feat(agents): add openshell-onboarding skill

[letv1nnn]

Summary

Adds a structured onboarding skill for the OpenShell codebase. The skill reads the engineer's GitHub profile to determine Rust experience, then generates a phased plan covering: project orientation, guided local setup (gateway + sandbox), architecture deep dive with Socratic exercises, sandbox/policy hands-on, and first contribution workflow. Includes curated Rust resources for engineers new to the language. Offers Jira export and persists progress to onboarding-state.md.

Phases

Phase 0 — What OpenShell Is

Brief orientation briefing synthesized from canonical architecture docs. Covers project identity, four core components (gateway, supervisor/proxy, providers, policies), and inference.local. No deep reading yet — just enough mental model to make everything that follows make sense.

Phase 1a — Development Environment Setup

Guided walkthrough of prerequisites from CONTRIBUTING.md: mise, Rust, Python, Docker/Podman, Z3, macOS build tools. Step-by-step with verification gates. Blocks all hands-on phases.

Phase 1b — Get OpenShell Running Locally

Starts with a core primitives primer table (gateway, sandbox, provider, policy, inference.local — what each is and what you'll do with it). Then guided flow: start gateway, create sandbox, explore CLI commands. Includes Exercise 1 (Security Layer Walkthrough) — run real commands against a live sandbox and identify which isolation layer enforced each outcome.

Phase 1c — Rust Track

Parallel with 1a/1b. Experienced Rust devs get a synthesized dependency map from crate Cargo.toml files. New Rust devs get a curated study track (The Rust Book ch 1–10, Rustlings).

Phase 2 — Architecture Deep Dive

Read and discuss all architecture docs (gateway, sandbox, security-policy, compute-runtimes, build). Includes deployment options pointer (Kubernetes, OpenShift). Three exercises: crate ownership mapping, request trace with file:line references, and a Socratic "explain it in your own words" session with adaptive follow-up questions.

Phase 3 — Sandbox & Policy Deep Dive

Deep read of sandbox internals, policy schema, and OCSF logging. Three exercises: trace supervisor startup sequence, write and apply a real network policy, analyze OCSF event usage. Ends with a 5-question architecture reasoning quiz (70% pass threshold).

Phase 4 — First Contribution

Full contribution cycle: find an unclaimed good-first-issue, implement, open PR following Conventional Commits + DCO signoff, address review feedback. Includes vouch system reminder for external contributors.

Changes

• New skill: .agents/skills/openshell-onboarding/SKILL.md
• Registered in CONTRIBUTING.md skills table under Getting Started

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[ChristianZaccaria]

Hey Artem, great work!! 🙂 I think it looks fantastic and is very useful! - I left below some suggestions, but they are minor stuff compared to what you've done already, brilliant work🎉

I would suggest to have the agent help with setting up the development environment with the prerequisites such as mise , rust, python etc, before running OpenShell locally, as mentioned here: https://github.com/NVIDIA/OpenShell/blob/main/CONTRIBUTING.md#prerequisites

You could also add something about running this on OpenShift, in case someone wishes to learn more about that type of deployment, this way the agent will be able to point the user to the right docs.

The other thing about these types of skills, is that it's preferable to get the agent to read the canonical documentation (source of truth) and gather the right information about the architecture and other concepts, as opposed to copying into the skill content from the docs that might diverge at some point. This also reduces a lot the lines of code in the skill and narrows down the scope.

The skill should include behaviour, sequencing, decision logic, interaction patterns (you already have all of this which is perfect, but the content and concepts it may be best removed and simply have the agent read from the source, unless it's most likely not going to change.)