# wendy-self-hosted

A rule for agents touching Wendy interop code: the wendyos and wendy-agent stack has to run without the SaaS side. Useful for on-prem and airgapped setups.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · ★ 62
- Author: wendylabsinc
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/wendylabsinc/claude-skills/tree/HEAD/wendy-self-hosted/SKILL.md
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/skills/wendy-self-hosted

## What it does

The skill states one requirement. The self-hosted path must always work. Any feature that only functions when `pki-core`, Wendy Cloud or `wendy-auth` are managed GCP services counts as unfinished, because Wendy's critical-infrastructure partners cannot route fleet control through a vendor's multi-tenant cloud.

Two references ship with it: `references/identity-backends.md` and `references/review-checklist.md`. They lay out the pluggable identity provider seam. Define the interface first, put the managed backend behind it as one option, then add a self-hosted backend or a stub tied to a tracked issue. Backend choice comes from config, not from sniffing the environment. Nothing in the code may assume the GCP metadata server, PSC, VPC-SC, Google's JWKS, Artifact Registry or a reachable cloud control plane.

This distills AAA Contract v0.21, and the contract wins on any disagreement. The rule is mandatory, and related skills `wendy-aaa-interop`, `wendy-certificates`, `wendy-device-enrollment`, `wendy-device-interop` and `wendy-security-baselines` all point back to it. A change that breaks the self-hosted path does not pass.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-self-hosted -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/wendy-self-hosted/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/wendy-self-hosted/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-self-hosted -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/wendy-self-hosted/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-self-hosted -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/wendy-self-hosted/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install wendylabsinc/claude-skills wendy-self-hosted
```

2. **Manually: put the files in place**
- File: `.github/skills/wendy-self-hosted/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-self-hosted -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/wendylabsinc/claude-skills --path wendy-self-hosted
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/wendy-self-hosted/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-self-hosted -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/wendylabsinc/claude-skills/tree/HEAD/wendy-self-hosted/SKILL.md

## When to use it
- keep the self-hosted path intact while integrating with `pki-core` or `wendy-auth`
- add a pluggable identity provider seam instead of hard-wiring GCP
- define what a device does when the cloud is unreachable
- audit interop code for hidden PSC and Google JWKS assumptions
- make `pki-core` deployable on operator infrastructure

## Example prompts
- Check this feature against the wendy-self-hosted rule: does it work without Wendy Cloud?
- Add a seam for a self-hosted identity backend, keep the managed one as a single option
- What happens to a device if the cloud is unreachable at redemption time?

## Similar
- [Polar Health Data (self-hosted)](https://affpapa.org/en/nevibecode/mcp/polar-health-data-self-hosted.md) — MCP server · ★ 24
- [self-hosted-funnel-launch](https://affpapa.org/en/nevibecode/skills/self-hosted-funnel-launch.md) — skill · 103000 installs
- [grimmory-self-hosted-library](https://affpapa.org/en/nevibecode/skills/grimmory-self-hosted-library.md) — skill · 1300 installs
- [dpop-adoption](https://affpapa.org/en/nevibecode/skills/dpop-adoption.md) — skill · 2600 installs
- [sign-in-with-google-web](https://affpapa.org/en/nevibecode/skills/sign-in-with-google-web.md) — skill · 743 installs
- [temporal-cloud](https://affpapa.org/en/nevibecode/skills/temporal-cloud.md) — skill · 579 installs

From the same set: [wendylabsinc/claude-skills](https://affpapa.org/en/nevibecode/by/wendylabsinc/claude-skills.md) — 7 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md