docs(adr): content policy moves to workflow-public / package-proprietary (#805) - #809
Merged
Conversation
…ary-gated (#805) Supersedes the "dev skills stay internal" line in both skill-surface ADRs of record (0003-skill-surfaces-two-tier-checkout-gate, 0011-entitled-skill-surface — cited by slug; 0011-harness-contract untouched). Tier machinery verbatim: per-root surface admission, tier resolution, resolver gating, staging tiers, flip condition. Amendment records carry provenance (modes-first-class campaign, spec spec-20260905-063000-modes-first-class decision D2, Aaron Trowbridge's standing approval 2026-09-05) and the honest review status: at PR review. Companion record amicissimo ADR-0002 (boundary test) untouched. Supersession annotation applied to session-20260827-skill-lifecycle §10 (vault record, outside this repo).
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Member
Author
|
Review verdict: APPROVED (independent reviewer; the amendment's adversarial pass — issue #805's final AC — satisfied). Advisories folded in d5a5217: the slice-3 content-lens sentence (the usage-vs-internals boundary test applies to each of the five skills at #807's review) and the review outcome recorded. The internal-location vocabulary seam tracked as a chore for the parents' next amendment. |
aarontrowbridge
marked this pull request as ready for review
September 5, 2026 07:19
aarontrowbridge
added a commit
that referenced
this pull request
Sep 5, 2026
…kill (#807) (#812) * feat(schema): typed skill-revision contract + supersede-path validation (#807) The public workflow skills (spec-20260905-063000 D2) carry frontmatter source + revision (monotonic integer, missing = 0). Before a strictly newer vault revision may supersede the in-repo canonical copy, it is validated against the consumer floor (a copy may declare consumer_floor — the skill-stager contract it requires) AND the generated-region parity (the canonical's AMICO-GENERATED regions must classify ok in the superseding copy too; an unknown region is a named decline — never stage a generated region this build cannot verify). A mismatch declines to canonical with the NAMED failure: version-gap / generator-mismatch. Names the region via LEDGER_DISCOVERY_RULE_REGION_NAME (data, not a bare string). * feat(skills): public workflow skill surface + the autodev mode-protocol skill (#807) Slice 3 of modes-first-class (spec D2, the ADR-0011 amendment's workflow-public / package-proprietary policy): - The five dev-workflow skills (director-core, develop, implement-issue, write-an-issue, break-into-subissues) move to in-repo canonical copies under packages/extension/skills/ with surface: public + source/revision frontmatter — what the vsix ships and the tests pin. Content lens applied per line (#809 fold): internal mount paths, private repo pointers, the internal org name, and internal-roadmap detail scrubbed or generalized; the pass is pinned mechanically (blocklist + internal path-shape guards). - director-core's ledger-discovery-rule region becomes a delimited, generator-stamped generated region (the registry's generator emits it) — the AC8 leg deferred from #810; parity extends to the skill (card ≡ skill ≡ registry). The committed fixture is retired (the canonical copy IS in the repo); the mount-present vault pin reworks to rule-body parity — the precedence flip: canonical ships, the vault is the engine-neutral record. - resolveLibrarySkills gains typed revision selection when the same name is admitted by two roots: equal revision → in-repo canonical; a strictly newer vault revision supersedes AFTER validateSupersedingSkill- revision passes, disclosed on the skill-index line and the new skills deploy receipt (.deploy-receipt.json at the stage root); a decline keeps canonical with the named failure disclosed both places. - NEW public autodev mode-protocol skill, mirroring autoresearch: entry points, the loop bound to the dev pack's phases/gates, ledger discipline, honest degradation naming absent skill copies / bundle parts / dispatch surface, and the cross-mode handoff procedure with the mid-session switch marked PENDING-D5 (parameterized pin — flips with slice 5). develop cross-references it as the mode binding; autoresearch gains the mirrored handoff section (D6: the mode-protocol skills document the procedure); the autodev manifest declares the skill; the cards' canonical-copy pointer tracks the shipped library. - packaging.test.ts proves the public set ships and the proprietary *-dev set does not; naming_records pins open-protocol vocabulary over the public surface; the H3 matrix pins the five + autodev staging for a NON-entitled session (the standalone gap, closed). * fix(skills): fold review F1-F3 — drop wrong-ADR citation, widen internal-path guard shapes, collapse vestigial alias (#812 review)
