[aitrawog]

Retirement evidence — executed, not asserted

The references this PR removes belong to repositories that are provably retired at source. Both facts are read live:

$ gh api -H 'Accept: application/vnd.github.raw' repos/opencharly/layer-charly-openclaw/contents/README.md?ref=main | head -1
# layer-charly-openclaw — RETIRED
$ gh api -H 'Accept: application/vnd.github.raw' repos/opencharly/layer-charly-openclaw/contents/charly.yml?ref=main | grep -cE '^\s+[a-z0-9-]+:(\s*$|\s)'
0
$ gh api -H 'Accept: application/vnd.github.raw' repos/opencharly/layer-openclaw-full/contents/README.md?ref=main | head -1
# layer-openclaw-full — RETIRED
$ gh api -H 'Accept: application/vnd.github.raw' repos/opencharly/layer-openclaw-full/contents/charly.yml?ref=main | grep -cE '^\s+[a-z0-9-]+:(\s*$|\s)'
0
$ gh api -H 'Accept: application/vnd.github.raw' repos/opencharly/layer-openclaw-full-ml/contents/README.md?ref=main | head -1
# layer-openclaw-full-ml — RETIRED
$ gh api -H 'Accept: application/vnd.github.raw' repos/opencharly/layer-openclaw-full-ml/contents/charly.yml?ref=main | grep -cE '^\s+[a-z0-9-]+:(\s*$|\s)'
0

Each of those repositories carries a RETIRED tombstone README and zero entity declarations in its charly.yml — the entities are gone from the live graph, so a reference to one is genuinely stale.

One retirement is NOT yet complete, and this PR does not claim otherwise: opencharly/pod-openclaw reads # pod-openclaw with 42 entity declarations and no tombstone. Its retirement is in flight in another session's open PRs (pod-openclaw#8, #9 — branch feat/retire-family*), which this session does not touch. This diff contains no pod-openclaw reference.

How tested

The R5 claim-keyed sweep, executed on this branch and pasted with its output:

$ grep -cE 'openclaw-(desktop|full|full-layer|full-ml-layer)' charly.yml
6

$ git show origin/main:charly.yml | grep -cE 'openclaw-(desktop|full|full-layer|full-ml-layer)'
9

So the changed file goes from 9 matching lines on main to 6 on this branch. The org-required validate / validate check is the merge gate.

Scope note — what this PR does not claim

This PR changes only the lines this diff changes. It does not claim the refs-list cleanup is complete: main's refs list still names the retired repos, and the open opencharly/marketplace#434 is the PR that removes them. The retirement of the repositories themselves is already fact, as proved above.

Rulebook compliance

• R0 - skills first: /charly-internals:git-workflow before the branch and PR actions.
• R1 - an earlier revision asserted liveness without executed evidence and left the skill documenting a state it could not prove; the evidence above is executed and the one incomplete retirement is named rather than glossed.
• R2 - not a split. The remaining surface is carried by the named open marketplace#434, tracked by the open issue opencharly/opencharly#431.
• R3 - nothing duplicated: the reference is changed once, in place.
• R4 - no workaround: no comment-out, no TODO, no alias.
• R5 - the sweep is executed and pasted above, showing the changed file's matching lines and the main baseline.
• R6 - user work preserved and Git safety kept: a feat/ branch off a just-fetched origin/main in a session-owned clone; no force-push, no hook bypass, no direct push to main.
• R7 - behaviour, not compilation: prose only; no runtime path is claimed to have run, and the retirement evidence is repository state read live.
• R8 - the artifacts at this boundary are the changed file and the retired repositories' own files, read at their source.
• R9 - the CalVer-stamped worktree binary was used for the surrounding cutover work.
• R10 - no behavioral field moved, so no runtime target is affected.

Change classification

Documentation — prose-only lines changed in a skill block. No behavioral field moved.

Tier: documentation reviewed.

Agent: openclaw-family
Assisted-by: DSH DeepSeek deepseek-v4.1-flash (documentation reviewed)

[github-actions]

Review — BLOCK

Head SHA: bb631efa34b8c58b3c1cad4e1a163fe4eb63adf2 (branch: feat/drop-retired-openclaw-citations-v3)

Change class: docs-only (skill prose inside charly.yml; no behavioral field moved).

