Chaac Skills

The unified development process for every Tawa repo. If your Claude Code session loads `tawa-docs/.claude/rules/tawa-agile-workflow.md`, it will follow this…

The platform runs a Matomo instance at `engage.insureco.io`. Declare one line in your catalog and the builder provisions a per-environment Matomo site and…

Tawa uses artifact promotion to move builds through environments without rebuilding. Build once in sandbox, promote the same image to UAT, then to production.

import { Septor } from '@insureco/septor'

Without this, `BIO_CLIENT_ID` and `BIO_CLIENT_SECRET` are never injected. Your service cannot log users in.

How to let devs from a **second organization** help build and release a service that a **primary org** owns — without moving them into the owning org.

The iec-builder executes a fixed, ordered pipeline for every `tawa deploy`. Understanding each step — what it does, when it fails hard vs. fails open, and what…

The iec-builder runs under PM2 on the builder host and writes structured pino logs to `~/.pm2/logs/iec-builder-out.log` and `-error.log`. Because pino-http…

tawa init my-plugin # full scaffold tawa sample --api my-plugin # alternative ```

The single source of truth for how the builder deploys your service. Every deploy reads this file. The builder generates Dockerfiles, provisions databases,…

Every service gets a platform hostname automatically on deploy (`{service}.tawa.pro`, `{service}.sandbox.tawa.pro`, `{service}.uat.tawa.pro`). To put your own…

How DNS works on Tawa and how to add custom domains to your service.

Every MongoDB database on the platform is backed up automatically every night, and you can take an on-demand backup of your own service's database any time.…

Declare databases in `catalog-info.yaml`. The builder provisions connection strings and injects them as environment variables. Your code reads from…

What you must NEVER do when deploying on Tawa, and the correct alternatives.

How token economics work on Tawa — pod pricing, the deploy gate, gas metering, and wallet management.

Declare queues in `catalog-info.yaml`. iec-queue POSTs jobs to your endpoint. Return `2xx` = complete. Non-2xx = retry.

Platform databases (MongoDB, Redis, Neo4j) run inside the Kubernetes cluster and are not reachable from localhost. The `koko` CLI proxies all operations…

`tawa dev` reads your `catalog-info.yaml`, generates all platform environment variables, and either connects to real databases via SSH tunnels (online mode) or…

JCI-MCP uses Bio-ID as its authorization server. All identity — `bioId`, `orgSlug`, and `roles` — flows from a Bio-ID JWT. That JWT drives which JCI role a…

Next.js frontend services deployed on Tawa have a critical constraint: **environment variables injected by the platform are only available at runtime, not at…

Declare a bucket in `catalog-info.yaml` (catalog `0.3.0`+). The builder provisions a MinIO bucket with a hard quota, and credentials are injected into your pod…

A Passport is a self-contained identity object that travels with a user across every Tawa service. It carries identity, org branding, and permissions — all…

interface VaultBranding { // Self-serve (Claimed tier) displayName: string // shown on all surfaces — REQUIRED on first write tagline?: string // "Colorado's…

Three patterns — pick the one that fits your use case:

How to scaffold a new service on Tawa using `tawa sample` templates.

Declare schedules in `catalog-info.yaml`. iec-cron POSTs to your endpoint on schedule. Return 200 immediately — do slow work asynchronously.

import { RelayClient } from '@insureco/relay'

Renders a letter template to a PDF through docman and mails it through [Lob](https://lob.com). Delivery status arrives by webhook and is tracked per mailing.

All inter-service calls on the Tawa platform go through **Janus**. Direct pod-to-pod calls are blocked by NetworkPolicy. This gives the platform a single point…

`tawa skills sync` pulls Claude Code rules and slash-commands onto every dev's machine. This is where that content comes from, and how to change it.

The complete Bio-ID OAuth implementation for Next.js services on Tawa. Use this when building or debugging login flows.

The architecture of the Tawa platform — what services exist, how they connect, and the URLs you need.

Plan and execute work using Forgejo as the source of truth. No local markdown files to overwrite — everything lives in the repo's milestones and issues.

Step-by-step diagnosis of Tawa deployment failures. Always check the build log first — it contains the most useful information.

Every `tawa deploy` automatically registers an uptime monitor via iec-pulse. No configuration needed — the builder reads your service URL and health endpoint…

Every vault entity has a `profile.branding` record — the single source of truth for how an org appears across all Tawa surfaces. The Passport reads it at mint…

iec-cron → POST /internal/cron/{trigger} Your service: fetch pending items, fan out jobs → POST {IEC_QUEUE_URL}/jobs (one per item) iec-queue → POST…