aarontrowbridge
added a commit
that referenced
this pull request
Sep 5, 2026
…828) * feat(schema): the watched-repo registry validator (#820) S2 of living-sota (spec-20260905-103000 D3-data): the watched-repo registry is validator-checked TOML data — repos, why-watched, domains, fetch surface, match keywords, last-success stamps, consecutive-failure counters — so adding a repo is a data edit, never code. One shared validator (the mode_registry idiom) both amico-run's lenses and the extension suite import; the retire-or-confirm flag is DERIVED from the counter against the registry's failure_threshold (default 7, carried in the schema), never stored. * feat(amico-run): the sota one-fetcher seam — queue, cache, fetch floor (#820) D4/S6 of living-sota (spec-20260905-103000): all live survey traffic rides the FETCH cache plus ONE fleet-wide serialized query queue — a lock-file lease queue at the SHARED vault path (a per-host lock serializes nothing; the fleet is the concurrency). Waits are bounded and fall through to the NAMED queue-timeout outcome with the disclosed alternative — the survey never blocks. O4 pinned: lease TTL 90s (3x the curl --max-time 30 transport bound — a live fetcher is never evicted mid-fetch, a dead one blocks the fleet at most 90s); bounded wait 120s; 250ms poll. O1 pinned (sota_history): per-source append-only fetch-history under <sota-root>/fetch-history/, one JSON file per source, capped at 400 entries, corrupt/missing reads empty (degrades to unarmed). The floor is armed only after 7 DISTINCT prior fetch-days; a day's value is its LAST count; the trailing window is the last 7 fetch-days. An empty-200 against a nonzero mean records the NAMED anomaly 'empty-200-vs-nonzero- mean' and renders 'scan returned nothing — anomalous' — never 'nothing new'. The http:// recipe gotcha is mechanical: refused by name (export.arxiv.org's http endpoint silently hangs). * feat(amico-run): the sota lenses + the amico sota verb (#820) D1/S1 of living-sota (spec-20260905-103000): both SOTA survey lenses plus the verb surface the sota-review skill drives. Papers lens: on-demand queries against the real arXiv export API over HTTPS, through the fleet-wide queue; cited, provenance-stamped, PI-register briefs. The hermetic fixture of record is the payload of ONE real export.arxiv.org call (recorded 2026-09-05, committed under test/fixtures/sota/) — the hermetic suite seeds the FETCH cache with it and proves the lens serves it through the queue with zero transports (the second-fetcher-reads-the-cache property, made load-bearing); the live-gated describe (AMICO_SOTA_LIVE=1) re-verifies the wire on demand. Codebase lens: the watched-repo registry bootstrapped from the shipped seed (data-as-import: esbuild .toml:text loader + the matching vitest plugin — one canonical seed, both runtimes, and the self-contained bins carry it), fetched via the GitHub API against CANONICAL repos — the URL builder can only emit https://api.github.com/repos/<owner>/<name>, never a local checkout. Events surface keyword-filtered, cited by canonical URLs; the round stamps last_success / accrues consecutive_ failures (revalidated before persist); at threshold the brief names the entry for human retire-or-confirm. The anomaly floor rides per-source. Verb: amico sota papers --query / amico sota codebase [--repo] — usage errors exit 64; named failures exit 1 with the disclosed alternative, never a hang, never a silent empty. The fetch seam is named fetchFn so the S31 zero-dep grep (network rides subprocess curl) stays honest. * feat(skills): the public sota-review skill + the recipe lint (#820) D1 of living-sota (spec-20260905-103000): ONE surface:public skill carrying BOTH lenses — papers (the web-search recipe verbatim: vault/ repo grep FIRST, the arXiv API over HTTPS, never search-engine scraping, the http:// gotcha, on-demand