aitrawog · Oct 20, 2026
diff --git a/box/openclaw/charly.yml b/box/openclaw/charly.yml
@@ -16,76 +16,3 @@ openclaw-skill:
         name: openclaw
         family: openclaw
         owner: openclaw
-        description: |-
-            Headless OpenClaw AI gateway box (OpenClaw 2.0, npm openclaw@2026.9.8) on the
-            CachyOS base — the gateway layer plus the `openclaw:` check verb, nothing
-            else. Use when working with the headless gateway image, deploying OpenClaw
-            without a desktop, or probing a running gateway from a plan.
-        content: |-
-            # openclaw
-
-            Headless OpenClaw AI gateway (OpenClaw 2.0, npm openclaw@2026.9.8) — no desktop, no browser, just the gateway service.
-
-            ## Box Properties
-
-            | Property | Value |
-            |----------|-------|
-            | Base | cachyos (`cachyos.cachyos`) |
-            | Candies | `openclaw` (the gateway layer), `plugin-openclaw` (the `openclaw:` check verb) |
-            | Platforms | linux/amd64 |
-            | Ports | 18789 |
-            | Registry | ghcr.io/opencharly |
-            | Home repo | `opencharly/layer-openclaw` (`box/openclaw`) |
-
-            ## Full Candy Stack
-
-            1. `cachyos` (docker.io/cachyos/cachyos-v3, digest-pinned, Arch-derived)
-            2. `nodejs` → `socat` → `supervisord` (transitive via the `openclaw` layer)
-            3. `openclaw` — the gateway layer: npm `openclaw@2026.9.8`, the supervised service, the `data` volume at `~/.openclaw`, the port relay
-            4. `plugin-openclaw` — the out-of-process `openclaw:` check verb, composed so this box's plans can author `openclaw:` steps
-
-            Nothing else is composed. The family owns the gateway and its bed; a consumer that wants a desktop, a browser or a tool bundle composes those candies itself beside this one.
-
-            ## Ports
-
-            | Port | Service | Protocol |
-            |------|---------|----------|
-            | 18789 | OpenClaw gateway + Control UI | HTTP |
-
-            ## Quick Start
-
-            ```bash
-            charly box build openclaw
-            charly config openclaw
-            charly start openclaw
-            # gateway at http://localhost:18789
-            charly check run check-openclaw-pod      # the disposable R10 witness
-            ```
-
-            ## Key Candies
-
-            - `/charly-openclaw:openclaw-layer` — the gateway layer this box composes (npm pin, supervisord service, `data` volume, port relay)
-            - `/charly-check:openclaw-cmd` — the `openclaw:` check verb, served out-of-process by `opencharly/plugin-openclaw`
-
-            ## Verification
-
-            After `charly start`:
-
-            - `charly status openclaw` — container running
-            - `charly service status openclaw` — all services RUNNING
-            - `curl -s http://localhost:18789/healthz` — gateway liveness
-            - `charly check run check-openclaw-pod` — the family's build+runtime witness (fresh rebuild + deploy + the baked and verb checks)
-
-            ## Port Relay Architecture
-
-            The gateway binds loopback (`--bind loopback`), so it needs no auth and the Control UI never sees a non-loopback origin; `socat` relays it from the container interface (`port_relay: 18789`).
-
-            ## When to Use This Skill
-
-            **MUST be invoked** when the task involves the headless OpenClaw gateway image, deploying OpenClaw without a desktop, or probing a running gateway from a candy or box plan. Invoke it BEFORE reading source code or launching Explore agents.
-
-            ## Related
-
-            - `/charly-automation:openclaw-deploy` — gateway configuration, model auth and channel setup
-            - `/charly-image:image`, `/charly-image:layer` — composition and candy authoring
-            - [`opencharly/plugin-openclaw`](https://github.com/opencharly/plugin-openclaw) — the check verb's own repo
diff --git a/candy/openclaw/.agents/skills/openclaw-layer/SKILL.md b/candy/openclaw/.agents/skills/openclaw-layer/SKILL.md
@@ -0,0 +1,70 @@
+---
+name: openclaw-layer
+description: 'OpenClaw AI gateway service on port 18789 via npm with persistent data
+
+  (OpenClaw 2.0, npm openclaw@2026.9.8). Use when working with the OpenClaw gateway
+
+  layer, AI gateway configuration, or model routing.'
