feat!: reconcile capability matrix inconsistencies from skill audit - #74
Merged
Merged
Conversation
Adds a repo-local Claude Code skill (.claude/skills/capability-matrix/) that helps contributors keep capabilities/*.yaml and specs/ internally consistent: semantic duplicate detection, naming-convention drift within a group, grouping fit, spec-file suggestions, and platform-scope notes. It's advisory only and defers to `npm run validate` for anything mechanical. Carves out .claude/skills/ from the repo-wide .claude/ gitignore rule so committed skills are tracked while session/worktree state stays ignored. Supersedes the CI-bot / PR-review-comment scope in SDK-994.
|
Warning Review limit reached
Next review available in: 51 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (15)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Tr00d
approved these changes
Aug 7, 2026
Two review findings on the capability-matrix skill, both still valid: - validate-capabilities.yml's PR trigger didn't include specs/**, so a spec-only change (e.g. a typo'd path that orphans a spec) could merge without ever running the validator that catches exactly that. - SKILL.md described spec paths as specs/<area>/<group>/<method>.md, implying the current `group` field. The directory is actually derived from the feature id's own segments (<group_namespace>/<method_stem> per the schema), which can now diverge from `group` since SDK-1439 regrouped several features without renaming their ids. Reworded to match the schema's own terminology and call out the divergence.
Base automatically changed from
guilherme/sdk-994-llm-skill-for-maintaining-the-capability-matrix
to
main
August 7, 2026 08:17
Addresses the findings filed in SDK-1439 (from the capability-matrix
skill's first full audit):
Breaking (feature ID changes — sdk-compliance.yaml files referencing
the old IDs need updating):
- storage: merge file_buckets.list_files_paginated into list_files
(pagination is now a parameter of one capability, matching the
convention already used by vector_buckets/analytics list features)
- storage: split the bundled analytics.iceberg_namespace /
iceberg_table IDs into one ID per verb (create/list/delete_namespace,
create/list/load/update/rename/delete_table), matching the per-verb
modeling used everywhere else in the file and enabling per-verb SDK
compliance tracking
- auth: rename sign_in.reset_password -> sign_in.send_password_reset_email
to match what the capability actually does (sends a link, doesn't
reset the password itself)
- realtime: rename channel.send -> channel.broadcast to match its
transport twin, channel.broadcast_http
Non-breaking (group reassignment only, IDs unchanged):
- auth: new mfa_admin group for admin.delete_mfa_factor/list_mfa_factors,
mirroring the existing oauth_admin/passkey_admin pattern
- realtime: presence.presence_key -> subscriptions group, alongside the
other channel-option features (broadcast_self/ack/replay)
- functions: new request_configuration group for
region_selection/timeout/request_cancellation/set_auth_token,
mirroring client.yaml/database.yaml's existing config groups
- database: mutate.select_after_mutation -> using_modifiers group
(it's a chained modifier, like dry_run, not a mutation verb)
Also adds descriptions/specs for the audit's lighter findings: a
platform-scope note on the passkey features, and new specs for
auth.mfa.enroll, auth.oauth_server.{approve,deny}_authorization,
functions.invocation.streaming_response,
database.using_modifiers.relationship_embed, and the
client.authentication_integration.third_party_auth /
cross_client_token_sync pair (cross-linked via Related).
Declined: renaming the using_filters/using_modifiers group ids to drop
their "using_" prefix (cosmetic cross-area style nit) — the blast
radius (~39 feature ID renames) is disproportionate to the finding.
grdsdev
force-pushed
the
guilherme/sdk-1439-capability-matrix-audit-fixes
branch
from
August 7, 2026 08:19
4c87de6 to
891f96c
Compare
This was referenced Aug 7, 2026
Merged
Merged
Closed
grdsdev
added a commit
to supabase-community/supabase-csharp
that referenced
this pull request
Aug 7, 2026
…306) supabase/sdk#74 renames two feature IDs. Updates references here so CI's capability compliance validator doesn't fail on unknown IDs: - auth.sign_in.reset_password -> auth.sign_in.send_password_reset_email - realtime.channel.send -> realtime.channel.broadcast This file doesn't currently declare the storage.file_buckets/analytics IDs also renamed/split in that PR, so nothing else to update here. No SDK code changes — only the capability declarations. See supabase/sdk#74 and https://linear.app/supabase/issue/SDK-1439 for context.
grdsdev
added a commit
to supabase/supabase-swift
that referenced
this pull request
Aug 7, 2026
…1184) supabase/sdk#74 renames/splits several feature IDs. Updates references here so CI's capability compliance validator doesn't fail on unknown IDs: - auth.sign_in.reset_password -> auth.sign_in.send_password_reset_email - realtime.channel.send -> realtime.channel.broadcast - storage.file_buckets.list_files_paginated merged into list_files - storage.analytics.iceberg_namespace split into create_namespace/list_namespaces/delete_namespace - storage.analytics.iceberg_table split into create_table/list_tables/load_table/update_table/rename_table/delete_table No SDK code changes — only the capability declarations. See supabase/sdk#74 and https://linear.app/supabase/issue/SDK-1439 for context.
