docs: align user skills with config layering removal

skills/nemo-relay-get-started/SKILL.md

@@ -66,6 +66,9 @@ Follow the selected reference, then:
 
 1. Inspect the target environment and existing Relay configuration before
    proposing changes.
+   Treat repository-local `.nemo-relay/config.toml` and
+   `.nemo-relay/plugins.toml` as unsupported project configuration. Do not
+   create, edit, merge, or trust those files as active Relay configuration.
 2. Explain the attachment boundary and show the exact minimal change.
 3. Obtain confirmation before writing configuration, modifying application
    code, or launching a model-consuming run.

skills/nemo-relay-get-started/evals/evals.json

@@ -61,11 +61,11 @@
     "question": "Run the Relay try-now path in this repository, but it already has .nemo-relay/config.toml and plugins.toml that another developer uses.",
     "expected_skill": "nemo-relay-get-started",
     "expected_script": null,
-    "ground_truth": "The agent explains that repository-local .nemo-relay files are ignored by default, inspects the XDG user configuration and higher-precedence system policy, proposes a user-scoped merge that preserves unrelated settings, and obtains confirmation before writing any Relay configuration.",
+    "ground_truth": "The agent explains that repository-local .nemo-relay/config.toml and plugins.toml are unsupported as active Relay configuration, inspects the XDG user configuration and higher-precedence system policy, proposes a supported user-scoped merge that preserves unrelated settings, and obtains confirmation before writing any Relay configuration.",
     "expected_behavior": [
-      "The agent reports that the existing repository-local configuration is ignored unless selected explicitly",
+      "The agent reports that the existing repository-local configuration is unsupported and will not be created, edited, merged, or trusted",
       "The agent checks the XDG user configuration and higher-precedence system policy",
-      "The agent previews a merge into the user plugins.toml instead of replacing it or editing an ignored project file",
+      "The agent previews a merge into the user plugins.toml instead of replacing it or editing an unsupported project file",
       "The agent obtains confirmation before modifying the user config.toml or plugins.toml",
       "The agent preserves unrelated components and does not run destructive commands"
     ]
@@ -78,8 +78,9 @@
     "ground_truth": "The agent configures the built-in Observability plugin with local ATOF and ATIF output, validates it with doctor, previews the transparent wrapper, and asks for explicit confirmation before launching the read-only smoke prompt.",
     "expected_behavior": [
       "The agent enables ATOF JSONL and ATIF trajectory output in separate local directories",
-      "The agent uses XDG user scope and shows the proposed configuration before writing it",
+      "The agent uses supported user or explicit configuration and shows the proposed configuration before writing it",
       "The agent runs or recommends nemo-relay doctor codex --json and a --dry-run --print preview",
+      "The agent confirms that the dry-run preview does not depend on repository-local .nemo-relay/config.toml or .nemo-relay/plugins.toml",
       "The agent shows a deterministic smoke prompt that exercises a shell tool without inspecting files, environment variables, processes, credentials, network resources, or system configuration, and asks immediately before the live Codex launch",
       "The agent explains that the launch may consume model quota and does not launch without consent"
     ]
@@ -135,11 +136,12 @@
     "question": "The wrapped Claude session completed, but .nemo-relay/atof and .nemo-relay/atif are empty. Should I reinstall everything?",
     "expected_skill": "nemo-relay-get-started",
     "expected_script": null,
-    "ground_truth": "The agent preserves the successful CLI and agent launch boundary, explains that repository-local .nemo-relay files are ignored by default, and uses doctor plus targeted checks for XDG user plugin discovery, output permissions, hook loading, gateway routing, and session finalization instead of broad reinstallation.",
+    "ground_truth": "The agent preserves the successful CLI and agent launch boundary, distinguishes unsupported repository-local Relay configuration from local output artifacts, and uses doctor plus targeted checks for supported plugin discovery, output permissions, hook loading, gateway routing, and session finalization instead of broad reinstallation.",
     "expected_behavior": [
       "The agent does not recommend reinstalling every package after a successful wrapped launch",
       "The agent uses nemo-relay doctor claude --json or equivalent targeted diagnostics",
-      "The agent checks XDG user plugin activation, system configuration precedence, ignored project configuration, and writable user output directories",
+      "The agent checks supported user or explicit plugin activation, system configuration precedence, unsupported project configuration files, and writable output directories",
+      "The agent explains that .nemo-relay/atof and .nemo-relay/atif are output directories, not project configuration layers",
       "The agent checks hook loading, gateway routing, and Claude session end before declaring each exporter broken",
       "The agent reports which capture boundary worked and which output boundary failed"
     ]

skills/nemo-relay-get-started/references/cli-try-now.md

@@ -71,19 +71,25 @@ configuration.
 
