[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C1280EP33MP6GKXPJS8S5K":3,"skill-same:01M6C1280EP33MP6GKXPJS8S5K":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":53,"linkOnly":54,"markdownContent":55,"markdownBody":56,"frontMatter":57,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6C1280EP33MP6GKXPJS8S5K","cockpit-headless-deploy",null,"Guide or repair a headless Linux AIWG Cockpit plus Agentic Sandbox deployment when host topology, SSH access, service persistence, or runtime readiness must be planned safely.","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Faddons\u002Fagentic-installer\u002Fskills\u002Fcockpit-headless-deploy\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52],"headless","deploy","cockpit headless deploy","rollback","when","scripts","executor","host","runtime","stage","project","repair","guide","node","agentic","access","plan","ssh","manifest","persistence","yaml","topology","deployment","setup","sandbox","linux","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: cockpit-headless-deploy\ndescription: Guide or repair a headless Linux AIWG Cockpit plus Agentic Sandbox deployment when host topology, SSH access, service persistence, or runtime readiness must be planned safely.\nplatforms: [all]\nscript:\n  entrypoint: scripts\u002Fheadless-plan.mjs\n  runtime: node\n  cwd: project-root\n  argsHint: \"plan|stage|rollback --manifest \u003Csetup.aiwg.yaml> --cockpit-host \u003Chost> [--executor-host \u003Chost>]\"\n---\n\n# Cockpit Headless Deployment\n\nOwn the guided deployment or repair of Cockpit and Agentic Sandbox on a\nheadless Linux host. The canonical installation contract is\n`https:\u002F\u002Faiwg.io\u002Fagentic-sandbox\u002Fsetup.aiwg.yaml`; fetch or locate it, verify\nits release provenance when acquired remotely, and validate it with\n`aiwg setup-validate` before proposing mutation. Do not reproduce its package\nor installation action contract in this skill, and do not pass this\nprovider-orchestrated manifest to deterministic `aiwg setup-run`.\n\n## Topology gate\n\nEstablish three facts separately:\n\n- the host running Cockpit and its Bridge;\n- the host running Agentic Sandbox;\n- the operator host and its access path to the Bridge.\n\nIf the executor host is neither proven equal to nor explicitly different from\nthe Cockpit host, stop before mutation and ask exactly one question:\n\n> Will Agentic Sandbox run on the Cockpit host `\u003Chost>`, or a different host?\n\nAfter the answer, record `same-host` or `cross-host`. Model operator-to-Bridge\naccess separately from Bridge-to-executor transport. A cross-host deployment\nrequires an explicit trusted transport plan; never infer a forward from an\nambiguous hostname.\n\n## Preview and authorization\n\nRun the bundled planner after manifest validation:\n\n```bash\naiwg run skill cockpit-headless-deploy -- plan \\\n  --manifest setup.aiwg.yaml \\\n  --cockpit-host \u003Chost> \\\n  --executor-host \u003Chost> \\\n  --operator-host \u003Chost>\n```\n\nReview its value-free preview of packages (owned by the manifest), services,\nports, runtime tiers, mounts, egress, persistence, and cleanup. All application\nlisteners default to `127.0.0.1`. Require explicit operator authorization\nimmediately before packages, services, tunnels, mounts, or host policy change.\nPreserve dirty source checkouts; prefer verified release packages or a clean\nclone. Do not replace or clean an existing checkout to make deployment easier.\n\n## Deployment\n\nApply the validated SetupManifest through the provider-orchestrated installer\nhandoff. Use `stage` only to materialize the value-free user-service plan and\nattempt ledger inside an explicitly chosen staging root; review those files\nbefore installing them as user units. Host and Docker readiness are independent\nrequirements. Claim VM readiness only when KVM evidence exists.\n\nKeep Cockpit\u002FBridge and executor listeners on loopback. For cross-host\ntopologies, bind both applications locally and add only the reviewed transport\nbetween the declared endpoints. Order the Cockpit user unit after the executor\nunit when they share a host, enable only the created units, and record every\ncreated or changed resource in the attempt ledger.\n\n## Verification and rollback\n\nRun `aiwg cockpit doctor` with the declared topology and hosts. Do not report\nsuccess until its package, Bridge, real-executor, host, Docker, listener, and\npersistence rows meet the selected runtime plan. A VM row may remain a warning\nwhen VM isolation was not selected.\n\nOn failure, restore only resources marked as created or changed by this\nattempt. The bundled `rollback` command removes only ledger-owned staged files;\nit refuses paths outside the recorded staging root. Never perform generic\ncontainer, image, VM, worktree, package-cache, or data-directory cleanup.\n","# Cockpit Headless Deployment\n\nOwn the guided deployment or repair of Cockpit and Agentic Sandbox on a\nheadless Linux host. The canonical installation contract is\n`https:\u002F\u002Faiwg.io\u002Fagentic-sandbox\u002Fsetup.aiwg.yaml`; fetch or locate it, verify\nits release provenance when acquired remotely, and validate it with\n`aiwg setup-validate` before proposing mutation. Do not reproduce its package\nor installation action contract in this skill, and do not pass this\nprovider-orchestrated manifest to deterministic `aiwg setup-run`.\n\n## Topology gate\n\nEstablish three facts separately:\n\n- the host running Cockpit and its Bridge;\n- the host running Agentic Sandbox;\n- the operator host and its access path to the Bridge.\n\nIf the executor host is neither proven equal to nor explicitly different from\nthe Cockpit host, stop before mutation and ask exactly one question:\n\n> Will Agentic Sandbox run on the Cockpit host `\u003Chost>`, or a different host?\n\nAfter the answer, record `same-host` or `cross-host`. Model operator-to-Bridge\naccess separately from Bridge-to-executor transport. A cross-host deployment\nrequires an explicit trusted transport plan; never infer a forward from an\nambiguous hostname.\n\n## Preview and authorization\n\nRun the bundled planner after manifest validation:\n\n```bash\naiwg run skill cockpit-headless-deploy -- plan \\\n  --manifest setup.aiwg.yaml \\\n  --cockpit-host \u003Chost> \\\n  --executor-host \u003Chost> \\\n  --operator-host \u003Chost>\n```\n\nReview its value-free preview of packages (owned by the manifest), services,\nports, runtime tiers, mounts, egress, persistence, and cleanup. All application\nlisteners default to `127.0.0.1`. Require explicit operator authorization\nimmediately before packages, services, tunnels, mounts, or host policy change.\nPreserve dirty source checkouts; prefer verified release packages or a clean\nclone. Do not replace or clean an existing checkout to make deployment easier.\n\n## Deployment\n\nApply the validated SetupManifest through the provider-orchestrated installer\nhandoff. Use `stage` only to materialize the value-free user-service plan and\nattempt ledger inside an explicitly chosen staging root; review those files\nbefore installing them as user units. Host and Docker readiness are independent\nrequirements. Claim VM readiness only when KVM evidence exists.\n\nKeep Cockpit\u002FBridge and executor listeners on loopback. For cross-host\ntopologies, bind both applications locally and add only the reviewed transport\nbetween the declared endpoints. Order the Cockpit user unit after the executor\nunit when they share a host, enable only the created units, and record every\ncreated or changed resource in the attempt ledger.\n\n## Verification and rollback\n\nRun `aiwg cockpit doctor` with the declared topology and hosts. Do not report\nsuccess until its package, Bridge, real-executor, host, Docker, listener, and\npersistence rows meet the selected runtime plan. A VM row may remain a warning\nwhen VM isolation was not selected.\n\nOn failure, restore only resources marked as created or changed by this\nattempt. The bundled `rollback` command removes only ledger-owned staged files;\nit refuses paths outside the recorded staging root. Never perform generic\ncontainer, image, VM, worktree, package-cache, or data-directory cleanup.\n",{"name":5,"script":58,"namespace":62,"platforms":63,"description":7},{"cwd":59,"runtime":40,"argsHint":60,"entrypoint":61},"project-root","plan|stage|rollback --manifest \u003Csetup.aiwg.yaml> --cockpit-host \u003Chost> [--executor-host \u003Chost>]","scripts\u002Fheadless-plan.mjs","aiwg",[64],"all","main","6754967c344ccb087a8de06972f55a41067b291b","agentic\u002Fcode\u002Faddons\u002Fagentic-installer\u002Fskills\u002Fcockpit-headless-deploy",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-11 08:11:25",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add jmagly\u002Faiwg --skill cockpit-headless-deploy",{"tool":81,"command":82},"bunx","bunx skills add jmagly\u002Faiwg --skill cockpit-headless-deploy",{"tool":84,"command":85},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill cockpit-headless-deploy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Faddons\u002Fagentic-installer\u002Fskills\u002Fcockpit-headless-deploy\u002FSKILL.md",true,[89],{"path":61,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"SCRIPT","脚本",7956,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Faddons\u002Fagentic-installer\u002Fskills\u002Fcockpit-headless-deploy\u002Fscripts\u002Fheadless-plan.mjs",[95,120,142,148,155,169],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":102,"publishedAt":53},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[101],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[34,103,104,105,106,107,108,43,109,110,111,42,112,113,114,115,116,117,118,119],"host hardening","hardening","read","re","recommendations","remediation","port","verification","Bash","only","retention","audit","never","firewall","bind","secrets","request",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":128,"publishedAt":53},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[126,127],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[129,130,131,105,132,109,133,134,111,135,34,136,112,137,138,115,116,139,140,141],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","scope","reconstruction","operator","write",{"skillNo":143,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":53},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[146],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[104,34,103,42,105,119,108,107,114,43,109,110,111,118,112,113,106,115,116,117],{"skillNo":149,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":154,"publishedAt":53},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[152,153],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[130,129,115,132,109,133,111,131,34,136,112,137,138,105,116,135,134,139,140,141],{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":53},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[161],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[163,164,165,166,167,168],"fixture skill","fixture","rule","delivery","true","exercise",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":176,"publishedAt":53},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[175],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[177,178,137,179,164],"pi","pi local","duplicate"]