[Phase 0] Foundations and protected data boundaries #32

Activity

1. mrgoonie

   added

   enhancementNew feature or requestNew feature or request

   on Sep 21, 2026
2. mrgoonie commented on Sep 22, 2026

   

   mrgoonie

   on Sep 22, 2026

   ContributorAuthor

   More actions

   Phase 0 is merged and its migration is now actually applied to production, which is the part that had silently not happened.

   Merged: PR #39 squash-merged into main as b02b520. All 13 implementation tasks and the 5 acceptance criteria are in the tree; the plan and gap analysis live in plans/260921-1009-skillx-marketplace-roadmap/.

   Migration — the finding worth recording. Remote skillx-db had never applied 0009, so the seven Phase 0 tables (publishers, packages, package_releases, release_verification_evidence, entitlements, collections, collection_revisions) did not exist in production, months after the code that declares them merged. On 2026-09-22 both 0009 and 0010 were applied and verified independently through the D1 REST API rather than by trusting the migration tool's own report:

   • 28 tables, up from 21; all seven new tables present and empty as expected for additive changes;
   • skills 130,309 rows unchanged, skills_fts intact;
   • 11 migrations recorded, none pending.

   Recovery points were taken first: time-travel bookmark 000049e3-00000000-000050ee-38c209ac471ef825f224801bdbf967b3, plus a schema capture at .wrangler/backups/skillx-remote-schema-PRE-0010-20260922-074943.json. Note that wrangler d1 export --remote fails on this database (wrangler 4.63), so the schema capture goes through the D1 REST API instead.

   Two defects were found by doing the follow-up work rather than by the Phase 0 code itself:

   1. pnpm-lock.yaml had drifted from the manifests — apps/web's @skillx/contracts dependency had no entry and packages/contracts' typescript devDependency was unrecorded, so pnpm install --frozen-lockfile would have failed. Fixed in PR feat(phase-1): agent-native discovery and compatibility #41.
   2. The root typecheck script filtered to apps/web, so packages/cli and packages/contracts were never typechecked anywhere. It is now recursive and packages/cli has the script it was missing.

   Phase 1 (#33) is not part of this closure: it is in PR #41, still open.
3. mrgoonie

   closed this as completedon Sep 22, 2026