Skip to content

fix(skills-index): allowlist kwh/kya/vrfy with ontology reasons - #116

Draft
yakimoto wants to merge 1 commit into
mainfrom
eng/skills-index-kwh-kya-vrfy
Draft

yakimoto wants to merge 1 commit into
mainfrom
eng/skills-index-kwh-kya-vrfy

Conversation

@yakimoto

@yakimoto yakimoto commented Oct 12, 2026 •

Copy link
Copy Markdown
Contributor

User description

Fixes the API spec coverage gap: kwh, kya and vrfy are allowlisted in the skills index with their ontology reasons. Their spokes return 503 SPOKE_NOT_LIVE, and each entry expires automatically once a meter appears. One file, +21. Draft for Jake's merge line.

View guided diff Turn on auto-fix


CodeAnt-AI Description

Document unmetered KWH, KYA, and VRFY capabilities in the skills index

What Changed

  • The skills index now accepts KWH, KYA, and VRFY without documented operations while they have no meter.
  • The index explains that these routes are not currently served and why each capability has no live operation.
  • The exception ends automatically when a meter appears for one of these capabilities.

Impact

✅ Fewer missing-operation errors for unmetered capabilities
✅ Clearer reasons for absent KWH, KYA, and VRFY operations
✅ Metered capabilities must have documented operations

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

…es 503 SPOKE_NOT_LIVE, entries expire when a meter appears
@codeant-ai

codeant-ai Bot commented Oct 12, 2026 •

Copy link
Copy Markdown

🤖 CodeAnt AI — Review Status

Status Commit Started (UTC) Finished (UTC)
✅ Reviewed your PR 52ff375 Oct 12, 2026 · 01:12 01:14

@codeant-ai

codeant-ai Bot commented Oct 12, 2026

Copy link
Copy Markdown

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

@coderabbitai

coderabbitai Bot commented Oct 12, 2026

Copy link
Copy Markdown

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@codeant-ai codeant-ai Bot added the size:S This PR changes 10-29 lines, ignoring generated files label Oct 12, 2026
},
{
"name": "kwh",
"justification": "KWH issues metering and signed receipts for active agent work (ontology domains/kwh; ruling documents/d-domain-rulings-oct9). Probed 2026-10-09 6:59 PM ET: every /v1/kwh, GET and POST, on gateway.wave.online answers 503 SPOKE_NOT_LIVE, so there is no served operation to document yet. Add real operations when the KWH spoke has a live origin. Honored only while the index carries no meter.",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Rewrite this public allowlist justification to describe the unavailable endpoint without disclosing metering or other pricing details.

Severity Level: Major ⚠️ · 🏷️ Custom_rule

Rule source 📖

CodeAnt dashboard (rule "rules-1790440327969-5ltphbdub")

Use CodeAnt Skill Fix in Cursor Fix in VSCode Claude

Prompt for AI Agent 🤖
This is a comment left during a code review.

**Path:** .github/scripts/skills-index-allowlist.json
**Line:** 12:12
**Comment:**
	*Custom Rule: Rewrite this public allowlist justification to describe the unavailable endpoint without disclosing metering or other pricing details.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎

},
{
"name": "kya",
"justification": "KYA is identity: a public, stranger-checkable agent record, free forever (ontology domains/kya; documents/d-kya-k7-free-with-enterprise). The served free identity op is already documented as identityResolve (/identity/resolve). Probed 2026-10-09 6:59 PM ET: every /v1/kya, GET and POST, on gateway.wave.online answers 503 SPOKE_NOT_LIVE, so there is no served operation to document yet. Honored only while the index carries no meter.",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Remove the free-forever claim and plan reference, and explain the exemption using only the endpoint's unavailable status.

Severity Level: Major ⚠️ · 🏷️ Custom_rule

Rule source 📖

CodeAnt dashboard (rule "rules-1790440327969-5ltphbdub")

Use CodeAnt Skill Fix in Cursor Fix in VSCode Claude

Prompt for AI Agent 🤖
This is a comment left during a code review.

