PlanetScale safe orchestrator (master skill)

Purpose

Run the complete PlanetScale safe best-practices skill pack end to end. Load and execute each sub-skill in order, accumulate evidence, and produce one unified recommendations report. The first pass is assessment-only.

Non-negotiable safety contract

Default to read-only.

You may inspect configuration, branches, query telemetry, recommendations, webhooks, roles, backups, traffic budgets, and repository code. You must not mutate PlanetScale, the database, the repository, the network posture, credentials, schema, production traffic controls, or automation endpoints without explicit approval of a named change set.

Class C/D/E mutations require approval per ../11-change-gates-and-approval-contract/SKILL.md. When in doubt, stop and add to the proposed change set instead of executing.

One exception exists: if the operator explicitly acknowledges the risk and names a scope per ../13-autonomous-execution-mode/SKILL.md, execution proceeds autonomously under that skill's status and halt discipline instead of stopping for per-change approval. The assessment phases below are identical either way.

Sub-skills are sibling folders next to this skill (for example ../01-readonly-inventory/SKILL.md). Some installers rename skill folders to their frontmatter name (for example planetscale-readonly-inventory instead of 01-readonly-inventory); if a referenced numbered path does not exist, locate the sibling skill whose frontmatter name matches and use it instead.

Ground all CLI and API usage in the official documentation rather than guessing: the docs index is at https://planetscale.com/docs/llms.txt (append .md to any docs URL for the markdown version) and the API reference is https://planetscale.com/docs/openapi.yaml. When a command or endpoint fails, check the docs for the correct form before recording an evidence gap. Tooling and access failures belong in the internal run log, never in the customer report.