skills: allow user-space env setup; refuse only sudo/system-level ops

[ramakrishnap-nv]

The cuopt-developer skill forbade all package installs, which contradicted its own pre-flight check requiring the agent to create and activate the conda env. Agents (e.g. Codex) read this literally and refused to bootstrap conda or build a clean dev env.

This narrows the one non-negotiable refusal to privileged/system-level ops (sudo, root, /etc, drivers, system repos). User-space env setup — create/activate the conda env from conda/environments/*.yaml, pip/conda/mamba installs into the env, bootstrap miniforge into $HOME — is now explicitly allowed. The same relaxation applies to cuopt-user-rules.

[ramakrishnap-nv]

/nvskills-ci

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 227730e9-3046-46bf-9d4b-8b28509e8829

📥 Commits

Reviewing files that changed from the base of the PR and between 606c2d8 and 01d08e4.

📒 Files selected for processing (6)

• skills/cuopt-developer/BENCHMARK.md
• skills/cuopt-developer/skill-card.md
• skills/cuopt-developer/skill.oms.sig
• skills/cuopt-user-rules/BENCHMARK.md
• skills/cuopt-user-rules/skill-card.md
• skills/cuopt-user-rules/skill.oms.sig

---

📝 Walkthrough

Walkthrough

Updates to cuOpt skill documentation refine privilege refusal rules and package installation policies, expand conda environment setup guidance, and refresh benchmark metadata and evaluation results across both the cuopt-developer and cuopt-user-rules skills.

Changes

Skill Documentation Policy and Evaluation Updates

Layer / File(s)	Summary
Privilege refusal rules and package install policy skills/cuopt-developer/SKILL.md, skills/cuopt-user-rules/SKILL.md	cuopt-developer Refusal Rules section is rewritten to block only sudo/system-level operations while explicitly permitting user-space conda env setup and dependency installs. cuopt-user-rules package installs table row is updated to allow user-space installs after confirmation; the old blanket no-auto-install block is replaced with a mandatory No Privileged Operations section (forbidding sudo/root, system file changes, repo/key additions, firewall/network/driver changes) and an Installing Packages section with confirm-first flow, CUDA-suffix matching, and single package-manager enforcement.
Developer environment setup and pre-flight guidance skills/cuopt-developer/SKILL.md, skills/cuopt-developer/references/first_time_setup.md	The "Still ask before" list is narrowed to git write operations and destructive commands; the No Privileged Operations bullet is rewritten with a cross-link to Refusal Rules. An explicit conda/mamba env create and conda activate bash snippet is added to the pre-flight step using a local prefix (./.cuopt_env). A footer cross-reference line gains "conda-env" in its policy category list. The first_time_setup.md walk-through adds a user-space Miniforge bootstrap instruction and updates the pre-flight checks step to describe conda env creation from conda/environments/all_cuda-*.yaml before the first build.
cuOpt developer skill documentation and evaluation metadata skills/cuopt-developer/skill-card.md, skills/cuopt-developer/BENCHMARK.md, skills/cuopt-developer/skill.oms.sig	License format updated to "Apache-2.0"; Use Case description now explicitly covers contributor activities and scope (C++/CUDA, Python, server, CI, docs). Reference links revised with architecture, troubleshooting, and numerical methodology entries. Evaluation metadata reformatted with NVSkills-Eval external profile description and 3 internal tasks in astra-sandbox. Evaluation Results table replaced with updated Security/Correctness/Discoverability/Effectiveness/Efficiency percentages. BENCHMARK.md evaluation date set to 2026-06-22 and attempts-per-task reduced to 1; Tier 1 static validation findings refreshed with missing sections and unexpected root files; Tier 2 deduplication marked as not run. Sigstore bundle updated with new DSSE envelope and signature.
cuOpt user-rules skill documentation and evaluation metadata skills/cuopt-user-rules/skill-card.md, skills/cuopt-user-rules/BENCHMARK.md, skills/cuopt-user-rules/skill.oms.sig	Description refined to emphasize structured guidance (problem formulation, environment setup, API usage, result verification) across routing/LP/MILP/QP optimization interfaces. Evaluation Agents Used section added naming claude-code and codex; Evaluation Tasks updated to reference NVSkills-Eval external profile positive skill-activation case. Evaluation Results replaced with tabular breakdown by dimension showing per-agent percentages and deltas. BENCHMARK.md header updated with evaluation date and explicit agent list; Results table refreshed with new dimensions (Security, Skill Execution, Skill Efficiency, Accuracy/Goal Accuracy, Behavior Check, Token Efficiency) and per-agent scores; Tier 1 findings reduced and Tier 2 marked as not run. Sigstore bundle replaced with updated DSSE envelope and cryptographic material.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• NVIDIA/cuopt#1308: Adds an eval case in skills/cuopt-user-rules/evals/evals.json that tests the "ask before assuming/clarify before code" behavior described by the updated package installation policy.

Suggested reviewers

• Iroy30
• tmckayus

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: narrowing refusals from all package installs to only system-level operations while allowing user-space environment setup.
Description check	✅ Passed	The description directly explains the problem (contradictory blanket ban on installs) and the solution (allowing user-space setup while refusing only sudo/system ops).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch skills/allow-userspace-env-setup

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

skills/cuopt-developer/SKILL.md (1)

77-88: 🧹 Nitpick | 🔵 Trivial | 💤 Low value

Structure improvement: deduplication and clarity in Developer Behavior.

Line 88's cross-reference to Refusal Rules (instead of restating privilege restrictions) is good practice — maintains a single source of truth and avoids drift. The "OK to run" and "Still ask before" categories are now cleanly separated, with the new pre-commit setup guidance sitting between them. This structure is workable, though you may want to consider whether the pre-commit section (lines 79–80) could move into its own subsection (e.g., after "Still ask before") to keep "OK to run" and "Still ask before" as parallel categories. Not a blocker, but worth noting if clarity is a priority.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/cuopt-developer/SKILL.md` around lines 77 - 88, The "Set up pre-commit
hooks" section (around lines 79-80) is currently positioned between the
"Environment setup" (OK to run operations) and "Still ask before" sections,
which breaks the parallel structure of those two main categories. Move the
pre-commit setup section to after the "Still ask before" section, either as a
continuation or as its own subsection, so that "OK to run" and "Still ask
before" remain cleanly separated as parallel categories without interruption.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@skills/cuopt-developer/SKILL.md`:
- Around line 77-88: The "Set up pre-commit hooks" section (around lines 79-80)
is currently positioned between the "Environment setup" (OK to run operations)
and "Still ask before" sections, which breaks the parallel structure of those
two main categories. Move the pre-commit setup section to after the "Still ask
before" section, either as a continuation or as its own subsection, so that "OK
to run" and "Still ask before" remain cleanly separated as parallel categories
without interruption.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 209a3adc-565f-4f52-992b-cb84aa152968

📥 Commits

Reviewing files that changed from the base of the PR and between 8c79892 and 3bf6e6c.

📒 Files selected for processing (3)

• skills/cuopt-developer/SKILL.md
• skills/cuopt-developer/references/first_time_setup.md
• skills/cuopt-user-rules/SKILL.md

[ramakrishnap-nv]

/nvskills-ci

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.