feat(assets): simplify Skill publication - #162
Conversation
…mplification # Conflicts: # docs/roadmap.md
|
Warning Review limit reached
Next review available in: 40 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe asset registry now supports direct publication of Skill drafts. It adds authorization, immutable release provenance, API and UI flows, persistence, distribution metadata, documentation, and test coverage for direct and reviewed publication paths. ChangesSkill publication and provenance
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant API
participant Registry
participant Coordinator
participant Database
Client->>API: Submit version label
API->>Registry: Publish Skill draft
Registry->>Coordinator: Authorize and publish draft
Coordinator->>Database: Persist direct publication
Database-->>Coordinator: Return persisted release
Coordinator-->>Registry: Return AssetView
Registry-->>API: Return published asset
API-->>Client: Return created response
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…mplification # Conflicts: # docs/roadmap.md
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/web/src/features/assets/components/governance-draft-workspace.tsx`:
- Around line 74-78: Update canSubmit in the governance draft workspace so
eligible reviewed submission remains true even when actions.canPublishSkill is
enabled; do not gate reviewed submission on direct publication capability.
Ensure the action rendering around canPublishSkill, canSubmit, and hasAction
exposes both choices when both permissions are true, and add coverage for that
Skill scenario.
In
`@core/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryCoordinator.java`:
- Around line 563-580: Update publishSkillDraft() and submit() to load the asset
via requiredAssetForUpdate() instead of requiredAsset(), ensuring both
operations acquire the same asset-row lock before checking or creating review
state. Keep the existing review-state validation and surrounding behavior
unchanged.
In `@core/src/main/resources/db/migration/V15__record_asset_publication_mode.sql`:
- Around line 1-7: Update the publication_mode column definition in the
migration to use TEXT instead of varchar(16). Add
asset_release_publication_mode_check as NOT VALID, then validate it in a
follow-up migration step with VALIDATE CONSTRAINT, while preserving the existing
default removal and allowed values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ffd558bc-66a9-4042-98eb-1ac165877cdb
⛔ Files ignored due to path filters (12)
apps/docs/generated/openapi.public.jsonis excluded by!**/generated/**contracts/openapi.jsonis excluded by!contracts/openapi.jsondocs/decisions/0022-skill-publication-is-direct-by-default-and-reviewable.mdis excluded by!docs/**docs/increments/active/2026-07-31-skill-direct-sharing/challenge-brief.mdis excluded by!docs/**docs/increments/active/2026-07-31-skill-direct-sharing/challenge-verdict.mdis excluded by!docs/**docs/increments/active/2026-07-31-skill-direct-sharing/design.mdis excluded by!docs/**docs/increments/active/2026-07-31-skill-direct-sharing/plan.mdis excluded by!docs/**docs/increments/active/2026-07-31-skill-direct-sharing/verification.mdis excluded by!docs/**docs/roadmap.mdis excluded by!docs/**docs/specs/domains/asset-registry.mdis excluded by!docs/**docs/tests/domains/asset-registry.mdis excluded by!docs/**docs/vision.mdis excluded by!docs/**
📒 Files selected for processing (31)
ARCHITECTURE.mdapps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/AssetConsumptionControllerTests.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.javaapps/docs/content/docs/reference/api-reference/assets.mdxapps/web/src/features/assets/components/asset-detail-page.tsxapps/web/src/features/assets/components/governance-draft-workspace.tsxapps/web/src/features/assets/components/governance-workspace-page.tsxapps/web/src/features/assets/governance-policy.test.tsapps/web/src/features/assets/governance-policy.tsapps/web/test/e2e/asset-registry-golden-poc.spec.tscore/src/main/java/com/orgmemory/core/assetregistry/AssetAuthorizationTarget.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetConsumptionRelease.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetDeliveryRelease.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetGovernanceActions.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetPublicationMode.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryCoordinator.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryService.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetRelease.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetView.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillDistributionService.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillInstallManifest.javacore/src/main/resources/db/migration/V15__record_asset_publication_mode.sqlcore/src/test/java/com/orgmemory/core/assetregistry/AssetRegistryServiceTests.javacore/src/test/java/com/orgmemory/core/assetregistry/AssetValidationTests.javacore/src/test/java/com/orgmemory/core/assetregistry/CapabilityPackServiceTests.javacore/src/test/java/com/orgmemory/core/assetregistry/PromptExecutionServiceTests.javacore/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.javaintegrations/authorization-openfga/src/main/openfga/model.fgaintegrations/authorization-openfga/src/test/openfga/store.fga.yaml
📜 Review details
🧰 Additional context used
📓 Path-based instructions (14)
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
**/*: Always read the repository guidance and relevant sections ofARCHITECTURE.md; before changing a domain, read its specification, test-coverage document, and binding decision filenames.
