Ship capability groups (nms/common/topology) with shared netx skills.

One group maps to one skill and tools-*; rename NMS tools to *Nms*; sync playbooks from netx/skills.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/INSTALL.md

@@ -6,9 +6,9 @@ One install wires **all of**:
 
 | Piece | How you use it |
 |-------|----------------|
-| Host tools | Ops-preset-scoped `netx__*` → netx REST (Bearer token); other presets do not see them |
-| Plugins card | Settings → Plugins → **Netx Ops** (URL / lang / token) |
-| Agent preset + skills | Settings → Agent presets → **Custom → Netx Ops** (copied into `~/.dsh/.agent-presets` on first boot) |
+| Host tools | Capability groups **nms / common / topology** (one group ↔ one skill). Default nms+common in Ops preset; topology and all public off. Other agents may mount `dsh-netxops/tools-*` |
+| Plugins card | Settings → Plugins → **Netx Ops** (URL / lang / token / capability groups) |
+| Agent preset + skills | Settings → Agent presets → **Custom → Netx Ops** (copied into `~/.dsh/.agent-presets` on first boot); playbooks follow the same group toggles |
 
 You do **not** run `link-preset.ps1` for normal use. That script is only a manual fallback.
 
@@ -30,7 +30,8 @@ dsh web   # or: pnpm dsh web
 
 1. **Settings → Plugins → Netx Ops** → API URL (+ token if the field is enabled).  
    Token fallback: `scripts/set-netx-token.ps1` / `.sh`.  
-   Optional: enable **关键告警推送** so this DSH dials `ws(s)://<apiUrl>/v1/integrations/dsh-alarm/ws`. Choose **投递到 DSH 会话** and/or **投递到 WhatsApp / IM**. For IM, install `dsh-im-ops`, create a delivery target, then paste `imBotId` / `imTargetId`. The card header shows live WSS status.
+   Optional: enable **关键告警推送** so this DSH dials `ws(s)://<apiUrl>/v1/integrations/dsh-alarm/ws`. Choose **投递到 DSH 会话** and/or **投递到 WhatsApp / IM**. For IM, install `dsh-im-ops`, create a delivery target, then paste `imBotId` / `imTargetId`. The card header shows live WSS status.  
+   Capability groups: leave defaults for nms+common, or enable **topology** / **对其他预设公开** (new sessions after save).
 2. Restart or open Settings → **Agent presets** → Custom → **Netx Ops** should appear after the host plugin has activated once.
 3. **New session → preset Netx Ops** → ask e.g. Critical Top / single-host alarms.
 
@@ -46,7 +47,7 @@ dsh web   # or: pnpm dsh web
 1. Plugins card **Netx Ops** visible.
 2. With key-alarm push on: card badge shows **Connected** (or reconnecting / auth failed with detail).
 3. Agent presets → Custom → **Netx Ops**.
-4. Tools include `netx__queryUmeAlarms`.
+4. Tools include `netx__queryNmsAlarms` (**nms**). `netx__findTopologyPaths` is **common**. Canvas / dual_unit need **topology** (`netx-topology` skill).
 
 See [TOOL_MAP.md](TOOL_MAP.md).
 

docs/PORTING.md

@@ -5,21 +5,22 @@
 | Source (oclaw) | Destination |
 |----------------|-------------|
 | `runtime/workspaces/ops/ROLE_SYSTEM.md` | `presets/netxops/PERSONA.md` + persona in `agent.cordis.yml` (brand **Netx Ops**) |
-| `skills/_workspace/ops/ops-netx-ume-playbook/` | `presets/netxops/skills/ops-netx-ume-playbook/` |
-| `skills/_workspace/ops/ops-netx-managed-ne-playbook/` | `presets/netxops/skills/ops-netx-managed-ne-playbook/` |
+| `skills/_workspace/ops/ops-netx-ume-playbook/` | **Canonical:** `netx/skills/nms/netx-nms/` |
+| `skills/_workspace/ops/ops-netx-managed-ne-playbook/` | **Canonical:** `netx/skills/common/netx-common/` |
+| `skills/.../netx-topology` (MCP) | **Canonical:** `netx/skills/topology/netx-topology/` |
 | netx MCP HTTP surface | Host plugin `src/netx/*` + `src/index.ts`: settings namespace `netxops` + credential `NETX_API_TOKEN` → native `netx__*` tools |
 
-Adaptations: removed oclaw Admin / WhatsApp / `ume_alarm_xlsx_report` / wiki capture / skill_auto_install; fiber/offline recipes use Raw/aggregate tools only. DSH no longer spawns `python -m netx_mcp`.
+Adaptations: removed oclaw Admin / WhatsApp / `ume_alarm_xlsx_report` / wiki capture / skill_auto_install; fiber/offline recipes use Raw/aggregate tools only. DSH no longer spawns `python -m netx_mcp`. Model-facing NMS tools renamed to `*Nms*`; ZTE UME remains the `nmsProvider=zte-ume` adapter.
 
