From d2eeb644333e2f9783aeae60a0a7be24959cedf7 Mon Sep 17 00:00:00 2001 From: fargo Date: Wed, 19 Aug 2026 14:34:00 -0500 Subject: [PATCH] skills: sanitize operator-identity tokens from folded ops skills Four folded skills carried operator identity tokens that the sanitization gate (verify-sanitized.sh) forbids in the public framework package: - kickstart: template path pointed at a private brain checkout; now uses the framework-shipped $MOSAIC_HOME/templates/docs/TASKS.md.template - mosaic-deploy: dropped one estate-specific stack-name row from the example table - mosaic-portainer, mosaic-woodpecker: credentials now name the framework credentials store (load_credentials ) instead of a private checkout path Estate-specific values can live in a skills-local override, which the linker applies with precedence over canonical skills. --- packages/mosaic/framework/skills/kickstart/SKILL.md | 10 +++++----- .../mosaic/framework/skills/mosaic-deploy/SKILL.md | 1 - .../mosaic/framework/skills/mosaic-portainer/SKILL.md | 2 +- .../mosaic/framework/skills/mosaic-woodpecker/SKILL.md | 2 +- 4 files changed, 7 insertions(+), 8 deletions(-) diff --git a/packages/mosaic/framework/skills/kickstart/SKILL.md b/packages/mosaic/framework/skills/kickstart/SKILL.md index 8847e070..b90fda94 100644 --- a/packages/mosaic/framework/skills/kickstart/SKILL.md +++ b/packages/mosaic/framework/skills/kickstart/SKILL.md @@ -166,13 +166,13 @@ Always load these orchestrator-relevant skills: Create tracking files using templates: ```bash -TEMPLATES=~/src/jarvis-brain/docs/templates +MOSAIC_HOME="${MOSAIC_HOME:-$HOME/.config/mosaic}" -# Create tasks.md scaffold -envsubst < $TEMPLATES/orchestrator/tasks.md.template > docs/tasks.md +# Create tasks.md scaffold from the framework-shipped template +cp "$MOSAIC_HOME/templates/docs/TASKS.md.template" docs/tasks.md -# Create learnings tracking -envsubst < $TEMPLATES/orchestrator/orchestrator-learnings.json.template > docs/orchestrator-learnings.json +# Create learnings tracking (scaffold — adapt to your estate's template) +echo '{}' > docs/orchestrator-learnings.json ``` Then populate `docs/tasks.md` with tasks derived from the issues: diff --git a/packages/mosaic/framework/skills/mosaic-deploy/SKILL.md b/packages/mosaic/framework/skills/mosaic-deploy/SKILL.md index 46efe44e..5177701c 100644 --- a/packages/mosaic/framework/skills/mosaic-deploy/SKILL.md +++ b/packages/mosaic/framework/skills/mosaic-deploy/SKILL.md @@ -69,7 +69,6 @@ Check deployment: | mosaic-stack | `mosaic-stack` | | sage-phr | `sage-phr` | | openbrain | `openbrain` | -| jarvis-crypto | `jarvis-crypto` | | firefly | `firefly` | ## Notes diff --git a/packages/mosaic/framework/skills/mosaic-portainer/SKILL.md b/packages/mosaic/framework/skills/mosaic-portainer/SKILL.md index 47c2dbaf..5c191f0e 100644 --- a/packages/mosaic/framework/skills/mosaic-portainer/SKILL.md +++ b/packages/mosaic/framework/skills/mosaic-portainer/SKILL.md @@ -56,4 +56,4 @@ source ~/.config/mosaic/tools/_lib/credentials.sh && load_credentials portainer - Portainer URL: `https://10.1.1.43:9443` - Primary Docker host: `w-docker0` (10.1.1.45) managed via Portainer agent - Docker Swarm image updates: `stack-redeploy.sh -p` does NOT guarantee new image pull if digest is pinned; SSH to node and `docker pull` first if needed -- Credentials source: `~/src/jarvis-brain/credentials.json` (must be cloned) +- Credentials: `load_credentials portainer` (framework credentials store) diff --git a/packages/mosaic/framework/skills/mosaic-woodpecker/SKILL.md b/packages/mosaic/framework/skills/mosaic-woodpecker/SKILL.md index 37a063c0..d599e887 100644 --- a/packages/mosaic/framework/skills/mosaic-woodpecker/SKILL.md +++ b/packages/mosaic/framework/skills/mosaic-woodpecker/SKILL.md @@ -65,6 +65,6 @@ cd ~/src/ ## Notes - CI URL: `https://ci.mosaicstack.dev` -- Credentials: `load_credentials woodpecker` (from `~/src/jarvis-brain/credentials.json`) +- Credentials: `load_credentials woodpecker` (framework credentials store) - `ci-queue-wait.sh` is automatically called by `pr-merge.sh` unless `--skip-queue-guard` is passed - Pipeline output shows step-level status: OK / FAIL / RUN / SKIP / WAIT