メニュー
The CUE data-validation / configuration CLI (cue), pinned to v0.16.1. Use when working with the cue candy, installing the cue binary into a box or onto a target:local dev host, or running the offline schema-vendoring pipeline that feeds charly's egress validation.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | cue |
| description | The CUE data-validation / configuration CLI (cue), pinned to v0.16.1. Use when working with the cue candy, installing the cue binary into a box or onto a target:local dev host, or running the offline schema-vendoring pipeline that feeds charly's egress validation. |
| Property | Value |
|---|---|
| Candy | candy/cue |
| Binary | /usr/local/bin/cue |
| Version | pinned v0.16.1 (matches charly's embedded cuelang.org/go library) |
| Install | download: the cue-lang GitHub release tarball, extract cue (cross-distro, no package:) |
| Status | testing |
A single static Go binary, cue, from the pinned cue-lang GitHub release
(cue_v0.16.1_linux_${ARCH}.tar.gz). No distro packages — the download: verb
fetches and extracts the one binary, so the candy is distro-agnostic.
charly's runtime never shells out to cue — every build/deploy/check path
validates through the embedded cuelang.org/go library (the cueSchemaCtx
in charly/cue_schema.go, and the egress validator in the compiled-in
candy/plugin-egress — M16 — fronted by the charly/egress.go shim). The cue
CLI is here for the developer/agent workflow:
cue import jsonschema:,
cue mod get) that produces the .cue files charly embeds — see
/charly-internals:egress;cue vet, cue export) in a charly dev/coder box.Pin v0.16.1 so the CLI that vendors a schema is the SAME CUE version the embedded library compiles it with — a newer CLI could emit constructs the pinned library rejects.
The candy's plan: ships deterministic check: steps: the binary lands at
/usr/local/bin/cue, cue version reports the pinned v0.16.1, and a real
cue export of a computed field (y: x*2 → 42) proves the binary actually
evaluates CUE — a non-functional binary fails the check.
charly bundle add cue cue --target local # installs /usr/local/bin/cue on this host
…then the task cue:vendor pipeline (see /charly-internals:egress) can run.
/charly-internals:egress — the egress-validation subsystem the cue CLI feeds (the vendoring pipeline, candy/plugin-egress/egress-schemas/vendor/)./charly-build:validate — charly box validate (the ingress side; uses the embedded library, not this CLI)./charly-image:layer — the download: verb the candy uses.Invoke when working with the cue candy, installing the cue CLI into a box or
onto a target:local host, or before running the schema-vendoring pipeline.
MUST be invoked before any work involving: the `charly migrate` command (the single idempotent migration that brings any opencharly config up to the latest schema CalVer), the CalVer schema-version stamp (`version: YYYY.DDD.HHMM`), the CUE-anchored HEAD/floor (`charly/schema/version.cue` → `#SchemaVersion`/`#SchemaFloor`), the declarative migration table (`charly/migrations.cue`, applied by the core op-walker in `charly/migrate_engine.go`), the `LatestSchemaVersion()` load-time gate, or adding a new schema cutover as a migration-table entry.
MUST be invoked before any work involving: charly secrets commands, Secret Service / config-file credential management, GPG-encrypted .secrets files, credential import/export, or secret administration.
Authoritative reference for the "Hard Cutover by Default" policy governing schema changes, API renames, and deprecations. Forbidden patterns, required deliverables, rationale, examples from this repo, and the no-exception enforcement: plans are authored as full-scope single-phase cutovers and executed end-to-end regardless of estimated time, context, or scope. MUST be invoked when planning or reviewing any breaking change to Go types, YAML field names, CLI flags, or OCI labels.
Use when committing, branching, pushing, merging, tagging, creating PRs, or approving/merging PRs with gh — the feat/-branch, R10-gated, never-force-push landing workflow across the main repo + the plugins submodule + box/<distro> submodules. Covers sync-to-upstream, branch/worktree pruning, the fork+PR path for contributors without write access, and cross-repo @github landing order.
Go CLI development: building the charly binary, running tests, understanding the source code structure. MUST be invoked before reading or modifying any Go source file in charly/.
the `libvirt:` libvirt-RPC check verb for VMs — domain info, framebuffer screenshots, send-key, passwd, QMP, qemu-guest-agent client, snapshots, events — served out-of-process by candy/plugin-vm.