Skip to content

feat(assistant): activate governed skills - #304

Merged
kl3inIT merged 4 commits into
mainfrom
feat/agentic-skill-beta
Aug 5, 2026
Merged

feat(assistant): activate governed skills#304
kl3inIT merged 4 commits into
mainfrom
feat/agentic-skill-beta

Conversation

@kl3inIT

@kl3inIT kl3inIT commented Aug 5, 2026

Copy link
Copy Markdown
Owner

Summary

Deliver the Agentic Skill Beta as a bounded, read-only extension of the existing governed Assistant:

  • discover only Skill releases the current actor can use;
  • activate exact released SKILL.md instructions and read bounded verified UTF-8 resources;
  • expose three fixed request-local Spring AI tools with bounded recursive tool calling;
  • stream closed Skill activity states to the Assistant UI;
  • keep allowed-tools descriptive, and never execute package scripts, binaries, shell commands, or arbitrary code.

The Asset Registry remains the single Skill registry. The architecture challenge, completed increment, current specs, coverage matrices, and EN/VI product guidance are included.

Verification

  • Narrow affected tests pass.
  • Completion-grade repository gates pass or are explicitly scoped out.

Evidence:

  • ./gradlew.bat --no-daemon clean test — 108 actionable tasks, successful.
  • Web Node 24 gates — lint, typecheck, 68 unit tests, production build.
  • Playwright Chromium — 31 flows passed, including Assistant Skill activity frames.
  • Public docs Node 24 — checks and production build passed for 125 OpenAPI paths and 30 public pages.
  • pnpm release:check — Tegami release management checks passed.
  • git diff --check — passed.

JetBrains IDE inspection was unavailable in this tool session; clean Gradle compilation/tests and the mechanical frontend/docs gates were used as the documented fallback.

Documentation impact

  • I updated the relevant English and Vietnamese pages under apps/docs, or this change has no reader-visible product/API/UI/deployment behavior.
  • I updated engineering specs/tests/runbooks when current system behavior or operations changed.

The remaining beta boundary is explicit: empty authorized Knowledge retrieval still stops before the model and Skill tools. Sandboxed execution, autonomous jobs, and dynamic tool grants remain out of scope.

Summary by CodeRabbit

  • New Features

    • Added governed Skill discovery, exact-release activation, and bounded text-resource access during grounded Assistant responses.
    • Added progressive Assistant activity updates for Skill discovery, activation, resource loading, completion, and failures.
    • Enforced read-only Skill access without installing or executing Skills or expanding permissions.
  • Documentation

    • Updated getting-started guidance and architecture documentation to describe the governed Skill flow.
  • Tests

    • Added coverage for Skill authorization, integrity checks, bounded access, streaming activities, and tool-call limits.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@kl3inIT, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 41 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: dd220f79-8f17-41a5-9e6a-b3659e575a58

📥 Commits

Reviewing files that changed from the base of the PR and between 0115fea and e2fc879.

📒 Files selected for processing (2)
  • integrations/ai-model-gateways/src/main/java/com/orgmemory/integrations/ai/gateway/SpringAiChatModelAdapter.java
  • integrations/ai-model-gateways/src/test/java/com/orgmemory/integrations/ai/gateway/SpringAiChatModelAdapterTests.java
📝 Walkthrough

Walkthrough

Adds governed Skill discovery, exact-release activation, bounded resource reads, bounded model tool loops, and streamed Skill activity updates across core, gateway, API, and web layers.

