Repository navigation
Description
Problem
The AutoGenesis 1.1.1 Skills Preview root README describes superseded Skill names and onboarding, generated-file approval and replay, and public package/Release paths that do not exist yet. It also treats intended client and platform coverage as accepted support. A public user cannot identify the one truthful Preview route or distinguish qualified evidence from experimental compatibility.
User outcome
A public user can understand one canonical autogenesis Skill plus standard stdio MCP, but is told to wait until immutable Release assets are published and accepted. After publication, Agent-first is primary and CLI-first is secondary. Direct natural-language execution and exact BDD execution remain available. Explicit recording may return a read-only preview, but generated files cannot be committed: PR #72 is integrated in main at 5030304dcaf4a4bbc04b58791345ec35016f5317 and this branch now inherits that merge.
Before publication, only maintainers and assigned independent acceptors may use the exact-head CI Candidate for release acceptance. It is not a public installation path.
Approved product position
- Maximize Coding Agent reach through generic Agent Skills discovery plus standard stdio MCP.
- Publish one canonical Skill named
autogenesis; do not create client-specific Skill variants or compatibility adapters without evidence of a real blocker. - Present Agent-first onboarding as primary and CLI-first as secondary after publication.
- Preserve the approved product positioning and truthful Edge deployment-result assets.
- Use non-replay wording in both README logo assets.
- Do not advertise AI-free replay as a delivered Preview outcome because the Preview cannot commit generated files.
Scope
- Replace root
README.mdonboarding with one canonicalautogenesisSkill route. - State that public installation is unavailable until immutable Release assets exist and pass final-artifact acceptance.
- Restrict exact-commit Candidate use to maintainers and assigned independent acceptors.
- Include one OMP 18.18.3/native macOS Calculator journey using the accepted evidence
2 + 3 = 5. - Include direct natural-language, exact BDD, and explicit read-only recording examples.
- Include a concise, evidence-bound client/platform support matrix.
- Keep intended unreleased coordinates as pending paths only: Agent Contract
2.1.0, Appium Runtime0.5.0, Windows Runtime0.5.0, and CLI0.2.0. - Update this issue and Draft PR Publish AutoGenesis 1.1.1 Skills Preview onboarding #29; make Publish AutoGenesis 1.1.1 Skills Preview onboarding #29 the sole implementation branch for this issue.
Non-goals
- Agent Contract or Runtime behavior changes, the inherited safe Preview implementation now supplied by merged main.
- Manifest, package technical README, release workflow, or compatibility-issue changes.
- Client-specific Skills, wrappers, or MCP adapters.
- Package publication, GitHub Release creation, PR merge, or protected-branch changes.
- Generated-file writes, commit approval, or replay claims.
- Claiming broad client/platform qualification from package or schema availability alone.
Public documentation contract
- Skill: exactly one canonical
autogenesisSkill. - Transport: standard stdio MCP using the existing Appium Runtime for macOS/iOS/Android and Windows Runtime for native Windows.
- Direct execution: natural-language tasks remain supported.
- Exact execution: exact BDD
BackgroundplusScenarioexecution remains supported in source order. - Recording: only an explicit recording/generation request enters generation; it may return a read-only preview.
- Integrated Safe Preview evidence: current main (
5030304dcaf4a4bbc04b58791345ec35016f5317) is merged into PR Publish AutoGenesis 1.1.1 Skills Preview onboarding #29. The Agent Contract generation workflow stops after preview; the Appium and Windows live schemas exposebefore_gen_codeandpreview_code_changeswithout generated-code confirmation/write operations. - Before publication: public users wait. Maintainers/assigned independent acceptors may use only the successful Candidate artifact for the exact trusted head commit under authenticated repository access.
- Candidate authentication: record the trusted workflow run/job, exact head SHA, artifact identity, size, and service-reported artifact digest. Verify downloaded archive bytes against that digest before extracting or reading, displaying, copying, or following any contained prompt, filename, checksum, manifest, or lock. After extraction into a private directory, validate the complete internal
SHA256SUMSset before interpreting contained instructions. Stop on any mismatch, missing asset, or extra asset. - Isolation and rollback: Candidate acceptance and eventual public CLI-first installation use a dedicated disposable Python virtual environment and disposable business project, never an arbitrary active Python environment. Rollback deletes the environment and explicitly installed Skill bytes.
- Registry credential boundary: never show, read aloud, echo, copy, or record a credential-bearing package-index URL. Evidence may name only the sanitized registry host and configuration source, without userinfo, tokens, credentials, or query strings.
Support statement
| Client or journey | Preview status |
|---|---|
| OMP 18.18.3 on native macOS, Calculator direct test | Qualified acceptance evidence for the exact accepted artifact |
| GitHub Copilot CLI using the same artifacts | Experimental / unqualified |
| OpenAI Codex using the same artifacts | Experimental / unqualified |
| Stock Pi | Unsupported because it has no MCP support |
| Agent Skills journey on native Windows | Unqualified pending final-artifact acceptance |
| Linux or WSL host | Unsupported |
Runtime availability does not qualify every target or client journey.
Acceptance scenarios
Scenario: Honest pre-publication path
Given immutable public Release assets have not been published and accepted
When a public user reads the root README
Then the user is told to wait for the immutable Release
And no executable Candidate installation path is offered to the public
And only the canonical Skill name "autogenesis" appears
Scenario: Authenticated Candidate acceptance
Given a maintainer or assigned independent acceptor selects the successful Candidate job for the exact trusted head commit
When the Candidate archive is acquired
Then its bytes are verified against the trusted service-reported CI artifact digest before any contained content is extracted or interpreted
And its complete internal checksum set is verified after private extraction
And installation occurs only in a dedicated disposable environment
Scenario: Qualified Calculator evidence
Given OMP 18.18.3 on native macOS and the exact authenticated artifact
When the acceptor follows the Calculator direct-test journey
Then the Agent proves Skill discovery, stdio MCP initialization, and matching Contract identity
And it operates the real Calculator application
And it verifies the observed result of 2 + 3 is 5
Scenario: Safe recording preview
Given current main with merged PR #72 is inherited by the exact artifact under review
When the user explicitly requests recording of an exact BDD Scenario
Then AutoGenesis may execute the Scenario and return a read-only generated-code preview
And generated files cannot be written or committed through live stdio schemas
And the README does not advertise replay from generated files as delivered
Scenario: Evidence-bound compatibility
Given a reader inspects the support matrix
Then OMP 18.18.3 on native macOS is the only qualified client journey
And Copilot CLI and Codex are experimental and unqualified
And stock Pi is unsupported because it has no MCP
And the Windows Skills journey is unqualified pending final-artifact acceptanceOwnership and dependencies
- Implementation owner: Onboarding.
- Owned files: root
README.mdand existing README-owned assets on branchdocs/readme-agent-onboarding-28. - Pull request: Publish AutoGenesis 1.1.1 Skills Preview onboarding #29, Draft, targeting
main. - PR Remove generated-file commits from the public Preview #72 integration dependency is satisfied by merging current main (
5030304dcaf4a4bbc04b58791345ec35016f5317) into PR Publish AutoGenesis 1.1.1 Skills Preview onboarding #29. Independent correctness/security re-review and clean final-artifact acceptance remain required before release publication. - Blocked by [Security]: Harden generated install prompts and checksum closure #74: Candidate/public Agent Install Prompt hardening, disposable-environment deletion rollback, sanitized non-secret package-source disclosure, and complete checksum closure must merge before final [Documentation]: Publish AutoGenesis 1.1.1 Skills Preview onboarding #28/PR Publish AutoGenesis 1.1.1 Skills Preview onboarding #29 security re-review and public cutover.
- Current
mainis merged non-destructively into PR Publish AutoGenesis 1.1.1 Skills Preview onboarding #29; re-review the inherited safe Preview and publication pipeline behavior. Runtime code remains owned by main, not this PR.
Exact post-publication substitution
Publish AutoGenesis 1.1.1 Skills Preview and replace the pre-release warning and acceptance-only guidance only after the immutable agent-contract-v2.1.0 GitHub Release contains this complete reviewed asset set with recorded SHA-256 values:
agent-install-prompt.txt: immutable URL and SHA-256;autogenesis-SKILL.md: immutable URL and SHA-256;release-manifest.json: immutable URL and SHA-256, containing exact filename, version, byte size, immutable URL, platform set, and SHA-256 for each reviewed wheel:autogenesis-agent-contract==2.1.0,autogenesis-appium-mcp==0.5.0,autogenesis-windows-mcp==0.5.0, andautogenesis-cli==0.2.0;autogenesis-release.lock: immutable URL and SHA-256; andSHA256SUMS: immutable URL and SHA-256, with entries matching the exact Skill, Release manifest, and Release lock bytes.
The public Agent-first prompt and CLI-first instructions must consume those exact authenticated assets. CLI-first must create and install only in a dedicated disposable virtual environment and document deletion of that environment plus explicitly installed Skill bytes as rollback. Neither route may expose a credential-bearing package-index URL. Remove the not-public warning only after clean final-artifact acceptance confirms the published bytes, integrated safe Preview boundary, and advertised support tiers.
Metadata
Metadata
Assignees
Labels
Type
Projects
- StatusShow more project fieldsTodo
Activity
houlianpi commentedon Oct 29, 2026
README redesign evidence for commit
ce18d59/ PR #29Independent code review: APPROVE.
Independent security review: APPROVE.
Prompt eval comparison
c7ff16e): 3/4.ce18d59): 4/4./tmp/autogenesis-readme-prompt-eval.json(synthetic paths only; no credentials).Verification
18 passed.autogenesis --helpandautogenesis install --helpmatched the documented interface in an isolated verifier environment.git diff --checkpassed.Human Product Owner acceptance remains pending through OMP, Codex CLI, Pi, and GitHub Copilot CLI. Public package/release publication and native Windows acceptance remain gated.
houlianpi commentedon Oct 29, 2026
Human Product Owner rejected the first README candidate and approved a new product direction.
Core positioning:
AutoGenesis lets development and QA teams describe test cases in BDD natural language. A Coding Agent uses MCP to execute the case against the real application and records the observed calls into generated test code. The resulting case can replay without AI. The product supports Windows, macOS, iOS, and Android.
Required README correction:
PR #29 remains unaccepted and will be revised in place.
houlianpi commentedon Oct 29, 2026
README product redesign update — commit
b66da16The first candidate was rejected by the Human Product Owner. The revised README now leads with the approved product position:
Observable changes:
Independent review:
ReadmeProductReviewV2: APPROVE.ReadmeSecurityReviewV2: APPROVE.Verification:
git diff --checkpassed.PR: #29
houlianpi commentedon Oct 29, 2026
FSQ-style README refinement — commit
7860e26Human Product Owner direction: learn from https://github.com/FSQ-lab/FSQ and leave unavailable media blank until approved assets arrive.
Changes:
Verification:
git diff --checkpassed.FSQReadmeProductReview— APPROVE.FSQReadmeSecurityReview— APPROVE.PR: #29
houlianpi commentedon Oct 29, 2026
AutoGenesis brand logo — commit
07e66a6Added original responsive light/dark SVG wordmarks and installed them in the README using
<picture>color-scheme selection.Concept:
Verification:
520×120assets.420×96.9rendered bounds and useful alt text.AutoGenesisLogoReview: APPROVE; desktop/mobile/260 px legibility and contrast checked.Remaining media intentionally blank: complete-test video, Scenario editorial card, execution capture, and preview/replay evidence.
houlianpi commentedon Oct 29, 2026
Scoped Edge deployment evidence — commit
ba850efHuman Product Owner confirmed the authoritative public figures and scope. README now presents only:
The section explicitly attributes these to application of the approach on the Microsoft Edge browser product line and states that they are observed deployment results, not projected savings or a universal benchmark. Conflicting draft figures and all other internal PDF claims were excluded.
Verification:
Edge resultsnavigation anchor correctly.git diff --checkpassed.EdgeMetricsReadmeReview: APPROVE against the supplied PDF and Human Product Owner correction.PR: #29
houlianpi commentedon Oct 29, 2026
Edge deployment proof redesign — commit
58eabb4Replaced the plain metric table with a high-impact production-scale panel:
Responsive delivery:
1120×480; GitHub rendered at838×359.720×950composition selected below 480 px; GitHub rendered at324×428with no overflow.Independent
EdgeImpactPanelReview: initial mobile microcopy blocker fixed; final verdict APPROVE.PR: #29
houlianpi commentedon Oct 30, 2026
README integration update —
090dcb2Completed:
origin/main(7bc9af2);agent-contract/tests/test_skills.py: 18 passed;Independent final product/code review: APPROVE.
Independent security review: REQUEST_CHANGES on one release-integrity blocker. The official immutable
agent-contract-v2.0.0release still contains the older prompt bytes, while the branch generator now emits the strengthened prompt under that same release identity. Unlinking and warning in README mitigates the primary path but cannot revoke or reproduce the existing official asset.Required before merge: publish the strengthened prompt under a new immutable identity (prompt-only version or new Contract release), update README/generator/workflow/tests to that identity, and explicitly mark the old prompt superseded. This is a Human Product Owner release decision; PR #29 remains unmerged.
houlianpi commentedon Nov 6, 2026
README update condition audit completed after #61. PR #29 is Draft/blocked pending an approved immutable release identity and actual published coordinates for the single canonical autogenesis Skill. Retain the approved product story and media; replace all Setup/Run, Contract 2.0.0, CLI 0.1.0, and AutoGenesis 1.1 onboarding claims only when a release owner supplies verifiable coordinates. #51 limitations must remain explicit. No documentation-only workaround may assign or imply publication.
