Repository navigation
Add nethserver-ns8-core skill - #7
Merged
Merged
Conversation
stephdl
force-pushed
the
ns8-core-skill
branch
from
August 31, 2026 08:54
022b2eb to
f8eecdc
Compare
The existing skills describe ns8-core from the outside: nethserver-ns8-module covers how a module consumes the platform, nethserver-admin how to operate a cluster. Neither covers ns8-core as an object of development. The skill delegates rather than restates. It indexes AGENTS.md, the per-component README.md files and docs/, then carries only what none of them document: the parallel entry points of agent.tasks, the update hook skipped without warning when it lacks the executable bit, the two func main sharing one package directory. Every claim is verified against the sources at origin/main.
stephdl
force-pushed
the
ns8-core-skill
branch
from
August 31, 2026 09:05
f8eecdc to
7e3a352
Compare
Apply the progressive disclosure rules the repository adopted in #10. SKILL.md becomes a router of 73 lines: scope, reference map, the rules that hold whatever gets read, and the common mistakes. The 660 remaining lines move verbatim into five reference files, so an invoking turn reads one of them instead of all. Compress the description to triggers only, dropping the coverage list. Keep the symptom questions, which routing probes measured, and add the literal update-core.d/ path for the probe that reached no skill.
Measured routing on 6 questions in a real NethServer/ns8-core checkout, with the eight skills loaded in an isolated config and no skill named in the prompt. The 786-character description reached the skill once. Four variants later, the shortest one wins: 374 characters, the repository name, the directories a core task touches, and one line of task keywords. It fired 7 times out of 12 across two runs. Longer variants do worse, and adding keywords for the two remaining misses made it worse again (1 of 9). Those two misses look structural rather than fixable here: asked why go build fails, or which test loop to run, the model runs the command instead of loading a skill.
Measured with ACL DRYRUN on a live leader running core 3.22.0-dev.3: cluster and api-server are accepted on both cluster/tasks and node/<id>/tasks, a node agent only on its own node/<id>/tasks, and a module agent on neither. The rule claimed that only cluster and api-server may LPUSH tasks at all, which is too absolute. State the queue the restriction applies to, and record the read-only command that reproduces the check.
Nine claims of the api-server reference already appear in the repository's own files: authorization by filepath.Match, the GET bypass, TOTP, the JWT claims, the SQLite WAL audit store and its three events, the Melody relay and the authorize socket action in core/api-server/AGENTS.md, and the filesystem routing in core/api-moduled/AGENTS.md. The skill exists to carry what those files do not. Keep four facts no repository file states: the TODO on the GET bypass, the /api/2FA exemptions, grants re-read per request through RedisAuthorization, and melody.New() called without overrides. Point at the delegated files for the rest. Fix one of them while here: the exemption covers DELETE /api/2FA as well as POST, per middleware.go.
Two edits to the router. The body asked for a reference read "before writing anything" while the description asked for one before searching the tree by hand; the narrower wording is the one that fires, so a read-only diagnosis opened no reference at all. Widen it to the first grep, and add the symptoms that bring a reader here without a topic in mind. Then the public API bullet: pypkg.pth puts cluster and node on every agent's path, and core's own public surfaces import them, so the boundary it stated was wrong in the direction that breaks module agents.
Leader-only holds for grants, alerts, inventory, modules and vpn. cluster.backup runs on every node through run-backup, rclonegwctl and validate-backup-destination, and in module agents through the inherited list-backup-repositories. cluster.userdomains reaches module agents through agent/ldapproxy.py. node.ports_manager serves the port actions on every node, so node is not leader-only at all.
stephdl
force-pushed
the
ns8-core-skill
branch
from
September 7, 2026 14:15
77cbe63 to
2f200cd
Compare
stephdl
marked this pull request as ready for review
September 7, 2026 15:31
gsanchietti
approved these changes
Sep 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
nethserver-ns8-modulecovers a module using the platform,nethserver-adminrunning a cluster. This adds ns8-core as something you develop.It indexes
AGENTS.md, the componentREADME.mdfiles anddocs/instead of restating them, and keeps only what none of them document: the parallelagent.tasksentry points, the update hook skipped silently without the executable bit, the twofunc mainin one package directory. An 81-lineSKILL.mdrouter plus fivereferences/*.md, following #10 — a turn reads one, not all.Every claim was checked against a real checkout. The ones that failed are gone or fixed in place, including which agents may LPUSH into a task queue and the wrong
cluster/nodepackage boundary.Routing
12 questions in an ns8-core checkout, eight skills loaded, no skill named, one
claude -peach. At 374 characters the description fired 7/12; longer topic-shaped drafts did worse.The two persistent misses were symptom questions, so the shipped description names symptoms too and is back to 665 characters. First trial fired and cost 8 tool calls against ~20 without it — one sample, not a result.
Firing is not helping: on that trial the map sent the reader to
core-ui.mdon the word UI while the cause was incluster.modules, which the skill does not index. Next commit.