olares-cli shared rules

Foundation for every other olares-cli skill. Every business verb under cluster / files / market / settings / dashboard rides the active profile's token. Read this first.

This skill also hosts the cross-skill platform model in references/olares-platform.md — the userspace storage model, uid-1000 run identity, system-managed drive/Home dirs, app/namespace & networking, system middleware, and version/semver. files / chart / cluster link there (one hop) instead of re-describing it. That reference is pure platform model and needs no login.

Source of truth for flags & syntax is always olares-cli profile --help. This file only carries what --help cannot give: the profile mental model, agent-driven login flow, token-storage backends, refresh semantics, and the error → fix matrix.

When to use

• First time operating on an Olares / a given Olares ID (not logged in yet) — set up the profile
• Switching identity between several Olares IDs
• Any olares-cli command failed with an auth error (token invalidated / not logged in / 2FA required)
• Keywords: Olares ID, profile, login, 2FA/TOTP, refresh token, keychain, server rejected the access token, refresh token ... became invalid, no access token, already authenticated

Skill suite map (routing source of truth)

The olares-cli skills ship and install as one suite; each owns a distinct slice. This is the canonical intent->skill map — a skill's own ## When to use lists its scope and points here for everything else.