fed5cb0805
- Normalize rich proposals into atomic reviewed canonical graph bundles with exact row verification. - Harden reviewer/apply roles, upgrade ACLs, and prove generic plus Helmer lifecycles in isolated PostgreSQL. - Publish repo-native VPS/GCP/Cory skills and live-readonly GCP inventory without changing the live VPS runtime. `.agents/skills/crabbox/SKILL.md` `.agents/skills/teleo-gcp-parity-ops/SKILL.md` `.agents/skills/teleo-kb-db-change-workflow/SKILL.md` `.agents/skills/teleo-leo-onboarding/SKILL.md` `.agents/skills/teleo-vps-runtime-ops/SKILL.md` `.agents/skills/working-leo-cory-outcomes/SKILL.md` `docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.json` `docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.md` `docs/reports/leo-working-state-20260709/current-truth-index.md` `docs/reports/leo-working-state-20260709/gcp-cloud-sql-t3-live-readonly-current.json` `docs/reports/leo-working-state-20260709/gcp-cloud-sql-t3-live-readonly-current.md` `docs/reports/leo-working-state-20260709/gcp-cloudsql-studio-parity-gate-current.json` `docs/reports/leo-working-state-20260709/gcp-cloudsql-studio-parity-gate-current.md` `docs/reports/leo-working-state-20260709/gcp-parallel-delegation-current.json` `docs/reports/leo-working-state-20260709/helmer-approve-claim-clone-canary-current.json` `docs/reports/leo-working-state-20260709/helmer-approve-claim-normalization-current.json` `docs/reports/leo-working-state-20260709/skill-pack-manifest.json` `docs/reports/leo-working-state-20260709/skill-pack-readme.md` `docs/reports/leo-working-state-20260709/working-leo-current-state-20260709.md` `docs/reports/leo-working-state-20260709/working-leo-definition-20260709.md` `docs/reports/leo-working-state-20260709/working-leo-execution-plan-current.md` `scripts/apply_proposal.py` `scripts/apply_worker.py` `scripts/approve_proposal.py` `scripts/kb_apply_prereqs.sql` `scripts/kb_proposal_normalize.py` `scripts/probe_gcp_db_parity.py` `scripts/run_approve_claim_clone_canary.py` `scripts/run_approve_claim_isolated_container_canary.sh` `tests/test_apply_proposal.py` `tests/test_apply_worker.py` `tests/test_approve_proposal.py` `tests/test_kb_apply_prereqs.py` `tests/test_kb_proposal_normalize.py` `tests/test_kb_proposal_routes.py` `tests/test_probe_gcp_db_parity.py` `tests/test_repo_skill_pack.py`
40 lines
1.5 KiB
Markdown
40 lines
1.5 KiB
Markdown
---
|
|
name: crabbox
|
|
description: Use for remote Linux verification, isolated CI proof, Crabbox lease cleanup, and PR evidence without production deploys or secret forwarding.
|
|
---
|
|
|
|
# Crabbox
|
|
|
|
Use Crabbox for remote Linux verification and PR proof only.
|
|
|
|
Allowed jobs:
|
|
|
|
- `crabbox job run unit`
|
|
- `crabbox job run lint-phase1b`
|
|
- `crabbox job run ci-contract`
|
|
- `crabbox job run phase1b-local-proof`
|
|
- `crabbox job run sync-smoke`
|
|
|
|
Default workflow:
|
|
|
|
1. Run `crabbox job run --dry-run ci-contract`.
|
|
2. Run `crabbox job run --dry-run phase1b-local-proof`.
|
|
3. Inspect the planned commands and confirm no production secrets or production deploy commands appear.
|
|
4. Run `crabbox job run ci-contract`.
|
|
5. Run `crabbox job run phase1b-local-proof`.
|
|
6. Save the run id, lease id, stdout, downloaded proof JSON, and JUnit output.
|
|
7. Stop the lease unless the CLI has already stopped it.
|
|
|
|
Boundaries:
|
|
|
|
- Do not run production deploy commands from Crabbox.
|
|
- Do not forward production GitHub, Forgejo, OpenRouter, SSH, Bitwarden, or VPS secrets.
|
|
- Do not target the production `decision-engine` repo for sandbox proof.
|
|
- Do not mutate the production VPS.
|
|
- Do not call Crabbox proof equivalent to production proof unless the lease recreates `/opt/teleo-eval`, systemd services, runtime users, DB paths, timers, and deploy scripts.
|
|
|
|
Failure handling:
|
|
|
|
- If sync sanity fails, stop the lease and retry on a fresh lease.
|
|
- If a proof script fails, save the full run output and do not summarize it as a pass.
|
|
- If a remote box has unknown state, stop it instead of debugging against reused state.
|