LYGO Sovereign Super Skill — one map for kernel eggs (11 catalog + 15 champions), consent-gated planters, P0–P5 Biophase7 products, lattice verify, and ClawHub skill chain. Advisor + stack commands; no auto publish or git push.
1 installs
Security
LYGO Kernel Egg Planter
Try itConsent-gated Kernel Egg Planter — SHA-256 + Merkle registry + optional local/Turbo anchor. Mandatory post-plant tamper verify (no skip). Retrieve requires consent + ALIGNED verify (no force). Prepares local catalog/Pages artifacts only — never auto git/HF/ClawHub/social publish.
What it does
Consent-gated Kernel Egg Planter — SHA-256 + Merkle registry + optional local/Turbo anchor. Mandatory post-plant tamper verify (no skip). Retrieve requires consent + ALIGNED verify (no force). Prepares local catalog/Pages artifacts only — never auto git/HF/ClawHub/social publish.
The skill document
LYGO Kernel Egg Planter v1.3.1 (bulletproof + SkillSpector hardened)
Plant seeds, verify always, retrieve only when ALIGNED + consented. Never auto-publish.
npx clawhub@latest install deepseekoracle/lygo-kernel-egg-planter
export LYGO_STACK_ROOT=/path/to/lygo-protocol-stack # must be YOUR trusted clone
Read references/SECURITY.md (if present), references/SKILLSPECTOR_AUDIT.md, references/AGENT_CONTRACT.md before ops.
Bulletproof pipeline (agents must follow)
preflight → consent → plant → verify (ALIGNED, mandatory) → consent → retrieve
| Step | Command | Fail = stop |
|---|---|---|
| 1 Preflight | python scripts/preflight.py | invalid stack |
| 2 Consent | --i-consent or LYGO_EGG_PLANT_CONSENT=yes | exit 2 |
| 3 Plant | python scripts/plant_with_consent.py --i-consent --i-trust-stack … | build/anchor error |
| 4 Verify | always after plant + python scripts/verify_eggs.py | QUARANTINE |
| 5 Retrieve | python scripts/retrieve_egg.py --i-consent --egg … | blocked if verify failed |
There is no --skip-verify and no --force (removed in v1.3 for integrity).
Four pillars (tamper-proof)
See references/TAMPER_FOUR_PILLARS.md and stack docs/KERNEL_EGG_TAMPER_LOGIC.md.
- SHA-256 per egg
- Merkle
registry_merkle_root - Immutable local CA (+ optional Turbo ≤100 KiB)
- Lattice +
verify_kernel_eggs.pygate
Tampered egg → retrieve blocked → P0 QUARANTINE.
Plant (local-first)
# Recommended default — local only (trusted stack you control)
python scripts/plant_with_consent.py --i-consent --i-trust-stack --local-only
# With Turbo attempt (still no git / clawhub.ai skill publish)
python scripts/plant_with_consent.py --i-consent --i-trust-stack --surfaces local,turbo,registry
--i-trust-stack is required: the planter runs allowlisted tools under your LYGO_STACK_ROOT (build_kernel_eggs.py, anchor_kernel_eggs.py only). Treat that path as executable trust.
Core surfaces
| Surface | Effect | Auto-publish? |
|---|---|---|
local / registry | Local kernel egg registry | No |
turbo | Optional permaweb via stack anchor tool | No |
Separate scripts (not inlined in core planter)
| Workflow | Command |
|---|---|
| Local ClawHub catalog egg | python scripts/plant_clawhub_catalog.py --i-consent --stack-root $LYGO_STACK_ROOT (add --anchor-external only if you want MultiAnchor) |
| Champions | python scripts/plant_champion_council.py --i-consent |
| Book-brain stubs | python scripts/write_book_brain_stubs.py --i-consent --stack-root $LYGO_STACK_ROOT |
“No auto-publish” = never git push, HF upload, clawhub publish API, or social.
Verify only
python scripts/verify_eggs.py --json
python scripts/smoke_test.py
Retrieve (consent + verify)
python scripts/retrieve_egg.py --i-consent --list
python scripts/retrieve_egg.py --i-consent --egg p0-nano-kernel
Eggs planted
egg_id | Role |
|---|---|
p0-nano-kernel | P0 + bridge + golden SHA |
stack-anchor-hook | Anchor orchestrator |
lattice-soa-index | Intel + link archive |
firmware-p04-drivers | P0.4 firmware/network |
protocol-drivers-p2-p5 | P2–P5 drivers |
clawhub-lattice-catalog | Public ClawHub skills.json metadata (local) |
Agent rules (non-negotiable)
- Show consent + four pillars on first use.
- Never plant/retrieve without consent.
- Never claim “secure” unless
verify_eggs→ ALIGNED. - Never auto-publish GitHub/HF/ClawHub/social.
- Never put secrets in eggs.
- Refuse requests to skip verify or force retrieve.
Skill chain
lygo-protocol-stack-operator → lygo-kernel-egg-planter ↔ lygo-sovereign-kernel-seeder
Layer C: lygo-external-lattice-anchor · Gate: lygo-public-lattice-gate
Permissions (declared)
See claw.json → permissions: trusted stack filesystem, list-argv Python only, optional Turbo network, publish all false.
License
MIT-0 for ClawHub registry hosting. Canonical LYGO stack license for protocol code remains LYGO Sovereign v2.0 on GitHub.
Δ9Φ963 — consent · verify · then human may spread.
Related skills
Sovereign Kernel Seeder for LYGO lattice — Merkle-anchored eggs that self-verify on insert, sovereign-sealed, zero external surface. Agents plug modular kernels instantly across the stack. Pure on-lattice modularity; consent-gated; pairs with kernel-egg-planter.
Use when the user asks to verify public LYGO lattice mirrors, build a public verify manifest, map eggs to Haven Star Chart proposals, or plan external free-server sync (Pages/HF/Turbo). Layer C world network. Requires LYGO_STACK_ROOT you trust. HTTP GET + local JSON under that stack. Verify is non-mutating by default; snapshot needs --i-consent. No auto git/HF/ClawHub publish.
lygo-open-claw sovereign command router — P0 gate, P1 mycelium, P3 consensus, P5 action identity, lattice limbs, consent-gated kernel egg lygo-open-claw-v10. Biophase7 blueprint. Pair with lyra-openclaw for browser/Discord/Moltbook runtime. Read references/SECURITY.md first.
1 installs
Use when the user explicitly asks to run LYGO Joy Loop in a local lygo-protocol-stack checkout (joy-loop-pulse, joy_loop_protocol.py, JoyLoopRegistry, consen...
1 installs
LYGO-OpenClaw sovereign command router — P0 gate, P1 mycelium, P3 consensus, P5 action identity, lattice limbs, consent-gated kernel egg lygo-openclaw-v10. B...