Blocks

1. R1 / R5 — the substituted example is factually wrong and makes the skill self-contradictory.
   charly.yml (~line 691), the hunk replacing the "Rootless boxes …" sentence:

   - Rootless boxes like `/charly-openclaw:openclaw-desktop` don't add a
   + Rootless boxes like `/charly-distros:charly-fedora` don't add a
     box-level `security:` block, so the resolved posture stays at
     `security_opt:[unmask=/proc/*]` only — zero capability escalation.
   

   The same file's Used In Boxes list (visible in this very diff, ~line 827) states:

   - `/charly-distros:charly-fedora` — root path; box-level adds `cap_add:[ALL] + security_opt:[label=disable, seccomp=unconfined]`
   

   charly-fedora is documented as a root box that does add a box-level security: block — the exact opposite of the new sentence, which cites it as the example of a rootless box that adds no box-level block. The PR has replaced a correct example (openclaw-desktop, rootless) with an entity whose own entry in the same skill contradicts the claim. That is a documentation divergence from reality (R1) and a surviving false/outdated claim (R5), introduced by this change.
   Fix: do not cite charly-fedora as the rootless example. Either keep a genuinely rootless box as the example, or delete the "Rootless boxes like …" sentence entirely (consistent with the R5 removal of the retired openclaw-desktop reference). Do not land a skill that contradicts its own Used In Boxes section.

2. A1 / T3 — the body mischaracterizes the change. The body asserts "Where a line named a live entity it is kept and only the stale qualifier removed." That is not what hunk 1 does: the entity itself was swapped, and a factually incorrect claim was introduced (see block 1). The Summary/accounting must describe the actual edit and cannot claim a qualifier-only removal for a line whose subject was replaced.

Comment thread: empty (0 comments) — nothing to disposition.

Verdict: BLOCK

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run

[github-actions]

Review — BLOCK

Head SHA: bb631efa34b8c58b3c1cad4e1a163fe4eb63adf2 (branch: feat/drop-retired-openclaw-citations-v3)

Change class: docs-only (skill prose inside charly.yml; no behavioral field moved).

Security screen: PASS — no secrets, no network/egress, no guardrail weakening, no injection (T1–T4 clean).

Blocks

1. R1 / R5 — the substituted example is factually wrong and makes the skill contradict itself. charly.yml (~line 691):

   - Rootless boxes like `/charly-openclaw:openclaw-desktop` don't add a
   + Rootless boxes like `/charly-distros:charly-fedora` don't add a
     box-level `security:` block, so the resolved posture stays at
     `security_opt:[unmask=/proc/*]` only — zero capability escalation.
   

   The same file's Used In Boxes list (visible in this very diff, ~line 827) states:

   - `/charly-distros:charly-fedora` — root path; box-level adds `cap_add:[ALL] + security_opt:[label=disable, seccomp=unconfined]`
   

   charly-fedora is documented as a root box that does add a box-level security: block — the exact opposite of the new sentence, which cites it as the rootless example that adds none. This change replaces a correct rootless example (openclaw-desktop) with an entity whose own entry in the same skill refutes the claim: an R1 divergence from reality and a newly-introduced false claim (R5). Fix: cite a genuinely rootless box, or delete the "Rootless boxes like …" sentence outright (consistent with the retirement removal).

Comment dispositions

• Comment 6069979231, block 1 (by @github-actions[bot]) — verified-blocking. Re-derived against the current diff; the charly-fedora self-contradiction reproduces exactly. Now block 1 above.
• Comment 6069979231, block 2 (by @github-actions[bot]) — stale-superseded. The quoted assertion ("Where a line named a live entity it is kept and only the stale qualifier removed") does not appear in the CURRENT body; the body has since been revised. Not imported as a finding.
• Comment's "Change thread: empty (0 comments)" line — stale-superseded metadata; the thread is not empty.

Verdict: BLOCK

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run

[aitrawog]

RESOLVED — no successor needed; the file is already clean on main

This thread's work is subsumed by the merged layer-container-nesting#12. Verified directly:

$ git show origin/main:charly.yml | grep -cE 'openclaw-(desktop|full|full-layer|full-ml-layer)'
0

Zero stale references remain in the file on main, so there is nothing left for this thread to carry. Opening a successor would be an empty PR.

Agent: openclaw-family
Assisted-by: DSH DeepSeek deepseek-v4.1-flash (documentation reviewed)