+---
+
+# openclaw — AI gateway service
+
+## Candy Properties
+
+| Property | Value |
+|----------|-------|
+| Dependencies | `nodejs`, `socat`, `supervisord` |
+| Ports | 18789 |
+| Port relay | 18789 (eth0 -> loopback) |
+| Volumes | `data` -> `~/.openclaw` |
+| Aliases | `openclaw` -> `openclaw` |
+| Service | `openclaw` (supervisord) |
+| Install files | `package.json` |
+| Home repo | `opencharly/layer-openclaw` (`candy/openclaw`) |
+
+## Environment Variables
+
+| Variable | Value |
+|----------|-------|
+| `NODE_ENV` | `production` |
+
+## The package pin and the engine floor
+
+The npm pin lives in `package.json` (`openclaw@2026.9.8`) and the candy's own plan asserts
+it, together with the engine range the package declares — `>=24.16.0 <25 || >=26.1.0`. The
+floor moved at 2026.9.3 and excludes node 22 and node 25.x, so the check fails on a base
+whose node is outside the range instead of running an unsupported runtime. The Arch
+`nodejs` package in the CachyOS base satisfies it.
+
+## Usage
+
+```yaml
+# box charly.yml
+openclaw:
+  candy:
+    base: cachyos
+    candy:
+      - openclaw
+```
+
+```bash
+charly alias install openclaw    # install host 'openclaw' command
+openclaw config                  # uses the alias
+```
+
+## Used In Boxes
+
+- `/charly-openclaw:openclaw` — the family's gateway image (this layer plus the `openclaw:` check verb)
+
+## Port Relay
+
+The gateway binds to `127.0.0.1:18789` (loopback only). A socat relay forwards from the
+container's network interface to loopback, so every connection appears as loopback to the
+gateway and OpenClaw's `allowedOrigins` requirement for the Control UI never applies. Same
+pattern as the `chrome` candy (CDP on port 9222).
+
+## Related
+
+- `/charly-openclaw:openclaw` — the box that composes this layer
+- `/charly-check:openclaw-cmd` — the `openclaw:` check verb, served by `opencharly/plugin-openclaw`
+- `/charly-coder:nodejs`, `/charly-infrastructure:socat`, `/charly-infrastructure:supervisord` — this layer's dependencies
diff --git a/candy/openclaw/.agents/skills/openclaw/SKILL.md b/candy/openclaw/.agents/skills/openclaw/SKILL.md
@@ -0,0 +1,79 @@
+---
+name: openclaw
+description: 'Headless OpenClaw AI gateway box (OpenClaw 2.0, npm openclaw@2026.9.8)
+  on the
+
+  CachyOS base — the gateway layer plus the `openclaw:` check verb, nothing
+
+  else. Use when working with the headless gateway image, deploying OpenClaw
+
+  without a desktop, or probing a running gateway from a plan.'
+---
+
+# openclaw
+
+Headless OpenClaw AI gateway (OpenClaw 2.0, npm openclaw@2026.9.8) — no desktop, no browser, just the gateway service.
+
+## Box Properties
+
+| Property | Value |
+|----------|-------|
+| Base | cachyos (`cachyos.cachyos`) |
+| Candies | `openclaw` (the gateway layer), `plugin-openclaw` (the `openclaw:` check verb) |
+| Platforms | linux/amd64 |
+| Ports | 18789 |
+| Registry | ghcr.io/opencharly |
+| Home repo | `opencharly/layer-openclaw` (`box/openclaw`) |
+
+## Full Candy Stack
+
+1. `cachyos` (docker.io/cachyos/cachyos-v3, digest-pinned, Arch-derived)
+2. `nodejs` → `socat` → `supervisord` (transitive via the `openclaw` layer)
+3. `openclaw` — the gateway layer: npm `openclaw@2026.9.8`, the supervised service, the `data` volume at `~/.openclaw`, the port relay
+4. `plugin-openclaw` — the out-of-process `openclaw:` check verb, composed so this box's plans can author `openclaw:` steps
+
+Nothing else is composed. The family owns the gateway and its bed; a consumer that wants a desktop, a browser or a tool bundle composes those candies itself beside this one.