queries through the fleet-wide serialized queue) and codebases (the GitHub API against the watched-repo registry's canonical repos, never a local fork checkout; the registry is data; retire-or-confirm is the human decision). Briefs are cited, provenance-stamped, PI-register; empty scans render 'scan returned nothing — anomalous', never 'nothing new'; the survey never blocks. The recipe's rules are LINT-PINNED: the required rules grepped IN (whitespace-normalized so markdown reflow can't defeat the lint), the scraping patterns grepped OUT of the skill AND the lens code AND the verb, the sanctioned-https-host check pins the lenses' endpoints to export.arxiv.org + api.github.com, and the #809 content lens (blocklist + internal path shapes) applies to the new public surface. The packaging suite pins the skill's vsix presence + shipping frontmatter; naming_records extends the open-protocol vocabulary lens to it; the router help test pins the sota verb surface. * fix(amico-run): the sota fetch seam renames clean under the S31 grep (#820) The injected transport's option name (fetch → fetchFn) and the Omit keys follow, so tsc --noEmit passes with the S31 zero-dep rule intact: the grep ban on \bfetch\s*\( is the honest proxy for 'network rides subprocess curl', and the seam's name now says what it is — an injectable curl-transport, never an ambient HTTP fetch. * fix(amico-run): fold the #828 review — HTTP-error laundering, cache-carried floor verdict, tombstone release (#820) B1 (blocking): the production transports now run curl WITH --fail and the %{http_code} write-out (a shared curlArgs, pinned by test) — curl exits 0 on HTTP 403/404/429 without it, so a rate-limited or moved source laundered as a successful empty scan: stamps reset, last_success written, a fake zero in fetch history, the anomaly floor and the retire-or-confirm flag both disarmed exactly when the fleet chronically fails. A 404/429 now carries its REAL status as a named failure end-to-end (lens, stamps, history), tested through the production transports against a fake curl on PATH. B2 (blocking): the verb tests' cache seeds stamp new Date() — the verb path injects no clock, so a fixed stamp went stale past the 6h TTL and every CI run past midnight fired live curl. A1 (advisory): the cache entry stores the fill's count and the floor verdict is evaluated on the cache read (against strictly-earlier fetch-days, reproducing the fill's verdict, recording nothing) — an armed source served a cached empty payload now renders the armed anomaly, never the false disarm line; the disarm line renders n/7 fetch-days honestly (the verdict gains days). A3 (advisory): releaseQueueLock is rename-to-tombstone — the token check and the removal are never two unguarded steps; a release that finds a foreign lease RESTORES it (link fails EEXIST if a new owner already holds), so a release racing a reclaim can never unlink the new owner's lock. No-debris pinned by test. Nits: githubSourceKey hashes the slug (every character-level flattening collides — a/b__c vs a__b/c, a--b/c vs a/b--c; pinned by test); the dead void-existsSync shims dropped; the overclaiming comments fixed (matchKeywords is unweighted; the history store is an append-log in spirit, a bounded atomically-rewritten window in fact). * fix(skills): name the queue's fleet-wide mutual-exclusion limit (#820) A2 (review fold on #828): the skill's queue-discipline section names the known limit — the lock is atomic per host, vault-sync propagation latency makes fleet-wide mutual exclusion best-effort, and the under-lock cache re-check bounds the damage to a duplicate fetch. Named, not hidden; lint-pinned (the queue test asserts the known-limit line survives future edits).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #805.
Amends the two skill-surface ADRs of record (cited by slug) through the amendment discipline: the content-policy line moves to workflow public, package-proprietary gated; tier machinery (resolver gates, tier resolution, staging tiers) untouched — the diff is exactly two files, 29+/4−.
*-devpackage-proprietary stays internal)Verification:
git diff origin/main --stat→ exactly the two ADR files; worktree clean; branch re-checked before commit.Design of record: spec-20260905-063000-modes-first-class (D2). Campaign ledger: session-20260905-modes-first-class.