chore(runtime): define the skills MCP bundle the templates now ask for

provision_claw honours the template's bundle list as of the previous
commit, but a bundle an agent is assigned and the runtime config does not
define resolves to nothing — so the assignment had to be made to mean
something on the MCP side too.

Carries the caveat that matters at the point of use: this channel only
works for a provider that can surface tool calls, and mission claws run on
claude_cli, which is text-only. Their skills arrive as prompt text instead.
The entry is for tool-capable agents, and so that an assigned name resolves.

gitea_forge is left UNDEFINED on purpose, with a note. Six templates name
it and nothing defines it; a plausible-looking definition pointing at the
wrong URL would turn a name that resolves to nothing into a server that
fails at call time, which is harder to notice rather than easier.

Co-Authored-By: Claude Opus 5 <[email protected]>

deploy/clawmates-runtime/agent.config.example.toml

@@ -204,6 +204,35 @@ headers = { Authorization = "Bearer REPLACE_WITH_DOOR_TOKEN" }
 [mcp_bundles.clawmates_door]
 servers = ["clawmates"]
 
+# The skills catalogue (cm-api::mcp_skills). Templates name this bundle and
+# `provision_claw` now honours what they name — but a bundle an agent is
+# assigned and this file does not define resolves to nothing, so the entry
+# below is what makes the assignment mean something.
+#
+# NOTE, and it is the important one: this channel only works for a provider
+# that can surface tool calls. Mission claws run on `claude_cli`, which is
+# TEXT-ONLY (see the note further down this file), so they cannot call an MCP
+# server at all. Their skills arrive as text in the turn prompt instead
+# (`topology_exec::pinned_skills_text`). This entry is for tool-capable agents
+# — and so that an agent assigned the bundle is not assigned a name that
+# resolves to nothing.
+[[mcp.servers]]
+name = "clawmates_skills"
+transport = "http"
+url = "http://clawmates_server_1:8080/mcp/skills"
+tool_timeout_secs = 60
+headers = { Authorization = "Bearer REPLACE_WITH_DOOR_TOKEN" }
+
+[mcp_bundles.clawmates_skills]
+servers = ["clawmates_skills"]
+
+# NOT DEFINED: `gitea_forge`. Six team templates name it and it resolves to
+# nothing here. Left undefined rather than invented — a plausible-looking
+# definition pointing at the wrong URL would turn a name that resolves to
+# nothing into a server that fails at call time, which is harder to notice, not
+# easier. Agents reach the forge through `git` over HTTPS with the ambient
+# GITEA_TOKEN (see cm-api::mission_workspace), which is why nothing broke.
+
 # ── A2A ingress (Phase 2) ───────────────────────────────────────────────────
 # ZeroClaw's Agent2Agent server. These props are set at RUNTIME by cm-api
 # (runtime_provision::enable_a2a_server / publish_claw) when a workspace opts in

docs/CAPABILITY-REVIEW.md

@@ -140,11 +140,19 @@ work and the condition.
   `cm-telemetry` (1); 6 of `cm-brain`'s 9 tests are `#[ignore]`d.
 - **`ZEROCLAW_GATEWAY_URL` / `_TOKEN`** have no default and fail at *first use*,
   not boot — a deployment looks healthy until someone clicks run.
-- **Runtime config bundles.** `provision_claw` now sends the right bundle names,
+- **`gitea_forge` resolves to nothing.** Six templates name it; the runtime
-  but the deployed runtime config must define `[mcp_bundles.clawmates_skills]`
+  config defines no such bundle. Left undefined deliberately — inventing a
-  (and a server entry pointing at `/mcp/skills`) for the MCP channel to work at
+  definition pointing at the wrong URL turns a name that resolves to nothing
-  all. The prompt-injection path does not depend on it, which is why it was the
+  into a server that fails at call time, which is harder to notice. Agents
-  fix chosen here.
+  reach the forge through `git` over HTTPS with the ambient `GITEA_TOKEN`,
+  which is why nothing broke. Worth either defining or removing from the
+  templates; both are small, and the choice needs someone who knows whether a
+  forge MCP server is wanted.
+- **The deployed runtime config is not the example.** `[mcp_bundles.clawmates_skills]`
+  is now in `agent.config.example.toml`, but the live local config carries no
+  bundle definitions at all — a fresh deploy needs the example's blocks. The
+  prompt-injection path does not depend on this, which is why it was the fix
+  chosen for the mission tier.
 
 ## The one process change worth making