[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6JCJBMSZ619T54F5XV0B2VW":3,"skill-same:01M6JCJBMSZ619T54F5XV0B2VW":77},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":25,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":50,"ownerHtmlUrl":51,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":52,"install":53,"resources":66},"01M6JCJBMSZ619T54F5XV0B2VW","client-orgo-provisioning",null,"Provision a Weblyfe client bot from scratch: Orgo machine + Hermes + GitHub deploy keys + Telegram gateway.","S3YED\u002Fappie-kit","S3YED","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F62743867?v=4","01M6JBKBRRVP6KMS0VWZ27T3R6","01M6JBKBX0KG30284PW1DBYJT1",14,"MIT","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fdevops\u002Fclient-orgo-provisioning\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[26,27,28,29,30,31,32,33,34,35,36,37,38],"provisioning","client","client orgo provisioning","bot","github","deploy","gateway","hermes","telegram","machine","From Scratch","keys","weblyfe","2026-11-10 10:12:30",false,"---\nname: client-orgo-provisioning\ndescription: \"Provision a Weblyfe client bot from scratch: Orgo machine + Hermes + GitHub deploy keys + Telegram gateway.\"\nversion: 1.0.0\n---\n\n# Client Orgo Provisioning\n\nEnd-to-end provisioning of a Weblyfe client bot on an Orgo-managed machine with Hermes Agent, Telegram gateway, and GitHub deploy access.\n\n## Triggers\n\n- \"Set up [client name]'s bot\"\n- \"Provision [client] on Orgo\"\n- \"Check [client]'s orgo bot\"\n- Any new Weblyfe client needs their own Hermes agent\n\n## Prerequisites\n\nBefore starting, gather ALL secrets. Use a dedicated Python script that reads from all relevant env files:\n\n```python\nsecrets = {}\nfor env_file in [\"~\u002F.weblyfe-secrets\u002F.env\",\n                  \"~\u002F.weblyfe-secrets\u002Forgo-openrouter-keys.env\",\n                  \"~\u002F.weblyfe-secrets\u002Fbot-provisioning-pool.env\"]:\n    path = os.path.expanduser(env_file)\n    if os.path.exists(path):\n        with open(path) as f:\n            for line in f:\n                line = line.strip()\n                if line and not line.startswith('#'):\n                    # Handle 'export KEY=\"value\"' format\n                    if line.startswith('export '):\n                        line = line[7:]\n                    if '=' in line:\n                        k, v = line.split('=', 1)\n                        v = v.strip().strip('\"').strip(\"'\")\n                        secrets[k.strip()] = v\n```\n\nKey sources:\n- Master Orgo API key: `ORGO_API_KEY` from `~\u002F.weblyfe-secrets\u002F.env` (uses `export` prefix)\n- Client Orgo API key: `ORGO_APPIE\u003CN>_\u003CNAME>` from `~\u002F.weblyfe-secrets\u002Forgo-openrouter-keys.env`\n- Client Telegram bot token: `BOT_APPIE\u003CN>_TOKEN` from `~\u002F.weblyfe-secrets\u002Fbot-provisioning-pool.env`\n- OpenRouter API key: `OPENROUTER_API_KEY` from `~\u002F.weblyfe-secrets\u002F.env` (uses `export` prefix)\n- Vercel token if needed: `VERCEL_TOKEN` from `~\u002F.weblyfe-secrets\u002F.env`\n- Bot assignment mapping: `~\u002F.weblyfe-secrets\u002Fbot-provisioning-ledger.json`\n\n## Workflow\n\n### 1. Discover the Orgo computer\n\nOrgo computer IDs are NOT stable across rebuilds. If a previous session had an ID, it's likely stale.\n\n```bash\n# First, list projects to find the client project\npython3.11 -c \"\nimport urllib.request, json, os\n# Read master key\nwith open(os.path.expanduser('~\u002F.weblyfe-secrets\u002F.env')) as f:\n    for line in f:\n        if line.startswith('export ORGO_API_KEY='):\n            key = line.split('=',1)[1].strip().strip('\\\"').strip(\\\"'\\\")\n            break\n# GET projects\nreq = urllib.request.Request('https:\u002F\u002Fwww.orgo.ai\u002Fapi\u002Fprojects', headers={\n    'Authorization': f'Bearer {key}', 'Content-Type': 'application\u002Fjson'})\nwith urllib.request.urlopen(req) as r:\n    print(json.dumps(json.loads(r.read()), indent=2))\n\"\n```\n\nLook for the client's project. Nathan's project: `7a945fac-1f84-44af-aec9-87a462065878`.\n\n**Critical**: The only working way to get a computer ID is to create one via POST. Use `workspace_id` + `name`:\n\n```bash\ncurl -s -X POST https:\u002F\u002Fwww.orgo.ai\u002Fapi\u002Fcomputers \\\n  -H \"Authorization: Bearer $ORGO_API_KEY\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"workspace_id\": \"PROJECT_ID\", \"name\": \"list\"}'\n```\n\nThis returns 201 with the computer object including `id`. Save this ID.