Enforce level-aware skill capability contracts and agent-safe projections by Trecek · Pull Request #4345 · TalonT-Org/AutoSkillit

Trecek · 2026-07-24T04:45:48Z

Summary

This change separates machine-authoritative skill capability contracts from model-facing skill documents, validates exact execution-role ownership, resolves project-local overrides consistently, and persists the effective contract and projected document across resumed sessions. It also closes the follow-up audit findings by using effective project-root resolution during LLM triage and doctor checks, aligning projection and subprocess cwd, and adding regression coverage for override identity, role validation, fresh-versus-resume guards, and contract persistence.

Requirements

Parse and validate capabilities as typed, exact-role contracts.
Keep machine authority metadata out of model-facing projections.
Preserve effective source identity across routing, projection, execution, and resume.
Resolve project-local overrides consistently in triage and diagnostics.
Keep fresh-only validation out of resumed execution paths.

Closes #4332

Implementation Plan

Plan file: /home/talon/projects/generic_automation_mcp/.autoskillit/temp/rectify/rectify_run_skill_capability_contract_immunity_2026-07-22_201946.md

🤖 Generated with Claude Code via AutoSkillit

Trecek

AutoSkillit PR Review — Verdict: approved

Trecek

AutoSkillit review passed. No blocking issues found.

Trecek

AutoSkillit PR Review — Verdict: changes_requested

Trecek

AutoSkillit review: blocking findings detected. See inline comments.

Trecek

AutoSkillit PR Review — Verdict: changes_requested

Trecek

AutoSkillit review: blocking findings detected. See inline comments — changes required.

Trecek

AutoSkillit PR Review — Verdict: changes_requested

Trecek

AutoSkillit review — Verdict: changes_requested. Blocking and warning findings were detected; see the inline comments for required changes.

Trecek

AutoSkillit PR Review — Verdict: changes_requested

Trecek

AutoSkillit review: blocking findings detected. See inline comments — automated verdict: changes_requested. GitHub does not allow an author to request changes on their own PR.

Trecek

AutoSkillit PR Review — Verdict: approved_with_comments

Trecek

AutoSkillit review: warning-only findings detected. See inline comments — no blocking changes required.

Trecek commented Jul 24, 2026

View reviewed changes

Comment thread src/autoskillit/server/tools/_execution_helpers.py

Comment thread src/autoskillit/workspace/skills.py Outdated

Comment thread src/autoskillit/server/tools/_execution_helpers.py

Comment thread src/autoskillit/workspace/skills.py

Trecek commented Jul 24, 2026

View reviewed changes

Trecek added 18 commits July 24, 2026 17:44

test: define skill capability contract immunity

0de31aa

feat: add exact skill execution contracts

cddad0c

feat: resolve effective skill invocations

544ea33

feat: bind resumable skill session contracts

808b48a

feat: validate semantic skill capabilities

45df8fa

feat: project agent-facing skill documents

13f04bd

test: verify skill capability contract immunity

4b4e51a

fix: bind skill dispatch to persisted capability contracts

2285cbc

fix: close skill capability contract audit gaps

5349e26

fix: complete skill capability contract remediation

4eaa41d

fix: close capability contract audit findings

7a75c5d

fix: complete capability contract audit remediation

9d07920

fix: close remaining capability contract audit gaps

19b3135

fix(review): freeze persisted digest authority

f4addc4

fix(review): validate persisted boolean authority

0ba7346

fix(review): restore persisted resume command

8b345b4

fix(review): preserve resumed closure write scope

223a124

fix(review): encapsulate skill contract lifecycle

ea2d237

Trecek added 21 commits July 24, 2026 17:48

fix(review): derive direct dispatch authority from contract

2f7ac7c

fix(review): reject malformed persisted booleans

440d6c6

fix(review): invalidate malformed direct skill contracts

5c297b7

fix(review): include namespace sources in projection cache key

5a5baaa

fix(review): rebuild invalid projection cache entries

6e1bd12

fix(review): type skill authority across core boundary

330b8d7

fix(review): align authority fixtures and stub

4f73b49

fix(review): deduplicate internal skill overrides

4283f01

fix(review): attest materialized projection bytes

fe4c739

fix(review): render cross-skill backend sigils

c77e5a6

fix(review): contain project skill search roots

993f2e6

fix(review): fail closed on override I/O errors

3e10f10

fix(review): classify every git commit form

60c87c6

fix(review): classify GitHub write variants

b77bae9

fix(review): preserve workspace source budget

8bf7ff3

test(review): keep projection coverage layer-safe

832c86c

fix(review): ignore prohibited capability examples

189c003

fix(review): reject non-object persisted skill contracts

75d56af

fix(review): enforce SkillInfo source identity coherence

2b8bd87

fix(review): type skill visibility at composition boundaries

7dbfc5a

fix(review): satisfy typed visibility integration contracts

b2a106f

Trecek force-pushed the impl-rectify_run_skill_capability_contract_immunity_2026-07-22_201946-20260722-223229 branch from 0799ffc to b2a106f Compare July 25, 2026 00:51

Trecek enabled auto-merge July 25, 2026 01:04

Trecek added this pull request to the merge queue Jul 25, 2026

Merged via the queue into develop with commit c4317b4 Jul 25, 2026
3 checks passed

Trecek deleted the impl-rectify_run_skill_capability_contract_immunity_2026-07-22_201946-20260722-223229 branch July 25, 2026 01:19

Uh oh!

Conversation

Trecek commented Jul 24, 2026

Summary

Requirements

Implementation Plan

Uh oh!

Trecek left a comment

Choose a reason for hiding this comment

Uh oh!

Trecek left a comment

Choose a reason for hiding this comment

Uh oh!

Trecek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Trecek left a comment

Choose a reason for hiding this comment

Uh oh!

Trecek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Trecek left a comment

Choose a reason for hiding this comment

Uh oh!

Trecek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Trecek left a comment

Choose a reason for hiding this comment

Uh oh!

Trecek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Trecek left a comment

Choose a reason for hiding this comment

Uh oh!

Trecek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Trecek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers