[aitrawog]

Summary

The three prose surfaces that still called nerdctl the ENGINE now name the engine word containerd:

• README.md — the compose intro, the engine-capability paragraph, and the owning-skill row.
• AGENTS.md — the two skill pointers, plus the "Modify this repo" note, which still said the skill entity in candy/layer-nerdctl/charly.yml is the projected usage source. Since #14 the layer-nerdctl-skill: node is routing-only and .agents/skills/layer-nerdctl/SKILL.md is the source of record, so the note now says that.
• .agents/skills/layer-nerdctl/SKILL.md — the frontmatter description, the intro, the engine-capability section, and the "Use when" section.

containerd is the engine WORD; nerdctl is the CLI BINARY that drives it. The spec-owned #EngineBinaries map holds containerd → nerdctl, and opencharly/plugin-nerdctl serves engine:containerd. The nerdctl CLI, the nerdctl/nerdctl-full packages, nerdctl.toml, and the layer-nerdctl/plugin-nerdctl repo names are correct and unchanged.

The namespace = "default" change is already reflected on every surface (the candy writes it and asserts both the positive and the retired-charly negative), so this PR does not touch it.

Diff: 3 files changed, 29 insertions(+), 19 deletions(-); head 4f4b41bb221066ee2ff7f6a8eb0e8a97ad734b24, tree b51cd136eecf8c69253024e5d726fb64b7081db5.

How tested

Before (on origin/main 9b3b3ef, CHANGELOG excluded). Two commands: the engine-name forms, and the engine-op body token printed with -o so the paste carries no truncation:

$ git grep -n -E 'engine: ?nerdctl|nerdctl engine' origin/main -- . ':!CHANGELOG'
origin/main:.agents/skills/layer-nerdctl/SKILL.md:8:  slirp4netns), and the nested-pod posture. Use when working with the nerdctl engine,
origin/main:.agents/skills/layer-nerdctl/SKILL.md:9:  the layer-nerdctl candy, or engine: nerdctl deploys.'
origin/main:.agents/skills/layer-nerdctl/SKILL.md:15:stack, as ONE candy. Composed by a box that wants the opt-in `engine: nerdctl`
origin/main:.agents/skills/layer-nerdctl/SKILL.md:88:The `engine: nerdctl` word is served by `opencharly/plugin-nerdctl`
origin/main:.agents/skills/layer-nerdctl/SKILL.md:111:Working with the nerdctl engine, the layer-nerdctl candy, the rootless
origin/main:.agents/skills/layer-nerdctl/SKILL.md:112:containerd/buildkit checklist, or an `engine: nerdctl` deploy.
origin/main:AGENTS.md:27:- `/charly-distros:layer-nerdctl` — the owning skill. The nerdctl engine, the
origin/main:AGENTS.md:28:  `layer-nerdctl` candy, the nested-pod posture, and `engine: nerdctl` deploys.
origin/main:AGENTS.md:31:  `engine: nerdctl`.
origin/main:README.md:6:Composed by a box that wants the opt-in `engine: nerdctl` engine. On
origin/main:README.md:70:- Owning skill: `/charly-distros:layer-nerdctl` — the nerdctl engine, the
origin/main:README.md:71:  `layer-nerdctl` candy, the rootless checklist, and `engine: nerdctl` deploys.
$ echo $?
0

$ git grep -n -o -E 'InvokeEngineOp\("nerdctl"' origin/main -- . ':!CHANGELOG'
origin/main:.agents/skills/layer-nerdctl/SKILL.md:90:InvokeEngineOp("nerdctl"
origin/main:README.md:28:InvokeEngineOp("nerdctl"
$ echo $?
0

After (on this head, CHANGELOG excluded — each command's own rc printed):

$ git grep -n -E 'engine: ?nerdctl|nerdctl engine' -- . ':!CHANGELOG'
$ echo $?
1
$ git grep -n -o -E 'InvokeEngineOp\("nerdctl"' -- . ':!CHANGELOG'
$ echo $?
1

How the binary/CLI mentions were distinguished from the retired engine word. A hit is the retired engine word only when it names the ENGINE (engine: nerdctl, engine.run = nerdctl, "the nerdctl engine", or InvokeEngineOp("nerdctl", …)). The following remain and are correct: the nerdctl CLI binary (nerdctl info, nerdctl run, command -v nerdctl, KIND_EXPERIMENTAL_PROVIDER=nerdctl in other repos), the nerdctl and nerdctl-full packages, the nerdctl.toml config path, and the layer-nerdctl/plugin-nerdctl repo names. The before-grep above is keyed to the engine-word forms only, which is why it does not list those.

Structural gate (repo-native; this repo ships no per-repo workflow beyond the org validator):

$ /home/atrawog/Sync/Atrapub/mo/claude/opencharly/charly/bin/charly box validate
WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins ...
charly box validate: OK — checked 1 candy, 1 box, 2 deploys, 7 distros, 7 builders; 0 warnings, 0 errors
$ echo $?
0

The dev/worktree build line is the R9-required worktree-local binary's own banner, not a validation warning.

Rulebook compliance

• R0 — loaded /charly-internals:git-workflow, :cutover-policy, :skills, :strict-policy, /charly-build:docs, and the repo's own AGENTS.md before any edit.
• R1 — the finding is the tracker's own, RCA'd on opencharly/opencharly#589; the stale skill-edit note found in the same file is fixed here (documentation divergence on the changed surface).
• R2 — no duplicated rule or implementation; the skill has ONE source of record (the file) and the AGENTS.md note now says so.
• R3 — no workaround; prose only.
• R4 — the prose now matches the product (engine:containerd is what the loader accepts).
• R5 — claim-keyed sweep pasted above; zero engine-word hits remain outside CHANGELOG/.
• R6 — git status was empty at branch creation; worktree off origin/main 9b3b3ef; no force-push, no direct push to main, no submodule edited.
• R7 — docs-only class; the changed paths are the three prose files, and the sweep is the artifact-level proof.
• R8 — N/A — no service boundary in this change.
• R9 — the gate ran on the umbrella's worktree-local binary (2026.293.1809); no code or pin changed.
• R10 — documentation-only change class: no disposable target composes this prose. The marketplace and docs projections are regenerated in their own producer-first PRs.

Change classification

Documentation-only (README.md, AGENTS.md, one SKILL.md): documentation reviewed.

Filed issues

• opencharly/layer-nerdctl#15 — this PR's issue (filed and CLAIMed before branching).
• opencharly/opencharly#589 — the tracker this leg belongs to.

Closes #15

Agent: containerd-crabbox-program/docs-wave · session 8b1c01cf-7f79-4a75-bff8-240415a06208
Assisted-by: Claude Code deepseek-v4.1-flash:cloud (documentation reviewed)

[aitrawog]

STATUS — opencharly/layer-nerdctl#16 is open.

• Head 4f4b41bb221066ee2ff7f6a8eb0e8a97ad734b24, tree b51cd136eecf8c69253024e5d726fb64b7081db5
• Issue #15, tracker opencharly/opencharly#589
• Diff: 3 prose files, +29/−19; R5 sweep and charly box validate pasted in the body
• The watcher is armed for the validator verdict.

Next: the marketplace corpus leg, which must pin this repo only after this PR merges and tags.

Agent: containerd-crabbox-program/docs-wave · session 8b1c01cf-7f79-4a75-bff8-240415a06208
Assisted-by: Claude Code deepseek-v4.1-flash:cloud (documentation reviewed)

[github-actions]

Review — PASS

What the PR does

Documentation-only change across 3 files (README.md, AGENTS.md, .agents/skills/layer-nerdctl/SKILL.md) renaming the engine word from the retired nerdctl to containerd, while deliberately leaving the nerdctl CLI/binary, the nerdctl/nerdctl-full packages, nerdctl.toml, and the layer-nerdctl/plugin-nerdctl repo names untouched. It also refreshes the AGENTS.md "Modify this repo" note to point at SKILL.md as the skill source of record instead of the routing-only layer-nerdctl-skill: node.

Diff vs. body claims

• File counts / line counts. The three per-file diffs sum to +29/−19 across 3 files, exactly matching the body's stated 3 files changed, 29 insertions(+), 19 deletions(-). ✅
• Sweep coverage. The body's "before" grep lists every engine-word hit on origin/main: SKILL.md lines 8–9, 15, 88, 111–112; AGENTS.md 27, 28, 31; README.md 6, 70–71. Every one of those lines appears in the corresponding hunk, and the new text (engine: containerd, "containerd engine", "driven through the nerdctl CLI") does not reintroduce the engine: nerdctl / nerdctl engine pattern. The "after" rc=1 result is therefore consistent with the diff. ✅
• InvokeEngineOp change. The before-grep -o hits at README.md:28 and SKILL.md:90 are both rewritten to InvokeEngineOp("containerd", …) in the diff, so the "after" rc=1 is reproduced. The surrounding new prose explicitly explains the containerd(word)→nerdctl(binary) mapping via #EngineBinaries, so the rename is internally coherent rather than a blind substitution. ✅
• Structural description. The body's per-file summary matches the hunks: README (intro, engine-capability paragraph, owning-skill row), AGENTS (two skill pointers + Modify note), SKILL (frontmatter, intro, engine-capability, Use-when). No unexplained hunk, no missing claimed edit. ✅
• namespace = "default" note. Correctly declared out of scope and indeed untouched by the diff — no contradiction.

Honesty / consistency

The body's claims are reproduced by the diff; there is no stale or contradicted statement. Process attestations (R0–R10, charly box validate output, tree SHA) are not independently verifiable from the provided message, but they do not conflict with anything in the diff, and the concrete, checkable claims (grep before/after, line counts, hunk locations) all hold.

Tests / security / scope

• Docs-only class; the grep sweep is an appropriate artifact-level proof, and no code path is affected. No test gap.
• No secrets, injection surface, privilege, or dependency change.
• Scope is coherent: the only non-rename edit (the AGENTS.md source-of-record note) is directly tied to the same surface and explicitly justified. No dead code or leftover legacy wording remains in the changed files.

Comments

One comment, authored by @aitrawog (the PR author), is a status/issue-type note. It restates head SHA and the +29/−19 diff, both of which match the current state, and explicitly says the validator verdict is still pending — it is not a maintainer sign-off and does not assert approval. With no designated maintainer configured for this run, no comment qualifies as sign-off; the change stands on its own evidence, which it does.

Verdict

The diff does what the body claims, the evidence is internally consistent and reproducible from the hunks, and the change is coherent and scoped.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run