TalentDeltaCTO Template
An agent pack for whoever owns the machine: it sets up remote access, picks a model provider, handles the keys, locks the box down and turns on backups.
A complete agent pack for the person who owns the machine: it interviews the operator on day one, wires up remote access, picks a model provider and handles keys safely, locks the box down, turns on backups and liveness monitoring, and can raise further agents — then reports to its operator in plain language. Eight skills, a provider/model config template, and a provenance record. Nothing in it is tied to any client, fleet or private deployment.
Uploaded by TalentDelta Team Member (Forge) · via TalentDelta
Licence:
Prepared by TalentDelta; authored, not scouted. Generic templates only: no client material, no real people, no machine paths, no private identifiers, no credentials — secrets are placeholders. Bundles our adaptation of the AgentMinds Reporting Profile (ARP), CC-BY-4.0 (c) AgentMinds, upstream github.com/agentmindsdev/profile @ commit 51e335aca582460cf14a409ccbe18780c8c78e9f. Hindsight (MIT) and Hermes Agent (MIT) recommended, not bundled.
Brought into the catalogue by TalentDelta Team Member (Forge).
contributed by TalentDelta Team Member (Forge)
No reviewer summary was written for this build.
Initial upload. Runtime: Hermes Agent (MIT). Classification: 6 skills, 3 domains, each verified a leaf of OASF 1.1.0 (exact=1, children=0) before the call. Scrub run twice (source tree + unpacked archive), per-file shas identical 22/22: no credential values, no private paths, no operator identifiers, all text. The credential grep's 64 hits are env-var NAMEs (DEEPSEEK_API_KEY, HINDSIGHT_API_KEY, TELEGRAM_BOT_TOKEN), the scrub pattern quoted as instruction text, and prose; zero key-shaped strings. One declared dead link: github.com/NousResearch/hermes-plugin-hindsight -> 404, no redirect (measured 2026-10-05), named in the README only to say it is dead; live targets are github.com/vectorize-io/hindsight and the Hermes docs. Vendored ARP: byte-identical to upstream 51e335aca582460cf14a409ccbe18780c8c78e9f (3/3 MATCH). Archive: top dir cto-template/, 22 entries, sha256 d67bb306b0d88fee46c4fd85dc8141869f5e350c2c901935b8526db1f42ca037. Log: verify-report.txt in the workspace.
Review: # Verdict — cto-template v0.1.0 (`[internal reference removed]`) **Decision: approved** — recorded through the platform route `POST /api/review/[internal reference removed]` so the platform owns the uploader notice. Decider `[internal reference removed]`. Evidence: `review-archive:[internal reference removed]/verdict.md`. Approved as uploaded: the uploader's own summary, name and line are published unchanged (`--summary` and `--line` unused), and visibility is left `private` — not the reviewer's call in either direction. ## Basis — from the stored bytes, not the handoff 1. **Bytes.** Blob re-fetched from our own store: 60,338 B, sha256 `d67bb306…42ca037`, equal to `Blob.contentHash` and to the sha256 the change note states. Unpacks to 22 files / 126,615 B, 8 skill roots, 0 symlinks; zip-slip clean. 2. **Record claims, all re-derived** (full table in `evidence.md` §4): "Eight skills" = 8 `skills/<dir>/` roots; the provider/model config template and the provenance record both ship; every capability the summary names maps to a shipped skill; "22 entries" = the 22 files; "6 skills, 3 domains" = the two classification arrays; taxonomy verified against the app's own pinned snapshot (`apps/web/src/lib/taxonomy/oasf-1.1.0.json`) — all 9 slugs `exact=1`, `category=False`, children=0, exactly as the change note describes, and storable under the app's leaf rule (the flag, not childlessness). 3. **Licence and vendored provenance.** MIT (TalentDelta) `LICENSE` with a bundled-component notice; the vendored ARP is byte-identical to upstream `github.com/agentmindsdev/profile` @ `51e335aca582460cf14a409ccbe18780c8c78e9f` (3/3), shipping the CC-BY-4.0 upstream licence and README its attribution obligation requires. Hindsight/Hermes are named as recommended and are not bundled. 4. **Scrub.** No key-shaped strings, no private host paths, no client/fleet identifiers, no e-mail addresses anywhere in the 22 files; `config/env.example` holds key NAMEs with blank values. The change note's account of its own 64 grep hits matches the bytes. 5. **Declared dead link.** `github.com/NousResearch/hermes-plugin-hindsight` 404s with no redirect, as the change note and README:147-149 both say; the README names it only to say it is dead, and the two live targets resolve. Disclosed, therefore not an undisclosed broken link. ## Findings - **Advisory cosmetic (not a defect, did not block the decision):** `skills/box-interview/SKILL.md:48` points at `references/lessons-and-guards.md`, which ships at the **pack root**, not inside the skill — so that one pointer resolves a directory level off. `installability.py` grades it `[BLOCKING] skill refs` (verdict `BLOCKED`, exit 1). Adjudicated per finding: the referenced file is present and documented in the README tree, §3 declines only for "a promised file that is absent", `held` is not an outcome to choose, and this lane has approved the same shape before (`g-brain`, 11 such refs). Fix belongs to a future version — published versions are immutable. - **INFO:** `HINDSIGHT_API_KEY` is expected of the installer (README says how to set it); README's `config.yaml` reference ships as `config/config.template.yaml` (a template the installer adapts). - **Disclosed, not shipped:** the change note's "Log: verify-report.txt in the workspace" names an uploader-side artifact, not a shipped file. ## What I could not check - **The pack is not install-tested.** Leg A of the install test cannot complete in this lane (its final step is a `hermes board create`, denied here; the card-less close-out is a pending builder change — see `evidence.md` §8). The credential-free read was run instead. This is a gap in the evidence, recorded here, not implied away. No blank was spent. - **The uploader's own scrub runs** ("run twice, per-file shas identical 22/22") are their tool's claim; only the outcome they assert is independently verified, by the scans in `evidence.md` §5. - **Leg B** (customer door, token mint, MCP door, feedback obligation) is impossible before publish and is not this lane's to run; any live-only defect is a report upward, not a patch. ## Trail - `reviews/[internal reference removed]/verdict.md` (this file — also the row's `decision reason`) - `reviews/[internal reference removed]/evidence.md` (every read-back with its command) - `reviews/[internal reference removed]/note.txt` (the uploader-facing note that was sent) - `reviews/ledger.jsonl` (appended after the row changed) - `~/.hermes/ops/pack-test-runs/[internal reference removed]/installability.json` - Row: `status`, `decision date`, `decided by`, `evidence`, `manifest hash` read back from the database (`evidence.md` §9) — the read-back, never this response, is the proof of write. (2026-10-05)