local/skills/ov-cachyos/SKILL.md
Operator CachyOS workstation profile — a kind:local template + target:local deploy that installs the full dev stack (30 layers) onto a CachyOS host via ShellExecutor. Lives in the overthinkos/cachyos submodule. MUST be invoked before editing or applying the ov-cachyos workstation profile.
npx skillsauth add overthinkos/overthink-plugins ov-cachyosInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
The operator's CachyOS developer-workstation profile: a kind: local template
(local.ov-cachyos) plus a target: local + host: local deploy entry
(deploy.ov-cachyos) that applies a kitchen-sink dev stack directly to the
current machine via ShellExecutor — no SSH, no VM, no container.
It lives in the overthinkos/cachyos repo (git submodule at
image/cachyos), in that repo's config (its charly.yml + per-kind
sibling files) — both the
kind: local template and its kind: deploy entry (deploy.ov-cachyos). The
repo also carries a sibling kind: deploy, deploy.cachyos-gpu — the
persistent operator GPU-workstation VM (target: vm, not disposable;
see /charly-vm:cachyos) — so ov-cachyos is no longer the only kind: deploy
there; every disposable test bed remains kind: eval. Apply it with:
charly -C image/cachyos update ov-cachyos
# or, anywhere:
charly --repo overthinkos/cachyos update ov-cachyos
30 layers. Most are pulled from the main repo by git reference
(@github.com/overthinkos/overthink/candy/<name>:<tag>); the cachyos-exclusive
ghostty, keepassxc-keyring, and wheel-nopasswd are vendored locally in this
repo's candy/ (resolved via its discover: block):
wheel-nopasswd, yay, dev-tools, gh, pre-commit, tmux, direnv,
gnupg, keepassxc, keepassxc-keyring, tailscale, tailscale-up,
build-toolchain, golang, rust, nodejs, uv, claude-code, codex,
gemini, oracle, forgecode, devops-tools, docker-ce, kubernetes,
vscode, ghostty, chrome, nvidia, charly.
| Field | Value |
|---|---|
| install_opts.builder_image | ghcr.io/overthinkos/arch-builder:2026.122.2252 (OCI ref, not a layer) |
| install_opts | with_service, allow_repo_changes, allow_root_tasks all true |
| env | EDITOR=nvim, PAGER=less |
| disposable (deploy) | true — charly update ov-cachyos is authorized |
passwordless-sudo-host — sudo -n true (wheel-nopasswd layer must have run)nvidia-ctk-present — command -v nvidia-ctknvidia-cdi-spec — /etc/cdi/nvidia.yaml existsBoth nvidia-* probes gate on an active host NVIDIA driver
([ -e /dev/nvidiactl ] || nvidia-smi) and pass with an N/A note on a
card-less or VFIO-passthrough host, so the profile applies cleanly anywhere.
local.ov-cachyos's remote layer refs are collected and materialized by the
same CollectRemoteRefs walk as image layer refs: the walk collects the layer
refs of the ROOT project's own kind: local templates (ov-cachyos is the root
here), so charly box validate / charly update ov-cachyos resolve the github-ref'd
layers. (Collection is reachability-scoped — a namespace's kind:local
templates, imported only as a dependency, are NOT collected by an importer; only
the root's own locals are. See /charly-internals:go "Remote-layer resolver".)
/charly-local:local-spec — kind: local template authoring reference/charly-local:local-deploy — the target: local deployment surface/charly-distros:cachyos — the CachyOS base of the same family/charly-core:deploy — deploy entry semantics (cross-kind name reuse: deploy.ov-cachyos ↔ local.ov-cachyos)MUST be invoked when editing or applying the ov-cachyos workstation profile, or reasoning about the kind:local remote-layer-ref machinery. Invoke BEFORE reading source code or launching Explore agents.
tools
Use when authoring or modifying a charly PLUGIN — a candy with a `plugin:` block that contributes Providers (verbs/kinds/deploy-targets/steps/builders/commands), its own CUE schema, builtin (compiled-in) or external (out-of-tree git repo). Covers the unified Provider model, the per-plugin CUE-schema contract (single source → Go params for dev + schema-over-Describe RPC for runtime), the SDK, and the loader.
tools
The CUE data-validation / configuration CLI (cue), pinned to v0.16.1. Use when working with the cue candy, installing the cue binary into a box or onto a target:local dev host, or running the offline schema-vendoring pipeline that feeds charly's egress validation.
tools
CUE EGRESS validation — validating (and, where it adds value, generating) the config files charly WRITES to a system BEFORE the bytes hit disk. MUST be invoked before working on charly/egress.go, the vendored schemas under candy/plugin-egress/egress-schemas/vendor/, the ValidateEgress / registerVendoredEgressKind path, the offline `task cue:vendor` pipeline, or adding an egress schema for any written artifact (cloud-init, k8s manifests, traefik routes, runtime config, install ledger, systemd/quadlet units, ssh_config, libvirt XML).
tools
Kubernetes cluster-probe declarative check verb — the `kube:` check verb (nodes, pods, ingress, storage class, addon health, apply/delete, and arbitrary resource GETs) served out-of-process by the candy/plugin-kube plugin (vendored client-go; no external kubectl required).