**Path:** .github/scripts/skills-index-allowlist.json
**Line:** 19:19
**Comment:**
	*Custom Rule: Remove the free-forever claim and plan reference, and explain the exemption using only the endpoint's unavailable status.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎

Comment on lines +27 to +29
"expect": {
"pricing.meter": null
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: For kya and vrfy, the spokes can become live while pricing.meter stays null, so this predicate keeps bypassing coverage for undocumented operations.

Assessment: 🟠 Major · 🔁 Occurrence: Sometimes · 🏷️ Incorrect condition logic

Use CodeAnt Skill Fix in Cursor Fix in VSCode Claude

Prompt for AI Agent 🤖
This is a comment left during a code review.

**Path:** .github/scripts/skills-index-allowlist.json
**Line:** 27:29
**Comment:**
	*Incorrect Condition Logic: For `kya` and `vrfy`, the spokes can become live while `pricing.meter` stays null, so this predicate keeps bypassing coverage for undocumented operations.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎

@codeant-ai

codeant-ai Bot commented Oct 12, 2026

Copy link
Copy Markdown

CodeAnt PR Risk: Medium Risk

  • The PR needs attention before merging.
  • The KYA and VRFY exceptions key only on pricing.meter=null, so live free operations can remain excluded from index coverage.

Assessed commit: 52ff375bb894

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 issues found across 1 file

Confidence score: 3/5

  • skills-index-allowlist.json can keep KYA/VRFY exempt after they go live, leaving their skills permanently skipped by the coverage check. Tie the exemptions to endpoint availability rather than pricing.meter === null.
  • The public justification in skills-index-allowlist.json claims these endpoints are free forever and references enterprise plans. Remove those claims and say only that the endpoint is unavailable.
Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/scripts/skills-index-allowlist.json">

<violation number="1" location=".github/scripts/skills-index-allowlist.json:14">
P2: These exemptions persist after KYA/VRFY become live: both are described as free forever, while the only predicate is `pricing.meter === null`. `skills-index-coverage.mjs` then skips the uncovered skill indefinitely; expire the exemptions on a live-status change or remove them when those routes ship.</violation>

<violation number="2" location=".github/scripts/skills-index-allowlist.json:19">
P2: Remove the free-forever claim and enterprise-plan reference from this public justification; state only that the endpoint is unavailable.</violation>
</file>
Architecture diagram
sequenceDiagram
    participant Index as Skills Index (allowlist.json)
    participant Checker as API Spec Coverage Checker
    participant Gateway as Wave Gateway
    participant Spoke as Unmetered Spokes (KWH/KYA/VRFY)
    participant Meter as Meter Service

    Note over Index,Checker: Runtime Validation Flow
    
    Checker->>Index: Read allowlist entries
    Index-->>Checker: Return entries with name + justification
    
    loop For each allowlisted capability (kwh, kya, vrfy)
        Checker->>Checker: Check pricing.meter expectation
        alt Meter is null (unmetered)
            Checker->>Gateway: Probe /v1/{capability} endpoints (GET/POST)
            Gateway->>Spoke: Forward request to spoke
            Spoke-->>Gateway: Respond 503 SPOKE_NOT_LIVE
            Gateway-->>Checker: Return 503 status
            Checker->>Checker: Mark as NOT_LIVE (no operation to document)
            Checker-->>Index: Accept entry without operations
        else Meter is present
            Checker->>Meter: Detect meter attached to capability
            Meter-->>Checker: Meter information
            Checker->>Checker: Validate documented operations required
            alt Operations missing
                Checker-->>Index: Reject entry (missing-operation error)
            else Operations present
                Checker-->>Index: Accept entry with operations
            end
        end
    end
    
    Note over Index,Checker: Entry expires automatically when meter appears
    Checker->>Meter: Periodic meter availability check
    Meter-->>Checker: New meter detected for capability
    Checker->>Checker: Remove allowlist exception for that capability
Loading

Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic

},
{
"name": "kya",
"justification": "KYA is identity: a public, stranger-checkable agent record, free forever (ontology domains/kya; documents/d-kya-k7-free-with-enterprise). The served free identity op is already documented as identityResolve (/identity/resolve). Probed 2026-10-09 6:59 PM ET: every /v1/kya, GET and POST, on gateway.wave.online answers 503 SPOKE_NOT_LIVE, so there is no served operation to document yet. Honored only while the index carries no meter.",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Remove the free-forever claim and enterprise-plan reference from this public justification; state only that the endpoint is unavailable.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/scripts/skills-index-allowlist.json, line 19:

<comment>Remove the free-forever claim and enterprise-plan reference from this public justification; state only that the endpoint is unavailable.</comment>

<file context>
@@ -6,5 +6,26 @@
+  },
+  {
+    "name": "kya",
+    "justification": "KYA is identity: a public, stranger-checkable agent record, free forever (ontology domains/kya; documents/d-kya-k7-free-with-enterprise). The served free identity op is already documented as identityResolve (/identity/resolve). Probed 2026-10-09 6:59 PM ET: every /v1/kya, GET and POST, on gateway.wave.online answers 503 SPOKE_NOT_LIVE, so there is no served operation to document yet. Honored only while the index carries no meter.",
+    "expect": {
+      "pricing.meter": null
</file context>
Suggested change
"justification": "KYA is identity: a public, stranger-checkable agent record, free forever (ontology domains/kya; documents/d-kya-k7-free-with-enterprise). The served free identity op is already documented as identityResolve (/identity/resolve). Probed 2026-10-09 6:59 PM ET: every /v1/kya, GET and POST, on gateway.wave.online answers 503 SPOKE_NOT_LIVE, so there is no served operation to document yet. Honored only while the index carries no meter.",
"justification": "Probed 2026-10-09 6:59 PM ET: every /v1/kya GET and POST request on gateway.wave.online answers 503 SPOKE_NOT_LIVE, so there is no served operation to document yet.",

"name": "kwh",
"justification": "KWH issues metering and signed receipts for active agent work (ontology domains/kwh; ruling documents/d-domain-rulings-oct9). Probed 2026-10-09 6:59 PM ET: every /v1/kwh, GET and POST, on gateway.wave.online answers 503 SPOKE_NOT_LIVE, so there is no served operation to document yet. Add real operations when the KWH spoke has a live origin. Honored only while the index carries no meter.",
"expect": {
"pricing.meter": null

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: These exemptions persist after KYA/VRFY become live: both are described as free forever, while the only predicate is pricing.meter === null. skills-index-coverage.mjs then skips the uncovered skill indefinitely; expire the exemptions on a live-status change or remove them when those routes ship.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/scripts/skills-index-allowlist.json, line 14:

<comment>These exemptions persist after KYA/VRFY become live: both are described as free forever, while the only predicate is `pricing.meter === null`. `skills-index-coverage.mjs` then skips the uncovered skill indefinitely; expire the exemptions on a live-status change or remove them when those routes ship.</comment>

<file context>
@@ -6,5 +6,26 @@
+    "name": "kwh",
+    "justification": "KWH issues metering and signed receipts for active agent work (ontology domains/kwh; ruling documents/d-domain-rulings-oct9). Probed 2026-10-09 6:59 PM ET: every /v1/kwh, GET and POST, on gateway.wave.online answers 503 SPOKE_NOT_LIVE, so there is no served operation to document yet. Add real operations when the KWH spoke has a live origin. Honored only while the index carries no meter.",
+    "expect": {
+      "pricing.meter": null
+    }
+  },
</file context>

@wave-bugbot

wave-bugbot Bot commented Oct 12, 2026

Copy link
Copy Markdown

🟢 WAVE BugBot — clear

No confident findings on the changed lines.

Local review · $0 inference · wave-dispatch

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:S This PR changes 10-29 lines, ignoring generated files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant