Skip to content

Add the skill lifecycle hooks to the Trace mappings - #63

Open
sabasiddique1 wants to merge 5 commits into
GenAI-Security-Project:integrationfrom
sabasiddique1:fix/skill-hooks-trace-mappings
Open

Add the skill lifecycle hooks to the Trace mappings#63
sabasiddique1 wants to merge 5 commits into
GenAI-Security-Project:integrationfrom
sabasiddique1:fix/skill-hooks-trace-mappings

Conversation

@sabasiddique1

@sabasiddique1 sabasiddique1 commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown

What changed

skillRegister, skillLoad, and skillUnload had no entry in otel-mapping.json or ocsf-mapping.json, so a deployment claiming ACS-Trace had no normative span name or class_uid for a skill event. This adds both mappings, renders them on the Trace Events and Extending OCSF pages, corrects docs/acs.md from 16 to 19 hooks, and widens tests/test_hook_taxonomy.py to guard every surface that restates the hook set.

Which issue does this implement

Closes #57, closes #58.

  • This is an editorial correction (typo, grammar, link, formatting) with no change in meaning, so it needs no issue

Base branch

  • integration, because this touches the specification, schemas, a reference implementation, an adapter, tests, or CI
  • main, because every changed path is on the documentation lane allowlist in CONTRIBUTING.md

Type of change

  • Specification change (schema, hooks, events, AgBOM)
  • Reference implementation or adapter
  • Documentation
  • Tooling or CI
  • Governance (licensing, security policy, contributor docs)

Specification changes

  • I opened a Discussion before this PR
  • Schema changes validate against the JSON Schema spec
  • I described the impact on downstream implementers below

Breaking for implementers? No. Nothing on the wire changes. Three new keys appear in each mapping's default; existing keys, span names, and class assignments are untouched.

OTel: acs.skill.register, acs.skill.load, acs.skill.unload. Required attributes come from each schema's required list. acs.skill.load_path stays required because cascade containment is the reason the hook carries it.

OCSF: skillRegister/skillUnload → Inventory Info (5001), the class agbom/* uses, since they admit a skill to or remove it from the component set. skillLoad → Process Activity (1007), sibling of toolCallRequest. A denied skillRegister still surfaces as Detection Finding 2004 through decision_class. The alternative is 1005 Module Activity (Load=1, Unload=2); I will switch if the Spec leads prefer it.

Guard

The first commit widens the test and fails on exactly the surfaces #58 lists, plus one it did not: the class table in extend_ocsf.md never listed steps/agentTrigger. That row is fixed here too.

Not changed

The AgBOM trigger list in docs/spec/inspect/README.md omits skill; filed as #120. The "Sixteen" in specification/proposals/skill-lifecycle/README.md describes the pre-skill state and is correct in context.

I tested this

  • I synced my branch with the base branch before opening this
  • uv run pytest -v passes on my machine
  • uv run mkdocs build --strict passes on my machine

Checklist

  • Commits are signed off with git commit -s (required by the DCO)
  • Prose follows STYLE.md
  • No secrets, tokens, or internal URLs in the diff

Security

  • This change has no security impact

@sabasiddique1
Guard the Trace surfaces and the ACS overview against hook drift
066ddde 
Signed-off-by: Saba Siddique <sabasiddiqdev@gmail.com>
@sabasiddique1
Add the skill lifecycle hooks to the Trace mappings
acbf3c6 
Signed-off-by: Saba Siddique <sabasiddiqdev@gmail.com>
@sabasiddique1

sabasiddique1 commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Retargeted to integration per #64 and synced; 283 guards pass (1 skipped on macOS), mkdocs build --strict clean.

Two decisions needed from the Spec leads (@bar-capsule @afogel):

  1. OCSF class for skill hooks — 5001 Inventory Info + 1007 Process Activity as implemented, or 1005 Module Activity (Load=1 / Unload=2)? I will update within the hour either way.
  2. status:accepted on [Docs] Skill lifecycle hooks have no ACS-Trace mapping (no OTel span, no OCSF class) #57 / [Bug] Skill lifecycle hooks missing from the trace mappings, acs.md, and the Trace pillar docs #58 — both already carry scope:in-focus and priority:P2.

RESTATING_THRESHOLD = 8 can become an explicit list if preferred. The agentTrigger row in extend_ocsf.md is a plain omission fix. OCSF 1.5 naming (5001 → "Device Inventory Info") and the missing skill entry in the AgBOM trigger list are out of scope here and filed as #120 and #121.

@sabasiddique1 sabasiddique1 mentioned this pull request Sep 9, 2026
Open
@rocklambros rocklambros mentioned this pull request Sep 9, 2026
Merged
@rocklambros rocklambros moved this to In progress in ACS Project Tracker Sep 10, 2026
rocklambros added a commit that referenced this pull request Sep 10, 2026
@rocklambros
Install the contribution governance for the OWASP re-launch (#64)
7cf72e4 
Operationalizes the contribution governance the core team agreed on
September 8, filtered through the Strategic Adoption Plan v3 committed
outcome.

