feat(evolution): private reviewed overlay revisions from local session-derived skill improvements
メンテナーはふだん 1 日以内に返信
評価
- 難易度
- 5/5
- 見積もり時間
- 1週間以上
- 初心者へのやさしさ
- 20/100
- issue の種類
- 機能追加
- 明瞭さ
- 明確に書かれている
- 活発さ
- 活発
- 技術スタック
- typescript
調査の方向性
Read the current schema, auth, routes, and contracts, then review issues #31, #34, #35, and #55 for prerequisites and existing patterns. The issue scopes implementation to backend contracts and CLI helpers, with schema validation and negative security tests first. Done means the reviewed private overlay flow meets the listed privacy, lineage, authorization, concurrency, and rollback requirements; no specific files or tests are named.
索引モデルが issue の本文から書いたものです。
説明
Parent / prerequisites
Tracked by SkillX #31. Depends on personal-kit immutable lineage/overlay #55, registry releases #34/#54. Consumer AgentKit #2274, future AK ak insights -> skill improvement proposal and private publish.
Objective
Expose an authenticated, privacy-safe flow to publish user-reviewed skill overlay revisions created from local AgentKit session analysis, while preserving base foundation ancestry, source-license/entitlement restrictions, review history, optimistic concurrency and no raw session exfiltration.
Contract
- Inputs: target
@publisher/skill, base package ID/version/digest, existing overlay revision/generation, candidate structural patch and supporting non-sensitive evidence summary; never require or accept raw transcripts, environment secrets, local absolute filesystem paths, prompts containing customer data or arbitrary source trees without specific consent. - An optional local agent may analyze session/evaluation and propose a patch, but only user-authorized content is sent. Default visibility
private; profile settings do not grant automatic publish permission. - Validate package schema, patch bounds, AST/semantic extension points, submitted file paths, content scanner, license, foundation redistribution restrictions, publisher namespace, entitlements, declared required runtime permissions and resource manifests. Reject hidden binary/executable additions unless separately declared/reviewed.
- Immutable revision with
revision ID, parent digest, content digest, base digest, ancestry chain, author and audit metadata. Compare-and-swapexpectedGenerationand idempotency key to prevent lost updates and duplicate publish. - Distinguish
draft,candidate,reviewed,published,rejected, andquarantinedas needed without conflicting with package release states. Disallow publish based purely on an unverifiable success counter or self-reported prompt. - User explicitly approves diff + permissions + target visibility; record consent/approval proof, not private session content. Provide dry-run validation endpoint and machine-readable conflicts/new permission requests.
- Support rollback to previous revision and local locked sync; old revision remains available under policy when newer candidate rejected. Handle private/public transitions without exposing paid upstream contents.
- Reuse existing
skillx publish/ registry auth patterns and #55 lineage API; do not build a new service or second user identity.
Adversarial acceptance
- No raw transcript fields or secrets accidentally persisted, logged, vectorized, indexed or included in errors.
- Anonymous/other-user writer denied; wrong base digest/entitlement/visibility rejected; concurrent proposals conflict explicitly.
- Double-submit of same revision is idempotent; differing content under same immutable revision refused.
- Paid/private upstream derivative cannot leak protected foundation bytes through public patch/preview/search.
- Review denial, compromised account, quarantined content, rollback, retry and expired credentials deterministic.
- Works with manifest and locked sync from #55, and AK publishes only reviewed effective user-owned delta.
Agent implementation prompt
Read SkillX instructions and current schema/auth/routes/contracts plus #31/#34/#35/#55 before coding. Specify threat/privacy model and the exact acceptable request envelope; add schema validation tests first. Prefer a local-only evidence proposal and upload patch only. Implement a dry-run validate step, CAS-backed versioned persistence and explicit approval endpoint with audit, strict publisher and paid-license checks. Add negative security tests (accidental secret/session upload, cross-user access, unauthorized visibility, lost update) and backward compatibility coverage. Scope the PR to backend/contracts/CLI helpers; downstream AgentKit session parsing and eval stay in AgentKit. Include migrations, rollback and exact tests in PR.
Non-goals
Reading or indexing full user sessions server-side, training on private transcripts, automatic unattended publish, crypto payments/creator settlements, automatic security approval.
- 主要言語
- TypeScript
- スター
- 186
- フォーク
- 40
- 平均マージ
- 10時間 12分
- マージ済み PR（30日）
- 16
環境構築
このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
nextlevelbuilder/skillx のほかの issue
-
難易度 2/5 1〜3時間 初心者へのやさしさ 68/100
nextlevelbuilder/skillx#65 ·
メンテナーはふだん 1 日以内に返信
-
難易度 2/5 1〜3時間 初心者へのやさしさ 68/100
nextlevelbuilder/skillx#63 ·
メンテナーはふだん 1 日以内に返信
-
bug
難易度 2/5 1〜3時間 初心者へのやさしさ 88/100
nextlevelbuilder/skillx#49 ·
メンテナーはふだん 1 日以内に返信
-
bug
難易度 2/5 1〜3時間 初心者へのやさしさ 76/100
nextlevelbuilder/skillx#28 ·
メンテナーはふだん 1 日以内に返信
-
refactor
難易度 2/5 1〜3時間 初心者へのやさしさ 82/100
nextlevelbuilder/skillx#27 ·
メンテナーはふだん 1 日以内に返信
nextlevelbuilder/skillx の issue をすべて見る
似ている issue
-
useFragment does not require `variables` when the fragment's variables type has required fieldsオープン
難易度 2/5 1〜3時間 初心者へのやさしさ 75/100
apollographql/apollo-client#13493 ·
メンテナーはふだん 1 日以内に返信
-
Custom hosts written as trailing-dot FQDNs (`host.local.`) aren't detected as local backends対応中かも @roboomp が今日担当しました。 オープンbug prio:p2 providers triaged
難易度 2/5 1〜3時間 初心者へのやさしさ 82/100
can1357/oh-my-pi#15798 · コメント 3 件 ·
メンテナーはふだん 1 日以内に返信
-
難易度 2/5 1〜3時間 初心者へのやさしさ 62/100
code-yeongyu/oh-my-openagent#10172 ·
メンテナーはふだん 1 日以内に返信
-
難易度 2/5 1〜3時間 初心者へのやさしさ 70/100
PDFCraftTool/pdfcraft#189 ·
-
Add the Yahoo chart API duplicate last-day row (yfinance#573) to incidents.md (about 1 hour)対応中かも このイシューにリンクされたプルリクエストがオープン中、またはマージ済みです。 オープンdata docs good first issue
難易度 1/5 1時間未満 初心者へのやさしさ 80/100
pacocartones/market-data-sanity-checker#160 ·
メンテナーはふだん 1 日以内に返信