Changes

Agentic Skill flow

Layer / File(s) Summary
Skill runtime contracts and package access
core/src/main/java/com/orgmemory/core/assetregistry/..., core/src/test/java/com/orgmemory/core/assetregistry/..., core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java
Adds Skill release search, runtime operations, exact package activation, bounded UTF-8 resource reads, path validation, integrity checks, and related tests.
Assistant agent streaming
core/src/main/java/com/orgmemory/core/assistant/..., core/src/test/java/com/orgmemory/core/ai/AssistantAgentServiceTests.java
Adds agent activity and model-port contracts. AssistantService can stream agent output and activities through AssistantTurn.
Skill tool gateway and bounded execution
integrations/ai-model-gateways/src/main/java/com/orgmemory/integrations/ai/gateway/..., integrations/ai-model-gateways/src/test/java/com/orgmemory/integrations/ai/gateway/...
Adds three read-only Skill callbacks, a 12-call tool budget, an eight-round advisor limit, authorization handling, and tool-loop tests.
Assistant activity delivery and display
apps/api/src/main/java/com/orgmemory/api/assistant/..., apps/web/src/features/assistant/..., apps/web/test/e2e/assistant-pipeline.spec.ts, apps/docs/content/docs/getting-started/..., .tegami/2026-08-05-agentic-skill-beta.md
Merges text and activity streams, adds Skill activity phases and failure states, displays activity labels in the web client, updates fixtures, and documents the bounded Skill flow.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related PRs

  • kl3inIT/OrgMemory#88: Introduced governed exact-version Skill distribution services consumed by this runtime.
  • kl3inIT/OrgMemory#282: Introduced the release-delivery contracts extended here for actor-scoped Skill search.
  • kl3inIT/OrgMemory#57: Previously changed the assistant streaming flow used here for agent activity delivery.

Sequence Diagram(s)

sequenceDiagram
  participant AssistantService
  participant SpringAiChatModelAdapter
  participant AssistantSkillToolCallbacks
  participant SkillRuntimeService
  participant AssistantController
  AssistantService->>SpringAiChatModelAdapter: start actor-aware assistant stream
  SpringAiChatModelAdapter->>AssistantSkillToolCallbacks: invoke bounded Skill tool
  AssistantSkillToolCallbacks->>SkillRuntimeService: search, activate, or read resource
  SkillRuntimeService-->>AssistantSkillToolCallbacks: return authorized Skill data
  AssistantSkillToolCallbacks-->>SpringAiChatModelAdapter: return result and lifecycle activity
  SpringAiChatModelAdapter-->>AssistantService: stream text and activities
  AssistantService-->>AssistantController: return AssistantTurn
  AssistantController-->>AssistantController: merge text and activity stream parts
Loading
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 1.11% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main change: activating governed Skills in the Assistant.
Description check ✅ Passed The description completes all template sections and provides clear scope, documentation impact, verification evidence, and remaining boundaries.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/agentic-skill-beta

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Tegami

This repository uses Tegami to manage releases. When your changes affect published packages, add a changelog file under .tegami/ before merging.

Create a changelog → · Changelog format

Release preview

Package Bump Version
orgmemory minor 0.2.00.3.0

Changelogs in this PR

Changelog Title
2026-08-05-agentic-skill-beta.md Features

Run pnpm run tegami locally to create a changelog interactively.

Managed by Tegami.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
integrations/ai-model-gateways/src/main/java/com/orgmemory/integrations/ai/gateway/SpringAiChatModelAdapter.java (1)

282-306: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Separate the Assistant-specific memory-client cache.

memoryClient() and assistantMemoryClient() store both Assistant memory clients under ModelKey(organizationId, ASSISTANT_CHAT, route, gateway). computeIfAbsent caches the first builder configuration for both paths.