Design: `design/2026-09-09-contribution-governance-design.md` (v1.1)
Plan: `design/plans/2026-09-09-contribution-governance.md`

## What this installs

**Current Priority Scope.** `CONTRIBUTING.md` gains one section that
states what the project is driving at for the next ninety days, what is
deferred to v0.2.0, and what is out of scope by design. It is stated
once. Every other surface links to it rather than restating it, and the
landing page now renders it straight out of `CONTRIBUTING.md` so the two
cannot drift.

**Branching.** `main` publishes the site and all 44 schema `$id` URIs on
merge, so specification and code land on `integration` and publish on a
deliberate promotion. A guard (`tools/base_branch_guard.py`, 16 tests)
enforces a positive path allowlist and fails closed on anything nobody
anticipated. The promotion exemption checks the head *repository*, not
just the ref, so a fork branch named `integration` cannot walk a schema
change onto the publishing branch.

**Intake.** Blank issues are off. Six forms route by type, and no form
can stamp a `scope:`, `priority:`, `workstream:`, or `status:accepted`
label. That prohibition is the whole structural guarantee behind
maintainer-only triage. The sixth form asks for nothing but a
description, because the strongest outside contribution this project has
received would have fit none of the other five.

**The gate.** A change to behavior, normative text, or code references
an issue carrying `status:accepted`. An editorial correction does not,
wherever it lands. A pull request whose issue is not accepted yet is
neither closed nor reviewed. It waits, and a bot says why.

**Automation.** Four workflows: the base-branch guard, an integration
sync, a weekly promotion pull request, and the intake comment. Plus a
reminder that opens an issue when the priority scope passes its review
date.

**Phase 2 executor.** `tools/apply_governance.py` performs the live
migration steps idempotently, `--dry-run` by default. It is structurally
incapable of merging, closing, or retargeting a pull request, and a test
asserts no code path can emit those commands.

## Authorship policy change

The rule that a maintainer strips a `Co-Authored-By` trailer naming a
model is removed. The project now mandates neither direction. The human
`Signed-off-by` stays required, because only a person can make the DCO
certification. A standard about agent provenance should not erase the
provenance of its own commits.

## Reviewer notes

- Nothing on the published site changes except the landing page's
Contribute section. I built the full pipeline from `main` and from this
branch and diffed: the only files that differ are `index.html` and
`acs.css`. All 44 schemas are byte identical.
- 253 tests pass. `mkdocs build --strict` passes.
- This targets `integration` rather than `main` because it touches
`.github/`, `tools/`, and `tests/`, which is exactly what the guard it
installs requires.

## Still to do after this merges

Retarget #63, #24, #60, and #22 to `integration`. Merge #21, #20, and
#22 when the team is ready. Then run the executor for rulesets, default
branch, required check, and the seeded issues. The order that matters is
in the plan.

---------

Signed-off-by: rocklambros <rock@rockcyber.com>
@sabasiddique1
sabasiddique1 changed the base branch from main to integration September 14, 2026 17:26
@github-actions github-actions Bot added the status:needs-triage Not yet triaged. Applied by the issue forms label Sep 14, 2026
@github-actions

github-actions Bot commented Sep 14, 2026

Copy link
Copy Markdown

Thanks for this. It is queued rather than ignored.

This pull request does not reference an issue carrying status:accepted, so a maintainer has not looked at it yet and will not until the underlying issue is triaged. Nothing here is rejected. See Current Priority Scope for what the project is working on, and help wanted for work that is already accepted.

If this is an editorial correction, tick that box in the description and this comment stops applying.

@sabasiddique1
Merge remote-tracking branch 'upstream/integration' into fix/skill-ho…
395f73e 
…oks-trace-mappings

Signed-off-by: Saba Siddique <sabasiddiqdev@gmail.com>
@sabasiddique1
Merge branch 'fix/skill-hooks-trace-mappings' of github.com:sabasiddi…
d75b6f4 
…que1/agent-control-standard into fix/skill-hooks-trace-mappings
This was referenced Sep 14, 2026
Open
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rocklambros rocklambros Awaiting requested review from rocklambros rocklambros is a code owner
@fewdisc fewdisc Awaiting requested review from fewdisc fewdisc is a code owner
@GangGreenTemperTatum GangGreenTemperTatum Awaiting requested review from GangGreenTemperTatum GangGreenTemperTatum is a code owner
@mamicidal mamicidal Awaiting requested review from mamicidal mamicidal is a code owner
@sclintonowasp sclintonowasp Awaiting requested review from sclintonowasp sclintonowasp is a code owner
@afogel afogel Awaiting requested review from afogel afogel is a code owner
@bar-capsule bar-capsule Awaiting requested review from bar-capsule bar-capsule is a code owner
@stefanoamorelli stefanoamorelli Awaiting requested review from stefanoamorelli stefanoamorelli is a code owner
@almogbhl almogbhl Awaiting requested review from almogbhl almogbhl is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

status:needs-triage Not yet triaged. Applied by the issue forms

Projects

ACS Project Tracker
Status: In progress

Milestone

No milestone

2 participants

@sabasiddique1 @rocklambros