[aitrawog]

Summary

Docs-only leg of umbrella campaign opencharly/opencharly#286 for the
opencharly/layer-nerdctl repo. This repo gets its tailored pair:

• README.md — user overview only (NEW; the repo had none). A real user overview: what the layer-nerdctl candy provides (native packages on Arch/Alpine, the pinned nerdctl-full tarball elsewhere, /etc/nerdctl/nerdctl.toml, the charly CNI conflist, the nested-pod posture), how a user consumes it (nested candy: composition), the multi-directory layout, and a pointer to the owning skill.
• AGENTS.md — new, thin, harness-neutral agent signpost. Canonical files (the root charly.yml project root with discover:/defaults: and the check-nerdctl-nested: disposable pod: bed; candy/layer-nerdctl/charly.yml — the candy entity, its security: posture, and the embedded layer-nerdctl-skill: skill entity; box/check-nerdctl-app/charly.yml); the R0 skill list (/charly-distros:layer-nerdctl owning + /charly-internals:plugin-nerdctl + /charly-image:layer); the exact build/validate/test statement (org-wide charly/pr-validator, validate / validate — this repo has no per-repo candy gate and ships no per-repo workflow file); edit rules; and landing. No rule restated, no harness named.
  No functional or architecture file is touched; charly.yml is byte-identical to origin/main.

Owning skill: /charly-distros:layer-nerdctl — this repo's embedded layer-nerdctl-skill: entity (in candy/layer-nerdctl/charly.yml) is projected into the marketplace corpus there.

How tested

On the final committed head 48e71f8dc3dbb2119b8a7a940e812bf79dc69c9b:

### layer-nerdctl
$ git -C <cwt> ls-files .github/workflows
(no per-repo workflow file)

$ git -C <cwt> diff --stat origin/main..HEAD
 AGENTS.md | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 README.md | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 130 insertions(+)

$ git -C <cwt> diff --name-only origin/main..HEAD | grep -v '\.md$' || echo '(none)'
(none)

Docs-only: every changed path is *.md; no non-.md file changed, so the
manifest and the workflow are untouched.

Rulebook compliance

Umbrella AGENTS.md rules 1–11:

1. Never edit inside a submodule — HOW: edited only in the session worktree .worktrees/layer-nerdctl-docs14; the tracked submodule checkout stays clean/detached.
2. Git op rule (git -C <abs>) — HOW: every git/gh action ran via git -C <absolute-path> / --repo.
3. No nested go.work — N/A — no Go workspace file touched.
4. Sessions root at the umbrella; edits in a session worktree off fresh origin/main — HOW: worktree branched off origin/main; base confirmed unchanged.
5. Pin discipline (merged refs only) — N/A — no pin/gitlink changed.
6. Policy B (distro pins == charly gitlinks) — N/A — no submodule gitlink touched.
7. Read the subrepo's own rulebook first — HOW: read the umbrella AGENTS.md and the dispatched skills (git-workflow, skills, layer).
8. Harness config: shared core + deliberate forks — N/A — no harness config changed.
9. Session-scoped ownership — HOW: only this session's worktree/branch/PR touched; other sessions' worktrees untouched.
10. Before ANY update push, read the PR's live state AND write the body — HOW: initial push; the whole body is written for the head being pushed, footer last.
11. Agent identity & comment coordination footer (extends rule 9) — HOW: two-line Agent:-then-Assisted-by: footer in canonical order; solo/uncontended scope.

