[PR #4831] [CLOSED] feat(skill): add opt-in Coordo evidence handoffs #6431

Closed
opened 2026-10-31 01:14:25 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4831
Author: @RishabhhR
Created: 10/17/2026
Status: ❌ Closed

Base: main ← Head: codex/coordo-investigation-handoff


📝 Commits (6)

  • 416d5c7 feat(skill): add opt-in Coordo evidence handoffs
  • 53359d5 fix(skill): harden Coordo handoffs, package managed files, and add tests
  • 0794d74 fix(skill): validate manifest UTF-8, bound agent names, and enforce bundle repo ownership
  • 7294c84 fix(skill): allow selected subprojects in parent repositories
  • b888d04 fix(skill): suppress potentially credentialed Coordo errors
  • effd5d5 fix(skill): reject lone surrogates and align Coordo failure test

📊 Changes

9 files changed (+751 additions, -24 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+6 -1)
➕ .agents/skills/reverse-engineer-anything/references/coordo-multi-agent.md (+102 -0)
➕ .agents/skills/reverse-engineer-anything/scripts/coordo-handoff.mjs (+320 -0)
📝 src/application/SetupSkill.ts (+16 -2)
📝 src/generatedPackageMetadata.ts (+1 -1)
📝 tests/acceptance/setup/selectedSkillSetup.test.ts (+2 -1)
➕ tests/boundary/filesystem/coordoHandoff.test.ts (+294 -0)
📝 tests/boundary/filesystem/setupSkill.test.ts (+8 -19)
📝 turbo.json (+2 -0)

📄 Description

Problem and expected behavior

A lead using REA with several agents needs a repeatable way to turn an existing investigation into bounded Coordo tasks without copying private Evidence into a ledger. The proposed workflow creates one scoped task per agent, linked to a target digest, local Evidence bundle digest and path, and supporting Evidence IDs. Agents inspect the bundle and report findings with coverage and unknowns.

No linked issue: this is a user-requested, optional skill enhancement. This draft seeks maintainer feedback on its fit with REA's contribution scope.

Change and scope

  • Add a Coordo-specific reference (references/coordo-multi-agent.md) to the authored reverse-engineer-anything skill and bump its skill version.
  • Add an opt-in Node helper (scripts/coordo-handoff.mjs) with a dry run by default. It validates the manifest, local bundle containment, Git ignore status, and SHA-256 before constructing tasks. --apply calls the configured Coordo CLI sequentially and reports partial completion.
  • Harden handoff generation: emit caller-selected relative paths without leaking symlink targets, bound task text (max 256 Evidence IDs, 32 KiB text), and capture bounded stderr excerpts with redacted credentials.
  • Package coordo-multi-agent.md and coordo-handoff.mjs in MANAGED_SKILL_FILES (src/application/SetupSkill.ts) so rea setup installs (and rea uninstall removes) the new reference and helper with the rest of the managed skill; setup tests now read that list instead of repeating it.
  • Add Vitest boundary tests in tests/boundary/filesystem/coordoHandoff.test.ts.
  • Add .agents/skills/** scripts to the lint and lint:built cache inputs in turbo.json.
  • Apart from setup and uninstall managing two more skill files, keep the REA CLI, MCP contracts, providers, and analysis workflows unchanged. The helper does not launch agents or interact with a target.

The source instructions and helper live in .agents/skills/reverse-engineer-anything/; generated skills/ output is ignored. The helper is intentionally outside core REA orchestration. Maintainer feedback on whether this belongs in the shipped skill remains open.

Contract and boundary impact

  • Semantic owner and earliest changed stage: authored skill workflow and optional handoff helper, after REA Evidence export.
  • Contribution scope fit and linked maintainer decision: no new target execution, injection, mutation, provider, or protection recovery capability; no linked decision required for those categories. Fit of this Coordo-specific workflow is pending maintainer feedback.
  • CLI and MCP/tool-catalog contract: no command, option or tool changes. rea setup installs, and rea uninstall removes, two additional managed skill files.
  • Provider, bridge, target-format, or platform compatibility: no provider change. Dry run is platform-neutral; --apply currently requires a directly executable Coordo CLI on a Unix-like host. Windows command shims are unsupported.
  • Evidence, artifact, provenance, or reconstruction contract: task text carries caller-provided target SHA-256, bundle path and SHA-256, and Evidence IDs. The helper verifies bundle bytes and Git ignore status but does not parse the bundle or verify Evidence ID membership. Recipients must validate bundle content and coverage.
  • Target selection, authority, upstream behavior, and cleanup details: target identity and permitted work are caller supplied. Handoffs convey no additional target authority. A partial Coordo write is reported with created IDs; the user must inspect existing tasks before retrying.
  • Generated metadata, package, or installation impact: src/generatedPackageMetadata.ts changes skill version 42 to 43. MANAGED_SKILL_FILES packages the new reference and helper for agent setup.

Expected effects:

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration. (--apply writes Coordo task state only.)
  • Contact network services. (Only if the selected Coordo backend is remote.)
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated: tests/boundary/filesystem/coordoHandoff.test.ts (10 tests covering dry run, --apply, symlink path preservation, argument validation, text bounds, and stderr reporting); updated tests/boundary/filesystem/setupSkill.test.ts and tests/acceptance/setup/selectedSkillSetup.test.ts.
  • Base reproduction or other evidence: verified 10/10 passing tests in coordoHandoff.test.ts, 17/17 in setupSkill.test.ts, and 6/6 in selectedSkillSetup.test.ts.
  • User-visible CLI/MCP output: no REA CLI/MCP change. The helper prints JSON preview or created task IDs.
  • Remaining proof gaps: no real remote Coordo backend or Windows command-shim workflow was exercised; Evidence ID membership is intentionally recipient validated.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • npm run check:fast — passed (typecheck & lint).
  • npm run docs:check — passed.
  • node scripts/generate-skill-metadata.mjs --check — passed.
  • git diff --check — clean.
  • npm run test:focused -- tests/boundary/filesystem/coordoHandoff.test.ts — 10 passed.
  • npm run test:focused -- tests/boundary/filesystem/setupSkill.test.ts — 17 passed.
  • npm run test:focused -- tests/acceptance/setup/selectedSkillSetup.test.ts — 6 passed.
  • npm run test:focused -- all of tests/acceptance/setup/ — 86 passed; skill-related tests/boundary/cli/ files (cliSetup, clientProfileLifecycle, clientProfiles, packageRunnerRegistration, skillSync) — 37 passed.
  • npm run verify:package — passed; reports skill: true, skillReferences: true with all nine skill files installed from the packed tarball.
  • Re-run on 53359d5: coordoHandoff, setupSkill, staticCheckReports, selectedSkillSetup, cliSetup and skillSync — 56 passed; verify:package — passed.

Compatibility, safety, and release

  • Breaking changes or migration steps: none; optional helper only.
  • Real Hopper/Ghidra, browser, or OS coverage: no provider or target run; local macOS helper exercise only.
  • Package or release metadata impact: skill version 43; no package version change.
  • Security, privacy, process, or containment review: a public/shared Coordo ledger receives only caller-authored task text and digest/path references, not raw Evidence bytes. Bundle remains Git ignored and local. A configured remote backend may receive task text. Callers must avoid sensitive paths and text in the manifest.