spydon
added a commit
that referenced
this pull request
Aug 7, 2026
## Problem The `symbols` list in `sdk-compliance.yaml` feeds two checks that want opposite things: | Check | Reads `symbols` as | Wants | |---|---|---| | `checkDrift` | **Evidence** that a capability is implemented | A short, precise list of entry points, all of which must exist | | `checkNewSymbols` | **Coverage**, so no new public API slips in unclassified | An exhaustive account of the entire public surface | One list cannot serve both. When a capability's supporting types outnumber its methods, authors get pushed into one of two workarounds: 1. Padding `symbols` with option types, result types and exceptions that do not implement anything, or 2. Repeating one shared symbol list across several features so each has something to point at. Both inflate what the matrix claims is implemented, fan drift warnings out across features that do not own the symbol, and leave symbol-to-feature attribution arbitrary, since `buildSymbolIndex` silently last-wins on collision. This is not hypothetical. supabase/supabase-flutter#1666 hit it head-on: reconciling #74 required replicating a 330-symbol Iceberg list across 6 new feature IDs and a 22-symbol list across 3 more, for +1729 lines. Every one of those 330 symbols now resolves to `storage.analytics.delete_table` in the symbol index, purely because it sorts last. The existing escape hatches do not help. `@internal` and `.sdk-parse-ignore` remove symbols from the surface entirely, but types like `TableMetadata` are genuinely public API that consumers construct. They just are not *capabilities*. ## Change Adds an optional `supporting_symbols` list, per feature and top level, that counts for new-symbol coverage and is never drift-verified: ```yaml storage.analytics.create_table: status: implemented symbols: - IcebergRestCatalog.createTable # evidence, drift-verified supporting_symbols: - CreateTableRequest # coverage only supporting_symbols: # top level, shared across features - IcebergException ``` - `compliance.ts`: new field on `RawValue` and `RawCompliance`; validation extracted into a shared `checkSymbolList` helper so both lists get identical treatment; `normalizeCompliance` preserves it; `buildSymbolIndex` unions both. Entry points are indexed **last**, so a symbol listed both ways is attributed to the capability that implements it rather than to a supporting bucket. Top-level entries index against an exported `TOP_LEVEL_SUPPORTING` sentinel so removal messages stay readable. - `drift-check.ts`: **unchanged**. It already read only `value.symbols`, so the separation falls out for free. - `api-check.ts`: the failure message now teaches the distinction, since that message is exactly where an author hits this wall. - `types.ts`, `docs/capability-matrix.md`, tests. ## Compatibility The field is optional and the drift check already ignored anything outside `symbols`, so existing compliance files are unaffected. Verified that supabase-flutter's current `sdk-compliance.yaml` validates unchanged. ## Test plan - [x] 194 tests pass; 12 new, including the two that pin the semantics: supporting symbols do not satisfy drift on their own, and a missing supporting symbol produces no drift finding. - [x] `tsc --noEmit` clean. - [x] `npm run validate` still OK on the canonical registry. - [x] Rebuilt supabase-flutter#1666's Iceberg entries in this shape as a check that it solves the motivating case: 0 drift findings, 0 uncovered symbols out of 352, attribution exact (`createTable` maps to `create_table`, not `delete_table`), and **2046 symbol lines become 352**. ## Follow-ups, deliberately not in this PR - **Reject duplicate symbol registration.** Now that supporting types have a home this becomes viable, and it would have caught supabase-flutter#1666's shape automatically. Turning it on today would fail existing compliance files, so it needs its own migration. - **`renamed_from` aliases on canonical features.** Separate concern and arguably higher value: today every ID rename here breaks all seven SDK repos at once, with no window in which both old and new IDs validate, because each repo pins the reusable workflow at `@main`. - **The registry is narrower than the SDKs.** #74 splits namespaces into create/list/delete, but the real Flutter surface has seven namespace operations. `loadNamespaceMetadata`, `namespaceExists`, `updateNamespaceProperties`, `registerTable` and `tableExists` map to no capability at all. This PR gives them an honest home rather than a false claim, but the underlying gap is worth deciding on separately.
