Diagram generation: ref-arch-driven procedure + spec validator + KB enrichment

The diagram path now follows a documented standard procedure (lookup
the closest Oracle Architecture Center reference → confirm components
→ author absolute_layout → spec validator → render → visually verify)
and ships persistent guardrails so layout regressions can't recur.

Persistent procedure changes (apply to all users, all sessions):
- tools/diagram_spec_validator.py — geometry checks (CONTAINER_TOO_THIN,
  CONTAINER_PADDING_VIOLATION, LABEL_OVERFLOW_PARENT) run BEFORE either
  renderer (drawio + PPTX). Catches the subnet-collapse / label-overflow
  bugs that the post-render drawio validator missed.
- tools/oci_diagram_gen.py + tools/oci_pptx_diagram_gen.py — call the
  spec validator before emitting any output. Adds mysql / mysql_heatwave
  type aliases.
- tools/archcenter_pattern_lookup.py — scores against cached page
  descriptions (not just the 1-line summary), supports --queries for
  multi-fragment composition, and applies synonym expansion via
  kb/architecture-center/synonyms.yaml so "LB HA cross AD" matches
  "load balancer high availability availability domain".
- kb/architecture-center/synonyms.yaml — canonical synonym table
  (load balancer, autonomous database, data guard, …) used by the
  lookup scorer.

KB enrichment:
- tools/archcenter_description_fetcher.py + 121 cached _description.md
  under kb/diagram/assets/archcenter-refs/<slug>/. Removes the runtime
  dependency on docs.oracle.com when authoring specs and feeds the
  pattern-lookup scorer.
- 110+ cached .drawio / .svg / .png references for offline reuse,
  plus the OCI Toolkit v24.2 import (kb/diagram/assets/oci-toolkit-drawio).

Documentation:
- docs/skill/output-formats.md — new "Standard diagram-generation
  procedure (MANDATORY)" + geometry rules + the new validator entry.
- SKILL.md option 2 — references the mandatory procedure.
- README.md — describes the spec validator, archcenter_pattern_lookup
  and description fetcher, and updates the KB-health table.

Tooling that backs the procedure (cumulative across recent sessions):
tools/archcenter_case_runner.py, archcenter_batch_driver.py,
archcenter_zip_downloader.py, drawio_visual_validator.py,
drawio_fidelity_eval.py, harvest_drawio_icon.py, import_oci_library.py,
oci_pptx_diagram_gen.py, oci_pptx_render.py, refresh_pptx_icon_index.py.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kb/diagram/assets/archcenter-refs/data-safe-exadata-adb/_description.md