Author readiness

Human owner: @RishabhhR

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output. (No CLI/MCP change.)
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4831 **Author:** [@RishabhhR](https://github.com/RishabhhR) **Created:** 10/17/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `codex/coordo-investigation-handoff` --- ### 📝 Commits (6) - [`416d5c7`](https://github.com/morluto/rea/commit/416d5c79adb2edf76db0a27b59bcc0c8f20033be) feat(skill): add opt-in Coordo evidence handoffs - [`53359d5`](https://github.com/morluto/rea/commit/53359d5e3b674d80d5b6142388c9b91bd801aab4) fix(skill): harden Coordo handoffs, package managed files, and add tests - [`0794d74`](https://github.com/morluto/rea/commit/0794d74f01be2d852ff45bf6163b88590dfcb9c5) fix(skill): validate manifest UTF-8, bound agent names, and enforce bundle repo ownership - [`7294c84`](https://github.com/morluto/rea/commit/7294c84a098b291bf31266a1ef3cbfd21affe210) fix(skill): allow selected subprojects in parent repositories - [`b888d04`](https://github.com/morluto/rea/commit/b888d041eddfc78b7162b6bda33388ab37ff40bd) fix(skill): suppress potentially credentialed Coordo errors - [`effd5d5`](https://github.com/morluto/rea/commit/effd5d53a637c95f4addd71e7284f5451810e2ce) fix(skill): reject lone surrogates and align Coordo failure test ### 📊 Changes **9 files changed** (+751 additions, -24 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+6 -1) ➕ `.agents/skills/reverse-engineer-anything/references/coordo-multi-agent.md` (+102 -0) ➕ `.agents/skills/reverse-engineer-anything/scripts/coordo-handoff.mjs` (+320 -0) 📝 `src/application/SetupSkill.ts` (+16 -2) 📝 `src/generatedPackageMetadata.ts` (+1 -1) 📝 `tests/acceptance/setup/selectedSkillSetup.test.ts` (+2 -1) ➕ `tests/boundary/filesystem/coordoHandoff.test.ts` (+294 -0) 📝 `tests/boundary/filesystem/setupSkill.test.ts` (+8 -19) 📝 `turbo.json` (+2 -0) </details> ### 📄 Description ## Problem and expected behavior A lead using REA with several agents needs a repeatable way to turn an existing investigation into bounded Coordo tasks without copying private Evidence into a ledger. The proposed workflow creates one scoped task per agent, linked to a target digest, local Evidence bundle digest and path, and supporting Evidence IDs. Agents inspect the bundle and report findings with coverage and unknowns. No linked issue: this is a user-requested, optional skill enhancement. This draft seeks maintainer feedback on its fit with REA's contribution scope. ## Change and scope - Add a Coordo-specific reference (`references/coordo-multi-agent.md`) to the authored reverse-engineer-anything skill and bump its skill version. - Add an opt-in Node helper (`scripts/coordo-handoff.mjs`) with a dry run by default. It validates the manifest, local bundle containment, Git ignore status, and SHA-256 before constructing tasks. `--apply` calls the configured Coordo CLI sequentially and reports partial completion. - Harden handoff generation: emit caller-selected relative paths without leaking symlink targets, bound task text (max 256 Evidence IDs, 32 KiB text), and capture bounded stderr excerpts with redacted credentials. - Package `coordo-multi-agent.md` and `coordo-handoff.mjs` in `MANAGED_SKILL_FILES` (`src/application/SetupSkill.ts`) so `rea setup` installs (and `rea uninstall` removes) the new reference and helper with the rest of the managed skill; setup tests now read that list instead of repeating it. - Add Vitest boundary tests in `tests/boundary/filesystem/coordoHandoff.test.ts`. - Add `.agents/skills/**` scripts to the `lint` and `lint:built` cache inputs in `turbo.json`. - Apart from setup and uninstall managing two more skill files, keep the REA CLI, MCP contracts, providers, and analysis workflows unchanged. The helper does not launch agents or interact with a target. The source instructions and helper live in `.agents/skills/reverse-engineer-anything/`; generated `skills/` output is ignored. The helper is intentionally outside core REA orchestration. Maintainer feedback on whether this belongs in the shipped skill remains open. ## Contract and boundary impact - Semantic owner and earliest changed stage: authored skill workflow and optional handoff helper, after REA Evidence export. - Contribution scope fit and linked maintainer decision: no new target execution, injection, mutation, provider, or protection recovery capability; no linked decision required for those categories. Fit of this Coordo-specific workflow is