lesser-host

Use when Codex handles GitHub activity for equaltoai/lesser-host and should preserve routed-agent provenance: reading issues or PRs, commenting, reviewing, creating agent-scoped branches, committing bounded file changes, opening PRs, or creating truthful check runs. Prefer the mcp__host_lab__ GitHub tools whenever they can perform the needed operation; fall back to the general GitHub plugin or gh only for capabilities the routed tools do not expose.

Use when a change touches the trust API surface (`/.well-known/*`, `/attestations/*`), instance authentication (sha256(raw_key) matching), attestation shape or integrity, CSP (single-origin enforcement on `web/`), or safety / AI-evidence services. Walks trust posture with rigor; loosening these surfaces is refused without explicit governance event.

Use when building or maintaining host surfaces framework awkwardness — an AppTheory middleware / construct limitation, a TableTheory query-builder friction, a FaceTheory pattern gap (for `web/`). Produces a cleanly-shaped signal for the relevant Theory Cloud framework steward rather than a local patch. host's role as a high-governance, multi-tenant, multi-worker consumer means framework-consumption awkwardness here is scope-evidence for framework evolution under the harder constraints.

Use after plan-roadmap is approved, if the roadmap warrants a tracked GitHub Project at the equaltoai org level. Translates a roadmap document into a Projects v2 kanban board with issues across the affected repos. Follows equaltoai's established project pattern.

Use after scope-need and relevant specialist skills approve work. Takes the scoped-need document and produces a flat, ordered list of discrete changes required. Each change is scoped to be a single commit.

Use when a change touches the soul registry — Solidity contracts in `contracts/`, on-chain-reaching Go code, off-chain DynamoDB state that mirrors on-chain references, Safe-ready governance payloads, mint-signer key handling, or the soul-namespace contract lesser-soul publishes. Walks contract integrity (Slither + hardhat + solhint), deploy discipline (Sepolia → Safe-ready mainnet), off-chain reconciliation, and governance-coordination.

Use to execute a single milestone (or GitHub Project phase) of work — feature branch off main, commits per enumerated task, PR review with gov-infra verifiers, merge to main. Runs one milestone at a time. Deploys themselves (CDK lab/live, on-chain Sepolia/mainnet, managed-instance rollout) are handled separately.

Use when a user reports a bug, regression, or unexpected behavior in host — control-plane API failure, trust-API instance-auth rejection, provisioning worker failure, soul-registry on-chain mismatch, managed-update step failure, release-verification mismatch, CSP violation, gov-infra verifier failure, CDK deploy issue. Runs before any fix is proposed. Produces an investigation note, not a patch.

Use when a change touches the gov-infra governance rubric — adding a verifier, modifying an existing one, tightening thresholds, adjusting evidence policy, bumping pack.json, updating controls matrix or threat model. Walks the rubric-impact with anti-drift discipline. Rubric changes are governance events, not ordinary code changes.

Use after enumerate-changes. Takes a flat enumerated change list and sequences it with dependencies, risks, and a rollout plan across stages (lab → live) and (where applicable) on-chain networks (Sepolia → mainnet). Produces a roadmap document, not code or project state.

Use when a change touches the managed-instance provisioning pipeline, the managed-update flow, or the consumer-release-verification discipline. Walks per-slug AWS account provisioning, DNS delegation, CodeBuild runner coordination, checksum-based release verification, step-level recovery, and tenant-isolation preservation. Provisioning and its release-verification gate are the supply-chain frontier.

Use when the user pastes or describes an inbound advisor-agent email dispatched to this steward. Advisor emails end with `@lessersoul.ai` and carry a provenance signature. This skill verifies the brief's origin, extracts the request cleanly, and surfaces it to Aron for explicit review before any action is taken. Advisor-dispatched work never executes autonomously.

Use when a user brings a new capability, feature request, or enhancement need for host in vague terms. Interviews conversationally and produces a scoped-need document. Applies Gate 1 (host-mission alignment), Gate 2 (narrowest scope), and Gate 3 (specialist routing) before producing output.