[tracisiebel]

Summary

From Traci:
Caseware is using skills and they mentioned that

The SDK docs say skill content is delivered only through FDv2 (FDv2SkillStore), and that we'd get a 403 if FDv2 isn't enabled for our account.

I want to clarify that it is enabled for all accounts

FDv2SkillStore's 403 message and the README's beta caveat said FDv2 is "opt-in per account" and told users to ask support to enable it. That's no longer true. In production, fdv2-protocol-control allows /sdk/poll and /sdk/stream for every account under its "Server Side SDKs (GA)" rule. A customer recently asked us to "enable FDv2" because of this wording.

• FORBIDDEN_ADVICE now tells the user to check that the SDK key is the environment's server-side key and that no proxy in between is refusing the request, then to contact support.
• The README caveat now says that an account without Agent Skills access gets no skill content rather than an error status. This matches gonfalon: when SkillDeliveryAllowed is false, the skill payload is left out of the assignment and no error is returned. The ld-relay caveat is unchanged.
• The 403 test now asserts on the new wording.

How to test

npx vitest run src/__tests__/skills-fdv2.test.ts -t 403 from packages/client. Also ran make code-check.

Link to Devin session: https://app.devin.ai/sessions/86607bf5a72840ac922a278d08236eb9
Open in Devin Desktop: https://app.devin.ai/desktop/session/86607bf5a72840ac922a278d08236eb9?variant=devin
Requested by: @tracisiebel

---

Note

Overview
Updates FDv2 skill delivery docs and fatal HTTP 403 handling to match current LaunchDarkly behavior: SDK-facing FDv2 endpoints are no longer described as opt-in per account.

FORBIDDEN_ADVICE in skills-fdv2.ts now tells operators to verify the environment server-side SDK key and check for a proxy blocking the request before contacting support, instead of asking LaunchDarkly to enable FDv2. The README beta caveat is aligned: accounts without Agent Skills get empty skill content rather than a product error; 403 still surfaces as a fatal error with the revised guidance. The 403 integration test asserts the new proxy wording.

^{Reviewed by Cursor Bugbot for commit cb9e3a4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring