[Misc] Skill: CAP Operator skill updated

.agents/skills/cap-operator/SKILL.md

@@ -14,24 +14,27 @@ allowed-tools: Bash(kubectl:*)
 
 Manages the lifecycle of multi-tenant SAP Cloud Application Programming Model (CAP) applications on Kubernetes via the CAP Operator controller.
 
-Full docs: `website/content/en/docs/` | API reference: `website/content/en/docs/reference/` | Website: https://sap.github.io/cap-operator
+**Response rule:** Always include a link to the relevant page on https://sap.github.io/cap-operator/docs/ when answering any question. Match the topic to the most specific page available (resource reference, usage guide, troubleshooting, configuration, etc.).
+
+Full docs & API reference: `website/content/en/docs/` | https://sap.github.io/cap-operator/docs/
 
 ## Custom Resources
 
 | Resource | Scope | Purpose |
 |---|---|---|
-| `CAPApplication` | Namespaced | High-level app: BTP services, domain refs, provider subaccount |
-| `CAPApplicationVersion` | Namespaced | Immutable version: images, workloads, tenant operation steps |
-| `CAPTenant` | Namespaced | A subscribed consumer tenant — controller-managed only |
-| `CAPTenantOperation` | Namespaced | Orchestrates provisioning/upgrade/deprovisioning — auto-created |
-| `Domain` | Namespaced | Istio Gateway + TLS + DNS for one application |
-| `ClusterDomain` | Cluster | Shared domain config across applications |
+| [`CAPApplication`](https://sap.github.io/cap-operator/docs/usage/resources/capapplication/) | Namespaced | High-level app: BTP services, domain refs, provider subaccount |
+| [`CAPApplicationVersion`](https://sap.github.io/cap-operator/docs/usage/resources/capapplicationversion/) | Namespaced | Immutable version: images, workloads, tenant operation steps |
+| [`CAPTenant`](https://sap.github.io/cap-operator/docs/usage/resources/captenant/) | Namespaced | A subscribed consumer tenant — controller-managed only |
+| [`CAPTenantOperation`](https://sap.github.io/cap-operator/docs/usage/resources/captenantoperation/) | Namespaced | Orchestrates provisioning/upgrade/deprovisioning — auto-created |
+| [`Domain`](https://sap.github.io/cap-operator/docs/usage/resources/domain/) | Namespaced | Istio Gateway + TLS + DNS for one application |
+| [`ClusterDomain`](https://sap.github.io/cap-operator/docs/usage/resources/clusterdomain/) | Cluster | Shared domain config across applications |
 
 **Critical rules:**
 - `CAPApplicationVersion` is **immutable** after creation. To upgrade, create a new resource with a higher semantic version.
 - `CAPTenant` must **never** be created or deleted manually — managed by the subscription server only.
 - `CAPTenantOperation` is auto-created by the controller — do not create or delete manually.
 - Never remove finalizers from CAP Operator resources manually.
+- `CAPApplication.spec.provider` is **deprecated**. It previously caused the controller to auto-create a provider `CAPTenant`, but that behavior has been removed. All tenants (including the provider) must now be subscribed to explicitly. If `kubectl get captenant -n <namespace>` returns empty, this is expected for apps with no active subscriptions.
 
 ## Common Operations
 
@@ -62,7 +65,7 @@ kubectl get domain,clusterdomain -A
 
 ### Domain management
 - `Domain` — namespace-scoped, one application. `ClusterDomain` — cluster-scoped, shared.
-- TLS modes: `Simple` (default), `Mutual`, `OptionalMutual` (Domain only)
+- TLS modes: `Simple` (default), `Mutual`, `OptionalMutual`
 - DNS modes: `None` (default), `Wildcard`, `Subdomain`, `Custom`
 - First entry in `domainRefs` is the primary domain.
 - `domains` inline section in `CAPApplication` was removed in v0.26.0; use `domainRefs` instead.
@@ -82,6 +85,8 @@ See [credential rotation reference](references/credential-rotation.md).
 ### Version cleanup (monitoring-based)
 Enable with annotation `sme.sap.com/enable-cleanup-monitoring: "true"` on `CAPApplication`. Configure `deletionRules.expression` (PromQL) on a workload's `monitoring` section; when the expression evaluates to `true` the version is eligible for deletion.
 
+See [Version monitoring](https://sap.github.io/cap-operator/docs/usage/version-monitoring/) (`website/content/en/docs/usage/version-monitoring.md`).
+
 ## Key Annotations
 
 | Annotation | Resource | Effect |
@@ -101,7 +106,7 @@ Enable with annotation `sme.sap.com/enable-cleanup-monitoring: "true"` on `CAPAp
 | Approuter can't reach CAP backend | Missing `routerDestinationName` | Add `routerDestinationName` to the CAP workload port definition |
 | Credentials not injected | Service not in `consumedBTPServices` | Verify service name matches `CAPApplication.spec.btp.services[].name` |
 
-More: `website/content/en/docs/troubleshoot/_index.md`
+More: `website/content/en/docs/troubleshoot/_index.md` | https://sap.github.io/cap-operator/docs/troubleshoot/
 
 ## Controller Configuration
 
@@ -116,4 +121,4 @@ Tuned via env vars on the controller deployment. Key variables:
 | `MAX_CONCURRENT_RECONCILES_CAP_TENANT` | CAPTenant reconciliation concurrency |
 | `MAX_CONCURRENT_RECONCILES_CAP_TENANT_OPERATION` | CAPTenantOperation reconciliation concurrency |
 
-Full list: `website/content/en/docs/configuration/_index.md`
+Full list: `website/content/en/docs/configuration/_index.md` | https://sap.github.io/cap-operator/docs/configuration/

.agents/skills/cap-operator/references/credential-rotation.md

@@ -30,4 +30,4 @@ spec:
 - Keep old credentials valid for **at least 24 hours** after issuing new ones — do not revoke until all pods have restarted with the new credentials.
 - The batching window is configurable via the `ROLLOUT_DELAY` env var on the controller deployment (minimum `30s`).
 
-See `website/content/en/docs/usage/rollout-on-credential-update.md`.
+See `website/content/en/docs/usage/rollout-on-credential-update.md` | [Rollout on credential update](https://sap.github.io/cap-operator/docs/usage/rollout-on-credential-update/).

.agents/skills/cap-operator/references/deploy.md

@@ -155,3 +155,5 @@ The `getDependencies` endpoint is exposed automatically at:
 ```
 GET /dependencies/{providerSubaccountId}/{appName}/
 ```
+
+See `website/content/en/docs/usage/deploying-application.md` | [Deploying an application](https://sap.github.io/cap-operator/docs/usage/deploying-application/).

.agents/skills/cap-operator/references/domain.md

@@ -36,7 +36,7 @@ spec:
   ingressSelector:
     app: istio-ingressgateway
     istio: ingressgateway
-  tlsMode: Simple     # Simple (default) | Mutual
+  tlsMode: Simple     # Simple (default) | Mutual | OptionalMutual
   dnsMode: Subdomain  # None (default) | Wildcard | Subdomain | Custom
 ```
 
@@ -46,9 +46,9 @@ spec:
 |---|---|
 | `Simple` | Standard one-way TLS (default) |
 | `Mutual` | mTLS required — clients must present a certificate |
-| `OptionalMutual` | mTLS optional (`Domain` only — not supported on `ClusterDomain`) |
+| `OptionalMutual` | mTLS optional — client certificate is accepted if provided |
 
-When `tlsMode` is `Mutual` or `OptionalMutual`, provide additional CA certificates via `certConfig.additionalCACertificate`. See `website/content/en/docs/usage/domain-management/additional-ca.md`.
+When `tlsMode` is `Mutual` or `OptionalMutual`, provide additional CA certificates via `certConfig.additionalCACertificate`. See `website/content/en/docs/usage/domain-management/additional-ca.md` | [Additional CA certificates](https://sap.github.io/cap-operator/docs/usage/domain-management/additional-ca/).
 
 ## DNS modes
 
@@ -57,7 +57,7 @@ When `tlsMode` is `Mutual` or `OptionalMutual`, provide additional CA certificat
 | `None` | No DNS entry created (default) |
 | `Wildcard` | Single wildcard DNS entry (`*.<domain>`) |
 | `Subdomain` | Per-tenant subdomain DNS entries |
-| `Custom` | Template-based DNS entry — see `website/content/en/docs/usage/domain-management/custom-dns.md` |
+| `Custom` | Template-based DNS entry — see `website/content/en/docs/usage/domain-management/custom-dns.md` \| [Custom DNS](https://sap.github.io/cap-operator/docs/usage/domain-management/custom-dns/) |
 
 ## Referencing domains in CAPApplication
 
@@ -82,4 +82,4 @@ A mutation webhook will reject any attempt to reintroduce the `domains` section.
 1. Upgrade to v0.25.0 first — this runs the automatic `domains` → `domainRefs` migration.
 2. Then upgrade to the latest release.
 
-See `website/content/en/docs/usage/domain-management/_index.md`.
+See `website/content/en/docs/usage/domain-management/_index.md` | [Domain management](https://sap.github.io/cap-operator/docs/usage/domain-management/).

.agents/skills/cap-operator/references/service-exposure.md

@@ -59,3 +59,5 @@ For a domain `my.example.com` this produces:
 | `app.my.example.com` | `app:5000` |
 
 **Important:** Order routes most-specific-first within a `subDomain` to avoid routing conflicts (e.g. `/api/v2` before `/api`).
+
+See `website/content/en/docs/usage/service-exposure.md` | [Service exposure](https://sap.github.io/cap-operator/docs/usage/service-exposure/).

.agents/skills/cap-operator/references/upgrade.md

@@ -60,3 +60,5 @@ Defines execution order for `Content` workload jobs when a `CAPApplicationVersio
 ## Version Affinity (experimental)
 
 Add annotation `sme.sap.com/enable-version-affinity: "true"` to `CAPApplication` to keep users on their current version until logout. Set `sme.sap.com/logout-endpoint: "<path>"` on `CAPApplicationVersion` for a custom logout path (no leading slash).
+
+See `website/content/en/docs/usage/version-upgrade.md` | [Version upgrade](https://sap.github.io/cap-operator/docs/usage/version-upgrade/).