Skip to content

refactor(assetregistry): close skill semantics module - #283

Merged
kl3inIT merged 6 commits into
mainfrom
refactor/modulith-assetregistry-skill-module
Aug 3, 2026
Merged

refactor(assetregistry): close skill semantics module#283
kl3inIT merged 6 commits into
mainfrom
refactor/modulith-assetregistry-skill-module

Conversation

@kl3inIT

@kl3inIT kl3inIT commented Aug 3, 2026

Copy link
Copy Markdown
Owner

Summary

  • close assetregistry.skill as the bounded Skill semantics module
  • expose exactly three operation interfaces, one GitHub source port, and three immutable results
  • keep artifact storage, compensation, references, supersession, cleanup, and object keys in the parent
  • preserve REST/OpenAPI response shapes while routing API and GitHub connector through the child contracts

Verification

  • ./gradlew.bat clean test --no-daemon --max-workers=1 (99 tasks; 1,265 tests; zero failures/errors/skips)
  • Worker and MinIO consumer suites
  • focused Core, API, connector, OpenAPI, Asset Registry integration, and Modulith boundary suites
  • python scripts/check_docs.py (534 Markdown files; 8 mirrored domain pairs)
  • corepack pnpm release:check on Node 24.15.0 (18 product + 23 policy tests)
  • mechanical package/import/zero-byte/diff checks

skip-release: intermediate modular refactor; release follows completion of the full refactor goal

Summary by CodeRabbit

  • New Features

    • Added support for inspecting, importing, replacing, and distributing skill packages through unified operations.
    • Added GitHub skill connection listing, source previews, and selective imports with per-item results.
    • Improved package validation, metadata handling, and artifact integrity checks.
  • Bug Fixes

    • Improved cleanup when uploads, replacements, or asset creation fail.
    • Added safer handling for invalid, unavailable, or unreadable package content.
  • Documentation

    • Documented the skill package’s public capabilities and dependency boundaries.

@coderabbitai

coderabbitai Bot commented Aug 3, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@kl3inIT, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 32 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fb2af813-1539-4706-9378-b07e3f50825b

📥 Commits

Reviewing files that changed from the base of the PR and between 880d851 and a706ed1.

⛔ Files ignored due to path filters (3)
  • docs/increments/active/2026-07-31-spring-modulith-package-refactor/plan.md is excluded by !docs/**
  • docs/specs/domains/asset-registry.md is excluded by !docs/**
  • docs/tests/domains/asset-registry.md is excluded by !docs/**
📒 Files selected for processing (6)
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryControllerTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillGitHubImportService.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRegistryService.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillGitHubImportServiceTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillRegistryServiceTests.java
📝 Walkthrough

Walkthrough

The PR modularizes assetregistry.skill behind public operations interfaces, hides implementations, relocates Skill contracts, updates controllers and GitHub connectors, and adds tests for module boundaries, package lifecycle behavior, delivery, cleanup, and API wiring.

Changes

Skill module boundary

Layer / File(s) Summary
Skill contracts and module definition
ARCHITECTURE.md, core/src/main/java/com/orgmemory/core/assetregistry/skill/*, core/src/main/java/com/orgmemory/core/assetregistry/skillpackage/SkillPackagePayloadPolicy.java
The Skill package now exposes operations contracts and selected data types. Implementations and validation exceptions are package-private. The package declares closed-module dependencies.
Skill service implementations and artifact validation
core/src/main/java/com/orgmemory/core/assetregistry/skill/*, core/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryCoordinator.java
Package import, replacement, distribution, and GitHub import services implement the new contracts. Package operations return asset IDs. Artifact validation uses SkillPackagePayloadPolicy.
Controller operations wiring
apps/api/src/main/java/com/orgmemory/api/assetregistry/*
Controllers now consume Skill operations interfaces. Package operations return asset views after explicit asset lookup. GitHub imports map operation results into controller-local response records.
Boundary, lifecycle, and connector validation
core/src/test/java/com/orgmemory/core/*, core/src/test/java/com/orgmemory/core/assetregistry/*, apps/api/src/test/java/com/orgmemory/api/*, integrations/connectors/src/*
Tests verify the closed module boundary, public contracts, package lifecycle behavior, delivery behavior, storage cleanup, controller wiring, and relocated GitHub source-port types.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related PRs