-**Config UX:** Settings → Plugins → **Netx Ops** card (`src/client/` → `lib/client.js`). Token via credentials `NETX_API_TOKEN`; `apiUrl` / `lang` via settings namespace `netxops`.
+**Config UX:** Settings → Plugins → **Netx Ops** card (`src/client/` → `lib/client.js`). Token via credentials `NETX_API_TOKEN`; `apiUrl` / `lang` / capability groups / `nmsProvider` via settings namespace `netxops`.
 
-## Stay in oclaw
+## Stay in oclaw (until retired)
 
 Gateway, WhatsApp/Weixin, Admin MCP UI, specialist router, memory-wiki, ops-ai HTTP, schedulers.
 
 ## Phase 2 candidates
 
 - `ume_alarm_xlsx_report` + thin HTTP client as a DSH tool plugin
-- UME sync context inject
+- NMS sync context inject
 - `ops-ip-knowledge-playbook` + KB content
-- `netx-topology` MCP + topology skill
+- Full dual_unit layout engine in-process (today: MCP or experimental stubs)

docs/TOOL_MAP.md

@@ -1,28 +1,40 @@
 # Netx Ops tool map
 
-Tools are registered by the Ops agent preset (`dsh-netxops/tools`) into that preset's tool scope — not the host global layer — so other agent presets do not see them.
+Tools register by capability group. **One group ↔ one skill.**
 
-Model-facing name: `netx__<tool>`.
+| Group | Skill | Default in Ops preset |
+|-------|-------|------------------------|
+| **nms** | `netx-nms` | on |
+| **common** | `netx-common` | on |
+| **topology** | `netx-topology` | off |
+
+Public flags mount the same group on the host for other presets.
+Forced mounts: `dsh-netxops/tools-nms` | `tools-common` | `tools-topology`.
+
+Model names: `netx__<stem>`. NMS tools use `Nms`; adapter `nmsProvider=zte-ume` still hits `/v1/ume/*`.
+
+## nms → `netx-nms`
 
 | Tool | Role |
 |------|------|
-| `queryUmeAlarms` | Paged current alarms |
-| `aggregateUmeAlarms` | Severity / Top NE aggregate |
-| `runUmeDiagnostics` | Diagnostics + freshness meta |
-| `queryUmeNeInventory` | UME NE list |
-| `getUmeNe` | Single UME NE detail |
-| `queryUmeAlarmsRaw` | Raw / evidence fields |
-| `aggregateUmeAlarmsRaw` | Dynamic group_by |
-| `listUmeAlarmFields` | Field catalog |
-| `sqlQueryUme` | Read-only SELECT |
-| `findTopologyPaths` | Shortest path between UME NEs (path query only; no canvas layout in v1) |
-| `listManagedNe` | Managed device list |
-| `getManagedNe` | Managed device detail |
-| `execManagedNe` | Read-only CLI (batch-first) |
-| `listCliTargets` | CLI target index (managed + ume) |
+| `queryNmsAlarms` … `sqlQueryNms` | Alarm + inventory + SQL |
 
-Execution: browser/`fetch` from the DSH host → HTTP `apiUrl` + Bearer `NETX_API_TOKEN`.
+## common → `netx-common`
 
-Handler/paths mirror [netx `packages/netx-mcp`](https://github.com/hansjone/netx/tree/main/packages/netx-mcp) (`http_tools.py` / `http_client.py`).
+| Tool | Role |
+|------|------|
+| `listManagedNe` / `getManagedNe` / `execManagedNe` / `listCliTargets` | Managed CLI |
+| `findTopologyPaths` | Fabric path lookup |
 
-**Out of v1:** `netx-topology` MCP / topology canvas skills.
+## topology → `netx-topology`
+
+| Tool | Role |
+|------|------|
+| Tree / view / folders / membership / neighbors | Canvas CRUD |
+| Fabric query / classify / edges | Inventory + adjacency |
+| `layoutTopologyView` | move_nodes / catalog / … |
+| `suggestSinkHubs` / `analyzeTopologyViewLayout` / `sinkTopologyDualUnits` | Dual-unit / QA (may stub → MCP layout engine) |
+
+Canonical skill bodies: sibling **`netx/skills/`**. DSH loads them at runtime (`NETX_SKILLS_ROOT` or `../netx/skills`) or from `presets/netxops/skills` after sync.
+
+Execution: HTTP `apiUrl` + Bearer `NETX_API_TOKEN`.