Bailian managed agent IaC (bl managed-agent)

CRITICAL — Before executing, MUST read the shared protocol in ../bailian-protocol/SKILL.md: Version & updates (pre-flight checklist) and CLI errors: report an issue. Command details are authoritative in reference/managed-agent.md and bl managed-agent --help — do not guess flags. If that protocol file is missing, stop and run npx skills add modelstudioai/cli --all -g; do not guess auth/consent.

Safety guardrail (the most important rule)

apply / destroy mutate remote resources and only execute when --yes is passed:

1. Always run bl managed-agent plan first and show the diff to the user.
2. Only after explicit user confirmation, retry apply / destroy with --yes.
3. Never add --yes on your own initiative before the user has confirmed.

IaC lifecycle