spydon
added a commit
to supabase/supabase-flutter
that referenced
this pull request
Aug 7, 2026
…nd splits (#1667) ## Summary Reconciles `sdk-compliance.yaml` with three upstream changes that have now landed in `supabase/sdk`: - **supabase/sdk#74** renamed and split several canonical feature IDs. - **supabase/sdk#75** separated symbol *evidence* from symbol *coverage*, adding `supporting_symbols`. - **supabase/sdk#76** added the five Iceberg catalog capabilities that #74's split left without an ID. ### Renames and merges - `auth.sign_in.reset_password` → `auth.sign_in.send_password_reset_email` - `realtime.channel.send` → `realtime.channel.broadcast` - `storage.file_buckets.list_files_paginated` merged into `list_files` - `storage.analytics.iceberg_namespace` split into `create_namespace` / `list_namespaces` / `delete_namespace` - `storage.analytics.iceberg_table` split into `create_table` / `list_tables` / `load_table` / `update_table` / `rename_table` / `delete_table` ### New capabilities declared `load_namespace_metadata`, `namespace_exists`, `update_namespace_properties`, `register_table`, `table_exists`. ## Why the Iceberg entries look the way they do Splitting two bundled entries into fifteen raises the question of which symbols belong where. The Iceberg surface is 352 symbols, only 18 of which are catalog entry points; the rest are option types, result types, the schema and type model, and the exception hierarchy. `symbols` now holds **only** the methods a caller invokes, because the drift check treats every name in it as evidence the capability exists. Everything else sits under `supporting_symbols`, which counts for new-symbol coverage without claiming to implement anything. Owners for the supporting types are derived from the source rather than assigned by hand: build the type graph from `packages/storage_client/lib/src/iceberg/`, including subtype edges since a signature naming a sealed base reaches every variant a caller can pass, then ask which entry points reach each type. A type reachable from exactly one feature belongs to that feature. | | count | |---|---| | Sole natural owner | 37 of 67 | | Genuinely shared across several features | 20 | | Reachable from no entry point (thrown, not passed) | 10 | So all 28 `*Update` and `Assert*` classes land on `update_table`, `ListTablesOptions`/`ListTablesResult` on `list_tables`, `RegisterTableRequest` on `register_table`. The schema and type model and the exception hierarchy stay in the top-level `supporting_symbols` list, which is the honest answer rather than a coin flip. The alternative was to replicate the full 330-symbol list across all six table IDs and the 22-symbol list across all three namespace IDs (+1729 lines, as in the now-closed #1666). That inflates what the file claims is implemented, fans drift findings across features that do not own the symbol, and leaves attribution arbitrary, since `buildSymbolIndex` last-wins on collision. Under that shape only 2 of 9 split features resolved to their own entry point; here it is 9 of 9. ## Test plan Validated against current `supabase/sdk@main`, with #74, #75 and #76 all merged: - [x] `validate-compliance`: `OK — compliance file is valid.` Two features remain undeclared (`postgres_changes_multiple_filters`, `error_codes`); both are pre-existing and out of scope here. - [x] `check-drift` against symbols extracted with the real Dart extractor: `✅ No capability matrix drift detected.` - [x] `check-api-symbols`: all public API accounted for; 887 symbols covered, unchanged from before this PR. - [x] Verified no unintended edits: every feature outside the rename and split scope is byte-identical to `main` after re-serialization. - [x] CI re-run after the upstream merges: `Validate compliance file` and `Check public API against capability matrix` both green. No SDK code changes, only capability declarations. Context: [SDK-1439](https://linear.app/supabase/issue/SDK-1439) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Standardized capability names for password reset and realtime broadcast functionality. * Clarified storage file listing capabilities, including pagination and sorting support. * Added more granular capability definitions for Iceberg namespaces and tables. * Consolidated shared Iceberg models, errors, catalog access, and supporting symbols for more consistent capability descriptions. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #73.
Summary
Fixes every finding filed in SDK-1439, the audit produced by running the new
capability-matrixskill (#73) against the current matrix.Breaking (feature ID changes — SDKs'
sdk-compliance.yamlreferencing the old IDs need updating):storage: mergefile_buckets.list_files_paginatedintolist_files— pagination is now a parameter of one capability, matching the convention already used byvector_buckets/analyticslist featuresstorage: split the bundledanalytics.iceberg_namespace/iceberg_tableIDs into one ID per verb (create/list/delete_namespace,create/list/load/update/rename/delete_table) — matches the per-verb modeling used everywhere else in the file and unblocks per-verb SDK compliance trackingauth: renamesign_in.reset_password→sign_in.send_password_reset_emailto match what it actually does (sends a link; doesn't reset the password itself)realtime: renamechannel.send→channel.broadcastto match its transport twin,channel.broadcast_httpNon-breaking (group reassignment only, IDs unchanged):
auth: newmfa_admingroup for the two MFA admin ops, mirroring the existingoauth_admin/passkey_adminpatternrealtime:presence.presence_key→subscriptionsgroup, alongside the other channel-option featuresfunctions: newrequest_configurationgroup, mirroringclient.yaml/database.yaml's existing config groupsdatabase:mutate.select_after_mutation→using_modifiersgroup (it's a chained modifier, likedry_run, not a mutation verb)Also added: a platform-scope note on the passkey features, and specs for
auth.mfa.enroll,auth.oauth_server.{approve,deny}_authorization,functions.invocation.streaming_response,database.using_modifiers.relationship_embed, and theclientthird-party-auth / cross-client-token-sync pair (cross-linked).Declined: renaming the
using_filters/using_modifiersgroup ids to drop their "using_" prefix — cosmetic cross-area style nit, but fixing it would mean renaming ~39 feature IDs. Disproportionate to the finding; left as-is.Test plan
npm run validate— schema + structural checks passnpm test— 183/183 tests passnpm run typecheck— clean