Skip to content
This repository was archived by the owner on Jul 29, 2026. It is now read-only.
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .agents/skills/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ Installed skills:
- `test-build/` — test contract metadata blocks
- `meta-module-build/` — metadata-first module scaffolding
- `manifest/` — living-spec generator for `CLAUDE.md` (vendored from
`The-Interdependency/skill-lib@546b45b`). Generates the mechanical facts
`The-Interdependency/skill-lib@d6e4d78`). Generates the mechanical facts

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Restore the final vendoring SHA

This points the manifest skill provenance at an earlier re-vendor commit, but the merge commit that introduced the skill has a later ci(manifest) step that says the checksum is identical to skill-lib@546b45b and that it bumped the source ref. Since manifest/SKILL.md tells reviewers to verify generate.py.sha256 against the recorded SHA, recording d6e4d78 sends future updates/audits to the wrong upstream version and reintroduces the provenance mismatch this README entry was meant to prevent.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@codex[agent] repair

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary

  • Restored the manifest/ skill provenance entry to the final vendoring SHA, The-Interdependency/skill-lib@546b45b, addressing the review feedback that d6e4d78 pointed at the earlier re-vendor source rather than the later recorded source ref.
  • Committed the fix as 4ab2e48 (fix(docs): restore manifest vendoring SHA) and created a follow-up PR.

Testing

  • cd .agents/skills/manifest && sha256sum -c generate.py.sha256
  • python .agents/skills/manifest/generate.py --pyproject backend/pyproject.toml --check
  • git diff --check

View task →

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Restore the final manifest source SHA

The merge commit that introduced this skill first mentions d6e4d78, but its final ci(manifest) step says the pinned checksum is identical to skill-lib@546b45b and the README introduced by that merge recorded 546b45b. Since manifest/SKILL.md tells maintainers to verify the vendored generate.py.sha256 against the recorded source SHA, changing this line to the earlier re-vendor commit sends future audits to the wrong upstream artifact.

Useful? React with 👍 / 👎.

block in `CLAUDE.md` from `backend/pyproject.toml` + the tree; the
`manifest drift check` workflow runs `generate.py --check` in CI. Refresh with
`python .agents/skills/manifest/generate.py --pyproject backend/pyproject.toml --write`.
Expand Down
Loading