pending maintainer feedback. - CLI and MCP/tool-catalog contract: no command, option or tool changes. `rea setup` installs, and `rea uninstall` removes, two additional managed skill files. - Provider, bridge, target-format, or platform compatibility: no provider change. Dry run is platform-neutral; `--apply` currently requires a directly executable Coordo CLI on a Unix-like host. Windows command shims are unsupported. - Evidence, artifact, provenance, or reconstruction contract: task text carries caller-provided target SHA-256, bundle path and SHA-256, and Evidence IDs. The helper verifies bundle bytes and Git ignore status but does not parse the bundle or verify Evidence ID membership. Recipients must validate bundle content and coverage. - Target selection, authority, upstream behavior, and cleanup details: target identity and permitted work are caller supplied. Handoffs convey no additional target authority. A partial Coordo write is reported with created IDs; the user must inspect existing tasks before retrying. - Generated metadata, package, or installation impact: `src/generatedPackageMetadata.ts` changes skill version 42 to 43. `MANAGED_SKILL_FILES` packages the new reference and helper for agent setup. Expected effects: - [x] Read existing files or captured data. - [x] Launch or attach to a process. - [x] Inject instrumentation or run scripts/code. - [x] Change process memory, registers, files, or configuration. (`--apply` writes Coordo task state only.) - [x] Contact network services. (Only if the selected Coordo backend is remote.) - [x] Recover protected code or work around protections. - [x] Documentation or usability only; no target interaction. - [x] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `tests/boundary/filesystem/coordoHandoff.test.ts` (10 tests covering dry run, `--apply`, symlink path preservation, argument validation, text bounds, and stderr reporting); updated `tests/boundary/filesystem/setupSkill.test.ts` and `tests/acceptance/setup/selectedSkillSetup.test.ts`. - Base reproduction or other evidence: verified 10/10 passing tests in `coordoHandoff.test.ts`, 17/17 in `setupSkill.test.ts`, and 6/6 in `selectedSkillSetup.test.ts`. - User-visible CLI/MCP output: no REA CLI/MCP change. The helper prints JSON preview or created task IDs. - Remaining proof gaps: no real remote Coordo backend or Windows command-shim workflow was exercised; Evidence ID membership is intentionally recipient validated. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run check:fast` — passed (typecheck & lint). - `npm run docs:check` — passed. - `node scripts/generate-skill-metadata.mjs --check` — passed. - `git diff --check` — clean. - `npm run test:focused -- tests/boundary/filesystem/coordoHandoff.test.ts` — 10 passed. - `npm run test:focused -- tests/boundary/filesystem/setupSkill.test.ts` — 17 passed. - `npm run test:focused -- tests/acceptance/setup/selectedSkillSetup.test.ts` — 6 passed. - `npm run test:focused --` all of `tests/acceptance/setup/` — 86 passed; skill-related `tests/boundary/cli/` files (cliSetup, clientProfileLifecycle, clientProfiles, packageRunnerRegistration, skillSync) — 37 passed. - `npm run verify:package` — passed; reports `skill: true`, `skillReferences: true` with all nine skill files installed from the packed tarball. - Re-run on 53359d5: coordoHandoff, setupSkill, staticCheckReports, selectedSkillSetup, cliSetup and skillSync — 56 passed; `verify:package` — passed. ## Compatibility, safety, and release - Breaking changes or migration steps: none; optional helper only. - Real Hopper/Ghidra, browser, or OS coverage: no provider or target run; local macOS helper exercise only. - Package or release metadata impact: skill version 43; no package version change. - Security, privacy, process, or containment review: a public/shared Coordo ledger receives only caller-authored task text and digest/path references, not raw Evidence bytes. Bundle remains Git ignored and local. A configured remote backend may receive task text. Callers must avoid sensitive paths and text in the manifest. ## Author readiness Human owner: @RishabhhR - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. (No CLI/MCP change.) - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi changed title from [PR #4831] feat(skill): add opt-in Coordo evidence handoffs to [PR #4831] [CLOSED] feat(skill): add opt-in Coordo evidence handoffs 2026-11-01 21:41:57 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#6431
No description provided.