Treat the repository as the engineering system of record; current repository and runtime evidence take precedence over chat or Northstar.
Readdocs/guidelines/agent-safety.mdbefore retrieval, AI, MCP, permission, upload, graph, or export work. Never commit secrets or customer data.
Files:
core/src/main/java/com/orgmemory/core/assetregistry/AssetAuthorizationTarget.javaintegrations/authorization-openfga/src/main/openfga/model.fgacore/src/main/resources/db/migration/V15__record_asset_publication_mode.sqlcore/src/test/java/com/orgmemory/core/assetregistry/AssetValidationTests.javaapps/web/src/features/assets/components/asset-detail-page.tsxcore/src/main/java/com/orgmemory/core/assetregistry/AssetGovernanceActions.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetPublicationMode.javaARCHITECTURE.mdapps/docs/content/docs/reference/api-reference/assets.mdxcore/src/main/java/com/orgmemory/core/assetregistry/SkillDistributionService.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetRelease.javacore/src/test/java/com/orgmemory/core/assetregistry/PromptExecutionServiceTests.javaapps/web/src/features/assets/components/governance-workspace-page.tsxcore/src/main/java/com/orgmemory/core/assetregistry/SkillInstallManifest.javacore/src/test/java/com/orgmemory/core/assetregistry/CapabilityPackServiceTests.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.javacore/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/AssetConsumptionControllerTests.javaapps/web/src/features/assets/components/governance-draft-workspace.tsxcore/src/test/java/com/orgmemory/core/assetregistry/AssetRegistryServiceTests.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetView.javaapps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.javaapps/web/src/features/assets/governance-policy.test.tsintegrations/authorization-openfga/src/test/openfga/store.fga.yamlapps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetConsumptionRelease.javaapps/web/src/features/assets/governance-policy.tscore/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryService.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetDeliveryRelease.javaapps/web/test/e2e/asset-registry-golden-poc.spec.tscore/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryCoordinator.java
**/*.{java,gradle,gradle.kts,properties,yml,yaml}
📄 CodeRabbit inference engine (CLAUDE.md)
Before using unfamiliar Spring Boot 4, Spring Modulith 2, Spring AI 2, or Gradle APIs, consult current official documentation, Context7, and the relevant project verification skill.
Files:
core/src/main/java/com/orgmemory/core/assetregistry/AssetAuthorizationTarget.javacore/src/test/java/com/orgmemory/core/assetregistry/AssetValidationTests.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetGovernanceActions.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetPublicationMode.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillDistributionService.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetRelease.javacore/src/test/java/com/orgmemory/core/assetregistry/PromptExecutionServiceTests.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillInstallManifest.javacore/src/test/java/com/orgmemory/core/assetregistry/CapabilityPackServiceTests.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.javacore/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/AssetConsumptionControllerTests.javacore/src/test/java/com/orgmemory/core/assetregistry/AssetRegistryServiceTests.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetView.javaapps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.javaintegrations/authorization-openfga/src/test/openfga/store.fga.yamlapps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetConsumptionRelease.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryService.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetDeliveryRelease.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryCoordinator.java
**/*.{java,sql}
📄 CodeRabbit inference engine (CLAUDE.md)
Keep
ddl-auto=validateand pair every persisted-model change with a Flyway migration.
Files:
core/src/main/java/com/orgmemory/core/assetregistry/AssetAuthorizationTarget.javacore/src/main/resources/db/migration/V15__record_asset_publication_mode.sqlcore/src/test/java/com/orgmemory/core/assetregistry/AssetValidationTests.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetGovernanceActions.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetPublicationMode.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillDistributionService.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetRelease.javacore/src/test/java/com/orgmemory/core/assetregistry/PromptExecutionServiceTests.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillInstallManifest.javacore/src/test/java/com/orgmemory/core/assetregistry/CapabilityPackServiceTests.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.javacore/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/AssetConsumptionControllerTests.javacore/src/test/java/com/orgmemory/core/assetregistry/AssetRegistryServiceTests.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetView.javaapps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetConsumptionRelease.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryService.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetDeliveryRelease.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryCoordinator.java
**/*.{java,gradle,gradle.kts}
📄 CodeRabbit inference engine (CLAUDE.md)
Use the testing harness; a terminating clean test is the JVM context gate, and
bootRunis not verification. IDE inspection applies only to edited backend Java.