+
+## Ports
+
+| Port | Service | Protocol |
+|------|---------|----------|
+| 18789 | OpenClaw gateway + Control UI | HTTP |
+
+## Quick Start
+
+```bash
+charly box build openclaw
+charly config openclaw
+charly start openclaw
+# gateway at http://localhost:18789
+charly check run check-openclaw-pod      # the disposable R10 witness
+```
+
+## Key Candies
+
+- `/charly-openclaw:openclaw-layer` — the gateway layer this box composes (npm pin, supervisord service, `data` volume, port relay)
+- `/charly-check:openclaw-cmd` — the `openclaw:` check verb, served out-of-process by `opencharly/plugin-openclaw`
+
+## Verification
+
+After `charly start`:
+
+- `charly status openclaw` — container running
+- `charly service status openclaw` — all services RUNNING
+- `curl -s http://localhost:18789/healthz` — gateway liveness
+- `charly check run check-openclaw-pod` — the family's build+runtime witness (fresh rebuild + deploy + the baked and verb checks)
+
+## Port Relay Architecture
+
+The gateway binds loopback (`--bind loopback`), so it needs no auth and the Control UI never sees a non-loopback origin; `socat` relays it from the container interface (`port_relay: 18789`).
+
+## When to Use This Skill
+
+**MUST be invoked** when the task involves the headless OpenClaw gateway image, deploying OpenClaw without a desktop, or probing a running gateway from a candy or box plan. Invoke it BEFORE reading source code or launching Explore agents.
+
+## Related
+
+- `/charly-automation:openclaw-deploy` — gateway configuration, model auth and channel setup
+- `/charly-image:image`, `/charly-image:layer` — composition and candy authoring
+- [`opencharly/plugin-openclaw`](https://github.com/opencharly/plugin-openclaw) — the check verb's own repo
diff --git a/candy/openclaw/charly.yml b/candy/openclaw/charly.yml
@@ -75,70 +75,3 @@ openclaw-layer-skill:
         name: openclaw-layer
         family: openclaw
         owner: openclaw
-        description: |-
-            OpenClaw AI gateway service on port 18789 via npm with persistent data
-            (OpenClaw 2.0, npm openclaw@2026.9.8). Use when working with the OpenClaw gateway
-            layer, AI gateway configuration, or model routing.
-        content: |-
-            # openclaw — AI gateway service
-
-            ## Candy Properties
-
-            | Property | Value |
-            |----------|-------|
-            | Dependencies | `nodejs`, `socat`, `supervisord` |
-            | Ports | 18789 |
-            | Port relay | 18789 (eth0 -> loopback) |
-            | Volumes | `data` -> `~/.openclaw` |
-            | Aliases | `openclaw` -> `openclaw` |
-            | Service | `openclaw` (supervisord) |
-            | Install files | `package.json` |
-            | Home repo | `opencharly/layer-openclaw` (`candy/openclaw`) |
-
-            ## Environment Variables
-
-            | Variable | Value |
-            |----------|-------|
-            | `NODE_ENV` | `production` |
-
-            ## The package pin and the engine floor
-
-            The npm pin lives in `package.json` (`openclaw@2026.9.8`) and the candy's own plan asserts
-            it, together with the engine range the package declares — `>=24.16.0 <25 || >=26.1.0`. The
-            floor moved at 2026.9.3 and excludes node 22 and node 25.x, so the check fails on a base
-            whose node is outside the range instead of running an unsupported runtime. The Arch
-            `nodejs` package in the CachyOS base satisfies it.
-
-            ## Usage
-
-            ```yaml
-            # box charly.yml
-            openclaw:
-              candy:
-                base: cachyos
-                candy:
-                  - openclaw
-            ```
-
-            ```bash
-            charly alias install openclaw    # install host 'openclaw' command
-            openclaw config                  # uses the alias
-            ```
-
-            ## Used In Boxes
-
-            - `/charly-openclaw:openclaw` — the family's gateway image (this layer plus the `openclaw:` check verb)
-
-            ## Port Relay
-
-            The gateway binds to `127.0.0.1:18789` (loopback only). A socat relay forwards from the
-            container's network interface to loopback, so every connection appears as loopback to the
-            gateway and OpenClaw's `allowedOrigins` requirement for the Control UI never applies. Same
-            pattern as the `chrome` candy (CDP on port 9222).
-
-            ## Related
-
-            - `/charly-openclaw:openclaw` — the box that composes this layer
-            - `/charly-check:openclaw-cmd` — the `openclaw:` check verb, served by `opencharly/plugin-openclaw`
-            - `/charly-coder:nodejs`, `/charly-infrastructure:socat`, `/charly-infrastructure:supervisord` — this layer's dependencies
-