q792602257andClaude Opus 4.6
dd03abbbb0
Opens the skill-management-console openspec change (cloud/local skill split with local override) with proposal, design (D1-D11), four delta specs, and tasks. Implements the agent-side persistent local skill store (storage/local_skills.py): authored local skills + cloud-skill overrides in a physically separate SQLite file, with fork-on-revocation. 10 tests pass. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
5.6 KiB
ADDED Requirements
Requirement: Administrators manage cloud-origin skills in the Cloud platform database
The Cloud Control Plane SHALL persist administrator-managed cloud-origin Skills (both knowledge and flow_template kinds, reusing the shared Skill metadata model) in the Cloud platform database, and SHALL expose authenticated, CSRF-protected, scope-guarded operations to list, create, update, and delete them. A cloud skill's metadata and content SHALL be validated before persistence; invalid input SHALL be rejected without partial writes.
Scenario: Administrator creates a cloud skill
- WHEN an authorized administrator submits a valid cloud skill (kind, name, model/model-agnostic content, tags, and for flow templates steps and a parameters schema)
- THEN the Cloud Control Plane persists it in the Cloud database and returns its non-secret metadata
Scenario: Invalid cloud skill is rejected
- WHEN an administrator submits a cloud skill with a blank name, unsupported kind, malformed flow-template steps, or duplicate name
- THEN the Cloud Control Plane rejects the write without creating or changing a skill
Scenario: Non-administrator attempts to mutate a cloud skill
- WHEN a principal without the cloud-skill admin scope invokes a cloud-skill mutation endpoint
- THEN the Cloud Control Plane rejects the request before reading or modifying any cloud skill
Requirement: Cloud skills are entitled per host
The Cloud Control Plane SHALL scope each cloud skill's visibility to the set of hosts it is explicitly entitled to, via a skill×host entitlement mapping that administrators manage. An agent SHALL receive, via sync, only the cloud skills entitled to its own host; a skill entitled to no hosts (or to other hosts only) SHALL NOT be visible to that agent.
Scenario: Administrator grants entitlement to a host
- WHEN an authorized administrator entitles a cloud skill to a specific host
- THEN that host's next sync may include that skill, and hosts not entitled never receive it
Scenario: Administrator revokes entitlement from a host
- WHEN an authorized administrator revokes a cloud skill's entitlement to a host
- THEN that host's next incremental sync reports the skill as removed for that host
Requirement: Cloud serves incremental per-host sync deltas
The Cloud Control Plane SHALL expose a host-scoped endpoint (authenticated with the same host-scoped bearer credential used for heartbeat and planner-decision) that returns an incremental delta of that host's entitled cloud skills. The Cloud SHALL maintain a monotonic per-host entitlement version that advances on any change to that host's entitled set or to an entitled skill's content, and SHALL accept a since_version parameter: when present and still servable, the response carries only upserted skills, removed_ids, and the new latest_version; when absent or too old, the response is a full replace of that host's entitled set.
Scenario: First sync is a full replace
- WHEN an agent syncs its host without a
since_version - THEN the Cloud Control Plane returns the host's full entitled set marked as a full replace, plus the current entitlement version
Scenario: Incremental sync returns only changes
- WHEN an agent syncs its host with a recent
since_versionand entitlements or skill content have changed since - THEN the Cloud Control Plane returns only the upserted skills and
removed_idssince that version, plus the newlatest_version
Scenario: Sync request from a foreign or unauthenticated host is rejected
- WHEN a sync request omits valid host-scoped credentials or presents credentials bound to a different host
- THEN the Cloud Control Plane rejects it without disclosing any skill content
Requirement: Agents report their local-skill inventory to the Cloud
The Cloud Control Plane SHALL accept a best-effort, host-scoped, read-only inventory of an agent's local skills (authored skills and active overrides, metadata only — no secrets), so the Console can display per-host local skills. A failed or absent inventory report SHALL NOT impair the agent's local operation or its entitlement to cloud skills.
Scenario: Agent reports its local inventory
- WHEN an agent submits its local-skill inventory over the host-scoped channel
- THEN the Cloud Control Plane records the reported metadata keyed by host, without persisting any secret or full-content obligation
Scenario: Inventory report failure is non-fatal
- WHEN an agent's inventory report cannot be delivered or is rejected
- THEN the agent's local skills, authoring, and sync behaviour are unaffected
Requirement: Cloud Console provides a skill management surface
The Cloud Console SHALL provide an administrator-only view to create, edit, and delete cloud skills, to assign and revoke per-host entitlement, and to view each host's reported local-skill inventory (read-only). Mutating actions in the Console SHALL go through the same scope-guarded, CSRF-protected Cloud API endpoints as direct API use.
Scenario: Administrator manages cloud skills and entitlements in the Console
- WHEN an administrator opens the Skills management view
- THEN they can create/edit/delete cloud skills, assign or revoke per-host entitlement, and see each host's reported local skills, all through the admin-authenticated Console
Scenario: Read-only observer of local inventory
- WHEN an administrator views a host's local-skill inventory in the Console
- THEN the inventory is displayed read-only with no ability to mutate an agent's local skills from the Console