Files:
core/src/main/java/com/orgmemory/core/assetregistry/AssetAuthorizationTarget.javacore/src/test/java/com/orgmemory/core/assetregistry/AssetValidationTests.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetGovernanceActions.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetPublicationMode.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillDistributionService.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetRelease.javacore/src/test/java/com/orgmemory/core/assetregistry/PromptExecutionServiceTests.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillInstallManifest.javacore/src/test/java/com/orgmemory/core/assetregistry/CapabilityPackServiceTests.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.javacore/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/AssetConsumptionControllerTests.javacore/src/test/java/com/orgmemory/core/assetregistry/AssetRegistryServiceTests.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetView.javaapps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetConsumptionRelease.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryService.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetDeliveryRelease.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryCoordinator.java
integrations/authorization-openfga/**/*
⚙️ CodeRabbit configuration file
integrations/authorization-openfga/**/*: Source-native ACL is a hard ceiling. Flag any parent, organization, role,
or wildcard relation that can broaden source access. Require negative
Check and ListObjects coverage for every new permission path.
Files:
integrations/authorization-openfga/src/main/openfga/model.fgaintegrations/authorization-openfga/src/test/openfga/store.fga.yaml
core/src/main/resources/db/migration/*.sql
⚙️ CodeRabbit configuration file
core/src/main/resources/db/migration/*.sql: The repository is pre-release: V1 is the intentionally resettable clean
baseline and development data carries no migration cost. Once a release
baseline is frozen, later Flyway migrations are immutable. Check tenant
isolation, foreign keys, uniqueness, indexes, append-only evidence
semantics, safe defaults, and PostgreSQL 18 plus pgvector compatibility.
Files:
core/src/main/resources/db/migration/V15__record_asset_publication_mode.sql
**/*.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{js,jsx,ts,tsx}: Frontend verification must include lint, typecheck, tests, production build, and browser verification when the flow matters.
Before using unfamiliar React, Vite, Tailwind, TypeScript, Next.js, or Fumadocs APIs, consult current official documentation, Context7, and the relevant project verification skill.
Files:
apps/web/src/features/assets/components/asset-detail-page.tsxapps/web/src/features/assets/components/governance-workspace-page.tsxapps/web/src/features/assets/components/governance-draft-workspace.tsxapps/web/src/features/assets/governance-policy.test.tsapps/web/src/features/assets/governance-policy.tsapps/web/test/e2e/asset-registry-golden-poc.spec.ts
apps/web/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
apps/web/**/*.{ts,tsx}: Extend the established OrgMemory product shell, design tokens, shadcn/Radix primitives, and existing layout patterns; do not introduce a separate visual system in the web application.
Generate ordinary REST clients fromcontracts/openapi.jsonusing Hey API.
Use TanStack Query for server state, TanStack Router for navigation, and limit Zustand to durable or high-frequency UI state.
Preserve keyboard accessibility, light/dark theme support, loading and error states, and responsive behavior in the web application.
Files:
apps/web/src/features/assets/components/asset-detail-page.tsxapps/web/src/features/assets/components/governance-workspace-page.tsxapps/web/src/features/assets/components/governance-draft-workspace.tsxapps/web/src/features/assets/governance-policy.test.tsapps/web/src/features/assets/governance-policy.tsapps/web/test/e2e/asset-registry-golden-poc.spec.ts
apps/web/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
apps/web/src/**/*.{ts,tsx}: OAuth access and refresh tokens must never enter browser JavaScript or
browser storage. Use the HttpOnly BFF session, CSRF-protected mutations,
generated Hey API data clients, accessible states, and both light and
dark themes. Handwritten transport is reserved for documented protocol
flows such as navigation redirects and streaming.
Files:
apps/web/src/features/assets/components/asset-detail-page.tsxapps/web/src/features/assets/components/governance-workspace-page.tsxapps/web/src/features/assets/components/governance-draft-workspace.tsxapps/web/src/features/assets/governance-policy.test.tsapps/web/src/features/assets/governance-policy.ts
ARCHITECTURE.md
📄 CodeRabbit inference engine (CLAUDE.md)
Keep
ARCHITECTURE.mdlimited to implemented facts, current project-wide facts, and commands; do not use it for intended or unimplemented behavior.
Files:
ARCHITECTURE.md
apps/docs/content/docs/**/*.{md,mdx}
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
apps/docs/content/docs/**/*.{md,mdx}: Public prose must live only inapps/docs/content/docs; internal engineering documents are source evidence, not publication input.
sourceRefsis build-time traceability metadata and must never be rendered in published content.
Draft pages must remain excluded unlessDOCS_INCLUDE_DRAFTS=trueis set for a local or controlled preview.
