Skip to content

[Phase 2] Immutable registry and publishing CLI/CI #34

Closed
Closed
[Phase 2] Immutable registry and publishing CLI/CI#34
Assignees
mrgoonie
Labels
enhancementNew feature or requestshippedMerged/deployed

Description

@mrgoonie
mrgoonie
opened on Sep 21, 2026

Depends on

Objective

Move SkillX from GitHub registration to immutable reproducible package releases.

Contracts come from Phase 0/1. Package-format work may begin after Phase 0.

Scope

  • Deterministic artifact format.
  • R2 artifact storage.
  • Publisher namespace ownership.
  • import vs publish semantics.
  • validate, pack, publish, promote.
  • CI trusted/scoped publishing.
  • Quarantine/review/yank lifecycle.
  • Entitlement-aware artifact resolution.

Implementation tasks

  • Define archive layout and path safety constraints.
  • Implement deterministic packer + SHA-256.
  • Store immutable artifacts in R2.
  • Add package/release registry APIs.
  • Add publisher profiles/namespaces.
  • Add namespace authorization.
  • Rename/deprecate old GitHub publish semantics toward import.
  • Implement skillx validate.
  • Implement skillx pack.
  • Implement release skillx publish.
  • Implement skillx promote.
  • Add publish idempotency keys.
  • Add CI-scoped publisher credentials.
  • Evaluate/implement GitHub OIDC trusted publishing.
  • Add quarantine and review state.
  • Add yanking and release-resolution policy.
  • Add authorized signed/short-lived artifact download flow.
  • Publish one standalone AgentKit skill manually.
  • Publish same AgentKit artifact through CI.

Acceptance criteria

  • Same version cannot receive different bytes.
  • Manual/CI publish of same input resolves to same digest.
  • Retried publish is safe.
  • Publisher token cannot change commerce/account state.
  • One AgentKit standalone skill is published without altering ak installer behavior.

Activity

  1. mrgoonie
    added
    enhancementNew feature or request
    on Sep 21, 2026

  2. zuey-cloud-harness commented on Oct 11, 2026

    @zuey-cloud-harness
    zuey-cloud-harnessBot
    on Oct 11, 2026 – with Zuey Cloud Harness

    Child delivery slice: #54, AgentKit foundation publishing and pinned whole-tree artifact resolution. Contract counterpart: https://github.com/bestagentkits/agentkit/issues/2275; consumer https://github.com/bestagentkits/agentkit/issues/2277; E2E https://github.com/bestagentkits/agentkit/issues/2282. Acceptance includes nested assets/modules/scripts/references (#21), deterministic SHA-256 same manual+CI release, immutable version, namespace/scoped publisher, quarantine/yank/private entitlements and non-execution during read. This #34 continues to own generic registry primitives; #54 does not duplicate them. Umbrella https://github.com/bestagentkits/agentkit/issues/2274.

  3. mrgoonie
    added
    in progressBeing worked on
    on Oct 19, 2026
  4. mrgoonie
    self-assigned this
    on Oct 19, 2026
  5. mrgoonie
    added
    in reviewPR under review
    and removed
    in progressBeing worked on
    on Oct 19, 2026

  6. mrgoonie commented on Oct 21, 2026

    @mrgoonie
    mrgoonie
    on Oct 21, 2026
    ContributorAuthor

    Production receipt (2026-10-20/21)

    Delivered by #99 (squash 5fc3077, 3 isolated review rounds):

    • skillx import, with publish kept as a deprecated alias.
    • Top-level validate, pack, publish and promote.
    • Idempotency-Key on publish: bound per publisher, with a 24 h replay.
    • Operator review and quarantine.
    • Signed, short-lived download URLs.
    • GitHub OIDC trusted publishing, which exchanges the Actions JWT for a short-lived namespace-scoped token.
    • The publish-agentkit-foundation.yml workflow.

    The CLI exit codes and envelope were unified in #97.

    Production setup

    • Migration 0018 (registry_publishing) was applied after a D1 Time Travel bookmark.
    • SKILLX_TOKEN_SECRET is set on the worker.
    • Publisher bestagentkits has a key scoped to releases:publish:@bestagentkits and the trusted publisher tp_dd0997c9. The trusted publisher is bound to repo nextlevelbuilder/skillx (id 1154190512), the workflow .github/workflows/publish-agentkit-foundation.yml, refs/heads/main, and environment skillx-publish.
    • The skillx-publish environment requires owner approval and accepts main only. It holds the fallback key and a read-only PAT for the private AgentKit repo.

    Same skill published manually and by CI, same digest

    Manual (CLI from main, scoped key) CI (run 39363637901, OIDC)
    Source kits/core/skills/ak-plan at AgentKit f8e2da556c1e19dd5e53934304d7fcce4c0974a0 same commit and path
    Identity @bestagentkits/plan@0.1.0, beta same
    releaseDigest sha256:08b0fce1b56819e0e85f9edcc479432f4f3e56c0a79c9f91c95e58fe84cbac65 sha256:08b0fce1b56819e0e85f9edcc479432f4f3e56c0a79c9f91c95e58fe84cbac65
    Result created: true, state published pack matched expected-digest before upload; the registry answered with the same digest, state published; no fallback to the API key

    The digest also equals AgentKit's own skilltree.Build digest of that directory.

    The MCP get_release on production returns this release with the same digest.

    Naming: foundations publish as @bestagentkits/<slug> because skillx.release/v1 reserves @agentkit/* and ak- slugs. AgentKit consumes them as skillx:bestagentkits/<slug>.

    The CLI ships to npm when the next release-please PR merges.

  7. mrgoonie
    added
    shippedMerged/deployed
    and removed
    in reviewPR under review
    on Oct 21, 2026
  8. mrgoonie
    closed this as completedon Oct 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

enhancementNew feature or requestshippedMerged/deployed

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions