Chaac Skills

The unified development process for every Tawa repo. If your Claude Code session loads `tawa-docs/.claude/rules/tawa-agile-workflow.md`, it will follow this…

The platform runs a Matomo instance at `engage.insureco.io`. Declare one line in your catalog and the builder provisions a per-environment Matomo site and…

Tawa uses artifact promotion to move builds through environments without rebuilding. Build once in sandbox, promote the same image to UAT, then to production.

import { Septor } from '@insureco/septor'

Without this, `BIO_CLIENT_ID` and `BIO_CLIENT_SECRET` are never injected. Your service cannot log users in.

How to let devs from a **second organization** help build and release a service that a **primary org** owns — without moving them into the owning org.

const IEC_SHORT_URL = process.env.IEC_SHORT_URL // injected — see Setup

The iec-builder executes a fixed, ordered pipeline for every `tawa deploy`. Understanding each step — what it does, when it fails hard vs. fails open, and what…

The procedure for turning a brief ("a landing page for Acme with a waitlist") into a published site. The always-on rules are in `tawa-hypesites`; this is the…

The iec-builder runs under PM2 on the builder host and writes structured pino logs to `~/.pm2/logs/iec-builder-out.log` and `-error.log`. Because pino-http…

tawa init my-plugin # full scaffold tawa sample --api my-plugin # alternative ```

The single source of truth for how the builder deploys your service. Every deploy reads this file. The builder generates Dockerfiles, provisions databases,…

A service that calls Claude does not need an Anthropic API key. Switch **Claude access** on for its OAuth client and the builder gives that service its own…

Anything a service needs at runtime that the platform does not provision for it — an API key, a third-party account id — is a **config var**. Tunables (feature…

Every service gets a platform hostname automatically on deploy (`{service}.tawa.pro`, `{service}.sandbox.tawa.pro`, `{service}.uat.tawa.pro`). To put your own…

How DNS works on Tawa and how to add custom domains to your service.

Every MongoDB and PostgreSQL database on the platform is backed up automatically every night, and you can take an on-demand backup of your own service's…

Declare databases in `catalog-info.yaml`. The builder provisions connection strings and injects them as environment variables. Your code reads from…

On 2026-09-26 an audit of iec-ledger found months of work reported "done" that an accountant could not use: 48 vendor fields in the API schema and 11 in the…

What you must NEVER do when deploying on Tawa, and the correct alternatives.

How token economics work on Tawa — pod pricing, the deploy gate, gas metering, and wallet management.

A **HypeSite** publishes a project's **artifact pages** in iec-portal as a real public website, with that project's **tables** as its database. Build the…

Declare queues in `catalog-info.yaml`. iec-queue POSTs jobs to your endpoint. Return `2xx` = complete. Non-2xx = retry.

Platform databases (MongoDB, Redis, Neo4j) run inside the Kubernetes cluster and are not reachable from localhost. The `koko` CLI proxies all operations…

`tawa dev` reads your `catalog-info.yaml`, generates all platform environment variables, and either connects to real databases via SSH tunnels (online mode) or…

The [Locker](https://portal.insureco.io/locker) (service `iec-locker`) is where org credentials live. A Tawa service never needs someone to copy a value out of…

JCI-MCP uses Bio-ID as its authorization server. All identity — `bioId`, `orgSlug`, and `roles` — flows from a Bio-ID JWT. That JWT drives which JCI role a…

Next.js frontend services deployed on Tawa have a critical constraint: **environment variables injected by the platform are only available at runtime, not at…

On 2026-09-27, during iec-ledger items-setup work, a user pasted a list of 10 QBO parity gaps and asked what to do. The agent filed **3** — labelled "the big…

Declare a bucket in `catalog-info.yaml` (catalog `0.3.0`+). The builder provisions a MinIO bucket with a hard quota, and credentials are injected into your pod…

A Passport is a self-contained identity object that travels with a user across every Tawa service. It carries identity, org branding, and permissions — all…

interface VaultBranding { // Self-serve (Claimed tier) displayName: string // shown on all surfaces — REQUIRED on first write tagline?: string // "Colorado's…

Some services you depend on also **call you back** with signed webhooks — PolicySign today; Relay and lob-send have the same shape. To verify those webhooks…

Three patterns — pick the one that fits your use case:

Tunable values are **runtime settings**: stored in the service's own database and edited by super admins in the Tawa Console. A redeploy or a code change is…

How to scaffold a new service on Tawa with `tawa sample`.

Declare schedules in `catalog-info.yaml`. iec-cron POSTs to your endpoint on schedule. Return 200 immediately — do slow work asynchronously.

import { RelayClient } from '@insureco/relay'

Renders a letter template to a PDF through docman and mails it through [Lob](https://lob.com). Delivery status arrives by webhook and is tracked per mailing.

A service that serves pages declares `spec.seo` in its catalog. On a prod deploy the builder registers the service's custom domain with **iec-webmaster** (the…

All inter-service calls on the Tawa platform go through **Janus**. Direct pod-to-pod calls are blocked by NetworkPolicy. This gives the platform a single point…

`tawa skills sync` pulls Claude Code rules and slash-commands onto every dev's machine. This is where that content comes from, and how to change it.

Human explainer: https://portal.insureco.io/spaces/iec-portal/pages/walkthrough-maker Styling rules: https://brand.insureco.io/artifact-spec.md

The complete Bio-ID OAuth implementation for Next.js services on Tawa. Use this when building or debugging login flows.

Half of what sits on a board is one person waiting on one or two facts from one other person. The work is not hard, it is just not *here* — and the loop that…

The architecture of the Tawa platform — what services exist, how they connect, and the URLs you need.

Plan and execute work using Forgejo as the source of truth. No local markdown files to overwrite — everything lives in the repo's milestones and issues.

`https://iec-test.tawa.pro` — runs every check the platform makes against a service *after* it is deployed and *before* the build is called green. You declare…

A walkthrough is a short flow through a UI where every step **asserts** something on the page and then screenshots it. The output is a public page with the…

A **persona** is a password-less Bio-ID user in an org you already belong to. You create one with the CLI and get a logged-in browser session as it — without…

Step-by-step diagnosis of Tawa deployment failures. Always check the build log first — it contains the most useful information.

Every `tawa deploy` automatically registers an uptime monitor via iec-pulse. No configuration needed — the builder reads your service URL and health endpoint…

Every vault entity has a `profile.branding` record — the single source of truth for how an org appears across all Tawa surfaces. The Passport reads it at mint…

A walkthrough drives a UI flow, **asserts on every page**, screenshots each step, and publishes an immutable page showing what shipped. There are two ways to…

`iec-webmaster` is the Tawa service that knows every domain InsurEco owns and what Google thinks of it: the property registry seeded from the Marketing Domain…

iec-cron → POST /internal/cron/{trigger} Your service: fetch pending items, fan out jobs → POST {IEC_QUEUE_URL}/jobs (one per item) iec-queue → POST…

Coding agents (Claude, Cursor, Copilot, etc.) share a small set of persistent failure modes. They are not random and they are not model-specific — they all…