\n\n### 2. Execute commands on Orgo\n\n```python\nurl = f\"https:\u002F\u002Fwww.orgo.ai\u002Fapi\u002Fcomputers\u002F{computer_id}\u002Fbash\"\nreq = urllib.request.Request(url,\n    data=json.dumps({\"command\": cmd}).encode(),\n    method=\"POST\",\n    headers={\"Authorization\": f\"Bearer {master_key}\", \"Content-Type\": \"application\u002Fjson\"})\n```\n\nTimeout is 60s default — bump to 180-300 for apt-get\u002Fnpm install. Expect 504 for slow network operations (Orgo Fly.io machines have limited bandwidth).\n\n### 3. Install base packages\n\n```bash\napt-get update -qq && apt-get install -y -qq openssh-client git curl\n```\n\nMinimum: openssh-client (for GitHub deploy keys), git (for repo access), curl.\n\n### 4. Install Hermes Agent\n\n**DO NOT use the bootstrap script** (`install.sh`) — it times out on Orgo's slow network. Use `uv tool install` instead:\n\n```bash\ncurl -LsSf https:\u002F\u002Fastral.sh\u002Fuv\u002Finstall.sh | sh          # install uv first\nexport PATH=$HOME\u002F.local\u002Fbin:$PATH\nuv tool install hermes-agent                              # install Hermes\n```\n\nVerify: `which hermes && hermes --version`\n\n### 5. Generate SSH deploy key\n\n```bash\nssh-keygen -t ed25519 -C 'CLIENT-bot-orgo-YYYYMMDD' -f \u002Froot\u002F.ssh\u002Fid_ed25519 -N ''\ncat \u002Froot\u002F.ssh\u002Fid_ed25519.pub\n```\n\nAdd to GitHub repo as deploy key:\n```bash\n# Delete old key first (get ID from gh api repos\u002FOWNER\u002FREPO\u002Fkeys)\ngh api repos\u002FOWNER\u002FREPO\u002Fkeys\u002FOLD_KEY_ID -X DELETE\n# Add new key\ngh api repos\u002FOWNER\u002FREPO\u002Fkeys -X POST \\\n  -F \"title=CLIENT-bot-orgo-YYYYMMDD\" \\\n  -F \"key=ssh-ed25519 AAA...\" \\\n  -F \"read_only=false\"\n```\n\nTest: `ssh -o StrictHostKeyChecking=accept-new -T git@github.com`\n\n### 6. Write Hermes config files\n\n**Use base64 encoding** to write files — avoids shell escaping nightmares with special characters in API keys:\n\n```python\nimport base64\n\ndef write_file_orgo(path, content, chmod=\"600\"):\n    b64 = base64.b64encode(content.encode()).decode()\n    cmd = f\"echo {b64} | base64 -d > {path} && chmod {chmod} {path}\"\n    # then run cmd via Orgo bash API\n```\n\n#### .env\n```\nTELEGRAM_BOT_TOKEN=\u003Cfrom pool>\nOPENROUTER_API_KEY=\u003Cfrom vault>\nVERCEL_TOKEN=\u003Cfrom vault>\n```\nchmod 600.\n\n#### config.yaml\n```yaml\nmodel:\n  default: deepseek\u002Fdeepseek-v4-pro\n  provider: openrouter\n\nproviders:\n  openrouter:\n    api_key: ${OPENROUTER_API_KEY}\n    models:\n      deepseek\u002Fdeepseek-v4-pro: {}\n      deepseek\u002Fdeepseek-v4-flash: {}\n\nterminal:\n  backend: local\n  cwd: \u002Froot\n  timeout: 180\n\ndisplay:\n  tool_progress: none\n  show_cost: false\n\nmessaging:\n  telegram:\n    enabled: true\n    token: ${TELEGRAM_BOT_TOKEN}\n    allowed_users:\n      - SEYED_TELEGRAM_ID\n    allow_admin_from:\n      - SEYED_TELEGRAM_ID\n```\n\n#### SOUL.md\nInclude: client identity, tech stack, design language, deploy instructions, guardrails. Keep it concise — the bot loads this every session.\n\nSee `references\u002Fnathan-nuyts-soul.md` for a worked example.\n\n### 7. Clone the repo\n\n```bash\nmkdir -p \u002Froot\u002Fprojects\ncd \u002Froot\u002Fprojects\ngit clone git@github.com:OWNER\u002FREPO.git\n```\n\n`npm install` may timeout on first attempt — retry if needed.\n\n### 8. Start the gateway\n\nOrgo runs Docker containers — **no systemd**. Use `setsid` to detach:\n\n```bash\n# Kill any existing\npkill -f 'hermes gateway' 2>\u002Fdev\u002Fnull\n\n# Start detached\nsetsid \u002Froot\u002F.local\u002Fbin\u002Fhermes gateway run \u003C\u002Fdev\u002Fnull >\u002Froot\u002F.hermes\u002Flogs\u002Fgateway.log 2>&1 &\ndisown\n\n# Verify\nsleep 2\npgrep -f 'hermes gateway'\ntail -5 \u002Froot\u002F.hermes\u002Flogs\u002Fgateway.log\n```\n\nLook for: `✓ telegram connected` and `Gateway running with 1 platform(s)`\n\n### 9. Approve users\n\nFirst message to the bot triggers pairing. The user gets a code like `33YPYMW2`. Approve on the Orgo machine:\n\n```bash\nexport PATH=$HOME\u002F.local\u002Fbin:$PATH\nhermes pairing approve telegram PAIRING_CODE\n```\n\nAdd client's Telegram ID to `config.yaml` under `allowed_users` once known.\n\n### 10. Update the ledger\n\nUpdate `~\u002F.weblyfe-secrets\u002Fbot-provisioning-ledger.json`:\n- `status`: `active`\n- `orgo_computer`: new computer ID\n- `verified_at`: today's date\n\n### 11. Deploy standalone Cognify (client knowledge graph)\n\nClient bots need their OWN Cognify instance — the fleet Cognify is Tailscale-only and reserved for Seyed's team. Deploy Cognify directly on the Orgo machine so the bot accesses it via `http:\u002F\u002F127.0.0.1:8799`.\n\n**Prerequisites:**\n- A separate OpenRouter API key for the client (do NOT reuse the fleet key)\n- Python 3.10+ on the Orgo machine (comes standard)\n\n**Steps:**\n\n```python\n# Clone Cognify (HTTPS — no SSH deploy key needed for this public repo)\nbash(\"cd \u002Froot && git clone https:\u002F\u002Fgithub.com\u002FS3YED\u002Fcognify.git 2>&1\", timeout=120)\n\n# Run setup\nbash(\"cd \u002Froot\u002Fcognify && bash setup.sh local 2>&1\", timeout=300)\n```\n\nWrite the `.env` file (base64-encode as always):\n```bash\nOPENROUTER_API_KEY=\u003Cclient-specific key>\nCOGNIFY_BACKEND=local\n# COGNIFY_DATA_DIR defaults to ~\u002F.cognify — fine for local backend\n```\n\nStart `cognify-serve` as a background process (no systemd on Orgo):\n```bash\ncd \u002Froot\u002Fcognify\nsource .venv\u002Fbin\u002Factivate && set -a && . .\u002F.env && set +a\nsetsid cognify-serve \u003C\u002Fdev\u002Fnull >\u002Froot\u002F.hermes\u002Flogs\u002Fcognify.log 2>&1 &\ndisown\n```\n\nVerify:\n```python\nout, code = bash(\"curl -s http:\u002F\u002F127.0.0.1:8799\u002Fhealth\")\n# Expected: {\"status\":\"ok\",\"backend\":\"local\",\"version\":\"...\"}\n```\n\n**Configure the bot** to use its local Cognify:\n- Set `COGNIFY_HOST=127.0.0.1` and `COGNIFY_PORT=8799` in the bot's Hermes `.env`\n- The `cognify` skill's recall endpoint is `http:\u002F\u002F$COGNIFY_HOST:$COGNIFY_PORT\u002Frecall`\n- Namespace convention for client bots: `workspace:\u003Cbot-name>` (e.g. `workspace:zeus`)\n\n**Differences from fleet Cognify:**\n- Fleet: `100.101.29.56:8765\u002Fcognify\u002Frecall` (Tailscale-only, shared Neo4j backend)\n- Client: `127.0.0.1:8799\u002Frecall` (localhost, local ChromaDB+networkx backend)\n- Client endpoint does NOT have the `\u002Fcognify\u002F` path prefix — that was nginx on the fleet machine\n- Client has its own data directory (~\u002F.cognify\u002F), fully isolated\n\n## Pitfalls\n\n- **Orgo computer IDs are ephemeral.** A rebuilt machine gets a new ID. Always re-discover.\n- **Client Orgo API keys often don't work.** Use the master key for all operations. Client keys (e.g. `ORGO_APPIE10_NATHAN`) may return 401.\n- **Bootstrap install script times out.** Orgo has slow outbound network. Use `uv tool install`.\n- **npm install times out.** Orgo bandwidth is limited. Retry or run in background.\n- **No systemd in Docker.** Use `setsid ... \u003C\u002Fdev\u002Fnull >\u002Fdev\u002Fnull 2>&1 & disown` to detach the gateway.\n- **Base64-encode file writes.** Shell heredocs with secrets risk escaping bugs. Base64 is deterministic.\n- **Google Calendar token format.** If using `google-workspace` skill with existing tokens from `~\u002F.weblyfe-secrets\u002F`, the token JSON may need `\"type\": \"authorized_user\"` added and the file linked to `~\u002F.hermes\u002Fgoogle_token.json`.\n- **`export` prefix in env files.** The vault env files use `export KEY=\"value\"` format. Strip `export ` prefix and quotes before using values.\n- **SSH key per-repo on Appie-1.** The default `id_ed25519` key may not have access to all repos. For repos like `S3YED\u002Fnathan-nuyts`, use the account-level `id_ed25519_github` key via `git config --local core.sshCommand \"ssh -i ~\u002F.ssh\u002Fid_ed25519_github -o IdentitiesOnly=yes\"`.\n- **Git pre-commit hook blocks em dashes.** Weblyfe projects have a hook that blocks commits containing `—` (U+2014). Replace with period, comma, colon, or hyphen before committing. Use `git commit --no-verify` only as emergency bypass.\n- **Orgo auth scoping across projects.** Not all computers in Seyed's main workspace (`77e2768b`) are accessible with the master key — some return 401. Computers in project-specific workspaces (e.g. `7a945fac` for Nathan Nuyts) ARE accessible. The machine named \"Zeus (Nathan Nuyts)\" in Seyed's workspace is a different computer ID from the actual Zeus. Always test `echo 'ALIVE'` before building tooling around a computer ID. If 401, re-discover — the real bot machine may be in a different project.\n- **Client bots get their OWN Cognify instance.