You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
packages/runtime/resources/bundled-skills/provenance.json held one record and had no consumers: scripts/gen-bundled-skill-catalog.mjs reads only <id>/SKILL.md, and the sole reference in the tree was docs/code-origin-audit.md. The schema was built for the batch that #2695 resolved — 29 Skills went, one stayed.
This PR deletes the file and moves the computer-use Skill's origin, AI-assistance, and review facts into the "Bundled Skills" section of docs/code-origin-audit.md, which already had to be touched to remove the provenance.json reference.
The issue's two constraints are preserved:
The record stays out of SKILL.md, so provenance edits never change installed Skill content hashes — the property the deleted file existed to hold.
It does not touch docs/computer-use-provenance.md, which registers third-party material; this Skill is origin: independently-authored.
Every fact is carried over verbatim from the deleted JSON (author Haoqing Wang / @hqhq1025, OpenAI Codex drafting assistance, inputs list, introduction via #2147 at 2fb83e20, contributor confirmation 2026-08-11, independent review in #2676 at 3c7683b9 on 2026-08-12 with its scope caveat), anchored to fixed commits so the historical audit report is not turned into mutable living state.
npm run generate:bundled-skills -- --check — catalog unaffected (the generator never read the JSON)
npm run format:check, npm run typecheck, npm run check:asf-headers
Repo-wide search confirms no remaining references to provenance.json
Not run: npm run lint, npm run build, knip — no code changed; CI covers them
Review focus
One tradeoff worth flagging: docs/code-origin-audit.md is a dated evidence report. Folding the record in means any future bundled-Skill provenance update edits a historical document; if more Skills are bundled later, a dedicated provenance home may be worth revisiting.
AI use
Select exactly one:
No generative tool made a substantive contribution
Generative tooling made a substantive contribution
Tool(s) and scope: opencode explored the repository, drafted both the doc change and this description, and proposed the record's new home (selected by the human contributor of record, who reviewed every fact against the deleted JSON before submitting). The commit carries a Generated-by: opencode trailer.
Checklist
Tests cover the change and fail without it — not applicable: resource-file deletion plus documentation; nothing testable changed (catalog generator check confirms behavior is unchanged)
Lint, format, typecheck and the affected suites pass locally
provenance.json held one record and had no consumers; the bundled Skill
catalog reads only <id>/SKILL.md and the sole tree reference was
docs/code-origin-audit.md. The computer-use Skill's origin, AI-assistance,
and review facts now live in the audit's Bundled Skills section — outside
SKILL.md so provenance edits never change installed Skill content hashes.
Closesapache#3424
Generated-by: opencode
The reason will be displayed to describe this comment to others. Learn more.
I reviewed this head and found no blocking issues.
The retirement removes a retired bundled Skill provenance schema (schemaVersion 1 / unresolvedGroups metadata) while preserving all substantive facts in code-origin-audit. No hidden consumers remain (generator still scans SKILL.md directories, SHA unchanged). Document hygiene is maintained and checks are green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
packages/runtime/resources/bundled-skills/provenance.jsonheld one record and had no consumers:scripts/gen-bundled-skill-catalog.mjsreads only<id>/SKILL.md, and the sole reference in the tree wasdocs/code-origin-audit.md. The schema was built for the batch that #2695 resolved — 29 Skills went, one stayed.This PR deletes the file and moves the
computer-useSkill's origin, AI-assistance, and review facts into the "Bundled Skills" section ofdocs/code-origin-audit.md, which already had to be touched to remove theprovenance.jsonreference.The issue's two constraints are preserved:
SKILL.md, so provenance edits never change installed Skill content hashes — the property the deleted file existed to hold.docs/computer-use-provenance.md, which registers third-party material; this Skill isorigin: independently-authored.Every fact is carried over verbatim from the deleted JSON (author Haoqing Wang / @hqhq1025, OpenAI Codex drafting assistance, inputs list, introduction via #2147 at
2fb83e20, contributor confirmation 2026-08-11, independent review in #2676 at3c7683b9on 2026-08-12 with its scope caveat), anchored to fixed commits so the historical audit report is not turned into mutable living state.Fixes#3424
Verification
npm run generate:bundled-skills -- --check— catalog unaffected (the generator never read the JSON)npm run format:check,npm run typecheck,npm run check:asf-headersprovenance.jsonnpm run lint,npm run build, knip — no code changed; CI covers themReview focus
One tradeoff worth flagging:
docs/code-origin-audit.mdis a dated evidence report. Folding the record in means any future bundled-Skill provenance update edits a historical document; if more Skills are bundled later, a dedicated provenance home may be worth revisiting.AI use
Select exactly one:
Tool(s) and scope: opencode explored the repository, drafted both the doc change and this description, and proposed the record's new home (selected by the human contributor of record, who reviewed every fact against the deleted JSON before submitting). The commit carries a
Generated-by: opencodetrailer.Checklist
Does this PR entail a change in behavior?