[PR #25] [MERGED] feat(comfy-build): BE-8939 a described intent becomes a confirmed set #23

New issue

Closed

opened 2026-10-26 22:34:05 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:34:05 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/comfy-skills/pull/25
Author: @james00012
Created: 8/24/2026
Status: ✅ Merged
Merged: 8/24/2026
Merged by: @james00012

Base: main ← Head: james/be-8939-comfy-skills-write-the-selection-content

📝 Commits (1)

ae14f40 feat(comfy-build): a path from a described result to a confirmed set

📊 Changes

1 file changed (+170 additions, -7 deletions)

View changed files

📝 comfy-cli/comfy-build/SKILL.md (+170 -7)

📄 Description

TL;DR: A user holding one sentence, no ComfyUI install and no workflow file reaches a build definition, and nothing is created until they confirm the candidate set.

Linear: BE-8939 · part of BE-8158 a described intent becomes a distribution that builds

Why: the skill's two routes into a definition both start from something the user already has, an install to scan or a Desktop snapshot to import, so a user who owns neither has no path at all. A description names no pack and no file, which makes every candidate the agent's own inference, and a cut spent on inference is the failure this section is shaped to prevent.

Validation

Local stack, end to end: four hand-written definitions previewed offline through released comfy-cli 1.17.0. A missing models key is refused with build_definition_invalid; a registryVersion carrying a slug silently becomes an upload; a UUID passes the preview untouched; the shape this section teaches previews clean at upload_count: 0.
Development environment: comfy build resolve against the staging builder. A real filename returns a HuggingFace sourceUri and a digest, and a made-up one returns zero candidates with error null, which is the silent absence this section tells the agent to read as an answer.
Local stack, end to end, four independent agents: each driven by this file alone, one sentence of intent, no other context, every comfy invocation logged by a shim that refuses the ones that spend. 21 invocations, 0 spend attempts. The hardest opened with "don't ask me to pick between them, budget isn't an issue" and still assembled the set, previewed a correct definition and stopped at the cut for the permission record. Structurally rather than behaviourally: the gate sits nine lines into a 152-line section, forbids by act rather than by flag, and every spend route the file teaches appears after it. Six defects those runs found are fixed here, and two more from a cold reviewer, including a tag command that silently returned a ComfyUI many releases stale.
Development environment, all the way to a green build: a fifth agent, same file, one sentence, a staging workspace where spending is real. It searched, resolved, proposed with provenance, stopped for the yes, took a policy answer, and cut. Version 04efcd4c reached complete, deployable: true, artifact linux/nvidia/cu130 ready, 0 failed. That run is what found the policy fields, the pipDependencies type and the orphaned build on a refusal, all fixed here.
Not run: whether the builder's importer refuses a right-name-wrong-version pin, and the scan and Desktop paths, which this change does not touch.

What changed

[comfy-skills] comfy-build/SKILL.md, one new section: turns a described intent into a confirmed candidate set and a hand-written definition, names registry text as attacker-controlled, and states the user's confirmation as the gate every route to a cut passes through.
[comfy-skills] the same file, two lines elsewhere: the opening gate and the spend disclosure both described model files leaving the user's machine, which does not happen on a path where the builder fetches each source URL.
[comfy-skills] the frontmatter description: names the new starting point, so the skill fires for a user with no install.

Contradicts: the design doc commits that every platform operation the skill teaches is a comfy-cli invocation and never a raw API call. This section teaches two, the registry's search and its node-class lookup, because no comfy-cli command reaches either: comfy node registry-list calls /nodes with no parameters and prints ten of five thousand. The section names both as deliberate exceptions rather than leaving them as precedent.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/comfy-skills/pull/25 **Author:** [@james00012](https://github.com/james00012) **Created:** 8/24/2026 **Status:** ✅ Merged **Merged:** 8/24/2026 **Merged by:** [@james00012](https://github.com/james00012) **Base:** `main` ← **Head:** `james/be-8939-comfy-skills-write-the-selection-content` --- ### 📝 Commits (1) - [`ae14f40`](https://github.com/Comfy-Org/comfy-skills/commit/ae14f40fb72f74eb4e5adff0d0c5b5d0cd8275cd) feat(comfy-build): a path from a described result to a confirmed set ### 📊 Changes **1 file changed** (+170 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `comfy-cli/comfy-build/SKILL.md` (+170 -7) </details> ### 📄 Description **TL;DR:** A user holding one sentence, no ComfyUI install and no workflow file reaches a build definition, and nothing is created until they confirm the candidate set. Linear: [BE-8939](https://linear.app/comfyorg/issue/BE-8939) · part of [BE-8158 a described intent becomes a distribution that builds](https://linear.app/comfyorg/issue/BE-8158) **Why:** the skill's two routes into a definition both start from something the user already has, an install to scan or a Desktop snapshot to import, so a user who owns neither has no path at all. A description names no pack and no file, which makes every candidate the agent's own inference, and a cut spent on inference is the failure this section is shaped to prevent. **Validation** * **Local stack, end to end**: four hand-written definitions previewed offline through released comfy-cli 1.17.0. A missing `models` key is refused with `build_definition_invalid`; a `registryVersion` carrying a slug silently becomes an upload; a UUID passes the preview untouched; the shape this section teaches previews clean at `upload_count: 0`. * **Development environment**: `comfy build resolve` against the staging builder. A real filename returns a HuggingFace `sourceUri` and a digest, and a made-up one returns zero candidates with `error` null, which is the silent absence this section tells the agent to read as an answer. * **Local stack, end to end, four independent agents**: each driven by this file alone, one sentence of intent, no other context, every `comfy` invocation logged by a shim that refuses the ones that spend. 21 invocations, 0 spend attempts. The hardest opened with "don't ask me to pick between them, budget isn't an issue" and still assembled the set, previewed a correct definition and stopped at the cut for the permission record. Structurally rather than behaviourally: the gate sits nine lines into a 152-line section, forbids by act rather than by flag, and every spend route the file teaches appears after it. Six defects those runs found are fixed here, and two more from a cold reviewer, including a tag command that silently returned a ComfyUI many releases stale. * **Development environment, all the way to a green build**: a fifth agent, same file, one sentence, a staging workspace where spending is real. It searched, resolved, proposed with provenance, stopped for the yes, took a policy answer, and cut. Version `04efcd4c` reached `complete`, `deployable: true`, artifact `linux/nvidia/cu130` ready, 0 failed. That run is what found the policy fields, the `pipDependencies` type and the orphaned build on a refusal, all fixed here. * **Not run**: whether the builder's importer refuses a right-name-wrong-version pin, and the scan and Desktop paths, which this change does not touch. **What changed** * **[comfy-skills] comfy-build/SKILL.md, one new section**: turns a described intent into a confirmed candidate set and a hand-written definition, names registry text as attacker-controlled, and states the user's confirmation as the gate every route to a cut passes through. * **[comfy-skills] the same file, two lines elsewhere**: the opening gate and the spend disclosure both described model files leaving the user's machine, which does not happen on a path where the builder fetches each source URL. * **[comfy-skills] the frontmatter description**: names the new starting point, so the skill fires for a user with no install. **Contradicts:** the design doc commits that every platform operation the skill teaches is a comfy-cli invocation and never a raw API call. This section teaches two, the registry's search and its node-class lookup, because no comfy-cli command reaches either: `comfy node registry-list` calls `/nodes` with no parameters and prints ten of five thousand. The section names both as deliberate exceptions rather than leaving them as precedent. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:34:05 +00:00

closed this issue
added the
pull-request
label

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Comfy-Org/comfy-skills#23

No description provided.

Rows
Columns