feat(skill-sources): Phase B — fetch/pin/symlink wiring for trusted external skill sources#707
Merged
Merged
Conversation
…xternal skill sources Makes the trusted-external-skill-sources feature runnable (Phase A landed the design, formats, and validator in apache#677): - New /magpie-setup skill-sources sub-action (skills/setup/skill-sources.md): read the adopter trust list, fetch+verify each source into the gitignored .apache-magpie-sources/<id>/ reusing the framework install recipes, write the two source locks, and symlink the provided skills exactly like framework skills (canonical + relay, magpie- prefixed). - Two source locks: committed .apache-magpie.sources.lock (per-source pins) + gitignored .apache-magpie.sources.local.lock (per-machine fetch), same drift model as the framework snapshot. - Fold into adopt (Step 8b + .gitignore block), upgrade (Step 6f re-fetch + source drift), verify (check 10 source health), worktree-init (share the source snapshot). SKILL.md registers the sub-action, dispatch, locks. - symlink-lint prunes .apache-magpie-sources/ (a build artefact like the framework snapshot); regression test added.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Makes the trusted external skill sources feature runnable. Phase A (RFC-AI-0006, PRINCIPLES §13 carve-out, formats, validator) landed in #677; this is Phase B — the fetch / pin / symlink mechanism, per
docs/skill-sources/README.md.An adopter lists a source in
<project-config>/skill-sources.md(the install gate) and commits its pin;/magpie-setup skill-sourcesthen fetches it into a gitignored snapshot and wires its skills in so they behave exactly like in-tree framework skills — samemagpie-symlink relay, same override layer, same eval binding.What's included
skills/setup/skill-sources.md(/magpie-setup skill-sources): read trust list → fetch+verify into.apache-magpie-sources/<id>/(reusing the framework install recipes verbatim) → write both source locks → symlink the provided skills (canonical + relay)..apache-magpie.sources.lock(per-source pins) + gitignored.apache-magpie.sources.local.lock(per-machine fetch).adopt(Step 8b +.gitignoreblock),upgrade(Step 6f re-fetch + source drift),verify(check 10 source health),worktree-init(share the source snapshot).SKILL.mdregisters it all..apache-magpie-sources/(a build artefact like the framework snapshot); regression test added.Verification
symlink-lint+skill-and-tool-validatorpytest green (incl. new prune test); Phase A validator tests unchanged and green.prekclean on all changed files — markdownlint, lychee (every new cross-reference/anchor resolves), mypy, workspace pytest,skill-and-tool-validate.Notes
source.md), now locked in by Phase A.🤖 Generated with Claude Code