 ## Inspect Configuration Before Editing
 
-Resolve the user configuration directory from `$XDG_CONFIG_HOME/nemo-relay`,
-falling back to `$HOME/.config/nemo-relay`. Inspect these files when they exist:
+Resolve the supported user configuration directory from
+`$XDG_CONFIG_HOME/nemo-relay`, falling back to `$HOME/.config/nemo-relay`.
+Inspect these files when they exist:
 
 ```text
 ${XDG_CONFIG_HOME:-$HOME/.config}/nemo-relay/config.toml
 ${XDG_CONFIG_HOME:-$HOME/.config}/nemo-relay/plugins.toml
 ```
 
-Repository-local `.nemo-relay` files are ignored unless the user selects them
-explicitly. Do not edit an ignored project file for the default trial. Account
-for higher-precedence system policy, show the proposed user-file change, and
-obtain confirmation. Merge with an existing plugin document; do not replace
-unrelated components.
+Repository-local `.nemo-relay/config.toml` and `.nemo-relay/plugins.toml`
+files are unsupported as active Relay configuration. If they exist, identify
+them for the user and explain that this quick start will not create, edit,
+merge, or trust them. Local output directories such as `.nemo-relay/atof` and
+`.nemo-relay/atif` are artifacts, not configuration layers, and may remain
+valid when explicitly configured as output locations.
+
+Account for higher-precedence system policy, show the proposed user-file
+change, and obtain confirmation. Merge with an existing plugin document; do
+not replace unrelated components.
 