@@ -0,0 +1,295 @@
+# Implement Oracle Data Safe for Exadata and Autonomous Databases
+
+- Source: https://docs.oracle.com/en/solutions/data-safe-exadata-adb/index.html
+- Date: 2025-06
+- Type: reference-architecture
+- Services: data-safe, exacs, adb-s
+- Tags: security, database
+
+## Summary (catalog)
+
+Data Safe deployment for ExaCS and ADB. Security assessment, user assessment, activity auditing, data masking, and data discovery. Private endpoint connectivity for databases in private subnets.
+
+## Architecture (fetched from source)
+
+Architecture
+
+ 
+
+ 
+
+ 
+ 
+This reference architecture outlines the following target databases
+ and the way Data Safe connects to these databases:
+
+ 
+ 
+ 
+- Exadata Database Service or Exadata Cloud@Customer / Regional
+ Cloud@Customer / Dedicated Region 
+ 
+- Autonomous Databases 
+ 
+ 
+ 
+
+ 
+This reference architecture only discusses databases with private IP addresses. To
+ configure a database with a public IP address is from a security perspective not
+ advised. 
+
+ 
+For each different deployment of Data Safe discussed here, you should also
+ deploy a landing zone in your tenancy. The following resources provide best practices
+ for security and compliance, landing zone concepts and deployment of a landing zone on
+ Oracle Cloud Infrastructure using terraform scripts: 
+ 
+ 
+- Well-architected framework for Oracle Cloud Infrastructure 
+ 
+- Deploy a secure landing zone that meets the CIS Foundations
+ Benchmark for Oracle Cloud 
+ 
+- CIS Compliant OCI Landing Zones (GitHub repository) 
+ 
+ 
+
+ 
+Note:
+Please refer to the Explore
+ More topic below for access to these resources.
+ 
+
+ 
+
+ 
+ Exadata Database Service or Exadata Cloud@Customer 
+
+ 
+Oracle Exadata Database Service provides the Oracle Exadata Database Machine
+ as a service in an Oracle Cloud Infrastructure (OCI) data center. 
+
+ 
+Exadata Cloud@Customer, a managed service, provides an Exadata Database
+ Service that is hosted in the on-premises data center. 
+
+ 
+ Exadata Database Service 
+
+ 
+The Exadata Database Service does not need to connect to the on-premises
+ network because it is deployed on OCI and can therefor use the Private end-point
+ directly. After setting up the necessary connectivity, the databases can be configured
+ as targets in Data Safe using the wizard.
+
+ 
+ Exadata Cloud@Customer 
+
+ 
+To connect a Exadata Cloud@Customer target database there are two options : 
+ 
+ 
+- On-premises connector 
+ 
+- Private end-point 
+ 
+ 
+
+ 
+In the following diagram, the connections are shown between the Oracle Cloud
+ and the on-premises data center. The diagram shows the options to choose from. If there
+ is a site-to-site VPN or OCI FastConnect connection you can use a private endpoint to
+ connect to your Exadata Cloud@Customer target Data Safe databases. If there is no VPN or
+ OCI FastConnect, then you can deploy an on-premises connector to connect to your Exadata
+ Cloud@Customer target Data Safe databases. This on-premises connector will then connect
+ to Data Safe via a TLS tunnel.
+
+ 
+
+ 
+ 
+ Description of the illustration data-safe-exa-adb.png 
+
+ 
+ 
+
+ 
+
+ data-safe-exa-adb-oracle.zip 
+ 
+ 
+
+ 
+Be aware that as shown in the diagram, an outgoing, persistent, secure automation tunnel
+ connects the CPS infrastructure in the on-premises data center to the Oracle-managed
+ admin VCN in the OCI region for delivering cloud automation commands to the VM clusters.
+ This is a outgoing tunnel for the CPS infrastructure and can not be used for Data Safe
+ connections. For more information see the link below on 'Architecture Exadata
+ Cloud@Customer'.
+
+ 
+The Exadata Cloud@Customer environment is supported by Oracle using the
+ Oracle Operator Access Control (OpCtl). OpCtl is an OCI privileged access management
+ (PAM) service that gives customers a technical mechanism to better control how Oracle
+ staff can access their Exadata Cloud@Customer (ExaC@C) infrastructure. For a detailed
+ reading on this see the link Oracle Operator Access Control link below. The following
+ resources describe the architectures and setup in detail:
+ 
+ 
+- Architecture Exadata Cloud@Customer 
+ 
+- Architecture Exadata Database Service 
+ 
+- Setup Cloud@Customer database using private endpoint 
+ 
+- Setup Cloud@Customer database using the wizard 
+ 
+- Simplify Security for your on-premises Oracle Databases with Oracle
+ Data Safe 
+ 
+- Exadata Database Service Security Controls 
+ 
+ 
+
+ 
+Note:
+Please refer to the Explore
+ More topic below for access to these resources.
+ 
+
+ 
+
+ 
+ Autonomous Databases 
+
+ 
+Autonomous database on shared infrastructure is available with Data Safe.
+ Autonomous databases can be registered through the wizard or by a single click from the
+ Autonomous database details page. The steps to connect the autonomous database for the
+ Dedicated Region Cloud@Customer are discussed in this part of the Data Safe
+ documentation. 
+
+ 
+ Architecture Components 
+
+ 
+These architectures have the following components:
+ 
+ 
+- Tenancy 
+ 
+ 
+Oracle Autonomous Transaction Processing is a self-driving,
+ self-securing, self-repairing database service that is optimized for
+ transaction processing workloads. You do not need to configure or manage any
+ hardware, or install any software. Oracle Cloud Infrastructure handles
+ creating the database, as well as backing up, patching, upgrading, and
+ tuning the database. 
+
+ 
+ 
+- Region 
+ 
+ 
+An Oracle Cloud Infrastructure region is a localized geographic
+ area that contains one or more data centers, called availability domains.
+ Regions are independent of other regions, and vast distances can separate
+ them (across countries or even continents).
+
+ 
+ 
+ 
+- Compartment 
+ 
+ 
+Compartments are cross-region logical partitions within an
+ Oracle Cloud Infrastructure tenancy. Use compartments to organize your
+ resources in Oracle Cloud, control access to the resources, and set usage
+ quotas. To control access to the resources in a given compartment, you
+ define policies that specify who can access the resources and what actions
+ they can perform. 
+
+ 
+ 
+- Availability domains 
+ 
+ 
+Availability domains are standalone, independent data centers
+ within a region. The physical resources in each availability domain are
+ isolated from the resources in the other availability domains, which
+ provides fault tolerance. Availability domains don’t share infrastructure
+ such as power or cooling, or the internal availability domain network. So, a
+ failure at one availability domain is unlikely to affect the other
+ availability domains in the region. 
+
+ 
+ 
+- Fault domains 
+ 
+ 
+A fault domain is a grouping of hardware and infrastructure
+ within an availability domain. Each availability domain has three fault
+ domains with independent power and hardware. When you distribute resources
+ across multiple fault domains, your applications can tolerate physical
+ server failure, system maintenance, and power failures inside a fault
+ domain. 
+
+ 
+ 
+- Virtual cloud network (VCN) and subnets 
+ 
+ 
+A VCN is a customizable, software-defined network that you set up
+ in an Oracle Cloud Infrastructure region. Like traditional data center
+ networks, VCNs give you complete control over your network environment. A
+ VCN can have multiple non-overlapping CIDR blocks that you can change after
+ you create the VCN. You can segment a VCN into subnets, which can be scoped
+ to a region or to an availability domain. Each subnet consists of a
+ contiguous range of addresses that don't overlap with the other subnets in
+ the VCN. You can change the size of a subnet after creation. A subnet can be
+ public or private.
+
+ 
+ 
+ 
+- Load balancer 
+The Oracle Cloud
+ Infrastructure Load Balancing service provides automated traffic
+ distribution from a single entry point to multiple servers in the back end.
+ The load balancer provides access to different applications. 
+
+ 
+ 
+- Security list 
+For each subnet, you can create security rules that
+ specify the source, destination, and type of traffic that must be allowed in
+ and out of the subnet.
+
+ 
+ 
+ 
+- NAT gateway 
+ 
+ 
+The NAT gateway enables private resources in a VCN to access hosts on the
+ internet, without exposing those resources to incoming internet
+ connections.
+
+ 
+ 
+- Service gateway 
+ 
+ 
+The service gateway provides access from a VCN to other
+ services, such as Oracle Cloud Infrastructure Object Storage. The traffic
+ from the VCN to the Oracle service travels over the Oracle network fabric
+ and never traverses the internet. 
+
+ 
+ 
+- Cloud Guard 
+ 
+ 
+You can use Oracle Cloud Guard to monitor and maintain the
+ security of your resources in Oracle Cloud Inf

kb/diagram/assets/archcenter-refs/data-safe-exadata-adb/readme.txt

@@ -0,0 +1,7 @@
+The diagram you downloaded is available in these formats:
+- DRAWIO
+- SVG
+
+You can customize them for your organization using the associated tools:
+- For DRAWIO format, use draw.io for Confluence, online at diagrams.net, or the desktop app. Go to diagrams.net for more information.
+- For SVG format, use an SVG editor such as Inkscape or Sketsa SVG Editor, which are free and available for Windows, macOS, Linux.