Files:
apps/docs/content/docs/reference/api-reference/assets.mdx
apps/docs/content/docs/**/*.mdx
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
Use
index.mdxfor a section root and<slug>.mdxfor a named English page; add Vietnamese pages individually as adjacentindex.vi.mdxor<slug>.vi.mdxfiles, using the/vi/docs/...route.
Files:
apps/docs/content/docs/reference/api-reference/assets.mdx
apps/api/src/main/java/**/*.java
⚙️ CodeRabbit configuration file
apps/api/src/main/java/**/*.java: Enforce the browser-BFF and resource-server boundaries. Authentication
must resolve an active internal actor through the explicit issuer and
subject binding. Reject identity, tenant, roles, or permissions supplied
by request payloads, JWT email, or untrusted JWT role claims.
Files:
apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java
apps/web/**/*.{test,spec}.{ts,tsx}
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
Preserve the existing browser test suite when changing the web application.
Files:
apps/web/src/features/assets/governance-policy.test.tsapps/web/test/e2e/asset-registry-golden-poc.spec.ts
🧠 Learnings (5)
📚 Learning: 2026-07-23T23:30:44.585Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 30
File: core/src/main/resources/db/migration/V32__evidence_scoped_graph_semantics.sql:0-0
Timestamp: 2026-07-23T23:30:44.585Z
Learning: For OrgMemory PostgreSQL Flyway migrations under core/src/main/resources/db/migration, do not recommend using `CREATE INDEX CONCURRENTLY` or `DROP INDEX CONCURRENTLY` inside application-owned Flyway migration SQL. Flyway’s schema-history connection may hold a transaction that can cause concurrent index operations to wait indefinitely (e.g., on a `virtualxid`), and docs/conventions.md forbids this pattern. If you need large production-table index replacement, pre-stage online index operations via the deployment pipeline (outside Flyway) rather than inside the migration; “ordinary” index replacement is acceptable for unreleased projections before production traffic.
Applied to files:
core/src/main/resources/db/migration/V15__record_asset_publication_mode.sql
📚 Learning: 2026-07-28T20:06:14.930Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 112
File: apps/docs/content/docs/developers/api-reference/administration.mdx:11-11
Timestamp: 2026-07-28T20:06:14.930Z
Learning: In OrgMemory public documentation MDX files, ensure any `lastReviewed` dates are set using the repository project timezone `Asia/Bangkok`, not the reviewer’s local timezone or the runtime/build timezone. When generating or updating API-reference pages, intentionally use the exact same `lastReviewed` date convention as the authored public documentation pages to keep timestamps consistent across both sources.
Applied to files:
apps/docs/content/docs/reference/api-reference/assets.mdx
📚 Learning: 2026-07-28T20:06:15.064Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 112
File: apps/docs/content/docs/developers/api-reference/authentication.mdx:12-12
Timestamp: 2026-07-28T20:06:15.064Z
Learning: In OrgMemory docs/tests that describe date-based review checks, treat the project timezone as Asia/Bangkok for all “date” comparisons/validations. Do not assume UTC when interpreting or validating fields like `lastReviewed`. For example, `lastReviewed: '2026-07-29'` should be considered valid when the effective “current date” in Asia/Bangkok is July 29, 2026 (not merely when the UTC date matches).
Applied to files:
apps/docs/content/docs/reference/api-reference/assets.mdx
📚 Learning: 2026-07-30T06:46:08.031Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 144
File: apps/docs/public-content.manifest.json:13-67
Timestamp: 2026-07-30T06:46:08.031Z
Learning: For the Fumadocs docs portal under apps/docs, follow the expected MDX filename conventions that drive section-root vs named-page routing. Use `index.mdx` for English section-root pages and `<slug>.mdx` for named pages. For Vietnamese, use adjacent locale-suffixed files: `index.vi.mdx` for section roots and `<slug>.vi.mdx` for named pages. Do not require or enforce a `page.mdx` filename; doing so would change/break the intended section-root route structure.
Applied to files:
apps/docs/content/docs/reference/api-reference/assets.mdx
📚 Learning: 2026-07-26T05:46:47.443Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 61
File: apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.java:50-52
Timestamp: 2026-07-26T05:46:47.443Z
Learning: In OrgMemory, treat the `apps/mcp` and `apps/api` as independent protocol adapter modules. When adjusting OAuth/wire-level scopes, do not introduce a shared Java constant or create a code dependency from `apps/mcp` to `apps/api` solely to deduplicate scope values. Instead, keep OAuth/scope constants adapter-local (e.g., in the relevant adapter/security configuration classes) and ensure cross-adapter consistency via automated realm/OAuth/authorization tests, rather than via shared wiring-level constants or cross-module references.
