Implement planned topic: 0005-nexus-caller-limits

[temporal-plugin-updater]

Validation Report — nexus-caller-limits

Branch: draft/0005-nexus-caller-limits
Files validated:

• references/ops/nexus-caller-limits.md (new, 203 lines)
• SKILL.md (two additions: routing-table row, reference-file index bullet)

Independence: performed in a fresh session with no access to authoring artifacts.

---

Go/no-go

Check	Status	Notes
1 — Citation audit	PASS	18/18 unique cited ranges support their claims.
2 — Reverse-grep audit	PASS	0 unexplained grep-misses across flags, aliases, subcommand names, numerical limits, Terraform field.
3 — Regression audit	PASS	0 hits on universal or topic-specific wrong patterns.
4 — Independent re-verification	PASS	10/10 sampled claims match docs (100%).
5 — Integration layout	SKIPPED	Not a third-party integration; no references/integrations.md.
6 — Tone & scope	PASS	0 pattern-1 (workaround-disclosure) findings. 1 borderline MINOR observation.
7 — Cross-language structure	SKIPPED	Not a cross-SDK feature.

Overall verdict: GO.

---

Check 1 findings

None. All 18 unique cited docs ranges resolve and substantively support the anchored claim:

Ref file line	Cite	Resolves?
5, 191	nexus-security.mdx:22-23	✓ Cloud has built-in Endpoint access controls; self-hosted uses custom Authorizer plugin.
11	limits.mdx:260	✓ 1,000 caller Namespaces per Endpoint default.
11, 164	limits.mdx:261	✓ Increases via support ticket.
13	nexus-security.mdx:27	✓ Access Policy = allowlist of caller Namespaces.
13	nexus-security.mdx:34-36	✓ Cloud verifies caller's Namespace before routing (verbatim at line 35).
15, 190	nexus-registry.mdx:61	✓ No callers allowed by default, including same-Namespace.
19, 187	limits.mdx:255	✓ 100 Nexus Endpoints per Account default.
34	cli/…/nexus.mdx:57-61	✓ allowed-namespace list requires --name.
42	tcld/nexus.mdx:194-204	✓ tcld allowed-namespace list has --name (alias n).
50	cli/…/nexus.mdx:150-162	✓ endpoint get requires exactly one of --name/--id.
69	cli/…/nexus.mdx:32-49	✓ add requires --name + --namespace (string[]); already-listed silently ignored (line 35).
80	tcld/nexus.mdx:164-192	✓ tcld add flags and -n/-ns aliases present.
92	cli/…/nexus.mdx:63-80	✓ remove; not-currently-allowed silently ignored (line 66).
102	tcld/nexus.mdx:236-264	✓ tcld remove section.
117	cli/…/nexus.mdx:82-99	✓ set "replacing any previously allowed namespaces" (line 84-85).
128	tcld/nexus.mdx:206-234	✓ tcld set section.
145	cli/…/nexus.mdx:101-129	✓ create marks --target-namespace / --target-task-queue required; --allow-namespace optional string[].
158	tcld/nexus.mdx:53-93	✓ tcld create aliases n/tns/ttq/ans all present.
189	cli/…/nexus.mdx:28-99, 118	✓ subcommand group is allowed-namespace; --allow-namespace flag only on endpoint create (line 118).

All user-facing https:// links use full URLs (no root-relative paths). No sub-check gate broken.

---

Check 2 findings

None. Token extraction and grep-verification:

Token class	Extracted	All found in docs?
CLI flags	--allow-namespace, --id, --name, --namespace, --target-namespace, --target-task-queue	✓ all present in cli/…/nexus.mdx
tcld aliases	n, ns, tns, ttq, ans	✓ all present in tcld/nexus.mdx
Command roots	temporal cloud nexus endpoint …, tcld nexus endpoint …	✓
Subcommand names	allowed-namespace, add, remove, list, set, create, get	✓
Numerical limits	1,000 caller Namespaces, 100 Endpoints	✓ (limits.mdx:255,260)
Terraform field	allowed_caller_namespaces	✓ (cloud/terraform-provider.mdx:360,375,455)
Verbatim phrases	"silently ignored", "string[]"	✓

No token required an <!-- undocumented: … --> tag.

---

Check 3 findings

None. Regression grep results:

• Universal patterns (--profile, TEMPORAL_TLS_*_PATH, tcld service-account, --output text|jsonl, saas-api.tmprl.cloud:7233) — 0 hits.
• Topic-specific patterns:
  • Singular allow-namespace add|remove|list|set used as subcommand — 0 hits.
  • Swapped 100 caller / 1,000 Endpoints — 0 hits.
  • Self-hosted attributed the 1,000-cap — 0 hits (the two mentions at lines 181 and 191 explicitly deny the self-hosted attribution).

---

Check 4 findings

None. Sample of 10 claims, each independently re-derived from docs and compared:

#	Ref line	Claim	Docs source	Match?
1	11	1,000 caller Namespaces per Endpoint by default	limits.mdx:260	✓
2	15	No callers allowed by default, even same Namespace	nexus-registry.mdx:61	✓ (verbatim)
3	19	100 Nexus Endpoints per Account by default	limits.mdx:255	✓
4	34	allowed-namespace list requires --name	cli/…/nexus.mdx:60 (Required: Yes)	✓
5	50	endpoint get requires exactly one of --name/--id	cli/…/nexus.mdx:152-153	✓
6	69	--namespace is string[] repeatable; already-listed silently ignored	cli/…/nexus.mdx:35, 46	✓
7	117	set replaces the full list; entries not supplied are dropped	cli/…/nexus.mdx:84-85	✓
8	145	--target-namespace + --target-task-queue required on create; --allow-namespace optional/repeatable	cli/…/nexus.mdx:118, 128-129	✓
9	158	tcld create aliases: n, tns, ttq, ans	tcld/nexus.mdx:63, 81, 87, 93	✓
10	180	Terraform field is allowed_caller_namespaces	terraform-provider.mdx:360,375	✓

Match rate: 10/10 = 100%. No documented defaults were omitted (the 1,000 cap and the empty-allowlist-at-create defaults are both stated explicitly).

---

Check 6 findings

Pattern 1 (workaround disclosure) — none.

• The "Raise the 1,000 ceiling" section (lines 162-172) is a positive directive: it states the only supported path (support ticket) and explicitly forbids sharding-by-Endpoint or other workaround architectures. The instruction "Do not propose sharding-by-Endpoint or other workaround architectures" is a naming-a-forbidden-category boundary, not a recipe. The verbal shape matches the acceptable "Don't do X" form the template calls out.
• The "Treat set as a destructive operation" bullet (line 117) is positive safety guidance around a first-class supported command, not a workaround.

Public Preview admonition (patterns 5-7): not required. docs/encyclopedia/nexus/* and docs/cloud/nexus/* no longer carry "Public Preview" markers for the Nexus product. The (EXPERIMENTAL) tags in docs/cloud/tcld/nexus.mdx are a tcld-CLI-level auto-gen marker, not a Nexus-product-status marker; the reference file surfaces this factually at line 147 without paraphrasing it into a product-status claim.

Minor observation (not gating):

• Line 147 preamble "tcld (subcommand is (EXPERIMENTAL) in the auto-generated reference)" is a mild in-the-weeds note about the tcld auto-gen. It arguably reduces agent friction (pre-empts a "why is this EXPERIMENTAL" derail) but could be tightened or dropped in a follow-up polish. Not a MAJOR or MINOR-FIXES trigger.

Other patterns (2, 3, 4, 8-15) — no hits:

• No implementation-internals speculation.
• Common-mistakes bullets are grounded in docs positions or observed name-collision hazards, not hypothetical typos.
• No links to raw source trees.
• No repo slang / internal jargon.
• No inline imports or ambiguous "context" references (no code examples with imports).
• No DIY rebuilds of a supported integration.
• Resources section links to focused docs pages that are either primary sources or scope-adjacent (not local-duplication).

---

Statistics

• Citations audited: 21 inline citation comments across ~18 unique docs ranges.
• Grep-miss count: 0.
• Sample size for Check 4: 10.
• Sample match rate: 10/10 (100%).
• Pattern-1 findings: 0.
• Regression-pattern hits: 0.

---

Verdict

GO. The nexus-caller-limits reference file and its two SKILL.md hookups are grounded, factually accurate, and free of workaround-disclosure or regression patterns. Safe to merge.

[starfleeth]

I don't love that this mentions both tcld and temporal cli. Maybe we stick to tcld until we migrate the skill to the unified cli

[starfleeth]

made updates- removed temporal cloud examples