feat(skills): add signed catalog export

.agents/catalog-skills.yaml

@@ -0,0 +1,40 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Explicit allowlist for NemoClaw skills exported to the NVIDIA Verified Skills catalog.
+# Keep this file deterministic: no timestamps, no generated comments, and no implicit globs.
+# The export is regenerated with: python3 scripts/export-catalog-skills.py
+version: 1
+source: .agents/skills
+export: skills/nemoclaw
+include:
+  - skill: nemoclaw-skills-guide
+    rationale: Public index for user-facing NemoClaw skills.
+  - skill: nemoclaw-user-agent-skills
+    rationale: Public user documentation skill.
+  - skill: nemoclaw-user-configure-inference
+    rationale: Public user documentation skill.
+  - skill: nemoclaw-user-configure-security
+    rationale: Public user documentation skill.
+  - skill: nemoclaw-user-deploy-remote
+    rationale: Public user documentation skill.
+  - skill: nemoclaw-user-get-started
+    rationale: Public user documentation skill.
+  - skill: nemoclaw-user-manage-policy
+    rationale: Public user documentation skill.
+  - skill: nemoclaw-user-manage-sandboxes
+    rationale: Public user documentation skill.
+  - skill: nemoclaw-user-monitor-sandbox
+    rationale: Public user documentation skill.
+  - skill: nemoclaw-user-overview
+    rationale: Public user documentation skill.
+  - skill: nemoclaw-user-reference
+    rationale: Public user documentation skill.
+exclude:
+  - pattern: nemoclaw-maintainer-*
+    rationale: Internal maintainer workflows are not catalog/customer-facing.
+  - pattern: nemoclaw-contributor-*
+    rationale: Contributor workflows are repo-local until explicitly approved for catalog publication.
+metadata:
+  minNemoClawVersion: "0.1.0"
+  testedNemoClawVersion: "0.1.0"

.gitattributes

@@ -0,0 +1,5 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+/skills/nemoclaw/** linguist-generated=true
+/skills/nemoclaw/**/*.md diff=markdown

.github/CODEOWNERS

@@ -30,6 +30,11 @@
 /docs/                              @NVIDIA/nemoclaw-engineer
 /spark-install.md                   @NVIDIA/nemoclaw-engineer
 
+# ── Agent skills catalog ──
+/.agents/catalog-skills.yaml        @NVIDIA/nemoclaw-maintainer @NVIDIA/nemoclaw-engineer
+/.agents/skills/                    @NVIDIA/nemoclaw-maintainer @NVIDIA/nemoclaw-engineer
+/skills/nemoclaw/                   @NVIDIA/nemoclaw-maintainer @NVIDIA/nemoclaw-engineer
+
 # ── Tests ──
 /test/                              @NVIDIA/nemoclaw-engineer
 