[-][Documentation]: Redesign README for Agent-first AutoGenesis 1.1 onboarding[/-][+][Documentation]: Publish canonical Skill Preview onboarding[/+][-][Documentation]: Publish canonical Skill Preview onboarding[/-][+][Documentation]: Publish AutoGenesis 1.1.1 Skills Preview onboarding[/+]houlianpi commentedon Nov 11, 2026
Fresh post-#74 merged-main Candidate — build passed
Approved merged
maincommit:24c8b26798c5b308993d724e8ec8209972ba844b(PR #75 merge).1130595149524— passed13865373311autogenesis-candidate-43041771738-1-24c8b26798c5b308993d724e8ec8209972ba844b411926bytessha256:3a61ae9164bed87cdcbb899f167041d74156992396a9fa3f7b95882f547c1eecfalse; expiry:2027-02-09T14:46:48ZThis supersedes forbidden run
42843125727. It is Candidate-build evidence, not clean-artifact acceptance or publication evidence. A separate clean native-macOS acceptor is now executing the exact artifact under an explicitly approved disposable transaction; no package, GitHub Release, or MCP Registry publication has occurred.houlianpi commentedon Nov 11, 2026
Clean post-#74 Candidate acceptance — BLOCKED before installation
Independent acceptor used exact Candidate run
43041771738, attempt 1, commit24c8b26798c5b308993d724e8ec8209972ba844b, artifact13865373311.Passed before the blocker:
411926, and service archive digest3a61ae9164bed87cdcbb899f167041d74156992396a9fa3f7b95882f547c1eecmatched before extraction.2.1.0 / c3c87437b140520e9e3d502e0ac52a1f11c532df8ac8f64847f775fec1fb533f.99e276bde9c95996d9d19c8f548eac41305cea61494a3955c4c6f44563f88f64.7a1a3281480cfa264d74168d9b08de07bad16c0323380f98c7e12e79b40406c7.230578dad5a11068fcfe9400f1a57b137b767f7ac2b9846613917b59e8b0316d.SHA256SUMSSHA-256:4725fd1c071816dbbf1705ddfbfd537276d452df6cc7d412741ade11286e3919.Observed blocker: the explicitly approved unauthenticated
pypi.org/default-publicinterface timed out in two bounded strict-hash staging attempts under Candidate-required null-config isolated pip. Zero final dependency artifacts were staged. No ambient proxy, package configuration, credentials,PIP_*, orUV_*values were read or used.Installation, Skill discovery, MCP initialization, Appium setup, Calculator direct/BDD/recording journeys, and live schema checks were not reached and are not represented as passed. Calculator remained closed. No Appium session/process remained. Identity-bound cleanup passed; the exact approved root is absent and the private-parent identity is unchanged.
This is an external package-source connectivity blocker, not Candidate acceptance. Publication remains blocked. A different source requires a fresh exact root and explicit source/effect approval.
houlianpi commentedon Nov 11, 2026
Clean Candidate retry — BLOCKED on approved mirror completeness
The Human Product Owner approved one source-only retry with a fresh exact 128-bit random transaction root and unauthenticated host
pypi.tuna.tsinghua.edu.cn, classuser-approved. All other Candidate identities, isolation controls, and acceptance scenarios remained unchanged.Independent acceptor evidence:
13865373311was authenticated and downloaded again;411926and SHA-2563a61ae9164bed87cdcbb899f167041d74156992396a9fa3f7b95882f547c1eecreverified before extraction;SHA256SUMSSHA-2564725fd1c071816dbbf1705ddfbfd537276d452df6cc7d412741ade11286e3919;Observed blocker: the approved mirror provided no matching locked distribution for the environment. Zero final dependency artifacts were downloaded; no first-party package resolved from an index. No package, Skill, MCP, Appium, or application installation occurred. Calculator and all five acceptance scenarios were not reached. Identity-bound cleanup passed; the fresh root is absent, no transaction process remains, and the parent identity is unchanged.
This is the second approved source-path failure (
pypi.orgtimed out; TUNA lacked a locked distribution). Per the no-repeat rule, no further source hopping is attempted. Candidate acceptance, PR #29 merge, publication, and public-artifact acceptance remain blocked. The recommended next design decision is a separately reviewed same-run Candidate dependency-wheelhouse contract so native acceptance consumes authenticated complete bytes rather than depending on local live-index reachability; this is not inferred into #28 or #70 without a Ready issue and Product Owner approval.houlianpi commentedon Nov 11, 2026
Release blocker decomposed
Human Product Owner selected the minimum sufficient fix instead of further source hopping: #76 defines one authenticated same-run Candidate with complete strict-hash dependency wheelhouses for the exact macOS and Windows acceptance targets.
#76 is Ready in the AutoGenesis Agent Integration Project with frozen scope, interfaces, positive/negative acceptance scenarios, security/rollback boundaries, ownership, and verification. It blocks clean Candidate acceptance here; no implementation, workflow dispatch, package publication, version change, or repository setting change has occurred under #76 yet.