PPTX icon resolver: 50+ proactive aliases + menu-mode 'no code edits' rule

Diego flagged two patterns from the Codex session:

1. Aliases for natural-language slugs were missing — Codex authored
   ``type: refreshable_clone`` and ``type: oci_goldengate`` and the
   resolver returned None for both. Beyond fixing those two, expand
   the table proactively: 50+ slugs an SA / agent might naturally
   reach for (atp, alb, nlb, apigw, lambda, kms, secret, kafka,
   alarm, email, identity, iam, iac, terraform, oac, oic, language /
   speech / vision, rpc / lpg / cpe, health_check, tags, etc.) all
   mapped to canonical icon entries that exist in
   kb/diagram/oci-pptx-icons-index.json.

2. Codex was editing tools/oci_deck_gen.py and the deck-spec while
   fulfilling a menu-driven option-2 request — going off the
   procedure to "fix" perceived bugs in the renderer. New rule in
   SKILL.md § What You Do NOT Do: when the user is in menu mode
   (options 1–14), the agent USES the existing tools, never modifies
   them. Tool gaps (missing aliases, broken paths) get surfaced as
   end-of-reply follow-ups for a separate developer-mode session.
   Two narrow exceptions kept: kb/field-findings/tracker.yaml via
   option 11, and writing customer spec/output YAML under examples/.

Codex copy auto-synced via the pre-commit hook.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.agents/skills/oci-deal-accelerator/SKILL.md

@@ -570,5 +570,4 @@ KB lives under `kb/`. See [kb/README.md](kb/README.md) for the directory map, fr
 - You do NOT claim features exist if you're unsure. Check the KB first.
 - You do NOT do detailed project management. DELIVER artifacts are lightweight handover aids.
 - You do NOT add services or components the user did not request.
-
-<!-- test marker for sync hook -->
+- **You do NOT edit skill source code or tooling when the user is in "menu mode".** When the user invoked the skill via the welcome menu (options 1–14) or asked for one of the menu outputs (proposal, diagram, deck, BOM, WA review, etc.), your job is to USE the existing tools, not modify them. Do NOT touch `tools/`, `scripts/`, `kb/diagram/*.json`, or any other code/index file as part of fulfilling a menu request — even if you discover a bug or a missing alias mid-task. If you hit a tool gap (missing icon alias, broken renderer, type that doesn't resolve), surface it as a follow-up at the end of your reply (e.g. "I noticed `refreshable_clone` doesn't have a PPTX icon alias — flag this for the maintainer to add to `tools/oci_pptx_diagram_gen.py::TYPE_TO_ICON`") rather than silently patching it. Code edits happen in a separate "developer mode" engagement, not while the SA is generating customer artifacts. The two exceptions: (1) `kb/field-findings/tracker.yaml` via menu option 11 (the menu's purpose IS to write that file), and (2) writing the customer's spec/output YAML files under `examples/<customer>/` — those are the deliverable, not the skill itself.

SKILL.md

@@ -568,5 +568,4 @@ KB lives under `kb/`. See [kb/README.md](kb/README.md) for the directory map, fr
 - You do NOT claim features exist if you're unsure. Check the KB first.
 - You do NOT do detailed project management. DELIVER artifacts are lightweight handover aids.
 - You do NOT add services or components the user did not request.
-
-<!-- test marker for sync hook -->
+- **You do NOT edit skill source code or tooling when the user is in "menu mode".** When the user invoked the skill via the welcome menu (options 1–14) or asked for one of the menu outputs (proposal, diagram, deck, BOM, WA review, etc.), your job is to USE the existing tools, not modify them. Do NOT touch `tools/`, `scripts/`, `kb/diagram/*.json`, or any other code/index file as part of fulfilling a menu request — even if you discover a bug or a missing alias mid-task. If you hit a tool gap (missing icon alias, broken renderer, type that doesn't resolve), surface it as a follow-up at the end of your reply (e.g. "I noticed `refreshable_clone` doesn't have a PPTX icon alias — flag this for the maintainer to add to `tools/oci_pptx_diagram_gen.py::TYPE_TO_ICON`") rather than silently patching it. Code edits happen in a separate "developer mode" engagement, not while the SA is generating customer artifacts. The two exceptions: (1) `kb/field-findings/tracker.yaml` via menu option 11 (the menu's purpose IS to write that file), and (2) writing the customer's spec/output YAML files under `examples/<customer>/` — those are the deliverable, not the skill itself.

tools/oci_pptx_diagram_gen.py

@@ -133,6 +133,62 @@ TYPE_TO_ICON = {
     "mysql_heatwave": ["mysql_heatwave", "mysql_database_system", "mysql"],
     "heatwave": ["mysql_heatwave", "mysql_database_system", "mysql"],
     "mysql_database_service": ["mysql_heatwave", "mysql_database_system", "mysql"],
+    "autonomous_database": ["oracle_autonomous_database", "adb_d"],
+    "oracle_autonomous_database": ["oracle_autonomous_database", "adb_d"],
+    "refreshable_clone": ["oracle_autonomous_database", "adb_d"],
+    "adb_clone": ["oracle_autonomous_database", "adb_d"],
+    "oci_goldengate": ["goldengate"],
+    "ogg": ["goldengate"],
+    "dynamic_routing_gateway": ["drg"],
+    # Proactive aliases — natural-language slugs an SA / agent might
+    # reach for, all mapped to the canonical icon. Adding ahead of
+    # demand so a freshly-authored spec resolves on first try.
+    "atp": ["atp_d"],
+    "alb": ["load_balancer", "public_load_balancer"],
+    "nlb": ["load_balancer", "public_load_balancer"],
+    "apigw": ["api_gateway"],
+    "lambda": ["oci_functions", "functions"],
+    "kms": ["vault"],
+    "secret": ["vault"],
+    "secrets_manager": ["vault"],
+    "kafka": ["oci_streaming", "streaming"],
+    "alarm": ["alarms", "monitoring"],
+    "alarms": ["alarms", "monitoring"],
+    "email": ["email_delivery"],
+    "email_delivery": ["email_delivery"],
+    "identity": ["oracle_identity"],
+    "identity_domains": ["oracle_identity"],
+    "iam": ["oracle_identity"],
+    "user_group": ["user_group"],
+    "group": ["user_group"],
+    "iac": ["resource_manager"],
+    "terraform": ["resource_manager"],
+    "oac": ["analytics"],
+    "oracle_analytics_cloud": ["analytics"],
+    "oic": ["integration", "oci_data_integration"],
+    "oracle_integration_cloud": ["integration"],
+    "process_automation": ["oci_process_automation"],
+    "oracle_process_automation": ["oci_process_automation"],
+    "language": ["oci_language"],
+    "ai_language": ["oci_language"],
+    "speech": ["oci_speech"],
+    "ai_speech": ["oci_speech"],
+    "vision": ["oci_vision"],
+    "ai_vision": ["oci_vision"],
+    "rpc": ["remote_peering"],
+    "remote_peering_connection": ["remote_peering"],
+    "remote_peering": ["remote_peering"],
+    "lpg": ["local_peering_gateway"],
+    "local_peering_gateway": ["local_peering_gateway"],
+    "local_peering": ["local_peering_gateway"],
+    "health_check": ["health_checks"],
+    "health_checks": ["health_checks"],
+    "cpe": ["customer_premises_equipment"],
+    "customer_premises_equipment": ["customer_premises_equipment"],
+    "tag": ["tag_namespace"],
+    "tags": ["tag_namespace"],
+    "compartment": ["compartment"],
+    "compartments": ["compartment"],
 }
 
 ICON_KEYWORD_HINTS = {