  • kl3inIT/OrgMemory#282: Refactors the same Skill artifact lifecycle services behind capability interfaces and package boundaries.
  • kl3inIT/OrgMemory#197: Introduces the GitHub import flow that this PR moves onto SkillGitHubOperations.
  • kl3inIT/OrgMemory#274: Applies similar closed Spring Modulith boundary changes to other asset-registry capabilities.
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main change: closing the Skill semantics module boundary.
Description check ✅ Passed The description includes the required summary and detailed verification evidence, but omits the documentation impact section.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch refactor/modulith-assetregistry-skill-module

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Tegami

This repository uses Tegami to manage releases. When your changes affect published packages, add a changelog file under .tegami/ before merging.

Create a changelog → · Changelog format

Release preview

Package Bump Version
orgmemory minor 0.1.10.2.0

This PR does not add changelog files. Pending changelogs from other branches are included in the preview above.

Run pnpm run tegami locally to create a changelog interactively.

Managed by Tegami.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRegistryService.java (1)

82-84: 🚀 Performance & Scalability | 🟠 Major | 🏗️ Heavy lift

Remove the redundant requireCreate checks from the registry imports.

SkillGitHubImportService.importSelected calls packages.requireCreate(actor, request.source().knowledgeSpaceId) once, then calls skills.importPackage(...) for each selected package. SkillRegistryService.importPackage then calls packages.requireCreate(actor, knowledgeSpaceId) again before invoking packages.importPackage(...), which repeats assets.requireSkillCreate(...). The same duplicate authorization path exists for replacePackage/requireEdit. Keep the permission check on the persistence command and remove the wrapper calls.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRegistryService.java`
around lines 82 - 84, Remove the redundant packages.requireCreate call from
SkillRegistryService.importPackage, and remove the corresponding
packages.requireEdit wrapper check from replacePackage. Keep authorization in
the underlying packages.importPackage persistence command while preserving the
existing actor and classification validation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java`:
- Around line 270-283: Update the result mapping in AssetRegistryController to
resolve each imported item independently without allowing assets.get to abort
the overall ImportResult. Preserve successful per-item results, and convert any
resolution failure into that item's errorCode/errorMessage while retaining its
path and imported status. Avoid the current per-item full AssetView read pattern
where possible by reusing import results or a batch/minimal resolution path
exposed by the import services.

In
`@core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillRegistryServiceTests.java`:
- Around line 115-140: The existing replacement test does not verify
authorization occurs before reading the upload. Add a separate unauthorized test
near replacementAuthorizesBeforeReadingAndRoutesTheCanonicalUpload that
configures requireEdit(ACTOR, ASSET_ID) to throw the expected authorization
exception, invokes replacePackage with an UnreadableInputStream, and asserts
that exception; keep the existing authorized routing assertions unchanged.

---

Outside diff comments:
In
`@core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRegistryService.java`:
- Around line 82-84: Remove the redundant packages.requireCreate call from
SkillRegistryService.importPackage, and remove the corresponding
packages.requireEdit wrapper check from replacePackage. Keep authorization in
the underlying packages.importPackage persistence command while preserving the
existing actor and classification validation.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 42dbb7ab-4858-4a17-8efa-753a93eee423

📥 Commits

Reviewing files that changed from the base of the PR and between d3509d6 and 880d851.

