15c30f1fbe
Some checks are pending
CI / lint-and-test (push) Waiting to run
* make Leo skill onboarding clean-context reproducible * harden Leo clean-context skill acceptance
91 lines
4.7 KiB
Markdown
91 lines
4.7 KiB
Markdown
# Leo / Teleo Skill Pack - 2026-07-15
|
|
|
|
Purpose: give a new engineer or agent one repo-native route into Leo/Teleo
|
|
architecture, operations, database lifecycle, proof tiers, secrets, and recovery
|
|
without relying on historical chat or unmerged branch prose.
|
|
|
|
The pack lives under `.agents/skills/`, contains no credentials, and grants no
|
|
production database mutation or GCP promotion authority.
|
|
|
|
## Clean-Context Entry Point
|
|
|
|
From the repository root:
|
|
|
|
```bash
|
|
.agents/skills/teleo-leo-onboarding/scripts/validate_skill_pack.py --root .
|
|
.agents/skills/teleo-leo-onboarding/scripts/install_skill_pack.py \
|
|
--root . \
|
|
--target /private/tmp/teleo-clean-agent/skills
|
|
.agents/skills/teleo-leo-onboarding/scripts/run_clean_context_canary.py --root .
|
|
```
|
|
|
|
The validator uses standard-library Python through its executable shebang. For
|
|
pytest, create the repository virtual environment from `README.md` and use
|
|
`.venv/bin/python`; do not assume a bare `python` executable exists.
|
|
|
|
## Skills In This Pack
|
|
|
|
1. `teleo-leo-onboarding`: product, architecture, task router, and first canary.
|
|
2. `working-leo-m3taversal-outcomes`: exact identity discipline and working-Leo proof ceiling.
|
|
3. `teleo-vps-runtime-ops`: VPS services, Postgres, incidents, and cleanup.
|
|
4. `teleo-gcp-parity-ops`: GCP/Cloud SQL parity, no-send replay, and rollback.
|
|
5. `teleo-kb-db-change-workflow`: source ingestion through guarded proposal/apply.
|
|
6. `teleo-reconstruction-recovery`: snapshot, ledger, and semantic recovery modes.
|
|
7. `leo-telegram-canary-ops`: authorized Leo-specific Telegram canaries.
|
|
8. `teleo-infra-provenance`: repository, deploy, runtime, DB, and proof provenance.
|
|
9. `teleo-proof-handoff`: tiered evidence and continuation handoffs.
|
|
10. `nousresearch-hermes-agent`: Hermes packaging and runtime boundaries.
|
|
11. `teleo-db-operator`: read-first pipeline SQLite operation.
|
|
12. `private-password-storage`: device-local secure input and presence checks.
|
|
13. `crabbox`: isolated remote Linux and CI proof.
|
|
14. `decision-engine-refinement`: replayable evaluator and model-quality work.
|
|
15. `living-ip-kb-interop`: propose-first external-agent KB access.
|
|
16. `openclaw-agent`: no-secret OpenClaw workspace packaging.
|
|
|
|
The machine-readable topic coverage and exact paths are in
|
|
`docs/reports/leo-working-state-20260709/skill-pack-manifest.json`.
|
|
|
|
## Repository Reconciliation
|
|
|
|
- PR #146 is merged: deterministic turn manifests and the first exact
|
|
genesis-plus-ledger reconstruction slice are canonical `main` behavior.
|
|
- PR #147 is merged: the unseen-reasoning verifier accepts valid reasoning
|
|
variance while keeping evidence and receipt gates.
|
|
- PR #148 is open candidate evidence only. Its proposed least-privilege GCP
|
|
files and live end state are not canonical until merged and receipt-verified.
|
|
|
|
## Current Claim Ceiling
|
|
|
|
- T2 clean-context local skill install, route validation, and focused tests are
|
|
the onboarding target for this pack.
|
|
- VPS no-send behavior, isolated proposal/apply, snapshot recovery, disposable
|
|
GCP parity, and bounded no-send GCP reasoning have retained evidence.
|
|
- Persistent GCP `teleo_canonical` remains staging. No GCP promotion or cutover
|
|
is authorized or claimed.
|
|
- Production rich packets remain unapplied. A current Telegram-visible complete
|
|
flow is not proven by this pack.
|
|
|
|
## Key References
|
|
|
|
- Fresh-agent onboarding receipt: `docs/reports/leo-working-state-20260709/skill-pack-clean-context-agent-review-current.json`
|
|
- Isolated-install acceptance receipt: `docs/reports/leo-working-state-20260709/skill-pack-clean-context-canary-current.json`
|
|
- Current truth: `docs/reports/leo-working-state-20260709/current-truth-index.md`
|
|
- Architecture/outcomes: `docs/reports/leo-working-state-20260709/leo-architecture-work-and-outcomes-20260714.md`
|
|
- Recovery contract: `docs/kb-rebuild-and-recompile.md`
|
|
- GCP database-first proof: `docs/reports/leo-working-state-20260709/gcp-db-first-working-leo-20260714.md`
|
|
- GCP no-send reasoning receipt: `docs/reports/leo-working-state-20260709/gcp-db-first-blind-claim-current.json`
|
|
- Unified turn receipt: `docs/reports/leo-working-state-20260709/leo-unified-turn-manifest-canary-current.json`
|
|
- Operator map: `docs/reports/leo-working-state-20260709/operator-surface-map.md`
|
|
|
|
## Team Change Notes
|
|
|
|
- Replaced the missing legacy GCP replay route with the current database-first
|
|
no-send receipt.
|
|
- Added deterministic install and path-validation commands.
|
|
- Added separate T2 receipts for deterministic isolated install/path validation
|
|
and fresh-context agent reasoning, stale-claim rejection, and cleanup.
|
|
- Added an explicit topic router and recovery skill.
|
|
- Added merged-vs-open PR boundaries so branch candidates cannot silently become
|
|
source-of-truth instructions.
|
|
- Added tests for coverage, route existence, installer behavior, and exact
|
|
m3taversal identity prose.
|