Skip to content

fix(artifact-delivery): read moved and oversized Repositories - #488

Merged
harlan-zw merged 3 commits into
mainfrom
fix/github-source-scale
Oct 6, 2026
Merged

harlan-zw merged 3 commits into
mainfrom
fix/github-source-scale

Conversation

@harlan-zw

Copy link
Copy Markdown
Collaborator

🔗 Linked issue

Related to #481

❓ Type of change

  • 📖 Documentation
  • 🐞 Bug fix
  • 👌 Enhancement
  • ✨ New feature
  • 🧹 Chore
  • ⚠️ Breaking change

📚 Description

An offline sweep of the 5,949 Skills that show a run command found 587 that fail as SERVICE_UNAVAILABLE when resolved by name. Two read rules in github-source.ts cause all of them.

Moved Repositories: 229 Skills in 13 Repositories. GitHub answers the old name of a renamed or transferred Repository with a 301 to /repositories/<id>. requestJson treated every redirect as fatal. facebook/react now lives at react/react, so all 14 of its Skills failed. In production, skilld run facebook/react/fix waits through the queue retries and ends with RESOLUTION_TIMEOUT.

  • A read now follows that one hop, and only to /repositories/<id> on api.github.com. Every other redirect stays fatal.
  • The Resolution keeps the name the request used. The released CLI rejects an attestation whose owner or Repository differs from its request.
  • A load checks the Repository ID, then reads every Git object by the current name, so no later read redirects.

Trees over the 8 MiB read limit: 358 Skills in 4 Repositories. A recursive tree read of posthog/posthog, n8n-io/n8n, vercel/next.js or openshift/hypershift returns more than 8 MiB. The read threw, the queue tried the build 5 times, and the Resolution failed. #481 already resolves an admitted name by its folder, so production no longer reads these trees for registry Skills.

  • A response over the limit is now a too-large value. It no longer throws into the retry ladder.
  • The search by name still serves names the registry does not hold, such as a private Skill. It now splits a tree that one response cannot hold: one read lists that level, and each folder gets its own recursive read.
  • Anyone can send a name, so the split search stops at 64 tree reads (MAX_NAME_SEARCH_TREE_READS). It stops early when the folders it still has to read cannot fit. n8n-io/n8n, vercel/next.js and openshift/hypershift need 27 to 45 reads. posthog/posthog needs more than 128, so a name the registry does not hold there gets INVALID_SOURCE with "Name the Skill by its path" after about 40 reads.
  • The Skill folder listing handles too-large the way it already handles a truncated listing.

Sweep harness counts for the Skills that failed on main, run offline against the shared GitHub cache. "Ready" means the site built the Artifact.

Class Request Before After
Moved Repository admitted folder, registry commit 229 SERVICE_UNAVAILABLE 229 ready
Tree over the read limit Skill name, branch head 358 SERVICE_UNAVAILABLE 91 ready, 267 INVALID_SOURCE (posthog/posthog)
Tree over the read limit admitted folder, branch head 352 ready, 6 folder gone at head Same

#484 also changes loadFromTarball. Whichever merges second resolves a small conflict there.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

A run of a Skill in a renamed or transferred Repository failed: GitHub
answers the old name with a 301 to /repositories/<id>, and every read
treated that redirect as fatal. 229 registry Skills across 13
Repositories hit it, facebook/react among them. The read now follows
that one hop on the API origin. The Resolution keeps the name the
request used, because the released CLI checks the attested name against
its request. A load trusts the Repository ID and reads by the current
name.

A tree response over the 8 MiB read limit threw, so the queue spent its
whole retry ladder and then failed as SERVICE_UNAVAILABLE. It is now a
value each caller answers. A named search splits a tree that one
response cannot hold, so a small Skill in posthog/posthog or
vercel/next.js resolves by name.
Anyone can send a name, and every tree read comes out of the site's
GitHub quota. The split walk now stops as soon as the folders it knows
about cannot fit the budget. posthog/posthog needs more than 128 reads,
so it used to spend 128 before it asked for a path; it now stops after
about 40. n8n-io/n8n, vercel/next.js and openshift/hypershift need 27 to
45 and still resolve.
@harlan-zw harlan-zw added the harlan-agent-review Pull request triage requires an adversarial Review. Adding this label manually always forces one. label Oct 6, 2026
@harlan-github-agent harlan-github-agent Bot added harlan-agent-review-required Pull request triage requires an adversarial Review for this head commit. harlan-agent-running An Agent holds a Task on this issue or pull request right now. and removed harlan-agent-review Pull request triage requires an adversarial Review. Adding this label manually always forces one. labels Oct 6, 2026
@harlan-github-agent

harlan-github-agent Bot commented Oct 6, 2026 •

Copy link
Copy Markdown
Contributor

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-06 15:59 UTC.

GitHub merged this pull request.

No material findings were recorded.

The pull request closed.

@harlan-github-agent harlan-github-agent Bot added harlan-agent-running An Agent holds a Task on this issue or pull request right now. and removed harlan-agent-running An Agent holds a Task on this issue or pull request right now. labels Oct 6, 2026
Keeps #487's slug match and omitted files on top of the split tree
listing. A truncated tree is now split, so the reject test truncates
the single level read too.
@harlan-github-agent harlan-github-agent Bot removed the harlan-agent-running An Agent holds a Task on this issue or pull request right now. label Oct 6, 2026
@harlan-zw
harlan-zw merged commit 16e3bca into main Oct 6, 2026
1 of 6 checks passed
@harlan-github-agent harlan-github-agent Bot removed the harlan-agent-review-required Pull request triage requires an adversarial Review for this head commit. label Oct 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant