Skip to content

Update: product-verified catalog skill content - #13

Merged
0xLeif merged 5 commits into
mainfrom
leif/skills-v0-2-lifecycle
Aug 2, 2026
Merged

0xLeif merged 5 commits into
mainfrom
leif/skills-v0-2-lifecycle

Conversation

@0xLeif

@0xLeif 0xLeif commented Aug 2, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • Rebases onto latest main (provider hosts + managed lifecycle from Add OpenAI provider integration #11/Fix Skills provider review findings #12).
  • Re-audits all 15 public skills against live product CLIs and CorvidLabs repos.
  • Fixes inaccurate commands and guidance (Atlas --gaps, Attest export, public Rune surface, Spec Sync accept→merge→archive, agent-3md crates.io lag, Augur/Attest macOS plugin notes, Let dual-path discovery).
  • Slims agent-coordination as a hub and keeps host OpenAI prompts on $skill-name form.

Test plan

  • fledge run plugin-validate
  • fledge run lint
  • fledge run test (installer tests passed)
  • Spot-check skill examples against live fledge let|rune|augur|attest|atlas --help and specsync --help
  • Confirm no private paths or secrets in skill content

Cross-check every catalog skill against live Fledge plugins and product
repos, then fix wrong flags, lifecycle guidance, install paths, and host
prompt stubs so agents get accurate public commands.
@0xLeif
0xLeif force-pushed the leif/skills-v0-2-lifecycle branch from 69869e3 to 29470d3 Compare August 2, 2026 03:14
@0xLeif 0xLeif changed the title Update: skills lifecycle and product-verified skill content Update: product-verified catalog skill content Aug 2, 2026
Clarify that catalog skills install via fledge-plugin-skills, while product
CLIs use separate Fledge plugins (let, rune, augur, attest, atlas) or
standalone installs (specsync, threemd, agent3md) when they are not plugins.
@chatgpt-codex-connector

Copy link
Copy Markdown

💡 Codex Review

[[ "$state" == "current" ]] || fail "refusing to update $skill on $host: state is $state"

P1 Badge Detect metadata changes before replacing managed copies

The current gate is not sufficient to make the subsequent replacement safe because directory_digest hashes only regular-file contents; permission changes, added symlinks, and empty directories are invisible. For example, after changing an installed SKILL.md from mode 0644 to 0600, status still reports current and update silently replaces it with a 0644 copy; added symlinks or empty directories are likewise deleted. Include all removable filesystem state in the digest/check before allowing update or uninstall.


done < <(manifest_rows "$manifest")

P2 Badge Propagate manifest parsing failures from status

Because manifest_rows runs in process substitution, its nonzero exit status is ignored by the while loop. When a repository has an unsupported or corrupt manifest—for example, schema version 999 with recorded installs—status --json exits 0 and emits a schema-version-1 manifest with an empty installs array, despite printing an error to stderr. This can make automation conclude that nothing is installed; capture and validate the producer's status before producing status output.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

0xLeif added 3 commits August 1, 2026 21:29
Skills assume they are already loaded. Document only product CLI/plugin install
where relevant. README clarifies per-skill install (no install --all).
Document agent-coordination + fledge-workflows as the default install set;
product skills stay opt-in per tool.
Support installing, status, update, and uninstall under \$HOME (or
\$CORVID_SKILLS_HOME) for agent host skill dirs, tracked in
~/.corvid-skills.json. Document and test the new scope.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cd36546d75

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread bin/corvid-skills
local is_global="$1"
local repo_arg="$2"
if [[ "$is_global" == "true" ]]; then
[[ "$repo_arg" == "." ]] || fail "--global cannot be combined with --repo"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reject explicit --repo . with --global

When a caller explicitly supplies --repo . --global, repo_arg is indistinguishable from its default value, so this check passes and the command silently targets $HOME instead of rejecting the conflicting scope flags. For install, update, and uninstall, this can mutate machine-global skills when the caller intended repository-local operation; track whether --repo was provided rather than comparing its value with ..

Useful? React with 👍 / 👎.

Comment thread README.md
Comment on lines 119 to +120
fledge skills uninstall augur --dry-run
fledge skills uninstall augur
fledge skills uninstall augur --global

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preview the same scope before global uninstall

Following this documented preview-and-remove sequence checks the repository-local manifest during the dry run, but then removes the machine-global installation in the next command. When augur exists in both scopes, the preview provides no evidence about the copy that will actually be deleted; add --global to the dry-run command (or keep both commands repository-local).

Useful? React with 👍 / 👎.

@0xLeif
0xLeif merged commit 9cce6ae into main Aug 2, 2026
3 checks passed
@0xLeif
0xLeif deleted the leif/skills-v0-2-lifecycle branch August 2, 2026 16:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant