# Agents load the self-host skill on their own; approval, not activation, guards changes

The legacy skill was explicit-only (`disable-model-invocation: true`, Codex `allow_implicit_invocation: false`, legacy ADR 0006) because it could change the host. That shut out the people the CLI is for: someone who opens a fresh chat and asks "where's the video thing again?" never types `/self-host`, so their agent never learns the CLI exists. The new skill lets agents load it from a short description of when it applies (owning or running apps on your own machine, anything already set up with self-host), kept to about 200 tokens so it costs little while idle. Safety moves entirely to the boundary legacy ADR 0006 already named: loading the skill conveys intent, never approval. Before anything that installs software, changes Access or deletes data, the agent says in one plain sentence what will happen and waits for a yes through its ask-user tool; anything reachable from the internet needs a separate yes naming the risk; the agent changes the Project only through `self-host` commands and never asks for or shows a secret. This supersedes legacy ADR 0006 (removed in #192, see git history) for the new skill.