Flex unbrick

Portable Agent Skills for non-RAPP systems and launchpads for single-file RAPP agents

Install

npx -y skills add kody-w/rapp-skills --skill flex-unbrick

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

20 days oldThe repository was created 20 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Unbrick an Azure Flex Consumption function app after a tenant security-policy sweep silently re-disables storage public network access (app 403/503s, PNA=Disabled). Runs the proven 2026-07-09 runbook — PNA check, SecurityControl=Ignore tag, re-enable PNA, full stop/start, bounded health poll.

SKILL.md

10.7 KB, as published. Nobody here has run it

flex-unbrick — the storage-PNA outage runbook as one verb

Root cause: a management-group policy silently flips the function app's storage account to publicNetworkAccess: Disabled, which kills Flex Consumption apps. The fix sequence was re-derived by hand once (169 az calls, 573-minute session) — this skill replays it.

1 — Diagnose (read-only, always first)

bash ~/.claude/skills/flex-unbrick/scripts/unbrick.sh check <app> <rg> <storage>

Prints subscription, storage PNA state, app state, live HTTPS probe, and a verdict line: HEALTHY / DEGRADED (classic PNA outage — fix applies) / DOWN-OTHER-CAUSE (probe failed but PNA already Enabled — fix will NOT help). The live probe is the truth: PNA=Disabled with a healthy probe is the private-endpoint deployment shape, NOT an outage. If HEALTHY, stop — do not fix.

2 — Fix (mutating; only on a DEGRADED verdict)

bash ~/.claude/skills/flex-unbrick/scripts/unbrick.sh fix <app> <rg> <storage>

Order matters and is encoded in the script:

SecurityControl=Ignore tag on the storage account (merge, keeps other tags) — without it the policy re-disables PNA again within hours.
--public-network-access Enabled on the storage account.
FULL az functionapp stop then start — restart does NOT re-bind Flex storage.
Bounded health poll (20 × 15 s). HTTP 401/404 counts as recovered — an auth layer may 404 without its client-id env var; the metal being up is what we're testing.

3 — Aftercare

If you have alert rules wired on the app (health check, app-down, storage-config-change), check them: a storage-config-change alert firing timestamps the policy sweep.
If the app is still down after the poll: the problem is NOT this policy — go read Function App logs instead of re-running fix.

Don'ts

Don't run fix without a check first, and never on a HEALTHY verdict.
Don't substitute az functionapp restart for stop/start.
Don't remove the SecurityControl=Ignore tag "to clean up" — it is the thing keeping the app alive.

Parameters

The typed contract this capability answers to (JSON Schema — the deterministic layer):

{
  "properties": {
    "app": {
      "description": "Derived from `<app>` used in the documented command at line 11.",
      "type": "string"
    },
    "rg": {
      "description": "Derived from `<rg>` used in the documented command at line 11.",
      "type": "string"
    },
    "storage": {
      "description": "Derived from `<storage>` used in the documented command at line 11.",
      "type": "string"
    }
  },
  "required": [],
  "type": "object"
}

Deterministic steps

Lifted verbatim from the procedure above by toaster.py toast. Run them in order, substituting the typed parameters; do not paraphrase:

az functionapp stop
az functionapp restart
bash ~/.claude/skills/flex-unbrick/scripts/unbrick.sh check <app> <rg> <storage>
bash ~/.claude/skills/flex-unbrick/scripts/unbrick.sh fix <app> <rg> <storage>