Repository navigation
Support authenticated GitHub skill profiles and preserve local authoring updates - #23
Merged
Merged
Conversation
Honor existing authorization during guidance refreshes and distinguish source-evidence ranking from governing instructions and user scope. These clarifications prevent procedural wording from introducing redundant approval boundaries. Make narrow authoring reviews record changed criteria and material findings while preserving applicable checks. Require model, reasoning, harness, and simulation provenance so evaluation claims reflect observable evidence. Add three paired decision scenarios and preserve their frozen inputs, runtime hashes, and six responses. Both versions passed all cases; the candidate produced a shorter review record in one observation, without establishing general performance or live integration reliability. Validation: catalog and links, local skill discovery, Skill Creator validation, whitespace and evaluation artifact checks passed. A bounded independent review found no actionable issues, and affected documentation was reconciled. Next-goal runtime and invocation policies remain unchanged.
Preserve seven unpublished private skill registrations while retaining upstream Darty, development profiles, and v1.2 reconciliation behavior. Align canonical and embedded registries and update contract expectations to 50 entries. Keep this as an unmerged recovery branch: private entries currently extend kicpa, which conflicts with the selected kicpa-private authentication design. Record that boundary and the full recovery stash before further integration. Targeted Go contracts and all 12 Node registry/wrapper tests pass; private materialization is not validated.
Preserve local skill-authoring commit f689e91 and merge PR 22 tip e1529ff, which already includes origin/main at 143a340 and both dev histories. The common base is e6c7e48. Git merged the disjoint changes without conflicts; the residual authoring patch exactly matches the local commit. Keep private KICPA registrations as unfinished draft work on codex/combine-local-origin-pr22. Authentication and the separate private profile remain required before promotion to main or release. Retain all source commits and refs, and clarify this delivery boundary in progress and registry documentation. Validation: full Go suite and go vet, 21 Node registry/wrapper/hook tests, six Python release tests, skill and registry validation, whitespace checks, and one independent bounded merge review passed on macOS. Private materialization and cross-platform acceptance are not established by this integration.
Publish the combined local and PR 22 history for visibility while retaining the private-authentication completion gate before main. Preserve the original recovery branch and local main. Bounded documentation review confirms this changes delivery status only; the private-source plan remains the completion authority.
Keep the public KICPA profile unchanged and move recovered private registrations into kicpa-private. Carry validated access policy through profiles, direct declarations, resolution, discovery, fetch batching, snapshot identity, and review comparison. Missing access remains public, including older approved global plans; installed ownership continues to use the original remote source. Fetch authenticated selections through one controlled HTTPS Git clone and an exact-repository gh credential bridge, then use the pinned Skills CLI local discovery path. This avoids its implicit gh/SSH fallbacks. Disable redirects, other protocols, inherited Git helpers/configuration and tracing. Bound the private credential pipe, suppress external auth diagnostics, and retain process-tree cleanup. Refuse legacy gh configuration before it can migrate; token login uses version-only temporary configuration. Add Go/JavaScript policy tests and native controlled Git/gh CLI acceptance for mixed install/update/no-op/quarantine/restore, source ownership, credential denial and secrecy, token login, cancellation and timeout. Add YAML parsing to validate the gh migration guard without inventing a partial parser. Update operator docs, the delivery plan, and the maintenance plugin bundle/cachebuster. Validation: full Go suite and race suite, go vet, Node registry/wrapper/hook tests, release tests, skill validation, and isolated plugin schema/install/reinstall checks passed on macOS. Independent bounded review found no implementation defect; its requested full authentication-process cancellation tests were added and passed. Supported hosted native acceptance remains the pre-merge gate. No release or real-machine onboarding is included.
sjunepark
changed the title
sjunepark
marked this pull request as ready for review
September 10, 2026 13:24
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Record the implementation commit and successful source/build/native CI on macOS Intel, macOS ARM, and Windows. Link PR 23 as the authority for final merge status, avoiding stale pending-work claims after landing. Clarify that CodeRabbit skipped its requested review and that the independent review and follow-up acceptance passed. Release and machine onboarding remain outside this delivery.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 84ba2e7f65
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Fetch full commit hashes explicitly into a detached checkout because clone --branch accepts only named refs. Preserve branch and tag clone semantics, bounded process containment, and the existing credential restrictions; never substitute default-branch content for a rejected pin. Reject unsupported GitHub page suffixes consistently in Go and JavaScript, and apply authenticated-source validation only to Skills CLI entries so manual and workflow managers remain skippable. Reproduce all three review findings with regression coverage, including an actual CLI install of an older local Git commit. Isolate fixture Git configuration from user signing settings. Align the registry contract and delivery evidence. Full Go and race suites, vet, Node registry tests, skill validation, and bounded independent review passed.
sjunepark
added a commit
that referenced
this pull request
Sep 10, 2026
Advance the embedded minor version for explicit private GitHub skill selections delivered by PR #23. Publish only artifacts that pass the tagged native reconciliation and installer matrix; retain the authenticated administrator publication path while hosted permissions remain limited.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Projects can now select authenticated GitHub skills without making the public KICPA profile require private access.
kicparetains its public members;kicpa-privatecontains the seven recovered registrations from #22. Profiles and direct declarations carry explicit access policy, and profile discovery reports the requirement.Authenticated selections use a controlled HTTPS Git operations with a repository-scoped gh credential helper, followed by the pinned Skills CLI local discovery path. This avoids the CLI's implicit authentication fallbacks. Existing public fetching, remote-source ownership, quarantine, and restore behavior are preserved; access changes invalidate fetch and review evidence.
The branch also retains the local skill-authoring improvements and every source commit from the original integration. #22's source tip is included in this PR.
Validation
go vet ./...passed on macOS.cad1bf2: full commit pins install exact content, unsupported GitHub page URLs are rejected, and manual/workflow entries remain skippable. Each has regression coverage.cad1bf2: CI run.Operator boundaries
Authenticated selections require Git, gh, and existing repository access. Legacy gh configuration is refused before gh can migrate it; environment-token login uses isolated version-only configuration. Unknown host/access values fail before fetching. Older binaries may reject the new fields, so private selections require a supporting build.
This change does not publish a release, install actual private skills, reconcile a real machine, or perform login/account setup. No live private-GitHub smoke test was used; automated acceptance uses controlled fixtures. The implementation and delivery evidence are in
plans/sjskills-private-github-sources.md.Initial CodeRabbit review was requested with
coderabbit-review, but CodeRabbit skipped it because automatic reviews are disabled. The independent review and Codex feedback are complete; all three review threads are addressed.