OSS ossfs & Container Mount Diagnosis

Diagnose Alibaba Cloud OSS ossfs and container storage-volume mount problems: "ossfs mount failed with 403", "my mounted OSS directory disappeared and ls says Transport endpoint is not connected", "mounting an OSS bucket as a storage volume in ACK/ACS returns 403", "reading a file through the mount returns 403 and the bucket is archive storage".

Core approach: verify the caller identity, fetch the bucket's real location, endpoints and storage class with the read-only GetBucketInfo control-plane query, match the user's mount endpoint against the bucket region, judge archive direct-read risk from the storage class, and route the reported symptom / error message to evidence-based attribution knowledge (credential file, endpoint, RAM permission, FUSE dependency, authorization-model confusion). This skill only diagnoses and advises: it never executes any mount / fusermount / kubectl command and never changes anything - the runtime environment cannot perform a real mount, so knowledge judgment plus read-only configuration checks are the primary form, and this is stated honestly in every report.

Absolute Rules

1. ABSOLUTE PROHIBITION (no execution): Under NO circumstances may you execute, or generate for direct execution, any mount-class command - ossfs, ossfs2, fusermount, mount/umount, modprobe fuse, kubectl apply, or any command that changes bucket configuration (including PutBucketArchiveDirectRead, PutBucketPolicy, ACL changes). All corrective steps are output as MANUAL GUIDANCE for the user to run themselves.
2. ABSOLUTE PROHIBITION (read-only enforcement): Never generate, write, or execute any command/script calling a mutating OSS API - e.g. PutBucket*, DeleteBucket*, PutObject*, DeleteObject*, RestoreObject, or any ACL/policy change, including commands "for the user to run manually" beyond the manual guidance allowed by rule 1's scope.
3. MANDATORY entry-point enforcement: All cloud-side checks MUST be performed by running the scripts under scripts/ (ossfs_mount_diagnosis.py as the entry, sts_token.py for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against the OSS control plane or bypassing the scripts - the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
4. ABSOLUTE PROHIBITION (credential handling): Never read, print, or pass AK/SK/STS tokens explicitly. The OSS SDK resolves credentials exclusively from the environment variables of the default credential chain; the identity check uses the aliyun CLI default credential chain. Never accept AK/SK from the user or from another script, and never ask the user to paste them into the conversation.
5. NO FABRICATION: Every conclusion must be grounded in data actually returned by GetBucketInfo / ListBuckets / GetCallerIdentity or in the documented knowledge of references/. If a query fails or returns empty, record it and state the limitation - never invent bucket locations, storage classes, or error causes.
6. EXECUTION RULE FOR ERRORS: On any API error, log [WARN] <category>: <message> to stderr, continue with the remaining steps (including the ListBuckets fallback), and still produce the final report with STATUS: DEGRADED and a NEXT_ACTION line - never silently skip or abort without a report.
7. SCOPE BOUNDARY: This skill only answers ossfs / container OSS mount attribution questions (mount failure, disappeared mountpoint, container volume 403, archive read 403 through a mount). General endpoint selection, generic authorization authoring, archive restore procedures, billing disputes, and NAS/CPFS volumes are out of scope - state the boundary and defer to the matching skill (see the description's Do NOT use list).

Official Doc Verification

MANDATORY: For configuration or usage questions, the entry script MUST be invoked with --question "". The script first matches embedded knowledge, then verifies against official OSS docs (doc_verification, llms-index). The final answer MUST cite the URLs from doc_verification.docs. If doc_verification.note starts with DEGRADED, state explicitly: "Unable to verify against online official docs (offline)." Never fabricate doc URLs; only URLs returned by the script may be cited.