teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1
teleo-infrastructure/.agents/skills/crabbox/SKILL.md
twentyOne2x fed5cb0805 Add guarded canonical claim application 
- Normalize rich proposals into atomic reviewed canonical graph bundles with exact row verification.
- Harden reviewer/apply roles, upgrade ACLs, and prove generic plus Helmer lifecycles in isolated PostgreSQL.
- Publish repo-native VPS/GCP/Cory skills and live-readonly GCP inventory without changing the live VPS runtime.

`.agents/skills/crabbox/SKILL.md`
`.agents/skills/teleo-gcp-parity-ops/SKILL.md`
`.agents/skills/teleo-kb-db-change-workflow/SKILL.md`
`.agents/skills/teleo-leo-onboarding/SKILL.md`
`.agents/skills/teleo-vps-runtime-ops/SKILL.md`
`.agents/skills/working-leo-cory-outcomes/SKILL.md`
`docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.json`
`docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.md`
`docs/reports/leo-working-state-20260709/current-truth-index.md`
`docs/reports/leo-working-state-20260709/gcp-cloud-sql-t3-live-readonly-current.json`
`docs/reports/leo-working-state-20260709/gcp-cloud-sql-t3-live-readonly-current.md`
`docs/reports/leo-working-state-20260709/gcp-cloudsql-studio-parity-gate-current.json`
`docs/reports/leo-working-state-20260709/gcp-cloudsql-studio-parity-gate-current.md`
`docs/reports/leo-working-state-20260709/gcp-parallel-delegation-current.json`
`docs/reports/leo-working-state-20260709/helmer-approve-claim-clone-canary-current.json`
`docs/reports/leo-working-state-20260709/helmer-approve-claim-normalization-current.json`
`docs/reports/leo-working-state-20260709/skill-pack-manifest.json`
`docs/reports/leo-working-state-20260709/skill-pack-readme.md`
`docs/reports/leo-working-state-20260709/working-leo-current-state-20260709.md`
`docs/reports/leo-working-state-20260709/working-leo-definition-20260709.md`
`docs/reports/leo-working-state-20260709/working-leo-execution-plan-current.md`
`scripts/apply_proposal.py`
`scripts/apply_worker.py`
`scripts/approve_proposal.py`
`scripts/kb_apply_prereqs.sql`
`scripts/kb_proposal_normalize.py`
`scripts/probe_gcp_db_parity.py`
`scripts/run_approve_claim_clone_canary.py`
`scripts/run_approve_claim_isolated_container_canary.sh`
`tests/test_apply_proposal.py`
`tests/test_apply_worker.py`
`tests/test_approve_proposal.py`
`tests/test_kb_apply_prereqs.py`
`tests/test_kb_proposal_normalize.py`
`tests/test_kb_proposal_routes.py`
`tests/test_probe_gcp_db_parity.py`
`tests/test_repo_skill_pack.py`
2026-07-10 17:49:37 +02:00

1.5 KiB
Raw Blame History

name description
crabbox Use for remote Linux verification, isolated CI proof, Crabbox lease cleanup, and PR evidence without production deploys or secret forwarding.

Crabbox

Use Crabbox for remote Linux verification and PR proof only.

Allowed jobs:

  • crabbox job run unit
  • crabbox job run lint-phase1b
  • crabbox job run ci-contract
  • crabbox job run phase1b-local-proof
  • crabbox job run sync-smoke

Default workflow:

  1. Run crabbox job run --dry-run ci-contract.
  2. Run crabbox job run --dry-run phase1b-local-proof.
  3. Inspect the planned commands and confirm no production secrets or production deploy commands appear.
  4. Run crabbox job run ci-contract.
  5. Run crabbox job run phase1b-local-proof.
  6. Save the run id, lease id, stdout, downloaded proof JSON, and JUnit output.
  7. Stop the lease unless the CLI has already stopped it.

Boundaries:

  • Do not run production deploy commands from Crabbox.
  • Do not forward production GitHub, Forgejo, OpenRouter, SSH, Bitwarden, or VPS secrets.
  • Do not target the production decision-engine repo for sandbox proof.
  • Do not mutate the production VPS.
  • Do not call Crabbox proof equivalent to production proof unless the lease recreates /opt/teleo-eval, systemd services, runtime users, DB paths, timers, and deploy scripts.

Failure handling:

  • If sync sanity fails, stop the lease and retry on a fresh lease.
  • If a proof script fails, save the full run output and do not summarize it as a pass.
  • If a remote box has unknown state, stop it instead of debugging against reused state.