If memoryClient() creates the entry first, the fallback Assistant path reuses resolve(...) and does not disable automatic tool-advisor registration. If assistantMemoryClient() creates the entry first, the agent memory path reuses resolveAssistant(...) and Assistant-only configuration. Use a separate cache for assistantMemoryClient(), or include the client mode in ModelKey, and evict superseded entries from both caches. Add a regression test that invokes both memory-code paths in each order.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@integrations/ai-model-gateways/src/main/java/com/orgmemory/integrations/ai/gateway/SpringAiChatModelAdapter.java`
around lines 282 - 306, Separate the cache used by assistantMemoryClient() from
memoryClient(), or extend ModelKey with a client-mode discriminator, so each
path retains its own model resolver and advisor configuration. Update
evictSuperseded() to remove superseded entries from both caches, then add
regression coverage invoking memoryClient() and assistantMemoryClient() in both
creation orders and verifying each configuration remains distinct.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In
`@integrations/ai-model-gateways/src/main/java/com/orgmemory/integrations/ai/gateway/SpringAiChatModelAdapter.java`:
- Around line 282-306: Separate the cache used by assistantMemoryClient() from
memoryClient(), or extend ModelKey with a client-mode discriminator, so each
path retains its own model resolver and advisor configuration. Update
evictSuperseded() to remove superseded entries from both caches, then add
regression coverage invoking memoryClient() and assistantMemoryClient() in both
creation orders and verifying each configuration remains distinct.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2a31e61e-59d2-451e-a092-c78fe4d1e6eb

📥 Commits

Reviewing files that changed from the base of the PR and between 15e0e04 and 0115fea.

⛔ Files ignored due to path filters (10)
  • docs/increments/completed/2026-08-05-agentic-skill-beta/challenge-brief.md is excluded by !docs/**
  • docs/increments/completed/2026-08-05-agentic-skill-beta/challenge-verdict.md is excluded by !docs/**
  • docs/increments/completed/2026-08-05-agentic-skill-beta/design.md is excluded by !docs/**
  • docs/increments/completed/2026-08-05-agentic-skill-beta/plan.md is excluded by !docs/**
  • docs/increments/completed/2026-08-05-agentic-skill-beta/verification.md is excluded by !docs/**
  • docs/roadmap.md is excluded by !docs/**
  • docs/specs/domains/asset-registry.md is excluded by !docs/**
  • docs/specs/domains/assistant-and-mcp.md is excluded by !docs/**
  • docs/tests/domains/asset-registry.md is excluded by !docs/**
  • docs/tests/domains/assistant-and-mcp.md is excluded by !docs/**
📒 Files selected for processing (30)
  • .tegami/2026-08-05-agentic-skill-beta.md
  • ARCHITECTURE.md
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantConfiguration.java
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantStreamPart.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.java
  • apps/api/src/test/java/com/orgmemory/api/assistant/UiMessageStreamTests.java
  • apps/docs/content/docs/getting-started/first-governed-journey.mdx
  • apps/docs/content/docs/getting-started/first-governed-journey.vi.mdx
  • apps/web/src/features/assistant/assistant-activity.ts
  • apps/web/src/features/assistant/components/assistant-page.test.ts
  • apps/web/src/features/assistant/components/assistant-page.tsx
  • apps/web/test/e2e/assistant-pipeline.spec.ts
  • core/src/main/java/com/orgmemory/core/assetregistry/SkillReleaseDeliveryService.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeOperations.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeService.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skilldelivery/SkillReleaseDeliveryQuery.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skilldelivery/SkillReleaseSummary.java
  • core/src/main/java/com/orgmemory/core/assistant/AssistantAgentActivity.java
  • core/src/main/java/com/orgmemory/core/assistant/AssistantAgentModelPort.java
  • core/src/main/java/com/orgmemory/core/assistant/AssistantService.java
  • core/src/main/java/com/orgmemory/core/assistant/AssistantTurn.java
  • core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java
  • core/src/test/java/com/orgmemory/core/ai/AssistantAgentServiceTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/SkillReleaseDeliveryServiceTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeServiceTests.java
  • integrations/ai-model-gateways/src/main/java/com/orgmemory/integrations/ai/gateway/AssistantSkillToolCallbacks.java
  • integrations/ai-model-gateways/src/main/java/com/orgmemory/integrations/ai/gateway/SpringAiChatModelAdapter.java
  • integrations/ai-model-gateways/src/test/java/com/orgmemory/integrations/ai/gateway/AssistantSkillToolCallbacksTests.java
  • integrations/ai-model-gateways/src/test/java/com/orgmemory/integrations/ai/gateway/AssistantSkillToolLoopTests.java
📜 Review details
🧰 Additional context used
📓 Path-based instructions (10)
apps/web/**/*.{ts,tsx}