Applied to files:
apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java
🪛 Squawk (2.61.0)
core/src/main/resources/db/migration/V15__record_asset_publication_mode.sql
[warning] 2-2: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 6-7: By default new constraints require a table scan and block writes to the table while that scan occurs. Use NOT VALID with a later VALIDATE CONSTRAINT call.
(constraint-missing-not-valid)
🔇 Additional comments (30)
core/src/main/java/com/orgmemory/core/assetregistry/AssetPublicationMode.java (1)
1-11: LGTM!core/src/main/java/com/orgmemory/core/assetregistry/AssetRelease.java (1)
6-7: LGTM!Also applies to: 37-40, 72-72, 84-85, 116-119
core/src/main/java/com/orgmemory/core/assetregistry/AssetConsumptionRelease.java (1)
6-22: LGTM!core/src/main/java/com/orgmemory/core/assetregistry/AssetDeliveryRelease.java (1)
10-25: LGTM!Also applies to: 27-45
core/src/main/java/com/orgmemory/core/assetregistry/AssetView.java (1)
78-98: LGTM!core/src/main/java/com/orgmemory/core/assetregistry/SkillInstallManifest.java (1)
13-39: LGTM!core/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryCoordinator.java (2)
211-211: LGTM!Also applies to: 351-351, 518-518, 546-561, 634-683, 893-893, 1001-1016
563-632: 🔒 Security & PrivacyNo change needed.
AssetRegistryService.publishSkillDraft()callsrequire(actor, assetId, CAN_PUBLISH_SKILL)before delegating tocoordinator.publishSkillDraft(), so the direct Skill publication path is guarded bycan_publish_skill.core/src/test/java/com/orgmemory/core/assetregistry/AssetValidationTests.java (1)
55-64: LGTM!core/src/test/java/com/orgmemory/core/assetregistry/CapabilityPackServiceTests.java (1)
84-102: LGTM!Also applies to: 104-122
apps/web/test/e2e/asset-registry-golden-poc.spec.ts (1)
39-54: LGTM!Also applies to: 328-352, 554-554, 578-578, 591-636, 663-663, 694-694
core/src/main/java/com/orgmemory/core/assetregistry/SkillDistributionService.java (1)
139-139: LGTM!core/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.java (1)
45-45: LGTM!Also applies to: 171-171
core/src/test/java/com/orgmemory/core/assetregistry/PromptExecutionServiceTests.java (1)
138-138: LGTM!apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetConsumptionControllerTests.java (1)
12-12: LGTM!Also applies to: 125-125
apps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.java (1)
13-13: LGTM!Also applies to: 127-127
apps/web/src/features/assets/governance-policy.ts (1)
20-30: LGTM!apps/web/src/features/assets/governance-policy.test.ts (1)
3-7: LGTM!Also applies to: 40-64
apps/web/src/features/assets/components/governance-workspace-page.tsx (1)
91-95: LGTM!Also applies to: 129-129, 140-140, 467-469
apps/web/src/features/assets/components/asset-detail-page.tsx (1)
880-887: LGTM!core/src/main/java/com/orgmemory/core/assetregistry/AssetAuthorizationTarget.java (1)
5-10: LGTM!core/src/main/java/com/orgmemory/core/assetregistry/AssetGovernanceActions.java (1)
10-15: LGTM!integrations/authorization-openfga/src/main/openfga/model.fga (1)
88-88: LGTM!integrations/authorization-openfga/src/test/openfga/store.fga.yaml (1)
342-342: LGTM!Also applies to: 353-369, 379-379, 390-390, 418-430
core/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryService.java (1)
32-33: LGTM!Also applies to: 188-197, 291-297, 360-376
core/src/test/java/com/orgmemory/core/assetregistry/AssetRegistryServiceTests.java (1)
33-64: LGTM!Also applies to: 80-86
apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java (1)
106-108: LGTM!Also applies to: 246-260
apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.java (1)
37-37: LGTM!Also applies to: 53-53, 977-1049, 1063-1105
apps/docs/content/docs/reference/api-reference/assets.mdx (1)
40-42: LGTM!Also applies to: 154-155, 231-231
ARCHITECTURE.md (1)
118-121: LGTM!
1 participant
Outcome
DIRECTversusREVIEWEDprovenance in governance, delivery, and install manifestsAuthorization and safety
can_publish_skillinstead of broadeningcan_editVerification
test; focused Core/API checks and Postgres integration testsSummary by CodeRabbit
New Features
Bug Fixes
Documentation