local/skills/charly-cachyos/SKILL.md
Operator CachyOS workstation profile — a kind:local template plus a host:local deploy that installs the full dev stack (30 candies) onto a CachyOS host via ShellExecutor. Lives in the overthinkos/cachyos submodule. MUST be invoked before editing or applying the charly-cachyos workstation profile.
npx skillsauth add overthinkos/overthink-plugins charly-cachyosInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
The operator's CachyOS developer-workstation profile: a kind: local template
(charly-cachyos-app) plus a host: local deploy (charly-cachyos, the
deploying entry) that applies a kitchen-sink dev stack directly to the
current machine via ShellExecutor — no SSH, no VM, no container.
It lives in the overthinkos/cachyos repo (git submodule at
box/cachyos), in that repo's single charly.yml — both the
kind: local template (charly-cachyos-app) and the charly-cachyos local: deploy
that deploys it. The repo also carries the cachyos-gpu deploy — the
persistent operator GPU-workstation VM (vm: { from: cachyos-gpu-workstation-vm },
not disposable; see /charly-vm:cachyos) — so charly-cachyos is no longer
the only non-disposable deploy there; every disposable test bed is a
disposable: true deploy. Apply it with:
charly -C box/cachyos update charly-cachyos
# or, anywhere:
charly --repo overthinkos/cachyos update charly-cachyos
30 candies. Most are pulled from the main repo by git reference
(@github.com/overthinkos/overthink/candy/<name>:<tag>); the cachyos-exclusive
ghostty, keepassxc-keyring, and wheel-nopasswd are vendored locally in this
repo's candy/ (resolved via its discover: block):
wheel-nopasswd, yay, dev-tools, gh, pre-commit, tmux, direnv,
gnupg, keepassxc, keepassxc-keyring, tailscale, tailscale-up,
build-toolchain, golang, rust, nodejs, uv, claude-code, codex,
gemini, oracle, forgecode, devops-tools, docker-ce, kubernetes,
vscode, ghostty, chrome, nvidia, charly.
| Field | Value |
|---|---|
| install_opts.builder_image | ghcr.io/overthinkos/arch-builder:2026.122.2252 (OCI ref, not a candy) |
| install_opts | with_service, allow_repo_changes, allow_root_tasks all true |
| env | EDITOR=nvim, PAGER=less |
| disposable (deploy) | true — charly update charly-cachyos is authorized |
passwordless-sudo-host — sudo -n true (wheel-nopasswd candy must have run)nvidia-ctk-present — command -v nvidia-ctknvidia-cdi-spec — /etc/cdi/nvidia.yaml existsBoth nvidia-* probes gate on an active host NVIDIA driver
([ -e /dev/nvidiactl ] || nvidia-smi) and pass with an N/A note on a
card-less or VFIO-passthrough host, so the profile applies cleanly anywhere.
charly-cachyos-app's remote candy refs are collected and materialized by the
same CollectRemoteRefs walk as box candy refs: the walk collects the candy
refs of the ROOT project's own kind: local templates (the cachyos repo is the
root here), so charly box validate / charly update charly-cachyos resolve the github-ref'd
candies. (Collection is reachability-scoped — a namespace's kind:local
templates, imported only as a dependency, are NOT collected by an importer; only
the root's own locals are. See /charly-internals:go "Remote-layer resolver".)
/charly-local:local-spec — kind: local template authoring reference/charly-local:local-deploy — the target: local deployment surface/charly-distros:cachyos — the CachyOS base of the same family/charly-core:deploy — bundle entry semantics (globally-unique names within a document: the charly-cachyos bundle deploys the suffixed charly-cachyos-app kind: local template)MUST be invoked when editing or applying the charly-cachyos workstation profile, or reasoning about the kind:local remote-candy-ref machinery. Invoke BEFORE reading source code or launching Explore agents.
tools
Use when authoring or modifying a charly PLUGIN — a candy with a `plugin:` block that contributes Providers (verbs/kinds/deploy-targets/steps/builders/commands), its own CUE schema, builtin (compiled-in) or external (out-of-tree git repo). Covers the unified Provider model, the per-plugin CUE-schema contract (single source → Go params for dev + schema-over-Describe RPC for runtime), the SDK, and the loader.
tools
The CUE data-validation / configuration CLI (cue), pinned to v0.16.1. Use when working with the cue candy, installing the cue binary into a box or onto a target:local dev host, or running the offline schema-vendoring pipeline that feeds charly's egress validation.
tools
CUE EGRESS validation — validating (and, where it adds value, generating) the config files charly WRITES to a system BEFORE the bytes hit disk. MUST be invoked before working on charly/egress.go, the vendored schemas under candy/plugin-egress/egress-schemas/vendor/, the ValidateEgress / registerVendoredEgressKind path, the offline `task cue:vendor` pipeline, or adding an egress schema for any written artifact (cloud-init, k8s manifests, traefik routes, runtime config, install ledger, systemd/quadlet units, ssh_config, libvirt XML).
tools
Kubernetes cluster-probe declarative check verb — the `kube:` check verb (nodes, pods, ingress, storage class, addon health, apply/delete, and arbitrary resource GETs) served out-of-process by the candy/plugin-kube plugin (vendored client-go; no external kubectl required).