📄 CodeRabbit inference engine (apps/web/CLAUDE.md)

apps/web/**/*.{ts,tsx}: Extend the established OrgMemory product shell, design tokens, shadcn/Radix primitives, and existing layout patterns; do not introduce a separate visual system in the web application.
Generate ordinary REST clients from contracts/openapi.json using Hey API.
Use TanStack Query for server state, TanStack Router for navigation, and limit Zustand to durable or high-frequency UI state.
Preserve keyboard accessibility, light/dark theme support, loading and error states, and responsive behavior in the web application.

Files:

  • apps/web/test/e2e/assistant-pipeline.spec.ts
  • apps/web/src/features/assistant/assistant-activity.ts
  • apps/web/src/features/assistant/components/assistant-page.test.ts
  • apps/web/src/features/assistant/components/assistant-page.tsx
apps/web/**/*.{test,spec}.{ts,tsx}

📄 CodeRabbit inference engine (apps/web/CLAUDE.md)

Preserve the existing browser test suite when changing the web application.

Files:

  • apps/web/test/e2e/assistant-pipeline.spec.ts
  • apps/web/src/features/assistant/components/assistant-page.test.ts
**/*

📄 CodeRabbit inference engine (AGENTS.md)

**/*: Treat the repository and runtime evidence as the engineering system of record; do not treat chat or Northstar as authoritative.
Before changing a domain, read its specification, test-coverage document, and applicable decision filenames.
Material decisions about domain boundaries, authorization, persistence, publication, concurrency, cache isolation, parity scope, or deployment require an independent architecture challenge and documented alternatives before implementation.
Do not use completed increment documents as the source for current behavior; use them only for history or archaeology.
Before using unfamiliar Spring Boot, Spring Modulith, Spring AI, Gradle, React, Vite, Tailwind, TypeScript, Next.js, or Fumadocs APIs, consult current official documentation, Context7, and the relevant verification skill.
Read docs/guidelines/agent-safety.md before retrieval, AI, MCP, permission, upload, graph, or export work; never commit secrets or customer data.
Keep ddl-auto=validate and pair every persisted-model change with a Flyway migration.
Use the testing harness; a terminating clean test is the JVM context gate, and bootRun is not verification.

Files:

  • apps/web/test/e2e/assistant-pipeline.spec.ts
  • apps/docs/content/docs/getting-started/first-governed-journey.vi.mdx
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantConfiguration.java
  • integrations/ai-model-gateways/src/test/java/com/orgmemory/integrations/ai/gateway/AssistantSkillToolLoopTests.java
  • apps/api/src/test/java/com/orgmemory/api/assistant/UiMessageStreamTests.java
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantStreamPart.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skilldelivery/SkillReleaseDeliveryQuery.java
  • core/src/main/java/com/orgmemory/core/assistant/AssistantAgentModelPort.java
  • core/src/main/java/com/orgmemory/core/assistant/AssistantTurn.java
  • core/src/main/java/com/orgmemory/core/assistant/AssistantAgentActivity.java
  • integrations/ai-model-gateways/src/test/java/com/orgmemory/integrations/ai/gateway/AssistantSkillToolCallbacksTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skilldelivery/SkillReleaseSummary.java
  • core/src/test/java/com/orgmemory/core/ai/AssistantAgentServiceTests.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.java
  • apps/web/src/features/assistant/assistant-activity.ts
  • integrations/ai-model-gateways/src/main/java/com/orgmemory/integrations/ai/gateway/AssistantSkillToolCallbacks.java
  • apps/web/src/features/assistant/components/assistant-page.test.ts
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeOperations.java
  • core/src/main/java/com/orgmemory/core/assetregistry/SkillReleaseDeliveryService.java
  • core/src/main/java/com/orgmemory/core/assistant/AssistantService.java
  • apps/docs/content/docs/getting-started/first-governed-journey.mdx
  • integrations/ai-model-gateways/src/main/java/com/orgmemory/integrations/ai/gateway/SpringAiChatModelAdapter.java
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeService.java
  • ARCHITECTURE.md
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeServiceTests.java
  • core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/SkillReleaseDeliveryServiceTests.java
  • apps/web/src/features/assistant/components/assistant-page.tsx
**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (AGENTS.md)