.github/catalog-skills-signing-flow.md

@@ -0,0 +1,79 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+# NemoClaw catalog skills signing flow
+
+This diagram shows the required sequence for publishing NemoClaw user-facing skills into the NVIDIA Verified Skills catalog through the generated `skills/nemoclaw/` export.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    actor Maintainer as Human maintainer
+    participant Source as NemoClaw source<br/>.agents/skills + .agents/catalog-skills.yaml
+    participant Exporter as scripts/export-catalog-skills.py
+    participant Export as Generated export<br/>skills/nemoclaw
+    participant PRCI as PR workflow<br/>CI / Pull Request
+    participant Refresh as Skills / Catalog Refresh workflow
+    participant PR as Same-repo refresh PR
+    participant NVSkills as NVSkills CI signer
+    participant Main as NVIDIA/NemoClaw main
+    participant Target as NVIDIA/skills sync
+
+    Note over Source,Export: Implementation PR path added by issue #4282
+    Maintainer->>Source: Curate catalog-safe skills in .agents/catalog-skills.yaml
+    Maintainer->>Exporter: Run python3 scripts/export-catalog-skills.py
+    Exporter->>Export: Copy allowlisted skills as real files<br/>write catalog-metadata.json<br/>preserve skill.oms.sig + skill-card.md if present
+    Maintainer->>PRCI: Open implementation or content PR
+    PRCI->>Exporter: python3 scripts/export-catalog-skills.py --check --allow-missing
+    Exporter-->>PRCI: Pass before first export exists;<br/>after refresh PR, fail if skills/nemoclaw is stale or hand-edited
+    Maintainer->>Main: Merge reviewed PR after checks pass
+
+    Note over Refresh,PR: Post-merge refresh automation added by this PR
+    Maintainer->>Refresh: Optional manual workflow_dispatch<br/>dry_run=true first
+    Refresh->>Exporter: Regenerate export and show diff only
+    Refresh-->>Maintainer: No branch or PR created in dry run
+    Maintainer->>Refresh: Run dry_run=false when ready<br/>optionally request_nvskills_ci=true
+    Refresh->>Exporter: Regenerate export
+    Exporter->>Export: Update generated files if source changed
+    Refresh->>PR: Create/update automation/catalog-skills-refresh PR<br/>with export diff
+
+    alt request_nvskills_ci=true and bot is accepted
+        Refresh->>PR: Comment /nvskills-ci
+    else bot rejected or manual process preferred
+        Maintainer->>PR: Comment /nvskills-ci manually
+    end
+
+    NVSkills->>PR: Push signing artifacts<br/>skill.oms.sig + skill-card.md
+    PRCI->>Exporter: Re-run --check; signer artifacts are preserved
+    Maintainer->>PR: Review generated export and signing artifacts
+    Maintainer->>Main: Merge signed refresh PR
+    Target->>Main: Sync configured NemoClaw catalog path
+    Target->>Target: Keep only skills with skill.oms.sig and skill-card.md
+```
+
+## Human handoff points
+
+These are the manual review and approval points in the catalog signing flow.
+
+- Curate `.agents/catalog-skills.yaml` when public skill scope changes.
+- Review the generated `skills/nemoclaw/` diff in the same PR as the allowlist/source update.
+- Manually comment `/nvskills-ci` if the workflow bot cannot request signing.
+- Review and merge the signer-updated PR before expecting `NVIDIA/skills` to sync the signed skills.
+
+## Workflow steps added in this PR
+
+These checks and workflow steps automate export freshness while keeping signing under maintainer control.
+
+- `CI / Pull Request` runs `python3 scripts/export-catalog-skills.py --check --allow-missing` so this infrastructure PR can merge before the first generated export, while later export PRs still reject stale or hand-edited files.
+- `Skills / Catalog Refresh` supports:
+  - `dry_run=true` to regenerate and report changes without pushing.
+  - `dry_run=false` to create or update `automation/catalog-skills-refresh`.
+  - `request_nvskills_ci=true` to attempt the `/nvskills-ci` comment after opening/updating the PR.
+  - scheduled no-op/refresh behavior using the same exporter.
+
+## Next Steps
+
+- Review the exporter implementation in [`scripts/export-catalog-skills.py`](../scripts/export-catalog-skills.py).
+- Update the catalog allowlist in [`.agents/catalog-skills.yaml`](../.agents/catalog-skills.yaml) when public skill scope changes.
+- Review generated export diffs under `skills/nemoclaw/` in the refresh PR before requesting or accepting signing artifacts.
+- Check the workflow definitions in [`.github/workflows/pr.yaml`](workflows/pr.yaml) and [`.github/workflows/catalog-skills-refresh.yaml`](workflows/catalog-skills-refresh.yaml).

