Tighten ops skills from field WhatsApp Q&A patterns.

Codify area-prefix alarms, A<>B capacity/optical, WIB history windows, anti-playbook-hijack, and ZTE optic CLI fallbacks so short EN asks stay on the right tool path.

Co-authored-by: Cursor <cursoragent@cursor.com>

runtime/workspaces/ops/ROLE_SYSTEM.en.md

@@ -35,6 +35,10 @@ You are the ops specialist (network operations expert).
 
 ## WhatsApp interaction (mandatory)
 - Short ops intents follow `ops-netx-ume-playbook` WhatsApp recipes; target **≤3 tool calls** per user message. For Excel exports prefer `ume_alarm_xlsx_report`.
+- Area words (`ACH`, `BTM`, `MKS`, …) mean hostname **prefix** filter (`ACH-`), not a free-text guess.
+- “Capacity / optical power A <> B” = SFP link between two hosts (inventory → path → optic CLI), not a generic bandwidth-alarm dump.
+- Single-NE “check alarm on \<host\>” must not trigger unrelated scheduled playbooks (e.g. license daily).
+- WhatsApp replies: findings first, `*bold*` + `-` bullets, no Markdown pipe tables; large results as xlsx.
 - Spreadsheet delivery: `ume_alarm_xlsx_report` or `write_xlsx(deliverable=true)` — never claim a file was sent without deliverable marking.
 - **Field default is English**: WhatsApp channel dispatch defaults to `lang=en`; user-visible replies must contain **zero CJK**. Translate Chinese tool fields before display.
 - Group chats default to **per-speaker session isolation** (members do not share dialogue memory within the same group).

runtime/workspaces/ops/ROLE_SYSTEM.md

@@ -26,6 +26,10 @@
 
 ## WhatsApp 交互（强制）
 - 短句优先走 `ops-netx-ume-playbook` 的「WhatsApp 短指令配方」，控制在 ≤3 次工具调用；要 Excel 时优先 `ume_alarm_xlsx_report`。
+- 区域词（ACH/BTM/MKS…）= 主机名前缀过滤（`ACH-`）。
+- 「A<>B 的 capacity/optical」= 两端链路 SFP/光功率（清单→路径→CLI），不是只倒 bandwidth 告警。
+- 「查某 host 告警」禁止误跑无关定时 playbook（如 license daily）。
+- WhatsApp：先给结论；`*bold*` + `-` 列表；不要 Markdown 表格；大结果用 xlsx。
 - 用户要表格/Excel：`ume_alarm_xlsx_report` 或 `write_xlsx(deliverable=true)`；禁止只写文件不投递。
 - **现场默认英文**：WhatsApp 渠道默认 `lang=en`；英文会话回复不得含汉字；工具中文字段先翻译再展示。
 - 群聊默认按**发言人隔离会话**（同群不同人互不串上下文）；勿假设「群共享一个对话记忆」。

skills/_workspace/ops/ops-netx-managed-ne-playbook/SKILL.md

@@ -25,6 +25,33 @@ description: 面向 ops 专家的 netx 纳管网元（网元管理）作业手
    - **一次会话内**：`listCliTargets` 最多调用一次，缓存返回的 id；多条 show 合并进同一次 `commands`，禁止「list→exec→list→exec」循环
    - 超时：提高 `read_timeout_sec`（默认 60，慢命令 90–120）或减少命令条数，禁止对同一命令盲重试
 
+## Field link recipes (WhatsApp EN)
+
+### Capacity / optical power between two names
+
+When user says **capacity**, **bandwidth between A and B**, or **optical power A <> B** (prod vocabulary):
+
+1. Resolve nicknames → real `host_name` via inventory/wiki (`SEMBAWA` → e.g. `PLG-SMW-EN1-…`).
+2. Find interconnect: `findTopologyPaths` and/or LLDP (`show lldp …` / vendor equivalent) — identify **both ports**.
+3. Read optics on **both** ends with the correct vendor command (below). Summarize: interface, RX/TX power, threshold, whether link is up.
+4. Do **not** answer with only UME bandwidth-usage-rate alarms unless the user asked for congestion alarms.
+
+### ZTE optical CLI (prod corrections)
+
+Try in order; **one failure → switch command, do not retry the same spelling**:
+
+| Prefer | Fallback / notes |
+|--------|------------------|
+| `show opticalinfo brief` | Field-confirmed on ZXR10 (e.g. ANGKATAN / `PLG-A45-…`) |
+| `show optical brief` | Some EN platforms |
+| `show opticalinfo brief \| begin <if>` | Narrow to one interface after port known |
+
+Cisco/Huawei: use `show interface transceiver` / `display optical-module` style allowlisted commands as applicable.
+
+### Multi-NE same show
+
+Prefer `execManagedNe(ume_ne_ids=[…], commands=[…])` once. Cap to the NEs on the asked path (usually 2).
+
 ## CLI 约束（服务端强制）
 
 - 允许前缀：`show `、`display `、`ping `、`ping6 `、`traceroute `、`tracert `、`trace `、`trace6 `

skills/_workspace/ops/ops-netx-ume-playbook/SKILL.md

@@ -63,12 +63,46 @@ Prefer these fixed paths for short group/DM asks (EN first; ZH aliases still wor
 | Critical Top / alarm tally | ① `aggregateUmeAlarms(severity=critical, top_ne=20)`; for file: `ume_alarm_xlsx_report(mode=aggregate_by_host, severity=critical)` |
 | how many alarms / tally | ① `runUmeDiagnostics` or `aggregateUmeAlarms`; ② report by_severity + freshness |
 | export Excel / send spreadsheet | `ume_alarm_xlsx_report` **or** `write_xlsx(..., deliverable=true)`; never split into 3 steps |
+| CRC in area PAD / ACH / … | `queryUmeAlarmsRaw(keyword=CRC)` then keep rows whose `alarm_host_name` / `ne_host_name` starts with area prefix (`PAD-`, `ACH-`, …). Optional xlsx via `write_xlsx(deliverable=true)` |
+| bandwidth / congestion / usage rate (+ area) | keyword=`bandwidth` (do **not** require event_type unless user asks); filter hostname prefix for area; CLI validate only top 3–5 if user asks to confirm false positives |
+| BN EMS / dying gasp / unmanaged (+ area) | keyword or native cause match (`BN EMS` / `dying gasp`); filter area prefix; short EN summary + optional xlsx |
+| power / temperature / fan alarms (+ area/NE) | keyword=`power` / `temperature` / `fan`; scope to host or area prefix |
+| alarm on **one hostname** (e.g. `MDN-PLSP`, `MKS-SWBP-EN1`) | `queryUmeAlarms` / `queryUmeAlarmsRaw` with `host_name` / keyword=hostname. **Never** start a scheduled License/daily playbook |
+| alarm history / time range (e.g. `17.50-18.15`) | Resolve **WIB (UTC+7)** wall clock → `time_from`/`time_to` on `last_seen_at` / history fields; first check freshness; name hosts exactly (`MKS-KIM-CN1`) |
+| is NE rebooted? / alarm history for NE | Host-scoped alarm history (reboot/reload/power related causes); answer yes/no + evidence times |
 