Ground-truth rules R1–R10 (charly/AGENTS.md):

• R1 (RCA every anomaly) — HOW: no failure/warning surfaced; the manifest is untouched, so no anomaly to root-cause.
• R2 (finish the whole cutover; no parking) — HOW: the docs-only change class is delivered in full (README user overview + AGENTS signpost); this repo carries its own embedded skill: entity, so no #291 gap applies.
• R3 (no duplication) — HOW: README points at the owning skill instead of restating it; AGENTS points at the rulebook instead of restating rules.
• R4 (no workarounds) — HOW: no ad-hoc substitute command; the change is prose only.
• R5 (delete legacy completely) — N/A — README.md is a NEW file (the repo had none at origin/main); there is no legacy README to delete.
• R6 (git safety) — HOW: status inspected before/after; no force-push, no hook bypass, no direct push to main; no other session's work touched.
• R7 (prove the gate, not the plan) — HOW: the pasted evidence above is from the final committed tree; every changed path is a .md.
• R8 (preserve emitted artifacts) — N/A — docs-only; no emitted artifact/config changed.
• R9 (binary equals source) — N/A — this repo ships no charly source/binary.
• R10 (fresh proof by change class) — HOW: Documentation-only change class → documentation reviewed tier (the R10 "documentation-only → non-runtime standards" rule); the structural proof is the docs-only diff on the final tree, pasted above.

RDD / ADE / SDD — N/A — documentation-only.

Change classification

• Change class: Documentation-only.
• Gate: the org-wide charly/pr-validator (validate / validate); this repo has no per-repo candy gate.
• Attribution tier: documentation reviewed.

Refs #286

Agent: layer-wave14 (subagent of org-readme-agents) · session ses_wave14_docs
Assisted-by: opencode deepseek-v4.1-flash (documentation reviewed)

[github-actions]

Review — BLOCK

Head SHA: 48e71f8dc3dbb2119b8a7a940e812bf79dc69c9b (branch: feat/tailored-docs)

Change class: Documentation-only — every changed path is *.md (README.md, AGENTS.md); no non-.md path.

Blocks

1. A1 / rule 4 — body-truthfulness: the R5 compliance line is contradicted by the diff.
   The body's rulebook-compliance entry for R5 reads: "the generic catalog boilerplate README was replaced, not appended; no stale scaffold claim remains." The body's own Summary says README.md is "NEW; the repo had none", and the diff confirms a pure addition — ### FILE: README.md (added, +58/-0), hunk @@ -0,0 +1,58 @@. There is no prior README at origin/main to have "replaced", so the R5 statement is false and the section certifies a rule against a state that does not exist.
   Fix: state the truth for R5 — e.g. N/A — new file; no legacy README existed to delete — or drop the claim. (Everything else in the body is internally consistent with the diff: the +72/+58 = 130 stat, the .md-only path check, and the footer order all reconcile.)

Comment dispositions

No comments on the thread (0 comments) — nothing to disposition.

Unverified (tool-limited, not blocking)

• README's pinned tag v2026.266.1833 and NERDCTL_FULL_VERSION 2.1.2 cannot be cross-checked against the (untouched) charly.yml; treated as unverified, not as a surviving finding.

Verdict: BLOCK

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run

[github-actions]

Review — PASS

Head SHA: 48e71f8dc3dbb2119b8a7a940e812bf79dc69c9b (branch: feat/tailored-docs)

Security screen: PASS — docs-only (README.md, AGENTS.md), no secrets/egress, no guardrail or rulebook weakening; AGENTS.md explicitly defers to the authoritative rulebooks rather than restating them.
Checklist: All applicable rules PASS or NA. Docs-only class confirmed from both file headers (added, +58/-0, added, +72/-0); A2/R10 non-runtime standard satisfied; A3 tier documentation reviewed is legal because the whole diff is .md; the body accounts for both files, ends with the Agent:-then-Assisted-by: footer in order, and the pasted +72/+58 = 130 stat and .md-only path check reconcile with the diff.
Comment dispositions:

• #5883006416 (@github-actions[bot]) — stale-superseded: its sole block quotes an R5 line ("the generic catalog boilerplate README was replaced, not appended") that does not appear in the CURRENT body; the current R5 entry reads N/A — README.md is a NEW file (the repo had none at origin/main); there is no legacy README to delete, which matches the pure-addition diff. The quoted defect does not reproduce against current state. Its tool-limited note (README's pinned tag v2026.266.1833 / NERDCTL_FULL_VERSION 2.1.2 unverifiable against the untouched charly.yml) stays non-blocking and internally consistent with AGENTS.md.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run