docs(architecture): define multi-harness skill lifecycle - #306
Draft
davida-ps wants to merge 5 commits into
Draft
Conversation
![baz-reviewer[bot]](https://avatars.githubusercontent.com/in/933528?s=60&v=4){kind=small}
Comment on lines
+41
to
+45
| ## Skill Release Lifecycle | ||
|
|
||
| - Use Semantic Versioning prereleases in this order: `0.x.y-beta.N`, `0.x.y-rc.N`, then `0.x.y`. Never use or publish forms such as `0.x.yrcN`. | ||
| - Once the monotonic signed lifecycle-policy cutover serial is active, beta and RC artifacts plus stable-intent candidate identity, lab manifests, and receipts are private and lab-only. Reject every public prerelease ref not in the cutover policy's frozen legacy-ref/digest allowlist. Preserve allowlisted historical refs as legacy, non-authorized history; they remain fetchable and must not be deleted or rewritten. | ||
| - Deploy each candidate to a matching non-production harness lab. Use only an SSH endpoint explicitly named by the operator; never infer or substitute a hostname or alias. |
Contributor
There was a problem hiding this comment.
Misleading release lifecycle enforcement
.github/workflows/skill-release.yml doesn’t enforce the AGENTS.md cutover/allowlist rules, so alpha|beta|rc tags still get released and publish-clawhub publishes them instead of keeping them private-only. Should we either mark that lifecycle as future policy until the workflow changes, or add the gate/allowlist and drop the same-major gh release delete step?
Want Baz to fix this for you? Activate Fixer
Other fix methods
Prompt for AI Agents
Before applying, verify this suggestion against the current code. In `AGENTS.md` around
lines 41-45 (the “Skill Release Lifecycle” bullets about cutover making beta/RC
artifacts private and rejecting public prerelease refs outside the frozen
legacy-ref/digest allowlist), the guidance is inconsistent with the current automation
in `.github/workflows/skill-release.yml` (prerelease is determined only by tag name
patterns, the `publish-clawhub` job runs for pushed tags, and superseded releases are
deleted). Fix by either (1) updating `skill-release.yml` to enforce the documented
cutover/allowlist gate before prerelease publication and ClawHub publishing, and
removing/adjusting the same-major superseded release deletion so allowlisted legacy refs
are preserved, or (2) if the workflow cannot be updated yet, revise `AGENTS.md` to
explicitly label this section as “future policy / not yet enforced by current CI”
until the workflow changes land.
Comment on lines
30
to
34
| ## Operations | ||
| - [Multi-Harness Suite Design (Proposed)](multi-harness-suite-design.md) | ||
| - [Security Signing Runbook](security-signing-runbook.md) | ||
| - [Signed Feed Migration Plan](migration-signed-feed.md) | ||
| - [Platform Verification Checklist](platform-verification.md) |
Contributor
There was a problem hiding this comment.
Spanish operations index missing new page
wiki/es/INDEX.md doesn't include the new top-level Operations link for Multi-Harness Suite Design (Proposed), so the Spanish index diverges from wiki/INDEX.md and navigation to that page is inconsistent — should we add the same entry there?
Want Baz to fix this for you? Activate Fixer You can also update your AI coding guidelines based on this comment by apply pr to [branch name]
Other fix methods
Prompt for AI Agents
Before applying, verify this suggestion against the current code. In wiki/es/INDEX.md
around lines 23-28, under the top-level “Operations” section, update the localized
index to include the missing entry linking to “Multi-Harness Suite Design
(Proposed)” (multi-harness-suite-design.md). Mirror the corresponding item added in
wiki/INDEX.md lines 30-34 so Spanish navigation matches the untranslated Operations
document. Ensure the link text and relative path are correct and placed in the same
logical spot among the other Operations entries.
This was referenced Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
installable: falseas a denial-only lifecycle state, with a controlled tag-creation workflow plus tag ruleset required to prevent manual public refsclawsec-suiteconsumerKey sequencing decisions
non-installable-release-policy-v1must precede the NanoClaw tombstone.Security impact
Remote validation
The exact documentation worktree was copied with
scpinto a fresh quarantine ondavida@20.14.133.241./tmp/clawsec-design-installability.nDq1nenpm cicompleted; the older branch lockfile's audit findings were not modified in this docs PRnpm run gen:wiki-llmsgenerated 116 page exportsnpm run buildpassedNo local test or build is used as acceptance evidence for the current head.
Follow-up boundary
Every implementation unit described here uses its own branch and draft PR. This design does not authorize a merge, tag, release, publication, production-key operation, or repository-ruleset change.