overthinkos/clean
core/skills/clean/SKILL.md
Prune reusable build artifacts to defaults: retention (images, eval runs) and sweep one-time makepkg leftovers. MUST be invoked before any work involving: ov clean, build-artifact retention, keep_images / keep_eval_runs, image-tag pruning, or .eval run cleanup.
development
Updated May 24, 2026
$ install --global
skillsauthnpx skillsauth add overthinkos/overthink-plugins cleanInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 24, 2026, 5:31 AM128.1s1 file scanned
SKILL.md
- name:
- clean
- description:
- |
- Prune reusable build artifacts to defaults:
- retention (images, eval runs) and
- MUST be invoked before any work involving:
- ov clean, build-artifact retention,
ov clean -- Build-artifact retention + cleanup
Overview
ov clean reclaims disk by applying the project's configured retention to
reusable build artifacts and removing one-time transient leftovers. It is
the on-demand counterpart to the auto-pruning that runs after ov image build
and ov eval run.
Two artifact classes, two policies (operator principle):
- One-time / transient → always cleaned immediately. makepkg leftovers under
pkg/arch(src/,pkg/,*.pkg.tar.zst,*.log).task build:ovremoves these right after install;ov cleansweeps any backlog. - Reusable → keep-last-N, configurable in
defaults:. Container image tags and.evalrun output. Retention is set inoverthink.ymldefaults:and applied automatically at creation;ov cleanapplies it on demand.
Config (overthink.yml defaults:)
defaults:
keep_images: 3 # newest CalVer tags to keep per image after `ov image build`
keep_eval_runs: 3 # newest run dirs to keep per bed/score after `ov eval run`
0 (or absent → built-in fallback 0) disables that retention. The repo
opts in; third-party configs get no surprise pruning until they set a value.
Commands
ov clean # apply retention now: prune images + eval runs + makepkg leftovers
ov clean --dry-run # print everything that WOULD be removed; touch nothing
ov clean --images # only image-tag retention
ov clean --eval # only eval-run retention
ov clean --keep N # override the retention count for this run (0 = use defaults:)
With neither --images nor --eval, all three categories run (images + eval +
makepkg). --keep N overrides both counts for the invocation.
What gets pruned (and what never does)
Image-tag retention (keep_images): images are grouped by the
org.overthinkos.image label and ordered by the org.overthinkos.version
CalVer label; all but the newest N per group are podman rmi'd. Safety: any
image referenced by a container (podman ps -a, including stopped/quadlet
deploys) is skipped, and rmi runs WITHOUT -f so the engine refuses any
still-referenced image as a backstop. Non-ov images (no org.overthinkos.image
label) and images with an unparseable version are never touched.
Eval-run retention (keep_eval_runs): each .eval/<bed|score>/ dir is
trimmed to the newest N run artifacts — CalVer-named run dirs (bed runs),
runs/<id>/ dirs (score iterations), and result-<calver>.yml files.
NOTES.md is ALWAYS preserved (it's the durable Syncthing-replicated harness
memory), as is any other non-run file.
makepkg sweep: removes pkg/arch/{src,pkg,*.pkg.tar.zst,*.log} (the package
is already installed via pacman — pure transient waste).
--dry-run is best-effort: it lists prune candidates but cannot see "external"
build containers (buildah intermediates podman ps -a doesn't list), so an
image held by one is listed yet safely skipped at removal time (the rmi
backstop refuses it). The real run silently retains such in-use images.
Auto-prune at creation
The same retention runs automatically (no flag needed):
- After
ov image build(push runs excluded) →keep_images. - After
ov eval run(any path: bed /--all-beds/ score) →keep_eval_runs, after the new run's output is written so the newest run is kept.
ov clean exists for on-demand sweeps and to clear a pre-existing backlog.
Out of scope
VM disk images (output/, image/*/output/) are single products per type
(overwritten on rebuild, not accumulated) — remove them on demand with
ov vm destroy --disk. The VM raw intermediate is already auto-cleaned during
the qcow2 build.
Implementation
ov/clean.go — pruneImagesByRetention, pruneEvalRuns,
cleanMakepkgArtifacts, CleanCmd. Hooks in BuildCmd.Run (ov/build.go) and
EvalRunCmd.Run (ov/eval_runner_cmd.go). Retention keys live on ImageConfig
(ov/config.go), merged via mergeImageConfig (ov/unified.go), validated in
validateBuildTunables (ov/validate.go).
Cross-References
/ov-build:build—ov image build+ thekeep_imagesauto-prune./ov-eval:eval—ov eval run+ thekeep_eval_runsauto-prune./ov-vm:vm—ov vm destroy --diskfor VM disk removal./ov-image:image— thedefaults:block where retention keys live.
Related Skills
overthinkos/agents
development
VerifiedTrustedCommunity
Claude Code multi-agent support in Overthink — sub-agents, dynamic workflows, and agent teams, and how each drives the existing `ov eval` disposable beds to test and verify. MUST be invoked before authoring or invoking an ov sub-agent / dynamic workflow / agent team, wiring agent-lifecycle hooks, or asking "which primitive should drive the R10 beds?".
SKILL.mdUpdated May 31, 2026
overthinkos/workspace-mount
tools
VerifiedTrustedCommunity
Mounts a virtiofs share tagged `workspace` at /workspace inside a VM guest via a systemd .mount unit. Use when a kind:vm entity shares a host directory into the guest and you need it auto-mounted (and re-mounted at every boot).
SKILL.mdUpdated May 30, 2026
overthinkos/android
development
VerifiedTrustedCommunity
MUST be invoked before any work involving: the `kind: android` schema kind, a `target: android` deploy, the `apk:` layer package format (installing Android apps declaratively), AndroidDeployTarget, an in-pod emulator OR a remote/physical adb-endpoint device, or nested `pod → android` deployment. The first-class Android device + app surface that sits above `ov eval adb`/`appium`.
SKILL.mdUpdated May 26, 2026
overthinkos/git-workflow
tools
VerifiedTrustedCommunity
Use when committing, branching, pushing, merging, tagging, creating PRs, or approving/merging PRs with gh — the feat/-branch, R10-gated, never-force-push landing workflow across the main repo + the plugins submodule + image/<distro> submodules. Covers sync-to-upstream, branch/worktree pruning, the fork+PR path for contributors without write access, and cross-repo @github landing order.
SKILL.mdUpdated May 25, 2026