Frontend changes must pass lint, typecheck, tests, and a production build; perform browser verification when the flow warrants it.

Files:

  • apps/web/test/e2e/assistant-pipeline.spec.ts
  • apps/web/src/features/assistant/assistant-activity.ts
  • apps/web/src/features/assistant/components/assistant-page.test.ts
  • apps/web/src/features/assistant/components/assistant-page.tsx
apps/docs/content/docs/**/*.{md,mdx}

📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)

apps/docs/content/docs/**/*.{md,mdx}: Public prose must live only in apps/docs/content/docs; internal engineering documents are source evidence, not publication input.
sourceRefs is build-time traceability metadata and must never be rendered in published content.
Draft pages must remain excluded unless DOCS_INCLUDE_DRAFTS=true is set for a local or controlled preview.

Files:

  • apps/docs/content/docs/getting-started/first-governed-journey.vi.mdx
  • apps/docs/content/docs/getting-started/first-governed-journey.mdx
apps/docs/content/docs/**/*.mdx

📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)

Use index.mdx for a section root and <slug>.mdx for a named English page; add Vietnamese pages individually as adjacent index.vi.mdx or <slug>.vi.mdx files, using the /vi/docs/... route.

Files:

  • apps/docs/content/docs/getting-started/first-governed-journey.vi.mdx
  • apps/docs/content/docs/getting-started/first-governed-journey.mdx
apps/docs/content/docs/**/*.vi.mdx

📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)

Vietnamese routes must visibly fall back to the reviewed English page until the matching .vi.mdx exists; a fallback route is not a completed translation.

Files:

  • apps/docs/content/docs/getting-started/first-governed-journey.vi.mdx
**/*.java

📄 CodeRabbit inference engine (AGENTS.md)

Apply IDE inspection only to edited backend Java files.

Files:

  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantConfiguration.java
  • integrations/ai-model-gateways/src/test/java/com/orgmemory/integrations/ai/gateway/AssistantSkillToolLoopTests.java
  • apps/api/src/test/java/com/orgmemory/api/assistant/UiMessageStreamTests.java
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantStreamPart.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skilldelivery/SkillReleaseDeliveryQuery.java
  • core/src/main/java/com/orgmemory/core/assistant/AssistantAgentModelPort.java
  • core/src/main/java/com/orgmemory/core/assistant/AssistantTurn.java
  • core/src/main/java/com/orgmemory/core/assistant/AssistantAgentActivity.java
  • integrations/ai-model-gateways/src/test/java/com/orgmemory/integrations/ai/gateway/AssistantSkillToolCallbacksTests.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skilldelivery/SkillReleaseSummary.java
  • core/src/test/java/com/orgmemory/core/ai/AssistantAgentServiceTests.java
  • apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.java
  • integrations/ai-model-gateways/src/main/java/com/orgmemory/integrations/ai/gateway/AssistantSkillToolCallbacks.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeOperations.java
  • core/src/main/java/com/orgmemory/core/assetregistry/SkillReleaseDeliveryService.java
  • core/src/main/java/com/orgmemory/core/assistant/AssistantService.java
  • integrations/ai-model-gateways/src/main/java/com/orgmemory/integrations/ai/gateway/SpringAiChatModelAdapter.java
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java
  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeService.java
  • core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeServiceTests.java
  • core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java
  • core/src/test/java/com/orgmemory/core/assetregistry/SkillReleaseDeliveryServiceTests.java
apps/api/src/main/java/**/*.java

⚙️ CodeRabbit configuration file

apps/api/src/main/java/**/*.java: Enforce the browser-BFF and resource-server boundaries. Authentication
must resolve an active internal actor through the explicit issuer and
subject binding. Reject identity, tenant, roles, or permissions supplied
by request payloads, JWT email, or untrusted JWT role claims.

