메뉴
The CUE data-validation / configuration CLI (cue), pinned to v0.16.1. Use when working with the cue candy, installing the cue binary into a box or onto a target:local dev host, or running the offline schema-vendoring pipeline that feeds charly's egress validation.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
MUST be invoked before any work involving: the `charly migrate` command (the single idempotent migration that brings any opencharly config up to the latest schema CalVer), the CalVer schema-version stamp (`version: YYYY.DDD.HHMM`), the CUE-anchored HEAD/floor (`charly/schema/version.cue` → `#SchemaVersion`/`#SchemaFloor`), the declarative migration table (`charly/migrations.cue`, applied by the core op-walker in `charly/migrate_engine.go`), the `LatestSchemaVersion()` load-time gate, or adding a new schema cutover as a migration-table entry.
MUST be invoked before any work involving: charly secrets commands, Secret Service / config-file credential management, GPG-encrypted .secrets files, credential import/export, or secret administration.
Authoritative reference for the "Hard Cutover by Default" policy governing schema changes, API renames, and deprecations. Forbidden patterns, required deliverables, rationale, examples from this repo, and the no-exception enforcement: plans are authored as full-scope single-phase cutovers and executed end-to-end regardless of estimated time, context, or scope. MUST be invoked when planning or reviewing any breaking change to Go types, YAML field names, CLI flags, or OCI labels.
Use when committing, branching, pushing, merging, tagging, creating PRs, or approving/merging PRs with gh — the feat/-branch, R10-gated, never-force-push landing workflow across the main repo + the plugins submodule + box/<distro> submodules. Covers sync-to-upstream, branch/worktree pruning, the fork+PR path for contributors without write access, and cross-repo @github landing order.
Go CLI development: building the charly binary, running tests, understanding the source code structure. MUST be invoked before reading or modifying any Go source file in charly/.
the `libvirt:` libvirt-RPC check verb for VMs — domain info, framebuffer screenshots, send-key, passwd, QMP, qemu-guest-agent client, snapshots, events — served out-of-process by candy/plugin-vm.
| name | cue |
| description | The CUE data-validation / configuration CLI (cue), pinned to v0.16.1. Use when working with the cue candy, installing the cue binary into a box or onto a target:local dev host, or running the offline schema-vendoring pipeline that feeds charly's egress validation. |
| Property | Value |
|---|---|
| Candy | candy/cue |
| Binary | /usr/local/bin/cue |
| Version | pinned v0.16.1 (matches charly's embedded cuelang.org/go library) |
| Install | download: the cue-lang GitHub release tarball, extract cue (cross-distro, no package:) |
| Status | testing |
A single static Go binary, cue, from the pinned cue-lang GitHub release
(cue_v0.16.1_linux_${ARCH}.tar.gz). No distro packages — the download: verb
fetches and extracts the one binary, so the candy is distro-agnostic.
charly's runtime never shells out to cue — every build/deploy/check path
validates through the embedded cuelang.org/go library (the cueSchemaCtx
in charly/cue_schema.go, and the egress validator in the compiled-in
candy/plugin-egress — M16 — fronted by the charly/egress.go shim). The cue
CLI is here for the developer/agent workflow:
cue import jsonschema:,
cue mod get) that produces the .cue files charly embeds — see
/charly-internals:egress;cue vet, cue export) in a charly dev/coder box.Pin v0.16.1 so the CLI that vendors a schema is the SAME CUE version the embedded library compiles it with — a newer CLI could emit constructs the pinned library rejects.
The candy's plan: ships deterministic check: steps: the binary lands at
/usr/local/bin/cue, cue version reports the pinned v0.16.1, and a real
cue export of a computed field (y: x*2 → 42) proves the binary actually
evaluates CUE — a non-functional binary fails the check.
charly bundle add cue cue --target local # installs /usr/local/bin/cue on this host
…then the task cue:vendor pipeline (see /charly-internals:egress) can run.
/charly-internals:egress — the egress-validation subsystem the cue CLI feeds (the vendoring pipeline, candy/plugin-egress/egress-schemas/vendor/)./charly-build:validate — charly box validate (the ingress side; uses the embedded library, not this CLI)./charly-image:layer — the download: verb the candy uses.Invoke when working with the cue candy, installing the cue CLI into a box or
onto a target:local host, or before running the schema-vendoring pipeline.