** The fleet Cognify at `100.101.29.56:8765` is Tailscale-only and only for Appie's in Seyed's team. Client bots need their own standalone Cognify on their Orgo machine (see Cognify Deployment section below).\n- **Cognify clone requires HTTPS, not SSH.** Orgo machines only have deploy keys for their specific client repo. Clone Cognify via `https:\u002F\u002Fgithub.com\u002FS3YED\u002Fcognify.git` (public repo) instead of SSH.\n- **Disk fills up before Cognify install.** Orgo machines are often at 95%+ disk usage. Before `pip install`: clean `npm cache clean --force`, `rm -rf \u002Froot\u002F.cache\u002Fpip \u002Froot\u002F.cache\u002Fuv`, `apt-get clean`. Aim for 500MB+ free.\n- **`setup.sh local` does NOT install the serve extra.** The server command `cognify-serve` fails with \"FastAPI not installed\" unless you separately run `source .venv\u002Fbin\u002Factivate && pip install -e \".[serve]\"`. Run this in background + poll, same pattern as setup.sh.\n- **Long commands must run in background.** Orgo's API gateway 504s at ~150s. For `setup.sh`, `pip install`, or `npm install`: use `nohup CMD > \u002Ftmp\u002Flog 2>&1 & echo PID:$!`, then poll with 10s intervals checking `pgrep` and `tail -1 \u002Ftmp\u002Flog`.\n- **Cognify client server has NO `\u002Fcognify\u002F` path prefix.** The fleet instance uses `\u002Fcognify\u002Frecall` (via nginx reverse proxy). Client-local instances expose endpoints directly: `\u002Frecall`, `\u002Fingest`, `\u002Fhealth` on the configured port.\n- **Don't blindly clean `\u002Froot\u002F.cache\u002F`.** That directory contains `chroma\u002F` (ChromaDB ONNX embedder model). Cleaning pip\u002Fnpm\u002Fuv caches is fine, but wiping the entire `.cache` breaks Cognify's vector search. If you must clean it, re-verify `curl \u002Fhealth` + `curl \u002Frecall` after. The Chroma model auto-redownloads on next use, but existing vector data may need re-ingest.\n\n## References\n\n- `references\u002Fnathan-nuyts-config.yaml` — full working config for Nathan's bot\n- `references\u002Fsecret-sourcing.md` — which env files hold which keys","# Client Orgo Provisioning\n\nEnd-to-end provisioning of a Weblyfe client bot on an Orgo-managed machine with Hermes Agent, Telegram gateway, and GitHub deploy access.\n\n## Triggers\n\n- \"Set up [client name]'s bot\"\n- \"Provision [client] on Orgo\"\n- \"Check [client]'s orgo bot\"\n- Any new Weblyfe client needs their own Hermes agent\n\n## Prerequisites\n\nBefore starting, gather ALL secrets. Use a dedicated Python script that reads from all relevant env files:\n\n```python\nsecrets = {}\nfor env_file in [\"~\u002F.weblyfe-secrets\u002F.env\",\n                  \"~\u002F.weblyfe-secrets\u002Forgo-openrouter-keys.env\",\n                  \"~\u002F.weblyfe-secrets\u002Fbot-provisioning-pool.env\"]:\n    path = os.path.expanduser(env_file)\n    if os.path.exists(path):\n        with open(path) as f:\n            for line in f:\n                line = line.strip()\n                if line and not line.startswith('#'):\n                    # Handle 'export KEY=\"value\"' format\n                    if line.startswith('export '):\n                        line = line[7:]\n                    if '=' in line:\n                        k, v = line.split('=', 1)\n                        v = v.strip().strip('\"').strip(\"'\")\n                        secrets[k.strip()] = v\n```\n\nKey sources:\n- Master Orgo API key: `ORGO_API_KEY` from `~\u002F.weblyfe-secrets\u002F.env` (uses `export` prefix)\n- Client Orgo API key: `ORGO_APPIE\u003CN>_\u003CNAME>` from `~\u002F.weblyfe-secrets\u002Forgo-openrouter-keys.env`\n- Client Telegram bot token: `BOT_APPIE\u003CN>_TOKEN` from `~\u002F.weblyfe-secrets\u002Fbot-provisioning-pool.env`\n- OpenRouter API key: `OPENROUTER_API_KEY` from `~\u002F.weblyfe-secrets\u002F.env` (uses `export` prefix)\n- Vercel token if needed: `VERCEL_TOKEN` from `~\u002F.weblyfe-secrets\u002F.env`\n- Bot assignment mapping: `~\u002F.weblyfe-secrets\u002Fbot-provisioning-ledger.json`\n\n## Workflow\n\n### 1. Discover the Orgo computer\n\nOrgo computer IDs are NOT stable across rebuilds. If a previous session had an ID, it's likely stale.