jbaruch/nanoclaw-host

Skills and rules for the NanoClaw host agent (Claude Code on Mac), covering plugin promotion, container management, staging checks, repository safety, and upstream updates.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

jbaruch/nanoclaw-host

Name: jbaruch/nanoclaw-host
Rating: 72.2 (1 reviews)
Author: jbaruch

Skills and rules for the NanoClaw host agent (Claude Code on Mac). Plugin promotion, container management, staging checks, repo-chain enforcement.

Installation

tessl install jbaruch/nanoclaw-host

Rules

Rule	Summary
boyscout-host	Host agent owns the full stack (source, plugin repos, scripts, deploy, NAS, containers) — fix any problem you find, except owner's-domain content (SOUL.md, personal skills, group memory).
copilot-nudge-after-10min	When you summon a Copilot review via the GraphQL `requestReviews` mutation (see the `ship-code` and `promote` skills for the full lifecycle and the exact GraphQL call) and the review hasn't started within 10 minutes, post a follow-up PR comment that tags `@copilot` to re-activate it.
cross-tier-skill-state	Cross-trust-tier skills must persist state under `/workspace/state/<skill-name>/` (RW in every container). Tier-pinned skills may use `/workspace/group/`.
dual-agent-coexistence	Two agents (AyeAye and host) update this system asynchronously. Never assume the latest version; never assume the other agent's work is stale or inferior without reading it.
host-conventions	Deployment mechanics: always use `./scripts/deploy.sh`, registry is the delivery artifact, scripts source `scripts/common.sh`.
no-deferral	Every session is the only session — fix problems now, not "later". Forbidden-pattern bullets enumerated.
no-error-suppression	Never use `\|\| true`, `2>/dev/null`, empty `catch {}`, or any form of silent error swallowing in scripts. If something fails, it must fail visibly.
nuke-semantics	Nuke a group = kill the running container only. Never delete registrations or group folders.
orchestrator-dep-refresh	When an npm-from-GitHub dep in `Dockerfile.orchestrator` ships a new version, the default `./scripts/deploy.sh` does NOT pick it up because BuildKit caches `RUN npm install -g <GitHub-repo>` by Dockerfile string, not by GitHub state. Use `./scripts/deploy.sh --no-cache` and verify the resulting dep version against the running container.
overlay-tile-authoring	Authoring contract for per-chat overlay tiles under `containerConfig.additionalTiles`: cadence frontmatter mandatory, one cadence per SKILL.md, reader-without-writer is a release blocker, live-runtime verification before shipped, cross-skill subprocess composition.
persona-persist-direct-push	Authority-of-record for the `coding-policy: ci-safety` Content-Only Direct-Push Carve-Out: `jbaruch/nanoclaw`'s `persist_global_file` may direct-push `groups/global/SOUL.md` + `SOUL-untrusted.md` to `main` (so an operator-approved soul edit survives deploy), gated by the deterministic allowlist + pre-push diff check in `src/ipc.ts`.
post-merge-publish-watch	Every plugin-repo merge runs the `coding-policy: ci-safety` release contract through `skills/release` Step 7, never a hand-rolled watch. This plugin's specialization: pass the workflow FILE (`publish.yml`) as `resolve-publish-run.sh`'s `<workflow>` argument, never a display name. A run that can't be resolved is unresolved, never clean.
repo-chain	Pull upstream updates directly into private NanoClaw; require explicit GitHub targets and authorization for upstream contributions.
staging-diff-protocol	Before judging staging content: diff, read, reason, merge improvements, then decide. Stale = empty diff only.
tessl-version-floating	Authority-of-record for the Runtime-Managed Manifest Carve-Out (approved exception to `coding-policy: dependency-management`). Every covered `tessl.json` declares `"mode": "managed"` and floats `jbaruch/*` at `latest`; third-party pins, except in `jbaruch/nanoclaw`'s two unattended-update manifests where everything floats. Enforcement: `jbaruch/nanoclaw`'s `scripts/deploy.sh` step 3b for that pair, `coding-policy`'s `check-tessl-latest.sh` `SessionStart` hook for the eight plugin repos.
snitchmd-image-floating	The `fetch_markdown` sidecar image default MUST stay `syabro/snitchmd:latest` (approved exception to `coding-policy: dependency-management`) — this dependency's value is adversarial freshness, so a pin degrades toward blocked fetches. `deploy.sh` verifies on each deploy that no pin has crept in.
sync-cli-floating	The agent image's `reclaim-tripit-timezones-sync` install MUST stay specifier-less (approved exception to `coding-policy: dependency-management`, First-Party Co-Shipped Dependency Carve-Out). `deploy.sh` verifies the bare reference AND the `ADD` refetch trigger directly above it.
os-package-floating	The `apt-get install` lists in the three container images carry no version specifiers (approved exception to `coding-policy: dependency-management`, OS-Package Runtime Carve-Out). `deploy.sh` verifies each covered image's base stays pinned and that no package appears outside the recorded set.
tile-content-pipeline	Plugin content updates flow through staging → promote (forbids live-NAS edits). Feature-branch PRs against a plugin repo are OK — same review surface.
ugos-compose-projects	Topology + UI contract for Docker Compose projects on UGOS Pro (NASync) where the compose file is source-of-truth in the repo: `/volume1/docker/<project>` directory symlink, in-repo `.env` symlink, sudo INSERT into UGOS Pro's SQLite DB. UGOS Pro UI is Start/Stop only — never "Edit"; never paste env literals.

