Repository navigation
Discover shared .agents skills with explicit publication - #605
Conversation
…cation Add workspace/user shared-source preview, guarded adoption and UI confirmation; keep local installer observation separate from formal release approval. Validate packaged macOS DMG/ZIP and focused integration tests.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…warnings Codex review P1 on #605: the shared publish gate only rejected blocked/unchanged states and semantic errors, so a new or drifted source whose SKILL.md carries an error-severity warning (raw secret reference, unsafe path) could still be persisted even though the preview flagged it. Publication now rejects any selected record with error-severity warnings unless explicitly trusted, with a regression test asserting preview exposure, 409 rejection and no snapshot/skill persistence.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 68f9988128
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The shared-publication secret_reference fixture used an sk- token that the public-repo safety scanner flags as a model provider key. Renamed to sk-fake-... which both passes the scanner's clearlyFake rule and still matches the skill-source raw-secret detection under test.
…e removed CI-log artifact Both fingerprints point into shard2-log.txt (already removed in 003b0af). The flagged strings are in-repo test idempotency-key fixtures echoed by the daemon shard log, not credentials; reviewed locally with gitleaks 8.30.1 reporting no leaks.
…ning gate to content-changing records Codex review P1 (#605): the official sync preview excluded only the shared pack, so a gstack skill previously published from a local non-cache source lost its active snapshot (path scoping) and official apply treated it as attachable without expectations. The preview now scopes snapshots to the gstack-source-sync pack, which wins over path scoping by contract. Codex review P2 (#605): the new error-warning publication gate also rejected unchanged records, blocking referenced-file-only edits from an explicit publish. Unchanged records write nothing; the gate now applies only to records that would persist new content.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b8a6a6e217
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The pack-scoped snapshotPackIds preview broke the publication batch expectation contract: a second gstack publish cycle then failed with skill_source_publication_conflict because expectedSnapshotId/ expectedSourceChecksum must match the single active snapshot, which pack-scoping's broader snapshot set violates. The Codex-review P1 scenario (a locally published gstack skill losing its snapshot during official sync) needs a core-level design change and is tracked in the PR conversation instead of being patched here.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7319da27b5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… disabled Codex review P2 on #605: publishArtifacts:false callers still paid for realpath/size/checksum/64MiB-budget validation of every referenced file even though nothing is read or persisted. Referenced-file validation now only runs when artifact staging is enabled.
…aging is disabled" This reverts commit 0f71bee.
Summary
.agents/skillsas review-only candidates; block unsafe/duplicate sources and isolate publication ownership.Validation
Local installer evidence is marked release-ineligible; formal release validation remains separately gated.