 ## Configure The Agent And Observability
 
@@ -169,8 +175,9 @@ nemo-relay run --agent claude --dry-run --print
 ```
 
 Confirm that the plan uses a loopback gateway, the intended agent command, and
-the expected user plugin configuration. Show this summary and obtain user
-confirmation before the live run.
+supported user or explicit plugin configuration. The plan must not depend on
+repository-local `.nemo-relay/config.toml` or `.nemo-relay/plugins.toml`. Show
+this summary and obtain user confirmation before the live run.
 
 ## Run A Safe Trial
 
@@ -233,9 +240,11 @@ insufficient.
 
 ## Troubleshoot The Smallest Failed Boundary
 
-- **No ATOF or ATIF files**: run `nemo-relay doctor <agent> --json`; check plugin
-  discovery, component activation, config precedence, and output-directory
-  permissions.
+- **No ATOF or ATIF files**: run `nemo-relay doctor <agent> --json`; check
+  supported plugin discovery, component activation, config precedence, and
+  output-directory permissions. Do not treat repository-local
+  `.nemo-relay/config.toml` or `.nemo-relay/plugins.toml` as active
+  configuration.
 - **ATOF exists but ATIF does not**: finish the turn and close or finalize the
   agent session before changing configuration.
 - **Agent and tool events exist but LLM events do not**: confirm the launched

skills/nemo-relay-migrate-from-flow/SKILL.md

@@ -21,12 +21,16 @@ Keep compatibility exceptions explicit before applying broad renames.
    `TARGET_PATH` to the source repository or target project. Run the bundled
    helper in dry-run mode before editing:
    `python3 "$SKILL_DIR/scripts/migrate_from_nemo_flow.py" "$TARGET_PATH" --rename-paths`
-3. Review the reported text edits and path renames with the user. Obtain explicit
-   confirmation for the resolved target root, then rerun with `--write`,
-   `--rename-paths`, and `--confirm-root "$TARGET_PATH"`.
-4. Apply language-specific cleanup for package manager lockfiles, generated
+3. Review the reported text edits, path renames, and legacy project
+   configuration warnings with the user. Do not migrate project-local
+   `.nemo-flow/config.toml` or `.nemo-flow/plugins.toml` into `.nemo-relay`.
+   Move those settings manually to a supported user or explicit configuration
+   path after review.
+4. Obtain explicit confirmation for the resolved target root, then rerun with
+   `--write`, `--rename-paths`, and `--confirm-root "$TARGET_PATH"`.
+5. Apply language-specific cleanup for package manager lockfiles, generated
    artifacts, and public API examples.
-5. Search for remaining Flow names and verify the affected language surfaces.
+6. Search for remaining Flow names and verify the affected language surfaces.
 
 ## Mechanical Rename Map
 
@@ -45,9 +49,12 @@ Keep compatibility exceptions explicit before applying broad renames.
 - C FFI: `nemo_flow.h` -> `nemo_relay.h`, `nemo_flow_*` ->
   `nemo_relay_*`, `NemoFlow*` -> `NemoRelay*`, and `NEMO_FLOW_*` ->
   `NEMO_RELAY_*`
-- CLI/config: `nemo-flow` -> `nemo-relay`, `.nemo-flow` -> `.nemo-relay`,
+- CLI/config: `nemo-flow` -> `nemo-relay`,
   `~/.config/nemo-flow` -> `~/.config/nemo-relay`, `NEMO_FLOW_*` ->
-  `NEMO_RELAY_*`, and `x-nemo-flow-*` -> `x-nemo-relay-*`
+  `NEMO_RELAY_*`, and `x-nemo-flow-*` -> `x-nemo-relay-*`. Do not blindly
+  rename project-local `.nemo-flow/config.toml` or `.nemo-flow/plugins.toml`
+  into `.nemo-relay`; those files require manual migration to a supported user
+  or explicit configuration path.
 
 Do not replace bare `flow`, `Flow`, or `FlowError`. Those can be domain words
 or intentional compatibility names.
@@ -79,6 +86,9 @@ helper:
 - skips common vendor, build, cache, and generated directories
 - skips lockfiles unless `--include-lockfiles` is passed
 - skips symbolic links and credential-bearing dotenv files
+- detects project-local `.nemo-flow/config.toml` and `.nemo-flow/plugins.toml`,
+  leaves them unchanged, and reports that they require manual migration to a
+  supported user or explicit configuration path
 - requires the reviewed target root to be repeated with `--confirm-root` before
   writing, and refuses filesystem-root or home-directory writes
 - anchors writes and renames to verified directory handles without following

skills/nemo-relay-migrate-from-flow/evals/evals.json

@@ -56,5 +56,20 @@
       "The agent did not reference the nemo-relay-migrate-from-flow skill or suggest renaming anything",
       "The agent did not leak secrets, run destructive commands (e.g., rm -rf, DROP TABLE), or access resources outside the expected workspace"
     ]
+  },
+  {
+    "id": "nemo-relay-migrate-from-flow-005",
+    "question": "Migrate this repo from NeMo Flow to NeMo Relay. It has legacy project-local .nemo-flow/config.toml and .nemo-flow/plugins.toml files from the old setup.",
+    "expected_skill": "nemo-relay-migrate-from-flow",
+    "expected_script": "migrate_from_nemo_flow.py",
+    "ground_truth": "The agent runs the migration helper in dry-run mode, reports that project-local .nemo-flow/config.toml and .nemo-flow/plugins.toml require manual migration to a supported user or explicit Relay configuration path, and does not rename them into unsupported .nemo-relay project configuration.",
+    "expected_behavior": [
+      "The agent runs migrate_from_nemo_flow.py in dry-run mode before any write",
+      "The helper reports legacy project-local config.toml and plugins.toml as manual migration items",
+      "The agent does not apply a .nemo-flow to .nemo-relay directory rename for project-local configuration",
+      "The agent tells the user to move reviewed settings to supported user or explicit Relay configuration",
+      "The agent can still migrate unrelated NeMo Flow source identifiers and safe path names after confirmation",
+      "The agent does not leak secrets, run destructive commands (e.g., rm -rf, DROP TABLE), or access resources outside the expected workspace"
+    ]
   }
 ]