Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

feat(evolution): private reviewed overlay revisions from local session-derived skill improvements

Aperta
  • Qualcosa non va?
#56 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@mrgoonie ci sta già lavorando.

Dal 14/10/2026.

  • #83 di @mrgoonie — aperta

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
20/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
authentication, backend-api-design, security

Direzione di ricerca

Read the current schema, auth, routes, and contracts, then review issues #31, #34, #35, and #55 for prerequisites and existing patterns. The issue scopes implementation to backend contracts and CLI helpers, with schema validation and negative security tests first. Done means the reviewed private overlay flow meets the listed privacy, lineage, authorization, concurrency, and rollback requirements; no specific files or tests are named.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement

Parent / prerequisites

Tracked by SkillX #31. Depends on personal-kit immutable lineage/overlay #55, registry releases #34/#54. Consumer AgentKit #2274, future AK ak insights -> skill improvement proposal and private publish.

Objective

Expose an authenticated, privacy-safe flow to publish user-reviewed skill overlay revisions created from local AgentKit session analysis, while preserving base foundation ancestry, source-license/entitlement restrictions, review history, optimistic concurrency and no raw session exfiltration.

Contract

  1. Inputs: target @publisher/skill, base package ID/version/digest, existing overlay revision/generation, candidate structural patch and supporting non-sensitive evidence summary; never require or accept raw transcripts, environment secrets, local absolute filesystem paths, prompts containing customer data or arbitrary source trees without specific consent.
  2. An optional local agent may analyze session/evaluation and propose a patch, but only user-authorized content is sent. Default visibility private; profile settings do not grant automatic publish permission.
  3. Validate package schema, patch bounds, AST/semantic extension points, submitted file paths, content scanner, license, foundation redistribution restrictions, publisher namespace, entitlements, declared required runtime permissions and resource manifests. Reject hidden binary/executable additions unless separately declared/reviewed.
  4. Immutable revision with revision ID, parent digest, content digest, base digest, ancestry chain, author and audit metadata. Compare-and-swap expectedGeneration and idempotency key to prevent lost updates and duplicate publish.
  5. Distinguish draft, candidate, reviewed, published, rejected, and quarantined as needed without conflicting with package release states. Disallow publish based purely on an unverifiable success counter or self-reported prompt.
  6. User explicitly approves diff + permissions + target visibility; record consent/approval proof, not private session content. Provide dry-run validation endpoint and machine-readable conflicts/new permission requests.
  7. Support rollback to previous revision and local locked sync; old revision remains available under policy when newer candidate rejected. Handle private/public transitions without exposing paid upstream contents.
  8. Reuse existing skillx publish / registry auth patterns and #55 lineage API; do not build a new service or second user identity.

Adversarial acceptance

  • No raw transcript fields or secrets accidentally persisted, logged, vectorized, indexed or included in errors.
  • Anonymous/other-user writer denied; wrong base digest/entitlement/visibility rejected; concurrent proposals conflict explicitly.
  • Double-submit of same revision is idempotent; differing content under same immutable revision refused.
  • Paid/private upstream derivative cannot leak protected foundation bytes through public patch/preview/search.
  • Review denial, compromised account, quarantined content, rollback, retry and expired credentials deterministic.
  • Works with manifest and locked sync from #55, and AK publishes only reviewed effective user-owned delta.

Agent implementation prompt

Read SkillX instructions and current schema/auth/routes/contracts plus #31/#34/#35/#55 before coding. Specify threat/privacy model and the exact acceptable request envelope; add schema validation tests first. Prefer a local-only evidence proposal and upload patch only. Implement a dry-run validate step, CAS-backed versioned persistence and explicit approval endpoint with audit, strict publisher and paid-license checks. Add negative security tests (accidental secret/session upload, cross-user access, unauthorized visibility, lost update) and backward compatibility coverage. Scope the PR to backend/contracts/CLI helpers; downstream AgentKit session parsing and eval stay in AgentKit. Include migrations, rollback and exact tests in PR.

Non-goals

Reading or indexing full user sessions server-side, training on private transcripts, automatic unattended publish, crypto payments/creator settlements, automatic security approval.

Lingua principale
TypeScript
Stelle
186
Fork
40
Merge medio
10h 12m
PR unite (30g)
16

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di nextlevelbuilder/skillx

Tutte le issue di nextlevelbuilder/skillx

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.