do not lead with DNS\u002FTLS debugging until the endpoint and namespace are plausible.",{"type":40,"tag":413,"props":1235,"children":1237},{"id":1236},"certificate-errors",[1238],{"type":46,"value":1239},"Certificate Errors",{"type":40,"tag":756,"props":1241,"children":1244},{"className":1242,"code":1243,"language":46},[759],"Symptom: x509 certificate errors\n│\n├─ \"certificate signed by unknown authority\"\n│  ├─ Is CA uploaded to namespace?\n│  │  └─ tcld namespace accepted-client-ca list --namespace \u003Cns>\n│  │     ├─ CA not listed → Add it:\n│  │     │  tcld namespace accepted-client-ca add \\\n│  │     │    --namespace \u003Cns> --ca-certificate-file ca.pem\n│  │     └─ CA listed → Cert not signed by that CA\n│  │        └─ Verify: openssl verify -CAfile ca.pem client.pem\n│  │\n│  └─ Self-signed cert without CA?\n│     └─ Must use CA-signed certs for Cloud\n│\n├─ \"certificate has expired\"\n│  ├─ Check expiry: openssl x509 -enddate -noout -in cert.pem\n│  └─ Generate new cert:\n│     tcld generate-certificates end-entity-certificate \\\n│       --organization \u003Corg> --validity-period 365d \\\n│       --ca-certificate-file ca.pem --ca-key-file ca.key \\\n│       --certificate-file client.pem --key-file client.key\n│\n├─ \"private key does not match\"\n│  └─ Wrong key file - verify match:\n│     openssl x509 -modulus -noout -in cert.pem | md5\n│     openssl rsa -modulus -noout -in key.pem | md5\n│\n└─ \"bad certificate\" from server\n   └─ Server rejected cert - CA not in accepted list\n      └─ tcld namespace accepted-client-ca list --namespace \u003Cns>\n",[1245],{"type":40,"tag":86,"props":1246,"children":1247},{"__ignoreMap":764},[1248],{"type":46,"value":1243},{"type":40,"tag":413,"props":1250,"children":1252},{"id":1251},"namespace-issues",[1253],{"type":46,"value":1254},"Namespace Issues",{"type":40,"tag":756,"props":1256,"children":1259},{"className":1257,"code":1258,"language":46},[759],"Symptom: namespace not found or access denied\n│\n├─ Check: Namespace name format\n│  ├─ Format: \u003Cnamespace-name>.\u003Caccount-id>\n│  ├─ Example: my-namespace.a1b2c3\n│  └─ Wrong format → Use full namespace name\n│\n├─ Check: Namespace exists\n│  └─ tcld namespace list\n│     └─ Not listed → Wrong account, or namespace not created\n│\n├─ Check: Address format\n│  ├─ Namespace Endpoint (recommended): \u003Cnamespace>.\u003Caccount>.tmprl.cloud:7233\n│  ├─ Regional Endpoint (HA only): \u003Cregion>.\u003Ccloud_provider>.api.temporal.io:7233\n│  └─ Using wrong or stale endpoint? → switch to Namespace Endpoint\n│\n└─ Check: User permissions\n   └─ tcld user list\n      └─ Verify user has access to namespace\n",[1260],{"type":40,"tag":86,"props":1261,"children":1262},{"__ignoreMap":764},[1263],{"type":46,"value":1258},{"type":40,"tag":413,"props":1265,"children":1267},{"id":1266},"worker-issues",[1268],{"type":46,"value":1269},"Worker Issues",{"type":40,"tag":49,"props":1271,"children":1272},{},[1273,1275,1280],{"type":46,"value":1274},"This skill diagnoses ",{"type":40,"tag":70,"props":1276,"children":1277},{},[1278],{"type":46,"value":1279},"Cloud connectivity issues",{"type":46,"value":1281}," for workers. Worker performance tuning, scaling, and deployment patterns are out of scope.",{"type":40,"tag":49,"props":1283,"children":1284},{},[1285,1289,1290,1295],{"type":40,"tag":70,"props":1286,"children":1287},{},[1288],{"type":46,"value":780},{"type":46,"value":782},{"type":40,"tag":110,"props":1291,"children":1293},{"href":112,"rel":1292},[114],[1294],{"type":46,"value":788},{"type":46,"value":1296}," - SDK connection setup",{"type":40,"tag":756,"props":1298,"children":1301},{"className":1299,"code":1300,"language":46},[759],"Symptom: Workers not picking up tasks\n│\n├─ Check: Are workers running?\n│  └─ Verify worker process is up, check logs for errors\n│\n├─ Check: Task queue status\n│  └─ temporal task-queue describe --task-queue \u003Cqueue>\n│     ├─ No pollers listed → Workers not connected (Cloud issue)\n│     │  ├─ Check task queue name matches\n│     │  ├─ Check namespace in worker config\n│     │  ├─ Verify SDK connection options (see env config docs)\n│     │  └─ Check for connection errors in logs\n│     │\n│     │  Note: if only metrics or dashboards say \"no pollers\", verify with CLI or another direct surface before concluding workers are absent.\n│     │\n│     ├─ Pollers listed but backlog growing\n│     │  └─ NOT a Cloud issue (worker scaling\u002Ftuning problem)\n│     │\n│     └─ Pollers listed, no backlog\n│        └─ Workers healthy, issue is elsewhere\n│\n├─ Check: DNS caching (common in K8s)\n│  └─ Stale DNS can cause workers to connect to wrong endpoint\n│     └─ Restart workers to refresh DNS\n│\n└─ Check: Rate limiting\n   └─ RESOURCE_EXHAUSTED in logs?\n      └─ See Rate Limiting section\n",[1302],{"type":40,"tag":86,"props":1303,"children":1304},{"__ignoreMap":764},[1305],{"type":46,"value":1300},{"type":40,"tag":49,"props":1307,"children":1308},{},[1309],{"type":40,"tag":70,"props":1310,"children":1311},{},[1312],{"type":46,"value":1313},"Scope clarification:",{"type":40,"tag":161,"props":1315,"children":1316},{},[1317,1333],{"type":40,"tag":165,"props":1318,"children":1319},{},[1320],{"type":40,"tag":169,"props":1321,"children":1322},{},[1323,1328],{"type":40,"tag":173,"props":1324,"children":1325},{},[1326],{"type":46,"value":1327},"Issue Type",{"type":40,"tag":173,"props":1329,"children":1330},{},[1331],{"type":46,"value":1332},"In Scope?",{"type":40,"tag":189,"props":1334,"children":1335},{},[1336,1349,1362],{"type":40,"tag":169,"props":1337,"children":1338},{},[1339,1344],{"type":40,"tag":196,"props":1340,"children":1341},{},[1342],{"type":46,"value":1343},"tcld login, certs, namespace, private connectivity",{"type":40,"tag":196,"props":1345,"children":1346},{},[1347],{"type":46,"value":1348},"Yes",{"type":40,"tag":169,"props":1350,"children":1351},{},[1352,1357],{"type":40,"tag":196,"props":1353,"children":1354},{},[1355],{"type":46,"value":1356},"Worker scaling, metrics, tuning, deployment",{"type":40,"tag":196,"props":1358,"children":1359},{},[1360],{"type":46,"value":1361},"No",{"type":40,"tag":169,"props":1363,"children":1364},{},[1365,1370],{"type":40,"tag":196,"props":1366,"children":1367},{},[1368],{"type":46,"value":1369},"\"Workers not picking up tasks\"",{"type":40,"tag":196,"props":1371,"children":1372},{},[1373],{"type":46,"value":1374},"Yes - diagnose, hand off if not a Cloud issue",{"type":40,"tag":413,"props":1376,"children":1378},{"id":1377},"ha-namespace-connectivity",[1379],{"type":46,"value":1380},"HA Namespace Connectivity",{"type":40,"tag":49,"props":1382,"children":1383},{},[1384,1388,1389],{"type":40,"tag":70,"props":1385,"children":1386},{},[1387],{"type":46,"value":780},{"type":46,"value":782},{"type":40,"tag":110,"props":1390,"children":1392},{"href":125,"rel":1391},[114],[1393],{"type":46,"value":129},{"type":40,"tag":49,"props":1395,"children":1396},{},[1397],{"type":46,"value":1398},"HA (multi-region) namespaces use a hierarchical DNS structure:",{"type":40,"tag":76,"props":1400,"children":1401},{},[1402,1415,1426],{"type":40,"tag":80,"props":1403,"children":1404},{},[1405,1407,1413],{"type":46,"value":1406},"Namespace endpoint: ",{"type":40,"tag":86,"props":1408,"children":1410},{"className":1409},[],[1411],{"type":46,"value":1412},"\u003Cns>.\u003Cacct>.tmprl.cloud",{"type":46,"value":1414}," (CNAME to active region)",{"type":40,"tag":80,"props":1416,"children":1417},{},[1418,1420],{"type":46,"value":1419},"Regional endpoint: ",{"type":40,"tag":86,"props":1421,"children":1423},{"className":1422},[],[1424],{"type":46,"value":1425},"\u003Cregion>.region.tmprl.cloud",{"type":40,"tag":80,"props":1427,"children":1428},{},[1429],{"type":46,"value":1430},"During failover, CNAME switches regions (15s TTL, ~30s convergence)",{"type":40,"tag":756,"props":1432,"children":1435},{"className":1433,"code":1434,"language":46},[759],"Symptom: HA namespace connectivity or failover issues\n│\n├─ Check: DNS resolution\n│  └─ nslookup \u003Cnamespace>.tmprl.cloud\n│     ├─ Should return CNAME → \u003Cregion>.region.tmprl.cloud\n│     └─ Then resolve to IP address\n│\n├─ Symptom: Clients not failing over\n│  ├─ Check: DNS caching\n│  │  ├─ TTL is 15s - clients should converge within 30s\n│  │  ├─ Some DNS resolvers cache longer\n│  │  └─ Fix: Restart workers to refresh DNS\n│  │\n│  └─ Check: SDK connection caching\n│     └─ Some SDKs cache connections - may need restart\n│\n├─ Symptom: PrivateLink not working after failover\n│  ├─ Check: Regional DNS override configured?\n│  │  └─ Need Route 53 private hosted zone for region.tmprl.cloud\n│  │     mapping regional endpoints to VPC endpoint IPs\n│  │\n│  └─ Check: Inter-region connectivity\n│     └─ Workers need Transit Gateway or VPC Peering to reach\n│        VPC endpoints in both regions\n│\n├─ Symptom: GCP Private Service Connect not working\n│  └─ NOT SUPPORTED: Private connectivity not yet offered for\n│     GCP Multi-region Namespaces\n│\n└─ Symptom: sa-east-1 region issues\n   └─ NOT SUPPORTED: sa-east-1 not available for Multi-region namespaces (because there are no other regions on the continent)\n",[1436],{"type":40,"tag":86,"props":1437,"children":1438},{"__ignoreMap":764},[1439],{"type":46,"value":1434},{"type":40,"tag":49,"props":1441,"children":1442},{},[1443],{"type":40,"tag":70,"props":1444,"children":1445},{},[1446],{"type":46,"value":1447},"Worker placement for HA:",{"type":40,"tag":76,"props":1449,"children":1450},{},[1451,1456],{"type":40,"tag":80,"props":1452,"children":1453},{},[1454],{"type":46,"value":1455},"Option A: Run workers in both regions continuously",{"type":40,"tag":80,"props":1457,"children":1458},{},[1459],{"type":46,"value":1460},"Option B: Single region + Transit Gateway\u002FVPC Peering for failover access",{"type":40,"tag":413,"props":1462,"children":1464},{"id":1463},"private-connectivity-issues",[1465],{"type":46,"value":1466},"Private Connectivity Issues",{"type":40,"tag":756,"props":1468,"children":1471},{"className":1469,"code":1470,"language":46},[759],"Symptom: PrivateLink or Private Service Connect not working\n│\n├─ AWS PrivateLink\n│  ├─ Check: VPC endpoint status\n│  │  └─ AWS Console → VPC → Endpoints → Status = available\n│  │\n│  ├─ Check: Security groups\n│  │  └─ Allow outbound to endpoint on port 7233\n│  │\n│  ├─ Check: DNS resolution\n│  │  └─ Should resolve to private IP (10.x or 172.x)\n│  │\n│  └─ Check: Connectivity rules\n│     ├─ tcld connectivity-rule list --namespace \u003Cns>\n│     └─ If needed, attach rules with:\n│        tcld namespace set-connectivity-rules --namespace \u003Cns> --connectivity-rule-ids \u003Cid>\n│\n├─ GCP Private Service Connect\n│  ├─ Check: PSC endpoint status\n│  │  └─ GCP Console → Network Services → Private Service Connect\n│  │\n│  ├─ Check: Firewall rules\n│  │  └─ Allow egress to PSC endpoint\n│  │\n│  └─ Check: DNS configuration\n│     └─ Cloud DNS zone for tmprl.cloud pointing to PSC\n│\n└─ General\n   └─ Verify rule details:\n      tcld connectivity-rule get --connectivity-rule-id \u003Cid>\n",[1472],{"type":40,"tag":86,"props":1473,"children":1474},{"__ignoreMap":764},[1475],{"type":46,"value":1470},{"type":40,"tag":413,"props":1477,"children":1479},{"id":1478},"rate-limiting",[1480],{"type":46,"value":395},{"type":40,"tag":756,"props":1482,"children":1485},{"className":1483,"code":1484,"language":46},[759],"Symptom: RESOURCE_EXHAUSTED errors\n│\n├─ Check: Which operation is limited?\n│  └─ Error message indicates operation type\n│\n├─ \"namespace write ops\" exceeded\n│  ├─ Too many workflow starts\n│  ├─ Too many signals\u002Fupdates\n│  └─ Fix: Add backoff, batch operations\n│\n├─ \"namespace read ops\" exceeded\n│  ├─ Too many list\u002Fquery operations\n│  └─ Fix: Add caching, reduce polling frequency\n│\n└─ Poll operations rate limited\n   ├─ Too many pollers across workers\n   └─ Fix: Reduce MaxConcurrentPollers settings\n",[1486],{"type":40,"tag":86,"props":1487,"children":1488},{"__ignoreMap":764},[1489],{"type":46,"value":1484},{"type":40,"tag":55,"props":1491,"children":1493},{"id":1492},"common-scenarios",[1494],{"type":46,"value":1495},"Common Scenarios",{"type":40,"tag":49,"props":1497,"children":1498},{},[1499,1500,1505],{"type":46,"value":84},{"type":40,"tag":86,"props":1501,"children":1503},{"className":1502},[],[1504],{"type":46,"value":103},{"type":46,"value":1506}," for step-by-step walkthroughs:",{"type":40,"tag":76,"props":1508,"children":1509},{},[1510,1515,1520,1525],{"type":40,"tag":80,"props":1511,"children":1512},{},[1513],{"type":46,"value":1514},"API key connectivity setup",{"type":40,"tag":80,"props":1516,"children":1517},{},[1518],{"type":46,"value":1519},"New namespace setup (mTLS)",{"type":40,"tag":80,"props":1521,"children":1522},{},[1523],{"type":46,"value":1524},"Certificate rotation",{"type":40,"tag":80,"props":1526,"children":1527},{},[1528],{"type":46,"value":1529},"Switching from mTLS to API keys",{"type":40,"tag":55,"props":1531,"children":1533},{"id":1532},"common-pitfalls",[1534],{"type":46,"value":1535},"Common Pitfalls",{"type":40,"tag":161,"props":1537,"children":1538},{},[1539,1560],{"type":40,"tag":165,"props":1540,"children":1541},{},[1542],{"type":40,"tag":169,"props":1543,"children":1544},{},[1545,1550,1555],{"type":40,"tag":173,"props":1546,"children":1547},{},[1548],{"type":46,"value":1549},"Pitfall",{"type":40,"tag":173,"props":1551,"children":1552},{},[1553],{"type":46,"value":1554},"Why It Happens",{"type":40,"tag":173,"props":1556,"children":1557},{},[1558],{"type":46,"value":1559},"Fix",{"type":40,"tag":189,"props":1561,"children":1562},{},[1563,1593,1611,1641,1664,1682,1712,1734,1752],{"type":40,"tag":169,"props":1564,"children":1565},{},[1566,1571,1582],{"type":40,"tag":196,"props":1567,"children":1568},{},[1569],{"type":46,"value":1570},"Wrong namespace format",{"type":40,"tag":196,"props":1572,"children":1573},{},[1574,1576],{"type":46,"value":1575},"Using short name instead of ",{"type":40,"tag":86,"props":1577,"children":1579},{"className":1578},[],[1580],{"type":46,"value":1581},"name.account-id",{"type":40,"tag":196,"props":1583,"children":1584},{},[1585,1587],{"type":46,"value":1586},"Use full namespace from ",{"type":40,"tag":86,"props":1588,"children":1590},{"className":1589},[],[1591],{"type":46,"value":1592},"tcld namespace list",{"type":40,"tag":169,"props":1594,"children":1595},{},[1596,1601,1606],{"type":40,"tag":196,"props":1597,"children":1598},{},[1599],{"type":46,"value":1600},"Self-signed certs",{"type":40,"tag":196,"props":1602,"children":1603},{},[1604],{"type":46,"value":1605},"Trying to use self-signed without CA",{"type":40,"tag":196,"props":1607,"children":1608},{},[1609],{"type":46,"value":1610},"Generate CA first, sign certs with it, upload CA",{"type":40,"tag":169,"props":1612,"children":1613},{},[1614,1619,1631],{"type":40,"tag":196,"props":1615,"children":1616},{},[1617],{"type":46,"value":1618},"Regional endpoint when unnecessary",{"type":40,"tag":196,"props":1620,"children":1621},{},[1622,1624,1629],{"type":46,"value":1623},"Using ",{"type":40,"tag":86,"props":1625,"children":1627},{"className":1626},[],[1628],{"type":46,"value":1199},{"type":46,"value":1630}," when Namespace Endpoint works",{"type":40,"tag":196,"props":1632,"children":1633},{},[1634,1636],{"type":46,"value":1635},"Switch to ",{"type":40,"tag":86,"props":1637,"children":1639},{"className":1638},[],[1640],{"type":46,"value":842},{"type":40,"tag":169,"props":1642,"children":1643},{},[1644,1649,1654],{"type":40,"tag":196,"props":1645,"children":1646},{},[1647],{"type":46,"value":1648},"Old endpoint docs",{"type":40,"tag":196,"props":1650,"children":1651},{},[1652],{"type":46,"value":1653},"Following stale examples from before Namespace Endpoints were universal",{"type":40,"tag":196,"props":1655,"children":1656},{},[1657,1659],{"type":46,"value":1658},"Use Namespace Endpoint: ",{"type":40,"tag":86,"props":1660,"children":1662},{"className":1661},[],[1663],{"type":46,"value":1110},{"type":40,"tag":169,"props":1665,"children":1666},{},[1667,1672,1677],{"type":40,"tag":196,"props":1668,"children":1669},{},[1670],{"type":46,"value":1671},"Expired certs",{"type":40,"tag":196,"props":1673,"children":1674},{},[1675],{"type":46,"value":1676},"Not monitoring expiry",{"type":40,"tag":196,"props":1678,"children":1679},{},[1680],{"type":46,"value":1681},"Set up alerts, rotate before expiry",{"type":40,"tag":169,"props":1683,"children":1684},{},[1685,1690,1695],{"type":40,"tag":196,"props":1686,"children":1687},{},[1688],{"type":46,"value":1689},"tcld wrong account",{"type":40,"tag":196,"props":1691,"children":1692},{},[1693],{"type":46,"value":1694},"Logged into different org",{"type":40,"tag":196,"props":1696,"children":1697},{},[1698,1700,1705,1707],{"type":46,"value":1699},"Use ",{"type":40,"tag":86,"props":1701,"children":1703},{"className":1702},[],[1704],{"type":46,"value":217},{"type":46,"value":1706},", then verify the namespace in ",{"type":40,"tag":86,"props":1708,"children":1710},{"className":1709},[],[1711],{"type":46,"value":1592},{"type":40,"tag":169,"props":1713,"children":1714},{},[1715,1720,1725],{"type":40,"tag":196,"props":1716,"children":1717},{},[1718],{"type":46,"value":1719},"Stale tcld login",{"type":40,"tag":196,"props":1721,"children":1722},{},[1723],{"type":46,"value":1724},"Cached auth state is no longer valid",{"type":40,"tag":196,"props":1726,"children":1727},{},[1728],{"type":40,"tag":86,"props":1729,"children":1731},{"className":1730},[],[1732],{"type":46,"value":1733},"tcld logout && tcld login",{"type":40,"tag":169,"props":1735,"children":1736},{},[1737,1742,1747],{"type":40,"tag":196,"props":1738,"children":1739},{},[1740],{"type":46,"value":1741},"DNS caching",{"type":40,"tag":196,"props":1743,"children":1744},{},[1745],{"type":46,"value":1746},"K8s pods caching old DNS",{"type":40,"tag":196,"props":1748,"children":1749},{},[1750],{"type":46,"value":1751},"Restart pods after endpoint changes",{"type":40,"tag":169,"props":1753,"children":1754},{},[1755,1760,1765],{"type":40,"tag":196,"props":1756,"children":1757},{},[1758],{"type":46,"value":1759},"Missing port",{"type":40,"tag":196,"props":1761,"children":1762},{},[1763],{"type":46,"value":1764},"Firewall blocks 7233",{"type":40,"tag":196,"props":1766,"children":1767},{},[1768],{"type":46,"value":1769},"Ensure egress allowed on port 7233",{"type":40,"tag":55,"props":1771,"children":1773},{"id":1772},"tips",[1774],{"type":46,"value":1775},"Tips",{"type":40,"tag":76,"props":1777,"children":1778},{},[1779,1789,1799,1816,1826,1836,1846,1856],{"type":40,"tag":80,"props":1780,"children":1781},{},[1782,1787],{"type":40,"tag":70,"props":1783,"children":1784},{},[1785],{"type":46,"value":1786},"Always get the exact error message",{"type":46,"value":1788}," - Copy-paste, don't paraphrase",{"type":40,"tag":80,"props":1790,"children":1791},{},[1792,1797],{"type":40,"tag":70,"props":1793,"children":1794},{},[1795],{"type":46,"value":1796},"Check the simple things first",{"type":46,"value":1798}," - DNS, port connectivity, cert expiry",{"type":40,"tag":80,"props":1800,"children":1801},{},[1802,1807,1809,1814],{"type":40,"tag":70,"props":1803,"children":1804},{},[1805],{"type":46,"value":1806},"Use Namespace Endpoint by default",{"type":46,"value":1808}," - ",{"type":40,"tag":86,"props":1810,"children":1812},{"className":1811},[],[1813],{"type":46,"value":1110},{"type":46,"value":1815}," works for both mTLS and API key auth",{"type":40,"tag":80,"props":1817,"children":1818},{},[1819,1824],{"type":40,"tag":70,"props":1820,"children":1821},{},[1822],{"type":46,"value":1823},"Use openssl for cert issues",{"type":46,"value":1825}," - It gives clearer error messages than SDKs",{"type":40,"tag":80,"props":1827,"children":1828},{},[1829,1834],{"type":40,"tag":70,"props":1830,"children":1831},{},[1832],{"type":46,"value":1833},"tcld account get is your friend",{"type":46,"value":1835}," - Shows the current account context",{"type":40,"tag":80,"props":1837,"children":1838},{},[1839,1844],{"type":40,"tag":70,"props":1840,"children":1841},{},[1842],{"type":46,"value":1843},"Namespace names are case-sensitive",{"type":46,"value":1845}," - Match exactly",{"type":40,"tag":80,"props":1847,"children":1848},{},[1849,1854],{"type":40,"tag":70,"props":1850,"children":1851},{},[1852],{"type":46,"value":1853},"API keys are easier than mTLS",{"type":46,"value":1855}," - Consider for simpler setups",{"type":40,"tag":80,"props":1857,"children":1858},{},[1859,1864,1865,1870],{"type":40,"tag":70,"props":1860,"children":1861},{},[1862],{"type":46,"value":1863},"Point users to env config docs",{"type":46,"value":1808},{"type":40,"tag":110,"props":1866,"children":1868},{"href":112,"rel":1867},[114],[1869],{"type":46,"value":788},{"type":46,"value":1871}," covers all SDK connection options",{"items":1873,"total":24},[1874,1891,1898,1916,1944],{"slug":1875,"name":1875,"fn":1876,"description":1877,"org":1878,"tags":1879,"stars":1888,"repoUrl":1889,"updatedAt":1890},"temporal-developer","develop Temporal workflows and activities","Develop, debug, and manage Temporal applications across Python, TypeScript, Go, Java, .NET, Ruby, and Rust. Use when the user is building workflows, activities, or workers with a Temporal SDK, debugging issues like non-determinism errors, stuck workflows, or activity retries, using Temporal CLI, Temporal Server, or Temporal Cloud, or working with durable execution concepts like signals, queries, heartbeats, versioning, continue-as-new, child workflows, or saga patterns. Also use when the user mentions \"run a Temporal workflow from the CLI\", \"start a dev server\", \"run temporal server start-dev\", \"temporal workflow start\", \"temporal workflow execute\", \"temporal workflow signal\", \"temporal workflow query\", \"temporal workflow update\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1880,1883,1884,1885],{"name":1881,"slug":1882,"type":16},"Backend","backend",{"name":22,"slug":23,"type":16},{"name":9,"slug":8,"type":16},{"name":1886,"slug":1887,"type":16},"Workflow Automation","workflow-automation",201,"https:\u002F\u002Fgithub.com\u002Ftemporalio\u002Fskill-temporal-developer","2026-04-06T18:54:23.154697",{"slug":4,"name":4,"fn":5,"description":6,"org":1892,"tags":1893,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1894,1895,1896,1897],{"name":19,"slug":20,"type":16},{"name":22,"slug":23,"type":16},{"name":14,"slug":15,"type":16},{"name":9,"slug":8,"type":16},{"slug":1899,"name":1899,"fn":1900,"description":1901,"org":1902,"tags":1903,"stars":1913,"repoUrl":1914,"updatedAt":1915},"temporal-workflow-design-critic","audit Temporal workflow designs","Critique, audit, or score a Temporal workflow design for correctness, production readiness, and best-practice compliance. Use when asked to review a Temporal architecture, evaluate whether a design is production ready, identify anti-patterns or risks, assess Temporal fitness for a use case, or give a design a thumbs up\u002Fdown. Not for writing or debugging Temporal code — use temporal-developer for that.