⛔ Files ignored due to path filters (4)
  • docs/increments/active/2026-07-31-spring-modulith-package-refactor/design.md is excluded by !docs/**
  • docs/increments/active/2026-07-31-spring-modulith-package-refactor/plan.md is excluded by !docs/**
  • docs/specs/domains/asset-registry.md is excluded by !docs/**
  • docs/tests/domains/asset-registry.md is excluded by !docs/**
📒 Files selected for processing (43)
  • ARCHITECTURE.md
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetConsumptionController.java
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetDeliveryController.java
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java
  • apps/api/src/test/java/com/orgmemory/api/SkillCapabilityBoundaryTests.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetConsumptionControllerTests.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetDeliveryControllerSecurityTests.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryCoordinator.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillDistributionOperations.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillDistributionService.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillGitHubImportService.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillGitHubOperations.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillGitHubSourcePort.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillInstallManifest.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageContent.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageInspection.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageInspector.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageOperations.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageProfile.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageSpec.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageValidationException.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRegistryService.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/package-info.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skillpackage/SkillPackagePayloadPolicy.java
  • core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/AssetProfileValidationTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/SkillPackageAssetServiceTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/SkillRegistryServiceTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/SkillReleaseDeliveryServiceTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillDistributionServiceTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillGitHubImportServiceTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillPackageInspectorTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillPackageProfileTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillRegistryServiceTests.java
  • integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfiguration.java
  • integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillArchiveReader.java
  • integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapter.java
  • integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfigurationTests.java
  • integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillArchiveReaderTests.java
  • integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapterTests.java
💤 Files with no reviewable changes (2)
  • core/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/SkillRegistryServiceTests.java
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
  • GitHub Check: Web · Node 24
  • GitHub Check: Backend · Java 25
🧰 Additional context used
📓 Path-based instructions (3)
**/*

📄 CodeRabbit inference engine (AGENTS.md)

**/*: Treat the repository and runtime evidence as the engineering system of record; do not treat chat or Northstar as authoritative.
Before changing a domain, read its specification, test-coverage document, and applicable decision filenames.
Material decisions about domain boundaries, authorization, persistence, publication, concurrency, cache isolation, parity scope, or deployment require an independent architecture challenge and documented alternatives before implementation.
Do not use completed increment documents as the source for current behavior; use them only for history or archaeology.
Before using unfamiliar Spring Boot, Spring Modulith, Spring AI, Gradle, React, Vite, Tailwind, TypeScript, Next.js, or Fumadocs APIs, consult current official documentation, Context7, and the relevant verification skill.
Read docs/guidelines/agent-safety.md before retrieval, AI, MCP, permission, upload, graph, or export work; never commit secrets or customer data.
Keep ddl-auto=validate and pair every persisted-model change with a Flyway migration.
Use the testing harness; a terminating clean test is the JVM context gate, and bootRun is not verification.

Files:

  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillPackageProfileTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/package-info.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillDistributionOperations.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageOperations.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillDistributionServiceTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillGitHubOperations.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageInspector.java
  • integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfiguration.java
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetConsumptionController.java
  • integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillArchiveReader.java
  • apps/api/src/test/java/com/orgmemory/api/SkillCapabilityBoundaryTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skillpackage/SkillPackagePayloadPolicy.java
  • integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfigurationTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillInstallManifest.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillRegistryServiceTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillPackageInspectorTests.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetDeliveryControllerSecurityTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageProfile.java
  • integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillArchiveReaderTests.java
  • ARCHITECTURE.md
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageContent.java
  • core/src/test/java/com/orgmemory/core/assetregistry/SkillReleaseDeliveryServiceTests.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetConsumptionControllerTests.java
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetDeliveryController.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillGitHubSourcePort.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageValidationException.java
  • integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapterTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageInspection.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillDistributionService.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.java
  • core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageSpec.java
  • core/src/test/java/com/orgmemory/core/assetregistry/SkillPackageAssetServiceTests.java
  • integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapter.java
  • core/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryCoordinator.java
  • core/src/test/java/com/orgmemory/core/assetregistry/AssetProfileValidationTests.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillGitHubImportServiceTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRegistryService.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillGitHubImportService.java
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java
**/*.java

📄 CodeRabbit inference engine (AGENTS.md)

Apply IDE inspection only to edited backend Java files.

