jbaruch/nanoclaw-host
Skills and rules for the NanoClaw host agent (Claude Code on Mac), covering plugin promotion, container management, staging checks, repository safety, and upstream updates.
72
Quality
90%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Securityby
Medium
Suggest reviewing before use
jbaruch/nanoclaw-host
Skills and rules for the NanoClaw host agent (Claude Code on Mac). Plugin promotion, container management, staging checks, repo-chain enforcement.
Installation
tessl install jbaruch/nanoclaw-hostRules
| Rule | Summary |
|---|---|
| boyscout-host | Host agent owns the full stack (source, plugin repos, scripts, deploy, NAS, containers) — fix any problem you find, except owner's-domain content (SOUL.md, personal skills, group memory). |
| copilot-nudge-after-10min | When you summon a Copilot review via the GraphQL requestReviews mutation (see the ship-code and promote skills for the full lifecycle and the exact GraphQL call) and the review hasn't started within 10 minutes, post a follow-up PR comment that tags @copilot to re-activate it. |
| cross-tier-skill-state | Cross-trust-tier skills must persist state under /workspace/state/<skill-name>/ (RW in every container). Tier-pinned skills may use /workspace/group/. |
| dual-agent-coexistence | Two agents (AyeAye and host) update this system asynchronously. Never assume the latest version; never assume the other agent's work is stale or inferior without reading it. |
| host-conventions | Deployment mechanics: always use ./scripts/deploy.sh, registry is the delivery artifact, scripts source scripts/common.sh. |
| no-deferral | Every session is the only session — fix problems now, not "later". Forbidden-pattern bullets enumerated. |
| no-error-suppression | Never use || true, 2>/dev/null, empty catch {}, or any form of silent error swallowing in scripts. If something fails, it must fail visibly. |
| nuke-semantics | Nuke a group = kill the running container only. Never delete registrations or group folders. |
| orchestrator-dep-refresh | When an npm-from-GitHub dep in Dockerfile.orchestrator ships a new version, the default ./scripts/deploy.sh does NOT pick it up because BuildKit caches RUN npm install -g <GitHub-repo> by Dockerfile string, not by GitHub state. Use ./scripts/deploy.sh --no-cache and verify the resulting dep version against the running container. |
| overlay-tile-authoring | Authoring contract for per-chat overlay tiles under containerConfig.additionalTiles: cadence frontmatter mandatory, one cadence per SKILL.md, reader-without-writer is a release blocker, live-runtime verification before shipped, cross-skill subprocess composition. |
| persona-persist-direct-push | Authority-of-record for the coding-policy: ci-safety Content-Only Direct-Push Carve-Out: jbaruch/nanoclaw's persist_global_file may direct-push groups/global/SOUL.md + SOUL-untrusted.md to main (so an operator-approved soul edit survives deploy), gated by the deterministic allowlist + pre-push diff check in src/ipc.ts. |
| post-merge-publish-watch | Every plugin-repo merge runs the coding-policy: ci-safety release contract through skills/release Step 7, never a hand-rolled watch. This plugin's specialization: pass the workflow FILE (publish.yml) as resolve-publish-run.sh's <workflow> argument, never a display name. A run that can't be resolved is unresolved, never clean. |
| repo-chain | Pull upstream updates directly into private NanoClaw; require explicit GitHub targets and authorization for upstream contributions. |
| staging-diff-protocol | Before judging staging content: diff, read, reason, merge improvements, then decide. Stale = empty diff only. |
| tessl-version-floating | Authority-of-record for the Runtime-Managed Manifest Carve-Out (approved exception to coding-policy: dependency-management). Every covered tessl.json declares "mode": "managed" and floats jbaruch/* at latest; third-party pins, except in jbaruch/nanoclaw's two unattended-update manifests where everything floats. Enforcement: jbaruch/nanoclaw's scripts/deploy.sh step 3b for that pair, coding-policy's check-tessl-latest.sh SessionStart hook for the eight plugin repos. |
| snitchmd-image-floating | The fetch_markdown sidecar image default MUST stay syabro/snitchmd:latest (approved exception to coding-policy: dependency-management) — this dependency's value is adversarial freshness, so a pin degrades toward blocked fetches. deploy.sh verifies on each deploy that no pin has crept in. |
| sync-cli-floating | The agent image's reclaim-tripit-timezones-sync install MUST stay specifier-less (approved exception to coding-policy: dependency-management, First-Party Co-Shipped Dependency Carve-Out). deploy.sh verifies the bare reference AND the ADD refetch trigger directly above it. |
