Carry FailproofAI/skills as a submodule at skills/ - #559
Conversation
Pin the org's agent-skills collection into this repo as a gitlink, following the same shape platform and agenteye use to carry this repo at failproofai/oss. The pin is kept fresh automatically: a push-triggered job in FailproofAI/skills rewrites this gitlink whenever that repo's main moves, so the pinned commit tracks upstream without anyone bumping it by hand. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U6pt7MCEDAasEYkrLUGork
|
Warning Review limit reached
Next review available in: 38 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hermes-exosphere
left a comment
There was a problem hiding this comment.
Hermes Agent Review — APPROVED ✓
PR adds FailproofAI/skills as a submodule at skills/. Simple and clean.
What's here
- New
.gitmodulesentry:path = skills,url = https://github.com/failproofai/skills.git,branch = main - Gitlink pinned at
37d6892(skills' currentmain)
What's good
- ✅ Submodule config is standard — HTTPS URL,
branch = main, dedicated path - ✅ CI is unaffected:
actions/checkoutleaves submodules at default (recursive=false), soskills/stays empty in CI — no build/lint/tsc impact - ✅
skills/sits beside the unrelatedskills-lock.json(Mintlify lockfile), clearly distinct - ✅ PR body is thorough: merge order, companion job, one-time admin step, CI implications all documented
- ✅ All CI checks pass (build, test, test-e2e, quality, docs)
No concerns
This is a mechanical submodule addition with no code changes. The companion job in FailproofAI/skills#3 handles keeping the pin fresh, and the PR body correctly notes that this should land first.
Merge away. 🚀
The v1 desired-state payload named its fields `generation` and `revision`. After the rename it carried neither, at the same version number — same endpoint, same version, different shape, which is the one thing a schema version exists to prevent. AgentEye#559 now emits 2; this accepts both. 1 is accepted ONLY for files already on disk. A machine that ran an earlier beta has a `desired-state.json` and an `active.json` written at version 1, and both structs carry `deny_unknown_fields` — so refusing that version would leave the daemon unable to read its own persisted state, silently not enforcing cloud policy until a poll re-materialised everything. That same asymmetry decides where the field aliases live. They stay on the persisted `ActiveDeployment`/`ActivePolicy`, whose bytes may have been written by an older daemon than the one now reading them. They are REMOVED from the wire `DesiredState`/`DesiredPolicy`, because no server can emit the old spelling — an alias there is dead code, and a silently-tolerated stale field is exactly how two sides drift back apart. A test pins each half, including that the wire now REFUSES the old spelling rather than quietly taking it. The TypeScript hook reader had the same constant and accepted only 1. That is the worst-shaped version of this bug: the daemon reconciles, writes a correct `active.json`, reports "deployment 1 active" — and the hook path alone refuses it, so cloud policy stops being enforced while every other signal says the machine is healthy. Reproduced exactly that way while syncing against a live #559 server, before this fix. Verified end to end against the real stack: publish a policy, deploy it, the daemon pulls schemaVersion 2, verifies every digest, activates, and a matching tool call is denied with that policy's reason. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CCSFM55BcUEAHECabpeSr4
Adds the org's agent-skills collection (
FailproofAI/skills) to this repo as a submodule, pinned at a commit that a job keeps fresh automatically.Shape
Mirrors how
platformandagenteyecarry this repo atfailproofai/oss— dedicated path,branch = main, HTTPS url:Pinned at
FailproofAI/skills@37d6892(that repo's currentmain).How the pin stays fresh
This is the same push-from-source direction as
bump-platform-submodule.yml, just with this repo on the receiving end for once:failproofaiplatform,agenteyefailproofaiskillsfailproofaiskillsThe companion job is FailproofAI/skills#3. When
skills'mainmoves, it mints a version-bot token, rewrites the gitlink here, and pushes straight tomain— version-bot is a bypass actor on the org-levelfailproofai-rulesruleset, so it isn't stopped by the PR requirement.Notes for the reviewer
is not a gitlink — aborting) untilskills/exists here, which is deliberate — it fails loudly rather than inventing the entry.VERSION_BOT_APP_IDandVERSION_BOT_PRIVATE_KEYon theskillsrepo, which has no secrets today. Details in the companion PR.actions/checkouthere leavessubmodulesat the default, soskills/stays an empty dir in CI. The collection is.md/.py/.yamlonly, so lint,tsc, and build have nothing to pick up either way.skills/sits beside the existingskills-lock.json, which is unrelated — that's thenpx skills addlockfile for.agents/skills/mintlify.🤖 Generated with Claude Code
https://claude.ai/code/session_01U6pt7MCEDAasEYkrLUGork