Files:

  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillPackageProfileTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/package-info.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillDistributionOperations.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageOperations.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillDistributionServiceTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillGitHubOperations.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageInspector.java
  • integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfiguration.java
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetConsumptionController.java
  • integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillArchiveReader.java
  • apps/api/src/test/java/com/orgmemory/api/SkillCapabilityBoundaryTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skillpackage/SkillPackagePayloadPolicy.java
  • integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfigurationTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillInstallManifest.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillRegistryServiceTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillPackageInspectorTests.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetDeliveryControllerSecurityTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageProfile.java
  • integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillArchiveReaderTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageContent.java
  • core/src/test/java/com/orgmemory/core/assetregistry/SkillReleaseDeliveryServiceTests.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetConsumptionControllerTests.java
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetDeliveryController.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillGitHubSourcePort.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageValidationException.java
  • integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapterTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageInspection.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillDistributionService.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.java
  • core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageSpec.java
  • core/src/test/java/com/orgmemory/core/assetregistry/SkillPackageAssetServiceTests.java
  • integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapter.java
  • core/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryCoordinator.java
  • core/src/test/java/com/orgmemory/core/assetregistry/AssetProfileValidationTests.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillGitHubImportServiceTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRegistryService.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillGitHubImportService.java
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java
apps/api/src/main/java/**/*.java

⚙️ CodeRabbit configuration file

apps/api/src/main/java/**/*.java: Enforce the browser-BFF and resource-server boundaries. Authentication
must resolve an active internal actor through the explicit issuer and
subject binding. Reject identity, tenant, roles, or permissions supplied
by request payloads, JWT email, or untrusted JWT role claims.

Files:

  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetConsumptionController.java
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetDeliveryController.java
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java
🧠 Learnings (1)
📚 Learning: 2026-07-26T05:46:47.443Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 61
File: apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.java:50-52
Timestamp: 2026-07-26T05:46:47.443Z
Learning: In OrgMemory, treat the `apps/mcp` and `apps/api` as independent protocol adapter modules. When adjusting OAuth/wire-level scopes, do not introduce a shared Java constant or create a code dependency from `apps/mcp` to `apps/api` solely to deduplicate scope values. Instead, keep OAuth/scope constants adapter-local (e.g., in the relevant adapter/security configuration classes) and ensure cross-adapter consistency via automated realm/OAuth/authorization tests, rather than via shared wiring-level constants or cross-module references.

Applied to files:

  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetConsumptionController.java
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetDeliveryController.java
  • apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java
🔇 Additional comments (43)
ARCHITECTURE.md (1)

218-227: LGTM!

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillDistributionOperations.java (1)

1-19: LGTM!

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillGitHubSourcePort.java (2)

1-1: LGTM!

Also applies to: 42-46


56-60: 🗄️ Data Integrity & Integration

No remaining SkillPackageSpec.Visibility references.

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillInstallManifest.java (1)

1-1: LGTM!

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageContent.java (1)

1-1: LGTM!

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageInspection.java (1)

1-1: LGTM!

Also applies to: 16-24

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageSpec.java (1)

1-9: LGTM!

Also applies to: 59-59

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillDistributionService.java (1)

1-1: LGTM!

Also applies to: 17-17, 32-32, 42-42, 59-59

apps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.java (1)

15-17: LGTM!

Also applies to: 49-50, 90-91

core/src/test/java/com/orgmemory/core/assetregistry/SkillReleaseDeliveryServiceTests.java (1)

1-213: LGTM!

core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillDistributionServiceTests.java (1)

1-187: LGTM!

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillGitHubOperations.java (1)

9-95: LGTM!

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageOperations.java (1)

8-27: LGTM!

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRegistryService.java (1)

20-31: LGTM!

Also applies to: 33-54, 56-72, 107-113, 125-129

core/src/main/java/com/orgmemory/core/assetregistry/AssetRegistryCoordinator.java (2)

3-4: LGTM!

Also applies to: 61-61, 82-82, 184-185, 465-466, 540-546, 765-766, 847-848, 1159-1161


1174-1187: 🎯 Functional Correctness

No change needed. AssetPayloadReference.getContentLength() is boxed, but SkillPackageArtifact.contentLength() is primitive long, so reference.getContentLength() != artifact.contentLength() unboxes the reference before comparing values.

			> Likely an incorrect or invalid review comment.
core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillGitHubImportService.java (1)

1-3: LGTM!

Also applies to: 23-38, 40-48, 50-54, 90-97, 140-152

apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java (1)

15-18: LGTM!

Also applies to: 58-71, 128-131, 141-154, 197-205, 234-234, 245-245, 298-305

apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.java (1)

44-44: LGTM!

Also applies to: 152-152, 1019-1019, 1060-1060, 1069-1075, 1104-1104, 1132-1132, 1213-1213, 1632-1642

core/src/test/java/com/orgmemory/core/assetregistry/AssetProfileValidationTests.java (1)

31-45: LGTM!

Also applies to: 152-152

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageProfile.java (1)

1-1: 🗄️ Data Integrity & Integration

No cross-package references to SkillPackageProfile remain.

All SkillPackageProfile usages are in the core/src/main/java/com/orgmemory/core/assetregistry/skill package or string-based module test registrations, so the package-private type remains accessible only through the intended co-located components/interfaces.

core/src/main/java/com/orgmemory/core/assetregistry/skillpackage/SkillPackagePayloadPolicy.java (1)

6-7: 🗄️ Data Integrity & Integration

No issue.

Only SkillPackageProfile implements SkillPackagePayloadPolicy, and it defines artifact(String canonicalPayload); test usage mocks the interface instead of implementing it.

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageInspector.java (1)

1-1: LGTM!

core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java (1)

1248-1261: LGTM!

Also applies to: 1291-1369

core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillGitHubImportServiceTests.java (1)

1-1: LGTM!

Also applies to: 15-15, 45-45, 55-154, 170-175, 188-212, 235-235

core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillPackageInspectorTests.java (1)

1-1: LGTM!

core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillPackageProfileTests.java (1)

1-33: LGTM!

core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillRegistryServiceTests.java (1)

1-112: LGTM!

Also applies to: 142-170

integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfiguration.java (1)

3-3: LGTM!

integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillArchiveReader.java (1)

3-3: LGTM!

integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapter.java (1)

3-3: LGTM!

Also applies to: 99-99, 124-124, 200-202, 438-438

integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillArchiveReaderTests.java (1)

6-6: LGTM!

core/src/main/java/com/orgmemory/core/assetregistry/skill/package-info.java (1)

1-14: LGTM!

apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetConsumptionController.java (1)

17-18: LGTM!

Also applies to: 49-57

apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetDeliveryController.java (1)

12-13: LGTM!

Also applies to: 48-54

apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetConsumptionControllerTests.java (1)

16-17: LGTM!

Also applies to: 49-50, 72-73, 89-91

apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetDeliveryControllerSecurityTests.java (1)

9-9: LGTM!

Also applies to: 96-97, 106-112

core/src/test/java/com/orgmemory/core/assetregistry/SkillPackageAssetServiceTests.java (1)

4-17: LGTM!

Also applies to: 84-166, 177-178, 226-239

integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfigurationTests.java (1)

8-8: LGTM!

Also applies to: 56-62

integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapterTests.java (1)

16-16: LGTM!

Also applies to: 81-81, 141-141

apps/api/src/test/java/com/orgmemory/api/SkillCapabilityBoundaryTests.java (1)

33-57: LGTM!

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillPackageValidationException.java (1)

1-6: 🎯 Functional Correctness

No action needed. All references to SkillPackageValidationException are within com.orgmemory.core.assetregistry.skill.

@kl3inIT
kl3inIT merged commit ad794df into main Aug 3, 2026
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant