---
name: "tangled"
description: "Work with Tangled repositories, pull requests, and spindle CI through tg and AT Protocol."
metadata:
  createdAt: "2026-09-11T18:46:00.191389+00:00"
  repoUrl: "https://skillz.supply/skills/did:plc:xbtmt2zjwlrfegqvch7fboei/skills.tangled/SKILL.md"
---

# tangled

Use `tg` for ordinary repository and collaboration operations. Run `tg --help` and
subcommand help for the installed version. Inside a clone, it can detect the repo
from `origin`; otherwise provide the requested `<owner>/<repo>`. Reads generally need
no login. Check `tg auth status` before authorized writes; use the user's handle for
browser login. Never assume an account from an example or another repository.

## authority follows the object

- The owner's PDS holds `sh.tangled.repo` metadata.
- The selected knot holds Git objects and refs.
- The repository's selected spindle owns current CI execution and logs.
- The appview/Bobbin provides indexed discovery; it can lag the authoritative service.

Distinguish the owner DID, the repo-record AT-URI, and the repository DID (`repoDid`).
A DID in a Git remote may identify the repository, not the owner. New repo records
normally use the repo name as rkey; legacy records may use a TID and `value.name`.
Resolve the actual record before selecting a knot or spindle.

## CI

Workflows live in `.tangled/workflows/`. Follow the project's engine and dependency
conventions. For Nixery, declare tools used by the commands rather than assuming a
full distribution. Store credentials in that repo's spindle secrets, not workflow YAML.

Use `tg pipeline status` for a verdict and `tg pipeline logs <id>` for output. The SSH
log-viewer hint printed by a push launches an interactive TUI, not a finite status
command. If CLI or appview results are stale, query the selected spindle directly:

```text
GET https://<spindle>/xrpc/sh.tangled.ci.queryPipelines?repo=<repoDid>&commits=<sha>&limit=5
```

Check the workflow status on the pushed commit. If no pipeline appears, verify the
workflow existed in that commit, its triggers matched, and the repo record selected
the intended spindle. Spindle registration alone does not select it for a repo.

## writes

Honor authorization for the specific repository and action. Repository investigation
does not grant permission to publish issues, comments, or code. Use the configured
credential store for headless credentials; never put passwords in command arguments
or logs. If the repository's spindle selection needs changing, preserve the rest of
the repo record and guard the update with its current CID.

Use the repository's canonical remote. Do not assume Tangled or a mirror is canonical
without checking the project. See https://docs.tangled.org/spindles for current CI
configuration and https://tangled.org/aly.codes/tg for the CLI.