[Phase 3] Personal kits, installer, lockfile and multi-device sync #35

Activity

1. mrgoonie

   added

   enhancementNew feature or requestNew feature or request

   on Sep 21, 2026
2. zuey-cloud-harness commented on Oct 11, 2026

   

   zuey-cloud-harnessBot

   on Oct 11, 2026 – with Zuey Cloud Harness

   More actions

   Child slices: #55 personal-kit lineage, structured overlays and conflict-safe B0/U0/B1 rebase; #56 reviewed private patches from local sessions. AgentKit local counterparts https://github.com/bestagentkits/agentkit/issues/2278 (composer and atomic apply), https://github.com/bestagentkits/agentkit/issues/2281 (consented evolution), https://github.com/bestagentkits/agentkit/issues/2276 (owned projections). Require digest-pinned lock/revisions, CAS, permissions/dependency/semantic conflict blocking, rollback, no secret or absolute path sync, and paid/private foundation license preservation. Keep SkillX generic installer separately from AgentKit Go lifecycle. Umbrella https://github.com/bestagentkits/agentkit/issues/2274.
3. mrgoonie

   self-assigned this

   on Oct 19, 2026
4. mrgoonie

   added

   in progressBeing worked onBeing worked on

   in reviewPR under reviewPR under review

   and removed

   in progressBeing worked onBeing worked on

   on Oct 19, 2026
5. mrgoonie

   added 2 commits that reference this issue on Oct 19, 2026

   feat(collections): collections API with immutable revisions, clone an…

   ...

   b07481f

   feat: collections API and verified CLI installer with lockfile, sync …

   ...

   2c5a892
6. mrgoonie commented on Oct 20, 2026

   

   mrgoonie

   on Oct 20, 2026

   ContributorAuthor

   More actions

   Production receipt (2026-10-20)

   Delivered by

   • feat: collections API and verified CLI installer with lockfile, sync and local MCP (#35 phase 3) #98 (squash 2c5a892, 4 isolated review rounds): collections API, resolver, skillx.lock.json, atomic install/update/uninstall with receipts and per-runtime owners (ref-count requiredBy), preservation of locally modified files, sync --locked, local stdio MCP (skillx mcp; apply requires confirm + planDigest), Claude Code adapter then Codex adapter, and interruption tests (apps/web/tests/install/install-recovery.test.ts: 5 crash points × update/first install, rerun converges).
   • feat(web): enable personal kits and collections APIs in production #112 (5c1f879): SKILLX_COLLECTIONS_API set to "1". Rollback: set "0" and redeploy; routes answer 404.
   • feat(web): per-account collection cap and admin moderation for collections #115 (dfcb3f1): per-account collection cap and admin moderation (feat(web): per-user collection cap and moderation plan for public collections #114). Migration 0020 is applied in production.
   • Production D1 has 0019 and 0020 applied, each after a Time Travel bookmark. The worker is now at version 7d29ff0a (main 79f98fb).

   Smoke A → B (production registry, CLI built from main)

   • Isolation. Two machines with fresh temp roots. Every home, config and cache variable the CLI reads was set to the machine's root: HOME, USERPROFILE, APPDATA, LOCALAPPDATA, XDG_*, SKILLX_HOME, CLAUDE_CONFIG_DIR, CODEX_HOME, TEMP. No real user state was touched.
   • Signing key. The registry key was trusted via trusted-keys.json. Key id 993cd14a011f7b76 was cross-checked against /api/v1/keys.
   • Machine A.
     • Created an unlisted collection smoke-2610200943 with @bestagentkits/plan@0.1.0 (API).
     • Installed it for Claude Code: exit 0, receipt written.
     • Lockfile check: 0 absolute paths and 0 secret matches.
   • Machine B.
     • Copied only the lockfile and ran sync --locked: exit 0.
     • 23/23 installed file hashes are identical to A's.
     • lockDigest sha256:07c9fe3c… is equal on both machines, and the lock file is byte-identical.
   • Update and uninstall (A).
     • update was a no-op: lock and receipt unchanged.
     • uninstall removed 22 files, kept the locally modified file (keptModified) and the unknown file (keptUnknown), and left owners empty.
   • Cleanup. The smoke collection was deleted (200, then 404).

   Full receipts (secrets redacted) are in plans/reports/smoke-261020-prod-personal-kits-install.md in the delivery workspace.

   Open

   • The CLI ships to npm when the next release-please PR merges.
   • Follow-up: skillx update in human mode prints nothing when nothing is installed. It is low priority and tracked separately.
7. mrgoonie

   added

   shippedMerged/deployedMerged/deployed

   and removed

   in reviewPR under reviewPR under review

   on Oct 20, 2026
8. mrgoonie

   closed this as completedon Oct 20, 2026