Tide - Provable Security

Tide List

List all available content in the Tide agent pack by category

Tide Canon

Read a canon file (invariants, anti-patterns, concepts, framework-matrix, feature-mapping, troubleshooting, tidecloak-bootstrap, etc.)

Tide Playbook

Read a step-by-step playbook for a specific Tide task

Tide Skill

Read a composable skill definition

Tide Prompt

Read a reusable starter prompt from the pack

Tide Adapter

Read an adapter instruction file (AGENTS, CLAUDE, replit)

Tide List Scenarios

List all available scenario patterns under reference-apps/

Tide Scenario

Read a scenario summary from reference-apps/<scenario>/scenario.md

Tide Scenario Manifest

Read a scenario manifest from reference-apps/<scenario>/manifest.yaml

Tide Scenario Roles

Read a scenario role-policy matrix from reference-apps/<scenario>/role-policy-matrix.md

Tide Scenario Bootstrap

Read a scenario bootstrap sequence from reference-apps/<scenario>/bootstrap-sequence.md

Tide Choose Scenario

Match a user request to a known scenario pattern before falling back to generic playbooks

Tide Choose Playbook

Recommend the right playbook for a given situation

Tide Security Analysis

Analyze an EXISTING (possibly non-Tide) system for security gaps and map them to Tide capabilities. Returns the Security Analyst role instructions, the security gap mapping table (SG-01…SG-18), and the runtime-probe procedures. Use this when the user asks 'do a security analysis', 'where is my auth weak', or 'what would Tide change about my security'.

Tide Blast Radius

Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 companion explains how TideCloak shrinks each blast radius. Use this when the user wants to 'assess', 're

Tide Hosting

Where TideCloak runs: local Docker vs partner-hosted (Skycloak managed TideCloak-as-a-service). Returns the local-vs-hosted decision with the honest trade-offs, the trust model, the verified Skycloak API reference (correct cluster field names and the required version), and the full provisioning playbook. CALL THIS BEFORE STARTING ANY TIDECLOAK DEPLOYMENT — the choice must be made up front (I-17) because a realm cannot be moved between local and hosted afterwards. Triggers: 'deploy to production'

Tide Dpop Asset

Returns the CONTENTS of `public/tide_dpop_auth.html` — the DPoP relay page the Tide enclave loads during login — plus its sha256, the required next.config.ts rewrite/CSP wiring, and how to verify. The file is NOT shipped in the @tidecloak/* npm packages and is NOT in the TideCloak container, so there is nowhere else to get it: without this tool people search GitHub and find a STALE copy that posts to window.parent, which breaks the popup fallback and fails login with TIDE-SWE-UNHANDLED. CALL THI

Tide Onboarding

STOP KEYCLOAK'S 'UPDATE ACCOUNT INFORMATION' PAGE and collect the details in-app instead. Tide asserts ONLY a username (the vuid) -- no email, no name -- so Keycloak blocks new users on an unstyled form showing a 64-hex username. Returns: a read-only DIAGNOSTIC that identifies which of FOUR mechanisms is causing the page (they need different fixes), the script that fixes it, and a ready-to-drop React modal that collects the details AFTER login via the Account API. CALL THIS whenever signup, onbo

Tide Branding

BRAND THE ENCLAVE FOR THE USER — generate a logo + background and upload them so the Tide login/approval screen is branded. Returns a single ready-to-run command that generates the assets (no image model needed), validates them, uploads both, and saves+signs the IdP settings. Also returns the VERIFIED upload contract (multipart parts, the png/jpg/jpeg/gif/webp allowlist with SVG REJECTED, the 5 MB cap, set-branding = save AND re-sign, IGA-exempt) plus image-model prompts for agents that can gene

Tide Gaps

Read the gap register — what is still uncertain or unresolved in the pack