Files:

  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantConfiguration.java
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantStreamPart.java
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java
apps/web/src/**/*.{ts,tsx}

⚙️ CodeRabbit configuration file

apps/web/src/**/*.{ts,tsx}: OAuth access and refresh tokens must never enter browser JavaScript or
browser storage. Use the HttpOnly BFF session, CSRF-protected mutations,
generated Hey API data clients, accessible states, and both light and
dark themes. Handwritten transport is reserved for documented protocol
flows such as navigation redirects and streaming.

Files:

  • apps/web/src/features/assistant/assistant-activity.ts
  • apps/web/src/features/assistant/components/assistant-page.test.ts
  • apps/web/src/features/assistant/components/assistant-page.tsx
🧠 Learnings (5)
📚 Learning: 2026-07-28T20:06:14.930Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 112
File: apps/docs/content/docs/developers/api-reference/administration.mdx:11-11
Timestamp: 2026-07-28T20:06:14.930Z
Learning: In OrgMemory public documentation MDX files, ensure any `lastReviewed` dates are set using the repository project timezone `Asia/Bangkok`, not the reviewer’s local timezone or the runtime/build timezone. When generating or updating API-reference pages, intentionally use the exact same `lastReviewed` date convention as the authored public documentation pages to keep timestamps consistent across both sources.

Applied to files:

  • apps/docs/content/docs/getting-started/first-governed-journey.vi.mdx
  • apps/docs/content/docs/getting-started/first-governed-journey.mdx
📚 Learning: 2026-07-28T20:06:15.064Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 112
File: apps/docs/content/docs/developers/api-reference/authentication.mdx:12-12
Timestamp: 2026-07-28T20:06:15.064Z
Learning: In OrgMemory docs/tests that describe date-based review checks, treat the project timezone as Asia/Bangkok for all “date” comparisons/validations. Do not assume UTC when interpreting or validating fields like `lastReviewed`. For example, `lastReviewed: '2026-07-29'` should be considered valid when the effective “current date” in Asia/Bangkok is July 29, 2026 (not merely when the UTC date matches).

Applied to files:

  • apps/docs/content/docs/getting-started/first-governed-journey.vi.mdx
  • apps/docs/content/docs/getting-started/first-governed-journey.mdx
📚 Learning: 2026-07-30T06:46:08.031Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 144
File: apps/docs/public-content.manifest.json:13-67
Timestamp: 2026-07-30T06:46:08.031Z
Learning: For the Fumadocs docs portal under apps/docs, follow the expected MDX filename conventions that drive section-root vs named-page routing. Use `index.mdx` for English section-root pages and `<slug>.mdx` for named pages. For Vietnamese, use adjacent locale-suffixed files: `index.vi.mdx` for section roots and `<slug>.vi.mdx` for named pages. Do not require or enforce a `page.mdx` filename; doing so would change/break the intended section-root route structure.

Applied to files:

  • apps/docs/content/docs/getting-started/first-governed-journey.vi.mdx
  • apps/docs/content/docs/getting-started/first-governed-journey.mdx
📚 Learning: 2026-07-26T05:46:47.443Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 61
File: apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.java:50-52
Timestamp: 2026-07-26T05:46:47.443Z
Learning: In OrgMemory, treat the `apps/mcp` and `apps/api` as independent protocol adapter modules. When adjusting OAuth/wire-level scopes, do not introduce a shared Java constant or create a code dependency from `apps/mcp` to `apps/api` solely to deduplicate scope values. Instead, keep OAuth/scope constants adapter-local (e.g., in the relevant adapter/security configuration classes) and ensure cross-adapter consistency via automated realm/OAuth/authorization tests, rather than via shared wiring-level constants or cross-module references.