 Delivery rules:
 - `ume_alarm_xlsx_report` defaults `deliverable=true` so WhatsApp receives the file.
 - Generic sheets: `write_xlsx(..., deliverable=true)` can skip `save_deliverable_attachment`.
 - Do not build xlsx via `run_command` + openpyxl.
-- Confirm short replies (`YES` / `confirm` / `继续`): continue the previous task; do not restart the query.
+- Confirm short replies (`YES` / `confirm` / `继续` / `ya` / `yea`): continue the previous task; do not restart the query.
+
+### Field vocabulary (prod-learned; enforce)
+
+- **Area** = hostname **prefix** before first extra segment: `BTM-`, `ACH-`, `MKS-`, `PAD-`, `MDN-`, `KND-`, `SMD-`, `MDO-`, `PLG-`, … Case-insensitive starts-with.
+- **Capacity / bandwidth between A and B** (user correction in field): means **SFP/optical link capacity between two hostnames**, not UME bandwidth-usage-rate alarms alone. Resolve both NEs → interconnect ports (`findTopologyPaths` / LLDP) → optical/SFP CLI. See `ops-netx-managed-ne-playbook`.
+- **Site nicknames** (SEMBAWA, ANGKATAN_EP, …): resolve via inventory/wiki/`queryUmeNeInventory(keyword=…)` **before** CLI; never invent hostnames.
+- **Local clock phrases** (`17.50`, `today`, `yesterday`): treat as **Asia/Jakarta (WIB, UTC+7)** unless user says otherwise.
+
+### Anti-patterns seen in field (do not repeat)
+
+1. **Wrong playbook hijack** — User: `query alarm on MDN-AHJ-AN1` → must NOT run License/daily scheduled playbook. Answer that host’s current alarms only.
+2. **Narration-only turns** — Avoid “Let me start by…” / “I’ll fetch fields…” as the only WhatsApp message. Prefer: progress throttle already exists; final reply = **findings first** (counts + top hosts), then optional detail.
+3. **Markdown tables on WhatsApp** — Do not send `|---|+` pipe tables or `##` headings. Use `*bold*` labels and `-` bullets (outbound converter helps, but write WA-native).
+4. **Apology loops** — If user asks “are you still running / why no response?”, resume the **quoted task** immediately; one short status line, then results. Do not ask what a Run ID might mean if `schedule_list` / job tools can answer.
+5. **Group noise** — Pure emoji / mention-only / “hi” with no ops ask: stay minimal or silent per group policy; do not give a long “how can I help” menu.
+6. **Blind CLI retries** — Wrong ZTE optic command once → switch to `show opticalinfo brief` (see managed-ne skill); do not retry the failed spelling.
+
+### Answer shape (WhatsApp EN)
+
+```
+*<topic> — <area/NE>*
+- Finding: …
+- Evidence: N alarms / CLI ok|fail
+- Next: … (only if needed)
+```
+
+Keep body short; put large tables in **xlsx attachment**.
 
 ## 约束与护栏
 

skills/_workspace/ops/ops-netx-ume-playbook/reference.md

@@ -33,6 +33,20 @@
 | 按 host 统计+Excel | `ume_alarm_xlsx_report(mode=aggregate_by_host, severity=critical)` |
 | 断纤/离线清单+Excel | `ume_alarm_xlsx_report(mode=fiber_cut\|offline)` |
 | 发 Excel（已有表数据） | `write_xlsx(..., deliverable=true)` |
+| 区域 + 关键字（CRC/bandwidth/power） | `queryUmeAlarmsRaw(keyword=…)` → 过滤 `host` 前缀 `AREA-` |
+| 单网元当前告警 | `queryUmeAlarms(host_name=…)` — **禁止**误跑 License 定时 playbook |
+| 两端 capacity/optical | 解析两端 hostname → `findTopologyPaths` / LLDP → CLI optic（见 managed-ne） |
+| 时间窗历史（WIB） | freshness → `time_from`/`time_to`（按 Asia/Jakarta） |
+
+## 3c) 现场口语 → 动作
+
+| 用户说法 | 正确理解 |
+|----------|----------|
+| congestion / bandwidth usage in ACH | UME keyword bandwidth + hostname `ACH-`；要验真再 CLI top N |
+| capacity A to B / optical power A <> B | **链路口 SFP/光功率**，不是单独告警 tally |
+| site SEMBAWA / ANGKATAN_EP | 先 inventory/wiki 解析成真实 `host_name` |
+| `17.50 - 18.15` | WIB 当天 17:50–18:15 |
+| check alarm on MDN-xxx | **仅该 host**；勿触发 daily license 等无关 playbook |
 
 ## 4) 诊断