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1904,1907,1910],{"name":1905,"slug":1906,"type":16},"Architecture","architecture",{"name":1908,"slug":1909,"type":16},"Code Review","code-review",{"name":1911,"slug":1912,"type":16},"Engineering","engineering",4,"https:\u002F\u002Fgithub.com\u002Ftemporalio\u002Fskill-temporal-design","2026-05-23T06:01:03.120182",{"slug":1917,"name":1917,"fn":1918,"description":1919,"org":1920,"tags":1921,"stars":1941,"repoUrl":1942,"updatedAt":1943},"temporal-workertuning","tune Temporal worker performance","Tune Temporal Worker performance across Go, Java, TypeScript, Python, and .NET. Use when the user asks to \"configure slot suppliers\", \"set up a worker tuner\", \"enable poller autoscaling\", \"tune worker cache\", \"fix high schedule-to-start latency\", \"diagnose worker bottlenecks\", \"right-size workers for production\", \"choose between fixed-size and resource-based slot suppliers\", \"configure maxConcurrentWorkflowTaskExecutionSize\", \"set up resource-based tuner\", \"interpret worker_task_slots_available\", \"reduce schedule_to_start_latency\", \"scale worker fleet\", \"configure sticky cache\", or mentions Worker tuning, Worker performance, slot suppliers, composite tuners, or poller autoscaling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1922,1925,1928,1931,1934,1937,1938],{"name":1923,"slug":1924,"type":16},".NET","net",{"name":1926,"slug":1927,"type":16},"Go","go",{"name":1929,"slug":1930,"type":16},"Java","java",{"name":1932,"slug":1933,"type":16},"Performance","performance",{"name":1935,"slug":1936,"type":16},"Python","python",{"name":9,"slug":8,"type":16},{"name":1939,"slug":1940,"type":16},"TypeScript","typescript",2,"https:\u002F\u002Fgithub.com\u002Ftemporalio\u002Fskill-temporal-workertuning","2026-06-12T08:06:29.755112",{"slug":1945,"name":1945,"fn":1946,"description":1947,"org":1948,"tags":1949,"stars":1962,"repoUrl":1963,"updatedAt":1964},"temporal-observability","collect and query Temporal metrics","Instrument, collect, query, and alert on Temporal metrics across Temporal Cloud and self-hosted deployments. Covers Cloud OpenMetrics endpoint, SDK metrics, third-party integrations (Datadog, Grafana, New Relic, Prometheus, OTel Collector, ClickStack), worker fleet health, and PromQL v0-to-v1 migration. Use when the user mentions: \"Temporal metrics\", \"Temporal monitoring\", \"Temporal observability\", \"Temporal alerting\", \"Datadog Temporal\", \"Grafana Temporal\", \"Cloud metrics endpoint\", \"metrics.temporal.io\", \"SDK metrics\", \"worker backlog\", \"scrape Temporal metrics\", \"OpenMetrics\", \"PromQL migration\". Not for writing Workflows\u002FActivities (temporal-developer), Worker tuning (temporal-workertuning), or Cloud admin (temporal-cloud\u002Ftemporal-ops).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1950,1953,1956,1959],{"name":1951,"slug":1952,"type":16},"Datadog","datadog",{"name":1954,"slug":1955,"type":16},"Metrics","metrics",{"name":1957,"slug":1958,"type":16},"Monitoring","monitoring",{"name":1960,"slug":1961,"type":16},"Observability","observability",1,"https:\u002F\u002Fgithub.com\u002Ftemporalio\u002Fskill-temporal-observability","2026-06-09T07:35:44.598916",{"items":1966,"total":1962},[1967],{"slug":4,"name":4,"fn":5,"description":6,"org":1968,"tags":1969,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1970,1971,1972,1973],{"name":19,"slug":20,"type":16},{"name":22,"slug":23,"type":16},{"name":14,"slug":15,"type":16},{"name":9,"slug":8,"type":16}]