\n\n```bash\n# First, list projects to find the client project\npython3.11 -c \"\nimport urllib.request, json, os\n# Read master key\nwith open(os.path.expanduser('~\u002F.weblyfe-secrets\u002F.env')) as f:\n    for line in f:\n        if line.startswith('export ORGO_API_KEY='):\n            key = line.split('=',1)[1].strip().strip('\\\"').strip(\\\"'\\\")\n            break\n# GET projects\nreq = urllib.request.Request('https:\u002F\u002Fwww.orgo.ai\u002Fapi\u002Fprojects', headers={\n    'Authorization': f'Bearer {key}', 'Content-Type': 'application\u002Fjson'})\nwith urllib.request.urlopen(req) as r:\n    print(json.dumps(json.loads(r.read()), indent=2))\n\"\n```\n\nLook for the client's project. Nathan's project: `7a945fac-1f84-44af-aec9-87a462065878`.\n\n**Critical**: The only working way to get a computer ID is to create one via POST. Use `workspace_id` + `name`:\n\n```bash\ncurl -s -X POST https:\u002F\u002Fwww.orgo.ai\u002Fapi\u002Fcomputers \\\n  -H \"Authorization: Bearer $ORGO_API_KEY\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"workspace_id\": \"PROJECT_ID\", \"name\": \"list\"}'\n```\n\nThis returns 201 with the computer object including `id`. Save this ID.\n\n### 2. Execute commands on Orgo\n\n```python\nurl = f\"https:\u002F\u002Fwww.orgo.ai\u002Fapi\u002Fcomputers\u002F{computer_id}\u002Fbash\"\nreq = urllib.request.Request(url,\n    data=json.dumps({\"command\": cmd}).encode(),\n    method=\"POST\",\n    headers={\"Authorization\": f\"Bearer {master_key}\", \"Content-Type\": \"application\u002Fjson\"})\n```\n\nTimeout is 60s default — bump to 180-300 for apt-get\u002Fnpm install. Expect 504 for slow network operations (Orgo Fly.io machines have limited bandwidth).\n\n### 3. Install base packages\n\n```bash\napt-get update -qq && apt-get install -y -qq openssh-client git curl\n```\n\nMinimum: openssh-client (for GitHub deploy keys), git (for repo access), curl.\n\n### 4. Install Hermes Agent\n\n**DO NOT use the bootstrap script** (`install.sh`) — it times out on Orgo's slow network. Use `uv tool install` instead:\n\n```bash\ncurl -LsSf https:\u002F\u002Fastral.sh\u002Fuv\u002Finstall.sh | sh          # install uv first\nexport PATH=$HOME\u002F.local\u002Fbin:$PATH\nuv tool install hermes-agent                              # install Hermes\n```\n\nVerify: `which hermes && hermes --version`\n\n### 5. Generate SSH deploy key\n\n```bash\nssh-keygen -t ed25519 -C 'CLIENT-bot-orgo-YYYYMMDD' -f \u002Froot\u002F.ssh\u002Fid_ed25519 -N ''\ncat \u002Froot\u002F.ssh\u002Fid_ed25519.pub\n```\n\nAdd to GitHub repo as deploy key:\n```bash\n# Delete old key first (get ID from gh api repos\u002FOWNER\u002FREPO\u002Fkeys)\ngh api repos\u002FOWNER\u002FREPO\u002Fkeys\u002FOLD_KEY_ID -X DELETE\n# Add new key\ngh api repos\u002FOWNER\u002FREPO\u002Fkeys -X POST \\\n  -F \"title=CLIENT-bot-orgo-YYYYMMDD\" \\\n  -F \"key=ssh-ed25519 AAA...\" \\\n  -F \"read_only=false\"\n```\n\nTest: `ssh -o StrictHostKeyChecking=accept-new -T git@github.com`\n\n### 6. Write Hermes config files\n\n**Use base64 encoding** to write files — avoids shell escaping nightmares with special characters in API keys:\n\n```python\nimport base64\n\ndef write_file_orgo(path, content, chmod=\"600\"):\n    b64 = base64.b64encode(content.encode()).decode()\n    cmd = f\"echo {b64} | base64 -d > {path} && chmod {chmod} {path}\"\n    # then run cmd via Orgo bash API\n```\n\n#### .env\n```\nTELEGRAM_BOT_TOKEN=\u003Cfrom pool>\nOPENROUTER_API_KEY=\u003Cfrom vault>\nVERCEL_TOKEN=\u003Cfrom vault>\n```\nchmod 600.\n\n#### config.yaml\n```yaml\nmodel:\n  default: deepseek\u002Fdeepseek-v4-pro\n  provider: openrouter\n\nproviders:\n  openrouter:\n    api_key: ${OPENROUTER_API_KEY}\n    models:\n      deepseek\u002Fdeepseek-v4-pro: {}\n      deepseek\u002Fdeepseek-v4-flash: {}\n\nterminal:\n  backend: local\n  cwd: \u002Froot\n  timeout: 180\n\ndisplay:\n  tool_progress: none\n  show_cost: false\n\nmessaging:\n  telegram:\n    enabled: true\n    token: ${TELEGRAM_BOT_TOKEN}\n    allowed_users:\n      - SEYED_TELEGRAM_ID\n    allow_admin_from:\n      - SEYED_TELEGRAM_ID\n```\n\n#### SOUL.md\nInclude: client identity, tech stack, design language, deploy instructions, guardrails. Keep it concise — the bot loads this every session.\n\nSee `references\u002Fnathan-nuyts-soul.md` for a worked example.\n\n### 7. Clone the repo\n\n```bash\nmkdir -p \u002Froot\u002Fprojects\ncd \u002Froot\u002Fprojects\ngit clone git@github.com:OWNER\u002FREPO.git\n```\n\n`npm install` may timeout on first attempt — retry if needed.