Applied to files:

  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantConfiguration.java
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantStreamPart.java
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java
📚 Learning: 2026-08-05T09:53:56.596Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 300
File: .tegami/2026-08-05-retrieval-recall-observations.md:7-7
Timestamp: 2026-08-05T09:53:56.596Z
Learning: For Tegami release fragments in `.tegami/*.md`, do not require a top-level H1 solely to satisfy markdownlint MD041. These fragments must instead contain an approved level-two public changelog section, such as `## Improvements`, as enforced by `scripts/check-release.mjs`; the generated release output contract prevents adding a second page-level H1.

Applied to files:

  • .tegami/2026-08-05-agentic-skill-beta.md
🪛 ast-grep (0.45.0)
integrations/ai-model-gateways/src/main/java/com/orgmemory/integrations/ai/gateway/AssistantSkillToolCallbacks.java

[warning] 71-71: Avoid LDAP injections
Context: skills.search(actor, query, limit)
Note: [CWE-90] Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'). Security best practice.

(ldap-injection-java)

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeService.java

[warning] 45-45: Avoid LDAP injections
Context: deliveries.search(actor, query, limit)
Note: [CWE-90] Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'). Security best practice.

(ldap-injection-java)

🪛 markdownlint-cli2 (0.23.2)
.tegami/2026-08-05-agentic-skill-beta.md

[warning] 7-7: First line in a file should be a top-level heading

(MD041, first-line-heading, first-line-h1)

🔇 Additional comments (19)
ARCHITECTURE.md (1)

220-225: LGTM!

Also applies to: 420-428

core/src/main/java/com/orgmemory/core/assetregistry/skilldelivery/SkillReleaseSummary.java (1)

1-15: LGTM!

core/src/main/java/com/orgmemory/core/assetregistry/skilldelivery/SkillReleaseDeliveryQuery.java (1)

4-10: LGTM!

core/src/main/java/com/orgmemory/core/assetregistry/SkillReleaseDeliveryService.java (1)

12-16: LGTM!

Also applies to: 48-72, 179-188

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeService.java (1)

1-221: LGTM!

core/src/test/java/com/orgmemory/core/assetregistry/SkillReleaseDeliveryServiceTests.java (1)

24-74: LGTM!

core/src/test/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeServiceTests.java (1)

1-228: LGTM!

.tegami/2026-08-05-agentic-skill-beta.md (1)

1-12: LGTM!

apps/docs/content/docs/getting-started/first-governed-journey.mdx (1)

13-20: LGTM!

Also applies to: 98-103

apps/docs/content/docs/getting-started/first-governed-journey.vi.mdx (1)

13-20: LGTM!

Also applies to: 102-107

core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeOperations.java (1)

10-44: 📐 Maintainability & Code Quality

Run the required backend verification before merge.

Attach repository or CI evidence for a clean JVM test-harness run and IDE inspection of these edited backend Java files.