.github/workflows/catalog-skills-refresh.yaml

@@ -0,0 +1,102 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Skills / Catalog Refresh
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Regenerate and report changes without pushing or opening a PR"
+        type: boolean
+        required: true
+        default: true
+      request_nvskills_ci:
+        description: "Comment /nvskills-ci on the refresh PR after opening/updating it"
+        type: boolean
+        required: true
+        default: false
+  schedule:
+    - cron: "17 10 * * *"
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+concurrency:
+  group: catalog-skills-refresh
+  cancel-in-progress: false
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Configure git author
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Regenerate catalog skills export
+        run: python3 scripts/export-catalog-skills.py
+
+      - name: Check for changes
+        id: diff
+        run: |
+          if git diff --quiet -- .agents/catalog-skills.yaml skills/nemoclaw; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "No catalog skill export changes detected."
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            git diff --stat -- .agents/catalog-skills.yaml skills/nemoclaw
+          fi
+
+      - name: Stop after dry run
+        if: ${{ (github.event_name == 'workflow_dispatch' && inputs.dry_run) || (github.event_name == 'schedule' && steps.diff.outputs.changed != 'true') }}
+        run: |
+          if [[ "${{ steps.diff.outputs.changed }}" == "true" ]]; then
+            echo "Dry run detected catalog skill export changes; no branch or PR was created."
+          else
+            echo "Catalog skill export is already current."
+          fi
+
+      - name: Create or update refresh pull request
+        id: cpr
+        if: ${{ steps.diff.outputs.changed == 'true' && (github.event_name == 'schedule' || !inputs.dry_run) }}
+        uses: peter-evans/create-pull-request@8ce3b843f60ac63fbde403f79364ff7d80b5fbb1 # v7.0.8
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          branch: automation/catalog-skills-refresh
+          delete-branch: true
+          commit-message: "chore(skills): refresh catalog export"
+          title: "chore(skills): refresh catalog export"
+          body: |
+            ## Summary
+            - Regenerates `skills/nemoclaw/` from `.agents/catalog-skills.yaml` and `.agents/skills/`.
+            - Keeps the NVIDIA Verified Skills catalog export deterministic and reviewable.
+
+            ## Validation
+            - `python3 scripts/export-catalog-skills.py --check`
+
+            After maintainer review, request signing by commenting `/nvskills-ci` on this PR if the workflow did not do so automatically.
+          labels: |
+            documentation
+            CI/CD
+          add-paths: |
+            .agents/catalog-skills.yaml
+            skills/nemoclaw
+
+      - name: Request NVSkills signing
+        if: ${{ steps.cpr.outputs.pull-request-number != '' && github.event_name == 'workflow_dispatch' && inputs.request_nvskills_ci && !inputs.dry_run }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
+        run: |
+          gh pr comment "$PR_NUMBER" --body "/nvskills-ci"

.github/workflows/pr.yaml

@@ -51,6 +51,9 @@ jobs:
       - name: Verify platform matrix is in sync
         run: python3 scripts/generate-platform-docs.py --check
 
+      - name: Verify catalog skills export is in sync
+        run: python3 scripts/export-catalog-skills.py --check --allow-missing
+
   test-e2e-ollama-proxy:
     needs: [checks, changes]
     if: needs.changes.outputs.code == 'true'

.pre-commit-config.yaml

@@ -65,7 +65,7 @@ repos:
         name: SPDX license headers (insert if missing)
         entry: bash scripts/check-spdx-headers.sh --fix
         language: system
-        files: ^(nemoclaw/src/.*\.ts|scripts/.*\.ts|nemoclaw-blueprint/.*\.py|.*\.sh)$
+        files: ^(nemoclaw/src/.*\.ts|scripts/export-catalog-skills\.py|scripts/.*\.ts|nemoclaw-blueprint/.*\.py|.*\.sh)$
         exclude: ^nemoclaw-blueprint/.*__init__\.py$
         pass_filenames: true
         priority: 4
@@ -157,6 +157,14 @@ repos:
         pass_filenames: false
         priority: 10
 
+      - id: catalog-skills-export
+        name: Verify catalog skills export
+        entry: python3 scripts/export-catalog-skills.py --check --allow-missing
+        language: system
+        files: ^(\.agents/catalog-skills\.yaml|\.agents/skills/.*|skills/nemoclaw/.*|scripts/export-catalog-skills\.py)$
+        pass_filenames: false
+        priority: 10
+
       - id: env-var-docs
         name: NEMOCLAW_* env-var documentation gate
         entry: npx tsx scripts/check-env-var-docs.ts