fix(agent-improvement): fail closed on contract sections; route vendored fixes upstream#72
Merged
Merged
Conversation
…red fixes upstream Two findings from the Codex review of the plugin that bundles this skill (devantler-tech/agent-plugins#73). Contract guard: the skill is installable and invocable on its own, without the agent-improver wrapper that checks the deployment's Agent definition locations and Authority model. The pre-flight only checked that some definition files exist, then step 4 happily routed edits at bootstrap entries and permission configuration. A skill that edits guardrails must establish its own bounds, so it now performs those checks itself and fails closed per dimension. Vendored copies: the routing table treated "skills" as a version-controlled surface to patch in place. Where a definition file was installed from another repository — a bundled SKILL.md, a vendored agent — the consuming repo generally forbids hand-editing it and the next sync reverts the change, so the defect returns and the fix appears to have failed. Now says to fix it at its upstream and check for an origin marker before editing any definition file you did not author. Both are stated generically rather than in marketplace terms, since the skill is deployment-neutral; the plugin case is one instance of the pattern. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
Author
@codex review |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
devantler
marked this pull request as ready for review
July 18, 2026 14:41
devantler
added a commit
to devantler-tech/agent-plugins
that referenced
this pull request
Jul 18, 2026
Picks up devantler-tech/agent-skills#72 — the standalone contract guard and the rule routing vendored-copy fixes to their upstream. Installed with `gh skill install`, so provenance advances v1.9.0 -> v1.9.1 and the body is verified byte-identical to upstream main. This is the path the skill's own new rule prescribes: the previous two findings could not be fixed in this copy, because the next sync would have reverted them. Note for the next re-bundle: `gh skill install` resolves to the latest RELEASE tag, not main HEAD, so it must run after the release workflow finishes — an install fired seconds after merge silently returns the previous version. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
devantler
added a commit
to devantler-tech/agent-plugins
that referenced
this pull request
Jul 18, 2026
…nt (#73) * feat(automated-ai-engineer): add the agent-improver meta-engineer agent The plugin ships the engineer role but nothing that improves the engineer from the outside. Its `self-improvement` skill is one run reflecting on its own memory — so it cannot see failures recurring across hundreds of runs, waste that looks normal from inside a run, divergence between sibling instances, or drift between a non-version-controlled bootstrap entry and the contract it points at. Adds `agent-improver`: an external observer over the whole session corpus and every deployed instance, scoring the engineer on reliability, safety, efficiency, quality, coordination and currency, and shipping evidence-backed, reversible fixes to its definition. Two parts carry most of the weight. The ingestion boundary — a meta-engineer with authority over the definition is the deployment's highest-value injection target, so it mines BEHAVIOUR and never treats corpus prose as instruction. And distinguishing "the guard is wrong" from "the agent is wrong", which look identical in telemetry and whose confusion is how a working control gets deleted to silence a symptom. The agent's obligations (evidence, reversibility, audit trail, loosenings ship alone) hold under any authority model, since deployments differ in how much a meta-engineer may change alone. The matching `agent-improvement` skill bundle follows once its upstream merges (devantler-tech/agent-skills#71) — bundled skills must carry `gh skill install` provenance and are never hand-copied. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(automated-ai-engineer): document agent-improver's contract sections Codex review on #73 found the new agent's requirements were not reflected in the consumer docs. P2: enabling agent-improver makes two more AGENTS.md sections load-bearing — Agent definition locations (what it may change, and which surfaces are version-controlled vs edited-in-place) and Authority model (how much it may change alone, split by tighten/loosen and prose/enforcement). A consumer following the documented five-section setup would have neither, so the meta-engineer could not run safely. Also notes what Memory must hold for the verification loop. P3: the root README's custom-agent delivery section still described two bundled agents and gave VS Code copy targets for only those two, so anyone following the manual path would not discover the third. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(automated-ai-engineer): bundle the agent-improvement skill Closes the merge gate on this PR. The agent-improver agent declares and delegates to agent-improvement, so publishing the agent without the bundle would ship an unresolved skill reference (Codex P1 on this PR). Installed via `gh skill install` from the upstream that just merged (devantler-tech/agent-skills#71), so it carries the metadata.github-* provenance the manifest validator requires — a hand-copied SKILL.md is rejected, correctly. Verified the bundled body is byte-identical to upstream main. README resource index updated to match on-disk resources, which the validator enforces. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(automated-ai-engineer): fix count drift and fail closed on missing sections Four review findings, three of them the same shape: adding a third agent and a fourth skill left every count in the docs stale, each in a different file. - Root README claimed npx resolves "all 27 bundled skills"; the tree now holds 28. - Plugin README's Delivery section still said "both bundled agents" one screen after introducing the third. - ADR 0002 still described the bundle as "two agents + three skills" while being cited as its design record. Updated to note the extension rather than rewriting history. The substantive one: the two AGENTS.md sections this agent depends on (Agent definition locations, Authority model) were named only in the frontmatter description, so the prompt body never told the model to read them or to stop when they are absent — unlike the sibling agent, which fails closed per dimension. Added the same contract, with the reason stated: those sections are what constrain a role that edits its own guardrails, so an agent that improvises them has removed its own limits before doing anything else. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(automated-ai-engineer): correct the VS Code agent delivery instructions My previous fix corrected the agent COUNT but kept the claim that all agents load automatically everywhere. Under this repo's documented delivery model (root README, Custom agents) VS Code consumes agents but does not bundle them from a plugin — they must be copied into .github/agents/*.agent.md. So a VS Code user adding the new agent-improver would have followed this page, skipped the copy, and found the agent simply absent with nothing to explain it. Now states the split explicitly and lists all three copy targets. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(automated-ai-engineer): re-bundle agent-improvement at v1.9.1 Picks up devantler-tech/agent-skills#72 — the standalone contract guard and the rule routing vendored-copy fixes to their upstream. Installed with `gh skill install`, so provenance advances v1.9.0 -> v1.9.1 and the body is verified byte-identical to upstream main. This is the path the skill's own new rule prescribes: the previous two findings could not be fixed in this copy, because the next sync would have reverted them. Note for the next re-bundle: `gh skill install` resolves to the latest RELEASE tag, not main HEAD, so it must run after the release workflow finishes — an install fired seconds after merge silently returns the previous version. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Two defects found reviewing the plugin that bundles this skill (devantler-tech/agent-plugins#73), both affecting anyone who installs the skill on its own.
It could run without bounds. The skill is installable and invocable directly, without the
agent-improveragent that checks the deployment's Agent definition locations and Authority model. Its pre-flight only confirmed some definition files exist — then step 4 routed edits at bootstrap entries and permission configuration. A skill that edits guardrails has to establish its own bounds rather than assume a wrapper did.It told you to edit copies that get reverted. The routing table treated skills as a version-controlled surface to patch in place. Where a definition file came from another repository, the consuming repo usually forbids hand-editing it and the next sync overwrites the change — so the defect returns and the fix looks like it failed.
What
Adds a contract guard that performs those checks itself and fails closed per dimension, and a routing rule to fix vendored copies at their upstream, checking for an origin marker before editing any definition file you did not author.
Both stated generically, since the skill is deployment-neutral — the marketplace case is one instance of the pattern.
Merge order
devantler-tech/agent-plugins#73 waits on this: it can only re-bundle the corrected skill via
gh skill installonce this merges, because the validator rejects hand-copied bundles.