  • core/src/main/java/com/orgmemory/core/assetregistry/skill/SkillRuntimeOperations.java#L10-L44: include the new Skill runtime contract in IDE inspection.
  • core/src/main/java/com/orgmemory/core/assistant/AssistantAgentActivity.java#L4-L19: include the activity contract in IDE inspection.
  • core/src/main/java/com/orgmemory/core/assistant/AssistantAgentModelPort.java#L12-L18: include the agent model boundary in IDE inspection.
  • core/src/main/java/com/orgmemory/core/assistant/AssistantTurn.java#L9-L16,L33-L35: include the reactive turn contract in IDE inspection.
  • core/src/main/java/com/orgmemory/core/assistant/AssistantService.java#L190-L204,L237-L247: include the agent routing and activity-sink path in IDE inspection and the clean test gate.
  • core/src/test/java/com/orgmemory/core/ai/AssistantAgentServiceTests.java#L30-L110: execute this coverage through the clean test gate.
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java#L404-L415,L455-L460: include SSE activity mapping in IDE inspection and the clean test gate.
  • apps/api/src/main/java/com/orgmemory/api/assistant/AssistantStreamPart.java#L18-L27: include the stream protocol enum changes in IDE inspection.
  • apps/api/src/test/java/com/orgmemory/api/assistant/UiMessageStreamTests.java#L56-L74: execute SSE encoding coverage through the clean test gate.

As per coding guidelines, “Apply IDE inspection only to edited backend Java files” and “Use the testing harness; a terminating clean test is the JVM context gate, and bootRun is not verification.”

Source: Coding guidelines

apps/web/src/features/assistant/assistant-activity.ts (1)

1-38: 📐 Maintainability & Code Quality

Verify the changed Assistant activity flow in the web pipeline.

Run lint, typecheck, unit tests, the production build, and the existing browser suite. Verify Skill activity states in light and dark themes and with keyboard-only navigation.

As per coding guidelines, “Frontend changes must pass lint, typecheck, tests, and a production build; perform browser verification when the flow warrants it.”

Source: Coding guidelines

core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java (1)

1361-1365: LGTM!

Also applies to: 1410-1414, 1467-1486

integrations/ai-model-gateways/src/main/java/com/orgmemory/integrations/ai/gateway/AssistantSkillToolCallbacks.java (1)

26-180: LGTM!

integrations/ai-model-gateways/src/test/java/com/orgmemory/integrations/ai/gateway/AssistantSkillToolCallbacksTests.java (1)

35-137: LGTM!

integrations/ai-model-gateways/src/test/java/com/orgmemory/integrations/ai/gateway/AssistantSkillToolLoopTests.java (1)

30-153: LGTM!

apps/api/src/main/java/com/orgmemory/api/assistant/AssistantConfiguration.java (1)

5-5: LGTM!

Also applies to: 81-94

apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetRegistryIntegrationTests.java (1)

20-20: LGTM!

Also applies to: 204-205

apps/web/src/features/assistant/components/assistant-page.tsx (1)

224-231: 📐 Maintainability & Code Quality

Verify the modified Assistant activity flow in the frontend pipeline.

No repository or pipeline result is supplied in this review context. Do not use the PR summary as verification evidence.

  • apps/web/src/features/assistant/components/assistant-page.tsx#L224-L231: verify that active, complete, and failed Skill frames render without breaking the Assistant flow.
  • apps/web/src/features/assistant/components/assistant-page.test.ts#L6-L23: run the unit test suite and typecheck.
  • apps/web/test/e2e/assistant-pipeline.spec.ts#L797-L809: run the Playwright Assistant flow, including streamed Skill activity frames.

Run lint, typecheck, unit tests, a production build, and browser verification.

As per coding guidelines, “Frontend changes must pass lint, typecheck, tests, and a production build; perform browser verification when the flow warrants it,” and “Treat the repository and runtime evidence as the engineering system of record.”

Source: Coding guidelines

@kl3inIT

kl3inIT commented Aug 5, 2026

Copy link
Copy Markdown
Owner Author

Addressed the cache-isolation finding in e2fc879: Assistant agent memory clients now use a dedicated cache, superseded profile eviction covers all three client caches, and regression coverage exercises both general-first and assistant-first creation orders. Verified with the focused regression tests and the full ai-model-gateways test task.

@kl3inIT
kl3inIT merged commit 88721be into main Aug 5, 2026
18 checks passed
@kl3inIT
kl3inIT deleted the feat/agentic-skill-beta branch August 5, 2026 16:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant