# Leo / Teleo Skill Pack - 2026-07-09

Purpose: reusable onboarding and operating knowledge for future Codex/Fable workers working on Leo, Teleo, the VPS, GCP parity, Telegram canaries, and KB database changes.

This is the repo-native skill set under `.agents/skills/`. It is evidence-linked and validated by `tests/test_repo_skill_pack.py`. It does not contain secrets, private key contents, bot tokens, or production mutation authorization.

## Skills In This Pack

1. `teleo-leo-onboarding`: company/product/architecture orientation before touching Leo or Teleo.
2. `working-leo-m3taversal-outcomes`: m3taversal's expected Leo behavior and the current benchmark.
3. `teleo-vps-runtime-ops`: VPS service, paths, Postgres, Docker, report sync, and stability checks.
4. `teleo-gcp-parity-ops`: passwordless GCP access, Cloud SQL parity, no-send replay, rollback, and cleanup.
5. `teleo-kb-db-change-workflow`: source composition plus approved proposal to canonical-row workflow with clone rehearsal and rollback.
6. `leo-telegram-canary-ops`: live Telegram/Chrome/Computer Use canaries for Leo bot behavior.
7. `teleo-infra-provenance`: repo, deploy, mirror, and runtime provenance map.
8. `teleo-proof-handoff`: evidence bundle and Fable/Codex worker handoff protocol.

## Current Claim Ceiling

- VPS Leo Telegram memory, KB audit, and staged write canaries are live-proven.
- A strict canonical `add_edge` apply canary is live-proven.
- Deterministic source composition, full-data clone composition/reasoning, and guarded approved-bundle application are isolated-proven with exact source/evidence/claim links, row deltas, rollback, and cleanup. Production rich packets remain unapplied.
- Narrow VPS DB truth and restart behavior are proven. Broad blind reasoning is not yet reliable; exact participant naming, neutral labels, and current-v1 schema guards are now required.
- GCP gateway liveness, private Cloud SQL identity, exact VPS-to-GCP canonical parity, and hardened adapter-free model replay are live-proven. The database matches across `39` tables and `52,164` rows. Durable operator identity and retained replay-clone cleanup remain open because the intended target service accounts are absent.

## Key References

- Current whole-system proof: `docs/reports/leo-working-state-20260709/working-leo-current-proof-20260712.md` and `.json`
- Current truth index: `docs/reports/leo-working-state-20260709/current-truth-index.md`
- Operator surface map: `docs/reports/leo-working-state-20260709/operator-surface-map.md`
- Fable onboarding prompt: `docs/reports/leo-working-state-20260709/fable-leo-teleo-onboarding.md`
- PR #72 VPS auto-deploy/runtime readback: `docs/reports/leo-working-state-20260709/pr72-vps-auto-deploy-runtime-nonchange-current.md`
- GCP canonical parity: `docs/reports/leo-working-state-20260709/gcp-canonical-parity-live-20260712.json`
- GCP model replay (legacy artifact filename): `docs/reports/leo-working-state-20260709/gcp-cory-model-replay-current.json`
- Three-day delivery delta: `docs/reports/leo-working-state-20260709/working-leo-three-day-delivery-summary-20260713.md`
- Blind out-of-sample audit: `docs/reports/leo-working-state-20260709/telegram-handler-blind-oos-audit-current.json`
- GCP operator access gate: `docs/reports/leo-working-state-20260709/gcp-operator-access-blocker-current.json`
- Skill manifest: `skill-pack-manifest.json`

## Discovery

Codex-compatible workers should discover the committed `.agents/skills/` tree from this repository. The manifest is the index; each skill points to current retained evidence rather than embedding secrets or pretending a stale snapshot is live truth.