| os-package-floating | The apt-get install lists in the three container images carry no version specifiers (approved exception to coding-policy: dependency-management, OS-Package Runtime Carve-Out). deploy.sh verifies each covered image's base stays pinned and that no package appears outside the recorded set. |
| tile-content-pipeline | Plugin content updates flow through staging → promote (forbids live-NAS edits). Feature-branch PRs against a plugin repo are OK — same review surface. |
| ugos-compose-projects | Topology + UI contract for Docker Compose projects on UGOS Pro (NASync) where the compose file is source-of-truth in the repo: /volume1/docker/<project> directory symlink, in-repo .env symlink, sudo INSERT into UGOS Pro's SQLite DB. UGOS Pro UI is Start/Stop only — never "Edit"; never paste env literals. |
Skills
| Skill | Description |
|---|---|
| add-ugos-project | Register a new Docker Compose project on UGOS Pro (NASync) when the compose file lives in the nanoclaw repo. Plumbs the /volume1/docker/PROJECT_NAME directory symlink, the in-repo .env symlink, and the UGOS Pro SQLite registration row so the project appears in the Projects UI without UGOS rewriting the tracked compose file. Use when adding a new sidecar that needs UGOS Pro UI Start/Stop visibility, when wiring a repo-tracked compose project onto the NASync for the first time, when migrating an existing service to the symlinked-compose topology, or when asked to "register a UGOS project" / "add a sidecar to UGOS Pro". |
| check-staging | List pending skills and rules on the NAS staging area. Shows what the agent has created or updated that hasn't been promoted to plugins yet. Use before running promote, or when the user asks what's on staging. |
| extract-to-overlay | Sequential workflow for migrating an admin-plugin skill, rule, or script set into a per-chat overlay plugin. Audits cadence frontmatter, state-plane couplings, and cross-skill imports; moves files across two plugin repos; updates per-group additionalTiles config; ships each side through the publish pipeline; verifies live materialisation. Use when extracting an admin skill to an overlay, refactoring admin content into per-chat plugins, splitting capabilities out of nanoclaw-admin, or wiring additionalTiles for a freshly extracted overlay. |
| nuke | Kill a running agent container on the NAS by Telegram group JID. The orchestrator respawns a fresh container on the next message. Does NOT delete registration or group folder. Use when a container is stuck, stale, or needs a fresh start. |
| promote | Promote agent-created skills and rules from NAS staging to plugin GitHub repos — opens a PR from staging, then hands the review, merge, and publish-confirmation lifecycle to the release skill. Use when there are new items on staging, after check-staging shows pending items, or when asked to deploy skills, push to production, or publish rules to a plugin repo. The promote scripts keep the historical TILE_NAME env var. |
| reconcile | Verify that all tessl plugins are in sync between git source, tessl registry, and the NAS orchestrator. Reports drift, unpublished content, untracked files, and version mismatches. Use when plugin state seems wrong, container behavior looks stale, you suspect out-of-sync plugins, or need to check plugin health before a release. Run after promoting skills or after any manual plugin edits. The script keeps its historical name, ./scripts/reconcile-tiles.sh. |
| ship-code | Ship a committed code change to private NanoClaw (jbaruch/nanoclaw) through a reviewed PR, merge, and branch cleanup. Use when asked to ship a NanoClaw fix, open its PR, or merge its changes. Plugin repositories use the release skill directly. |
| update-from-upstream | Pull updates from qwibitai/nanoclaw directly into private NanoClaw through a reviewed PR, then deploy to NAS. Use when upstream has new features, when the user asks to update NanoClaw, or when /update-nanoclaw is invoked. |
See CHANGELOG.md for version history.
Development dependencies
tessl.json declares this repo's dev-time plugin dependencies. See tessl-version-floating for the carve-out this repo's manifest sits under.
- Every
jbaruch/*dependency floats atlatest(Runtime-Managed Manifest Carve-Out,jbaruch/coding-policy: dependency-management). jbaruch/coding-policyalso installs the carve-out's deterministic check, thecheck-tessl-latest.shSessionStarthook. Removing the dependency leaves this manifest unchecked.finsi/codex-reviewis third-party and pins. Renewal mechanism:tessl update --yesruns each session via that hook and rewrites the pin once the registry passes it. Review the resulting manifest diff and land it as its own commit.
- Workspace
- jbaruch
- Visibility
- Public
- Created
- Last updated
- Repository
- https://github.com/jbaruch/nanoclaw-host
- Publish Source
- GitHub
- Badge