\n\n### 8. Start the gateway\n\nOrgo runs Docker containers — **no systemd**. Use `setsid` to detach:\n\n```bash\n# Kill any existing\npkill -f 'hermes gateway' 2>\u002Fdev\u002Fnull\n\n# Start detached\nsetsid \u002Froot\u002F.local\u002Fbin\u002Fhermes gateway run \u003C\u002Fdev\u002Fnull >\u002Froot\u002F.hermes\u002Flogs\u002Fgateway.log 2>&1 &\ndisown\n\n# Verify\nsleep 2\npgrep -f 'hermes gateway'\ntail -5 \u002Froot\u002F.hermes\u002Flogs\u002Fgateway.log\n```\n\nLook for: `✓ telegram connected` and `Gateway running with 1 platform(s)`\n\n### 9. Approve users\n\nFirst message to the bot triggers pairing. The user gets a code like `33YPYMW2`. Approve on the Orgo machine:\n\n```bash\nexport PATH=$HOME\u002F.local\u002Fbin:$PATH\nhermes pairing approve telegram PAIRING_CODE\n```\n\nAdd client's Telegram ID to `config.yaml` under `allowed_users` once known.\n\n### 10. Update the ledger\n\nUpdate `~\u002F.weblyfe-secrets\u002Fbot-provisioning-ledger.json`:\n- `status`: `active`\n- `orgo_computer`: new computer ID\n- `verified_at`: today's date\n\n### 11. Deploy standalone Cognify (client knowledge graph)\n\nClient bots need their OWN Cognify instance — the fleet Cognify is Tailscale-only and reserved for Seyed's team. Deploy Cognify directly on the Orgo machine so the bot accesses it via `http:\u002F\u002F127.0.0.1:8799`.\n\n**Prerequisites:**\n- A separate OpenRouter API key for the client (do NOT reuse the fleet key)\n- Python 3.10+ on the Orgo machine (comes standard)\n\n**Steps:**\n\n```python\n# Clone Cognify (HTTPS — no SSH deploy key needed for this public repo)\nbash(\"cd \u002Froot && git clone https:\u002F\u002Fgithub.com\u002FS3YED\u002Fcognify.git 2>&1\", timeout=120)\n\n# Run setup\nbash(\"cd \u002Froot\u002Fcognify && bash setup.sh local 2>&1\", timeout=300)\n```\n\nWrite the `.env` file (base64-encode as always):\n```bash\nOPENROUTER_API_KEY=\u003Cclient-specific key>\nCOGNIFY_BACKEND=local\n# COGNIFY_DATA_DIR defaults to ~\u002F.cognify — fine for local backend\n```\n\nStart `cognify-serve` as a background process (no systemd on Orgo):\n```bash\ncd \u002Froot\u002Fcognify\nsource .venv\u002Fbin\u002Factivate && set -a && . .\u002F.env && set +a\nsetsid cognify-serve \u003C\u002Fdev\u002Fnull >\u002Froot\u002F.hermes\u002Flogs\u002Fcognify.log 2>&1 &\ndisown\n```\n\nVerify:\n```python\nout, code = bash(\"curl -s http:\u002F\u002F127.0.0.1:8799\u002Fhealth\")\n# Expected: {\"status\":\"ok\",\"backend\":\"local\",\"version\":\"...\"}\n```\n\n**Configure the bot** to use its local Cognify:\n- Set `COGNIFY_HOST=127.0.0.1` and `COGNIFY_PORT=8799` in the bot's Hermes `.env`\n- The `cognify` skill's recall endpoint is `http:\u002F\u002F$COGNIFY_HOST:$COGNIFY_PORT\u002Frecall`\n- Namespace convention for client bots: `workspace:\u003Cbot-name>` (e.g. `workspace:zeus`)\n\n**Differences from fleet Cognify:**\n- Fleet: `100.101.29.56:8765\u002Fcognify\u002Frecall` (Tailscale-only, shared Neo4j backend)\n- Client: `127.0.0.1:8799\u002Frecall` (localhost, local ChromaDB+networkx backend)\n- Client endpoint does NOT have the `\u002Fcognify\u002F` path prefix — that was nginx on the fleet machine\n- Client has its own data directory (~\u002F.cognify\u002F), fully isolated\n\n## Pitfalls\n\n- **Orgo computer IDs are ephemeral.** A rebuilt machine gets a new ID. Always re-discover.\n- **Client Orgo API keys often don't work.** Use the master key for all operations. Client keys (e.g. `ORGO_APPIE10_NATHAN`) may return 401.\n- **Bootstrap install script times out.** Orgo has slow outbound network. Use `uv tool install`.\n- **npm install times out.** Orgo bandwidth is limited. Retry or run in background.\n- **No systemd in Docker.** Use `setsid ... \u003C\u002Fdev\u002Fnull >\u002Fdev\u002Fnull 2>&1 & disown` to detach the gateway.\n- **Base64-encode file writes.** Shell heredocs with secrets risk escaping bugs. Base64 is deterministic.\n- **Google Calendar token format.** If using `google-workspace` skill with existing tokens from `~\u002F.weblyfe-secrets\u002F`, the token JSON may need `\"type\": \"authorized_user\"` added and the file linked to `~\u002F.hermes\u002Fgoogle_token.json`.\n- **`export` prefix in env files.** The vault env files use `export KEY=\"value\"` format. Strip `export ` prefix and quotes before using values.\n- **SSH key per-repo on Appie-1.** The default `id_ed25519` key may not have access to all repos. For repos like `S3YED\u002Fnathan-nuyts`, use the account-level `id_ed25519_github` key via `git config --local core.sshCommand \"ssh -i ~\u002F.ssh\u002Fid_ed25519_github -o IdentitiesOnly=yes\"`.\n- **Git pre-commit hook blocks em dashes.