Read and invoke: /mnt/skills/user/gitops-project-catalog/SKILL.md

Provide context:
- Tenant name
- GitHub repository URL(s) for source whitelisting
- Target namespaces and clusters
- Azure Entra ID group for RBAC
- Any custom resource restrictions

Read and invoke: /mnt/skills/user/gitops-system-apps/SKILL.md

Provide context:
- Tenant name
- Environments (dev/staging/prod)
- Namespace requirements
- External Secrets requirements
- Datadog monitoring needs
- cert-manager certificate requirements
- Kong API Gateway route requirements

Read and invoke: /mnt/skills/user/gitops-tenant-catalogs/SKILL.md

Provide context:
- Tenant name
- Self-service repository URL
- Environments
- ArgoCD Project name (from step 3a)
- Git generator path patterns
- Sync policies

# Tenant Onboarding Complete: {tenant_name}

## ✅ Resources Created

### 1. ArgoCD Project
- **Location**: `project-catalog/{tenant-name}/project.yaml`
- **Project Name**: `{tenant-name}`
- **Source Repos**: {list repos}
- **Destinations**: {list clusters and namespaces}
- **RBAC Group**: {azure-entra-group}

### 2. System Resources
- **Namespaces**: {list namespaces per environment}
- **External Secrets**: {list ESO resources created}
- **Datadog**: {monitoring configuration}
- **Certificates**: {cert-manager resources if applicable}
- **Kong Routes**: {API gateway routes if applicable}

### 3. Tenant ApplicationSets
- **Location**: `tenant-catalogs/{tenant-name}/appset.yaml`
- **Generator Type**: Git (SCM Provider or Git Files)
- **Source Repo**: {self-service-repo}
- **Sync Policy**: {manual or automated}

## 📋 Next Steps for Platform Team

1. **Review and commit changes**
   ```bash
   cd project-catalog && git add . && git commit -m "Add {tenant-name} project"
   cd ../system-apps && git add . && git commit -m "Add {tenant-name} system resources"
   cd ../tenant-catalogs && git add . && git commit -m "Add {tenant-name} appset"

# Check ArgoCD Project
argocd proj get {tenant-name}

# List tenant applications
argocd app list --project {tenant-name}

# Verify namespaces
kubectl get ns | grep {tenant-name}

# Check ApplicationSet generation
kubectl get appset -n argocd {tenant-name} -o yaml

# View External Secrets status
kubectl get externalsecret -n {tenant-name}-dev

## Error Handling

If any step fails:

1. **Stop the workflow** - don't proceed to subsequent steps
2. **Report the specific error** with context about which sub-skill failed
3. **Provide troubleshooting guidance** based on the error
4. **Suggest rollback steps** if partial resources were created
5. **Offer to retry** once the issue is resolved

Common error scenarios:

- **Git conflicts**: Tenant already exists in one repository
- **Validation failures**: Invalid tenant name, repo URL, etc.
- **Azure integration**: Entra ID group doesn't exist
- **Permission issues**: Cannot access repositories

## Example Invocations

### Example 1: Basic Onboarding

**User Input:**

**Your Actions:**
1. Parse: tenant_name="foo-bar", github_user="dudick123", repo="https://github.com/dudick123/platform-generator"
2. Use defaults: environments=["dev","staging","prod"], azure_group="aks-foo-bar-devs"
3. Invoke gitops-project-catalog skill
4. Invoke gitops-system-apps skill
5. Invoke gitops-tenant-catalogs skill
6. Generate summary

### Example 2: Custom Requirements

**User Input:**

**Your Actions:**
1. Parse custom requirements
2. Pass specific configurations to each sub-skill
3. Ensure Kong routes are configured in system-apps
4. Specify Key Vault in External Secrets config
5. Use custom Azure AD group name

## Best Practices

1. **Always read sub-skill documentation** before invoking them
2. **Validate inputs thoroughly** before starting the workflow
3. **Be explicit about defaults** when presenting summaries
4. **Include troubleshooting commands** in every summary
5. **Provide context** to sub-skills about related resources
6. **Use consistent naming conventions** across all resources
7. **Generate Git-ready YAML** that can be committed immediately

## Naming Conventions

- **Tenant names**: lowercase, kebab-case (e.g., "foo-bar")
- **ArgoCD Projects**: same as tenant name
- **Namespaces**: `{tenant-name}-{environment}` (e.g., "foo-bar-dev")
- **Azure Entra ID groups**: `aks-{tenant-name}-devs`
- **ApplicationSet names**: same as tenant name
- **Files**: `{tenant-name}/project.yaml`, `{tenant-name}/appset.yaml`

## Integration with Existing Tools

The platform has existing automation tools:

- **Python CLI (Typer)**: Used for tenant onboarding automation
- **Pydantic validation**: For configuration validation
- **Azure DevOps integration**: For repository creation
- **ServiceNow integration**: For change management (optional for onboarding)

When generating resources, ensure they're compatible with these existing tools and can be integrated into automated workflows if needed.

## Success Criteria

A successful onboarding produces:

✅ Valid ArgoCD Project in project-catalog repository
✅ Complete system resources in system-apps repository  
✅ Working ApplicationSet in tenant-catalogs repository
✅ All YAML files pass validation (valid Kubernetes resources)
✅ No conflicts with existing tenants
✅ Clear next steps for both platform team and tenant
✅ Troubleshooting commands for common issues

---

Remember: Your role is orchestration and coordination. Delegate the technical details to the specialized sub-skills, but maintain oversight of the entire workflow and ensure all pieces work together cohesively.