# Leo / Teleo Skill Pack - 2026-07-15

Purpose: give a new engineer or agent one repo-native route into Leo/Teleo
architecture, operations, database lifecycle, proof tiers, secrets, and recovery
without relying on historical chat or unmerged branch prose.

The pack lives under `.agents/skills/`, contains no credentials, and grants no
production database mutation or GCP promotion authority.

## Clean-Context Entry Point

From the repository root:

```bash
.agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py --root .
.agents/skills/teleo-leo-onboarding/scripts/install_skill_pack.py \
  --root . \
  --target /private/tmp/teleo-clean-agent/skills
.agents/skills/teleo-leo-onboarding/scripts/run_clean_context_canary.py --root .
```

The validator uses standard-library Python through its executable shebang. For
pytest, create the repository virtual environment from `README.md` and use
`.venv/bin/python`; do not assume a bare `python` executable exists.

## Skills In This Pack

1. `teleo-leo-onboarding`: product, architecture, task router, and first canary.
2. `working-leo-m3taversal-outcomes`: exact identity discipline and working-Leo proof ceiling.
3. `teleo-vps-runtime-ops`: VPS services, Postgres, incidents, and cleanup.
4. `teleo-gcp-parity-ops`: GCP/Cloud SQL parity, no-send replay, and rollback.
5. `teleo-kb-db-change-workflow`: source ingestion through guarded proposal/apply.
6. `teleo-reconstruction-recovery`: snapshot, ledger, and semantic recovery modes.
7. `leo-telegram-canary-ops`: authorized Leo-specific Telegram canaries.
8. `teleo-infra-provenance`: repository, deploy, runtime, DB, and proof provenance.
9. `teleo-proof-handoff`: tiered evidence and continuation handoffs.
10. `nousresearch-hermes-agent`: Hermes packaging and runtime boundaries.
11. `teleo-db-operator`: read-first pipeline SQLite operation.
12. `private-password-storage`: device-local secure input and presence checks.
13. `crabbox`: isolated remote Linux and CI proof.
14. `decision-engine-refinement`: replayable evaluator and model-quality work.
15. `living-ip-kb-interop`: propose-first external-agent KB access.
16. `openclaw-agent`: no-secret OpenClaw workspace packaging.

The machine-readable topic coverage and exact paths are in
`docs/reports/leo-working-state-20260709/skill-pack-manifest.json`.

## Repository Reconciliation

- PR #146 is merged: deterministic turn manifests and the first exact
  genesis-plus-ledger reconstruction slice are canonical `main` behavior.
- PR #147 is merged: the unseen-reasoning verifier accepts valid reasoning
  variance while keeping evidence and receipt gates.
- PR #148 is open candidate evidence only. Its proposed least-privilege GCP
  files and live end state are not canonical until merged and receipt-verified.

## Current Claim Ceiling

- T2 clean-context local skill install, route validation, and focused tests are
  the onboarding target for this pack.
- VPS no-send behavior, isolated proposal/apply, snapshot recovery, disposable
  GCP parity, and bounded no-send GCP reasoning have retained evidence.
- Persistent GCP `teleo_canonical` remains staging. No GCP promotion or cutover
  is authorized or claimed.
- Production rich packets remain unapplied. A current Telegram-visible complete
  flow is not proven by this pack.

## Key References

- Fresh-agent onboarding receipt: `docs/reports/leo-working-state-20260709/skill-pack-clean-context-agent-review-current.json`
- Isolated-install acceptance receipt: `docs/reports/leo-working-state-20260709/skill-pack-clean-context-canary-current.json`
- Current truth: `docs/reports/leo-working-state-20260709/current-truth-index.md`
- Architecture/outcomes: `docs/reports/leo-working-state-20260709/leo-architecture-work-and-outcomes-20260714.md`
- Recovery contract: `docs/kb-rebuild-and-recompile.md`
- GCP database-first proof: `docs/reports/leo-working-state-20260709/gcp-db-first-working-leo-20260714.md`
- GCP no-send reasoning receipt: `docs/reports/leo-working-state-20260709/gcp-db-first-blind-claim-current.json`
- Unified turn receipt: `docs/reports/leo-working-state-20260709/leo-unified-turn-manifest-canary-current.json`
- Operator map: `docs/reports/leo-working-state-20260709/operator-surface-map.md`

## Team Change Notes

- Replaced the missing legacy GCP replay route with the current database-first
  no-send receipt.
- Added deterministic install and path-validation commands.
- Added separate T2 receipts for deterministic isolated install/path validation
  and fresh-context agent reasoning, stale-claim rejection, and cleanup.
- Added an explicit topic router and recovery skill.
- Added merged-vs-open PR boundaries so branch candidates cannot silently become
  source-of-truth instructions.
- Added tests for coverage, route existence, installer behavior, and exact
  m3taversal identity prose.