** Weblyfe projects have a hook that blocks commits containing `—` (U+2014). Replace with period, comma, colon, or hyphen before committing. Use `git commit --no-verify` only as emergency bypass.\n- **Orgo auth scoping across projects.** Not all computers in Seyed's main workspace (`77e2768b`) are accessible with the master key — some return 401. Computers in project-specific workspaces (e.g. `7a945fac` for Nathan Nuyts) ARE accessible. The machine named \"Zeus (Nathan Nuyts)\" in Seyed's workspace is a different computer ID from the actual Zeus. Always test `echo 'ALIVE'` before building tooling around a computer ID. If 401, re-discover — the real bot machine may be in a different project.\n- **Client bots get their OWN Cognify instance.** The fleet Cognify at `100.101.29.56:8765` is Tailscale-only and only for Appie's in Seyed's team. Client bots need their own standalone Cognify on their Orgo machine (see Cognify Deployment section below).\n- **Cognify clone requires HTTPS, not SSH.** Orgo machines only have deploy keys for their specific client repo. Clone Cognify via `https:\u002F\u002Fgithub.com\u002FS3YED\u002Fcognify.git` (public repo) instead of SSH.\n- **Disk fills up before Cognify install.** Orgo machines are often at 95%+ disk usage. Before `pip install`: clean `npm cache clean --force`, `rm -rf \u002Froot\u002F.cache\u002Fpip \u002Froot\u002F.cache\u002Fuv`, `apt-get clean`. Aim for 500MB+ free.\n- **`setup.sh local` does NOT install the serve extra.** The server command `cognify-serve` fails with \"FastAPI not installed\" unless you separately run `source .venv\u002Fbin\u002Factivate && pip install -e \".[serve]\"`. Run this in background + poll, same pattern as setup.sh.\n- **Long commands must run in background.** Orgo's API gateway 504s at ~150s. For `setup.sh`, `pip install`, or `npm install`: use `nohup CMD > \u002Ftmp\u002Flog 2>&1 & echo PID:$!`, then poll with 10s intervals checking `pgrep` and `tail -1 \u002Ftmp\u002Flog`.\n- **Cognify client server has NO `\u002Fcognify\u002F` path prefix.** The fleet instance uses `\u002Fcognify\u002Frecall` (via nginx reverse proxy). Client-local instances expose endpoints directly: `\u002Frecall`, `\u002Fingest`, `\u002Fhealth` on the configured port.\n- **Don't blindly clean `\u002Froot\u002F.cache\u002F`.** That directory contains `chroma\u002F` (ChromaDB ONNX embedder model). Cleaning pip\u002Fnpm\u002Fuv caches is fine, but wiping the entire `.cache` breaks Cognify's vector search. If you must clean it, re-verify `curl \u002Fhealth` + `curl \u002Frecall` after. The Chroma model auto-redownloads on next use, but existing vector data may need re-ingest.\n\n## References\n\n- `references\u002Fnathan-nuyts-config.yaml` — full working config for Nathan's bot\n- `references\u002Fsecret-sourcing.md` — which env files hold which keys",{"name":5,"version":44,"description":7},"1.0.0","master","8ec37df6d71fb664ea19d32c079e7d3ff931a8e0","skills\u002Fdevops\u002Fclient-orgo-provisioning",3,"https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit","https:\u002F\u002Fweblyfe.ai","https:\u002F\u002Fgithub.com\u002FS3YED","2026-08-27 01:54:02",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add S3YED\u002Fappie-kit --skill client-orgo-provisioning",{"tool":59,"command":60},"bunx","bunx skills add S3YED\u002Fappie-kit --skill client-orgo-provisioning",{"tool":62,"command":63},"pnpm","pnpm dlx skills add S3YED\u002Fappie-kit --skill client-orgo-provisioning","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fdevops\u002Fclient-orgo-provisioning\u002FSKILL.md",true,[67,73],{"path":68,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"references\u002Fnathan-nuyts-soul.md","REFERENCE","参考文档",2094,"https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fdevops\u002Fclient-orgo-provisioning\u002Freferences\u002Fnathan-nuyts-soul.md",{"path":74,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":75,"sourceHtmlUrl":76},"references\u002Fsecret-sourcing.md",1383,"https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fdevops\u002Fclient-orgo-provisioning\u002Freferences\u002Fsecret-sourcing.md",[78,109,144,170,198,223],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":91,"publishedAt":39},"01M6JFD4M6N4DSGC7TXEJ5R3J2","ai-music","AI music generation and audio tools: HeartMuLa lyrics-to-music generation, songwriting craft (+ Suno prompts), and audio spectrogram\u002Ffeature visualization.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fwethlete\u002Fai-music\u002FSKILL.md",[84,87,90],{"categoryNo":85,"categoryName":86,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000013","分析与可视化",{"categoryNo":88,"categoryName":89,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[92,93,94,95,96,97,33,98,99,100,101,102,103,104,105,106,107,108],"music","ai music","humanizer","visualization","Tools","Audio","hermes agent","songwriting","suno","lyrics","prompts","heartmula","craft","generation","feature","ai music generation","music generation",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":123,"publishedAt":39},"01M6JFCZE4XNFQFMNZDHKHT5V5","agentic-webdesign-design-system-ingestion","Use v0 Design Systems 2.0, Bolt Design System Agents, or Lovable to generate production UI from a client's real design system components — not generic Tailwind. Use when building a client website where brand consistency matters.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fweb-design\u002Fagentic-webdesign-design-system-ingestion\u002FSKILL.md",[115,118],{"categoryNo":116,"categoryName":117,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143],"design","agentic","design system","system","ingestion","webdesign","agentic webdesign design system ingestion","components","generate","design systems","website","ui","Tailwind","bolt","lovable","v0","design-system","wed","design system components","appie",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":152,"publishedAt":39},"01M6JFCVPX3913CFAS6QQJ33ZB","agentic-webdesign-agent-elements","Use 21st.dev Agent Elements — 25 shadcn\u002Fui components purpose-built for AI agent UIs. Tool cards (Bash, Edit, Search, Plan, Subagent, MCP), chat, input, streaming. Open source, shadcn-registry install, no runtime lock-in.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fweb-design\u002Fagentic-webdesign-agent-elements\u002FSKILL.md",[150,151],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},[125,153,129,154,155,156,131,157,158,159,160,161,162,163,164,165,166,167,168,169],"elements","agentic webdesign agent elements","MCP","ai agent","registry","search","streaming","open source","open","Bash","plan","subagent","edit","install","input","lock","source",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":178,"publishedAt":39},"01M6JFCQC7H65M9QJ6TRE71BS1","vercel-deployment","Deploy static sites and frontends to Vercel — handles both CLI and REST API paths, including the CLI token sanitization workaround.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fsoftware-development\u002Fvercel-deployment\u002FSKILL.md",[176,177],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[179,180,181,182,183,184,185,31,186,187,188,189,190,191,192,193,194,195,196,197],"deployment","vercel deployment","vercel","macos","cli","linux","windows","vercel deploy","REST","api","site","deploy to vercel","token","rest api","host","sites","paths","sanitization","static site",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":205,"publishedAt":39},"01M6JFCM4SMTXBM5A01BK2YQG1","software-quality-workflows","Umbrella workflow for TDD, debugging, code simplification, spikes, pre-commit review, and debugger-assisted investigation.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fsoftware-development\u002Fsoftware-quality-workflows\u002FSKILL.md",[204],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222],"workflows","quality","software","software quality workflows","review","tdd","workflow","commit","debugging","code","debugger","pre-commit","investigation","code simplification","user","simplification","for",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":236,"publishedAt":39},"01M6JFCGD0M6CEATY01W7YN6DB","react-component-refactoring","Safely refactor large React components into smaller, maintainable pieces using proven patterns","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fsoftware-development\u002Freact-component-refactoring\u002FSKILL.md",[229,232,235],{"categoryNo":230,"categoryName":231,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":233,"categoryName":234,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[237,238,239,240,241,242,243,244,182,245,246,131,247,185,248,215,249,250,251,252],"react","component","refactoring","component refactoring","react component","react component refactoring","frontend","writing","safe","typescript","react components","modular","refactor","simplify","patterns","test-driven-development"]