OpenNexum

Contract-driven multi-agent orchestration with ACP. Contract sync, webhook + dispatch-queue dual dispatch, cross-review, auto-retry, batch progress tracking.

Security Scan

The skill's code, instructions, and required tools are consistent with a repo-local multi‑agent orchestration CLI; nothing obvious is requesting unrelated credentials or downloading remote code, but it does perform local git operations and writes project files so exercise caution before running on important repositories.

Purpose & Capability

Name/description (contract-driven multi-agent orchestration) matches the repository contents (CLI, core, spawn, prompts, notify packages). The included commands, dispatch queue, webhook flow, and ACP runtime references are coherent with the stated purpose. No unrelated cloud credentials, binaries, or installs are requested.

Instruction Scope

SKILL.md + code instruct the agent/CLI to read and write project files (AGENTS.md, nexum/* runtime files), build prompts, and interact with git (read last commit; commit/push is part of the documented workflow). The skill expects the generator/evaluator to run git add/commit/push as part of normal flow (see COMMIT-CONVENTION and retry prompt). This is consistent with the orchestration purpose but elevates risk when run against sensitive repos because it encourages automatic commits and pushes.

Install Mechanism

No install spec in registry metadata; the SKILL.md expects Node >=20, pnpm, and openclaw. The repository is a pnpm monorepo with no remote download/install steps in the registry manifest. No arbitrary URL downloads or archive extraction were found.

Credentials

No required environment variables or credentials are declared. SKILL.md references OpenClaw webhook token locations (~/.openclaw/openclaw.json and OPENCLAW_HOOKS_TOKEN) and `nexum/config.json`, which is appropriate for webhook/notify functionality. There are no demands for unrelated secrets (AWS, SSH keys, cloud tokens) in the manifest. Still: the skill will operate using local git remotes if configured (git push is part of the workflow), so repository remotes and credentials can cause network activity.

Persistence & Privilege

always:false (normal). The CLI writes/updates files inside the project (AGENTS.md, nexum/ runtime files, generated prompt files) and manages a project-level session counter and dispatch-queue. It does not claim system-wide privileges or modify other skills. Because it encourages/assumes automatic git commits and pushes, it effectively has the ability to change remote repositories (subject to the user's git credentials).

Assessment

This skill appears to be what it says — a repo-local CLI for coordinating generator/evaluator ACP sessions. Before installing or running it, consider the following: - Run in a sandbox or non-production repository first. The workflow expects and documents automatic git add/commit/push actions by generators; if you run this in a repo with a configured remote, agents could push changes upstream. Prefer repos where automatic pushes are acceptable or disable automatic push in your workflow. - Inspect prompt templates (packages/prompts/templates and renderRetryPrompt output) to ensure they don't instruct unapproved external actions. The generator prompts determine what the AI will do (including commands to run). - Check your OpenClaw webhook configuration (nexum/config.json and ~/.openclaw/openclaw.json). Ensure webhook gatewayUrl and tokens point to endpoints you control; do not expose production webhook tokens unintentionally. - The CLI reads/writes project files (AGENTS.md, nexum/*). Back up important state before first run. - If you want to reduce blast radius, run the CLI with limited git credentials (or no remote), or avoid enabling autonomous agents that perform pushes. If you want, I can point out the specific files and lines that implement git operations, webhook dispatch, and prompt rendering so you can review them in more detail.

Contract-driven coding agent orchestration via OpenClaw ACP.

When to use

• Coordinating multiple AI coding agents (Codex + Claude)
• Running generator/evaluator pairs with automatic retry and escalation
• Parallel task execution with independent ACP sessions
• Tracking task progress with OpenClaw notifications

Architecture

Dispatch (dual-path)

1. Webhook (real-time): nexum callback → POST /hooks/agent → orchestrator wakes up immediately
2. Dispatch Queue (fallback): nexum callback → writes nexum/dispatch-queue.jsonl → heartbeat processes within 10min

Cross-review

• codex-gen → claude-eval, claude-gen → codex-eval

Auto-routing

• generator: auto in Contract YAML → system selects agent by task type

Batch progress

• nexum status shows current batch progress + overall progress

Agent Naming: <model>-<role>-<number>

• codex-gen-01~03: backend/API code
• claude-gen-01~02: user-facing WebUI/docs
• codex-eval-01 / claude-eval-01: cross-review
• claude-plan-01: architecture (opus)

Key CLI Commands

nexum init [--project <dir>] [--yes]
nexum sync [taskId] [--project <dir>]
nexum spawn <taskId> [--project <dir>]
nexum track <taskId> <sessionKey>
nexum callback <taskId> [--role evaluator] [--model gpt-5.4] [--input-tokens N] [--output-tokens N]
nexum eval <taskId>
nexum complete <taskId> <pass|fail|escalated>
nexum status [--project <dir>]
nexum archive [--project <dir>]
nexum health [--project <dir>]
nexum retry <taskId> --force

Contract YAML

id: TASK-001
name: "implement feature X"
batch: batch-1
agent:
  generator: codex-gen-01
  evaluator: claude-eval-01
scope:
  files:
    - src/feature.ts
deliverables:
  - path: src/feature.ts
    description: "..."
eval_strategy:
  type: review
  criteria:
    - id: C1
      desc: "..."
      weight: 2
max_iterations: 3

Callback Protocol (injected into AGENTS.md via nexum init)

nexum init writes the callback protocol into AGENTS.md as the source of truth. If a project only has CLAUDE.md, Nexum will seed AGENTS.md from it and update AGENTS.md going forward.

After completing a task, run:

nexum callback <taskId> --project <projectDir> \
  --model gpt-5.4 \
  --input-tokens <n> \
  --output-tokens <n>

Git Convention

• Push directly to main, revert if needed
• English Conventional Commits: feat(scope): TASK-ID: description