Skills

Skill	Description
add-ugos-project	Register a new Docker Compose project on UGOS Pro (NASync) when the compose file lives in the nanoclaw repo. Plumbs the `/volume1/docker/PROJECT_NAME` directory symlink, the in-repo `.env` symlink, and the UGOS Pro SQLite registration row so the project appears in the Projects UI without UGOS rewriting the tracked compose file. Use when adding a new sidecar that needs UGOS Pro UI Start/Stop visibility, when wiring a repo-tracked compose project onto the NASync for the first time, when migrating an existing service to the symlinked-compose topology, or when asked to "register a UGOS project" / "add a sidecar to UGOS Pro".
check-staging	List pending skills and rules on the NAS staging area. Shows what the agent has created or updated that hasn't been promoted to plugins yet. Use before running promote, or when the user asks what's on staging.
extract-to-overlay	Sequential workflow for migrating an admin-plugin skill, rule, or script set into a per-chat overlay plugin. Audits cadence frontmatter, state-plane couplings, and cross-skill imports; moves files across two plugin repos; updates per-group additionalTiles config; ships each side through the publish pipeline; verifies live materialisation. Use when extracting an admin skill to an overlay, refactoring admin content into per-chat plugins, splitting capabilities out of nanoclaw-admin, or wiring additionalTiles for a freshly extracted overlay.
nuke	Kill a running agent container on the NAS by Telegram group JID. The orchestrator respawns a fresh container on the next message. Does NOT delete registration or group folder. Use when a container is stuck, stale, or needs a fresh start.
promote	Promote agent-created skills and rules from NAS staging to plugin GitHub repos — opens a PR from staging, then hands the review, merge, and publish-confirmation lifecycle to the release skill. Use when there are new items on staging, after check-staging shows pending items, or when asked to deploy skills, push to production, or publish rules to a plugin repo. The promote scripts keep the historical `TILE_NAME` env var.
reconcile	Verify that all tessl plugins are in sync between git source, tessl registry, and the NAS orchestrator. Reports drift, unpublished content, untracked files, and version mismatches. Use when plugin state seems wrong, container behavior looks stale, you suspect out-of-sync plugins, or need to check plugin health before a release. Run after promoting skills or after any manual plugin edits. The script keeps its historical name, `./scripts/reconcile-tiles.sh`.
ship-code	Ship a committed code change to private NanoClaw (jbaruch/nanoclaw) through a reviewed PR, merge, and branch cleanup. Use when asked to ship a NanoClaw fix, open its PR, or merge its changes. Plugin repositories use the release skill directly.
update-from-upstream	Pull updates from qwibitai/nanoclaw directly into private NanoClaw through a reviewed PR, then deploy to NAS. Use when upstream has new features, when the user asks to update NanoClaw, or when /update-nanoclaw is invoked.

See CHANGELOG.md for version history.

Development dependencies

tessl.json declares this repo's dev-time plugin dependencies. See tessl-version-floating for the carve-out this repo's manifest sits under.

Every jbaruch/* dependency floats at latest (Runtime-Managed Manifest Carve-Out, jbaruch/coding-policy: dependency-management).
jbaruch/coding-policy also installs the carve-out's deterministic check, the check-tessl-latest.sh SessionStart hook. Removing the dependency leaves this manifest unchecked.
finsi/codex-review is third-party and pins. Renewal mechanism: tessl update --yes runs each session via that hook and rewrites the pin once the registry passes it. Review the resulting manifest diff and land it as its own commit.