This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryUpdates Added — onboarding scaffold, Added — adopter playbook, and Changed — OutputKind cleanup across a mixed release.
Full changelog
Agent-as-author hardening. Closes structural gaps surfaced by the v0.7.3
roadmap review (076bdeac, Perry/CC thread, May 26). The language shape
locked at v0.7.2; v0.7.3 hardens the adopter surface so agents (and the
humans wiring them up) have a substrate-neutral, merge-friendly, honestly-
documented surface to build against. $ memory_write is deferred to v0.8.x
bundled with the passthrough auth model — see the auth design thread
43178c86 for the settled framing.
Added — adopter-extensible connector class registry
registerConnectorClass(name, entry)public API. Adopters with custom
McpConnectorclasses call this from their bootstrap before
loadConnectorsConfigruns. Closes the merge-conflict bait of editing
the bundledKNOWN_CONNECTOR_CLASSESMap directly. Adopter overrides
take precedence over bundled set on name collision (lets adopters swap
bundled classes with hardened variants). Companion:unregisterConnectorClass,
getConnectorClass. Seeexamples/custom-bootstrap.example.ts.
Added — canonical runtime config
skillscript.config.json. Externalizes runtime knobs (skillsDir,
traceDir, memoryDbPath, dashboard port + host, pollIntervalSeconds,
enableUnsafeShell, mode, ollamaBaseUrl, triggersFilePath,
connectorsConfigPath) into one declarative file.${VAR}substitution
matchesconnectors.json. Loader is graceful on missing file. CLI's
dashboard/servecommands accept--config <path>; CLI flags
override file values; file values override defaults.- Driver: two-instance posture. Running dev-skillscript + adopter-wiring
instance on the same machine requires independent ports/paths. The
config file makes this a copy-and-tweak operation rather than threading
CLI flags. skillscript.config.json.exampleships at repo root as the template.
Added — onboarding scaffold (examples/onboarding-scaffold/)
- Complete adopter deployment with file-backed memory + OpenAI LLM +
tmux-shell agent delivery. ~200 LOC across three adapter files plus
bootstrap. Case-1 typed-contract wiring end-to-end — skills authored
against this scaffold use canonical$ llm/$ memoryand run
unchanged against any other Case-1 substrate. file-memory-store.ts—MemoryStoreimpl over a JSON file with
simple substring FTSopenai-local-model.ts—LocalModelimpl over OpenAI Chat
Completions APItmux-shell-agent-connector.ts—AgentConnectorimpl viatmux send-keys(mirrors what nanoclaw-style harnesses do internally)bootstrap.ts— wiring example tying all three together with the
v0.7.2 bridgesREADME.mdwalking through quick-start, two-instance posture, and
what to modify for production
Added — adopter playbook (docs/adopter-playbook.md)
- Case-1 typed-contract vs Case-2 MCP-tools wiring tradeoff (the
load-bearing decision) - Joe-Programmer setup walkthrough
- Conventions for upstream-merge-friendly modifications (dedicated
adopter files,// ADOPTER:org —sentinels, public registration APIs) - Substrate ship-status table with honest v0.7.x gap callouts
- Skill discovery + cross-agent composition patterns under Case-1 memory
Changed — OutputKind cleanup (substrate-neutrality)
- Dropped
slackandcardfromOutputKind. Substrate-specific
delivery names in what's supposed to be a substrate-neutral language.
Same anti-pattern v0.7.0 removed forLocalModelandMemoryStore
dispatch shapes.OutputKindnow:text/prompt-context: <agent>/
template: <agent>/file: <path>/none. Adopters wanting
Slack / WhatsApp / Discord / etc. use either$ slack.post ...MCP
dispatch inside the skill body OR# Output: prompt-context: <agent>
letting the receiving agent decide. The bundledEmissionConnector
v1.x backlog item is also dropped — MCP-dispatch handles the use case. - Substrate-neutrality sweep of the language surface (parser
enums, lint code names, ambient refs, frontmatter values, help
content). Clean post-cleanup; no other substrate-specific leaks
found in the language contract. Internal AST fieldampParams
flagged for renaming in a future pass (not user-facing, no
contract impact).
Changed — reference bootstrap framing
src/bootstrap.tsreframed as reference wiring, not canonical.
File header +bootstrap()docstring explicitly direct adopters with
custom substrates to write their own bootstrap importing the public
APIs.bootstrap()remains part of the v0.7.x+ stable public surface
for default deployments. Seeexamples/custom-bootstrap.example.tsexamples/onboarding-scaffold/bootstrap.ts.
Changed — public exports
- New top-level exports from
skillscript-runtime:
loadSkillscriptConfig,bootstrap,defaultRegistry,
wireDeclarativeTriggers,registerConnectorClass,
unregisterConnectorClass,getConnectorClass,
listKnownConnectorClasses,loadConnectorsConfig. - New
skillscript-runtime/connectorsexports:
LocalModelMcpConnector,MemoryStoreMcpConnector(so adopter
bootstraps can wire bridges over their own typed-contract impls
without reaching into bundledbootstrap()).
Deferred to v0.8.x
$ memory_writewith theMemoryStore.write({content, tags?, recipients?, expires_at?, metadata?})contract extension. Ships
bundled with the passthrough auth model so the credibility-crack of
documented-but-unshipped delivery closes alongside the auth design.- Authorization model. Mixed: passthrough for op-level mutations
(substrate enforces; runtime threads credentials); runtime-enforced
for skill-promotion (# Status: Draft → Approvedrequires non-author
signer).# Autonomous: truebecomes documentation;unconfirmed-mutation
lint drops (substrate enforcement makes it theater). New-version-of-
same-name returns to Draft on content change. See thread43178c86
for the settled design.
Deferred (post-v0.7.3 ship)
- R7 cold-author harness. Tests NFR-6 agent-modifiability empirically:
cold agent adds a new filter, a new lint rule, and a new runtime-
intrinsic op against the v0.7.3 file layout. If they succeed, NFR-6 is
satisfied empirically; if they fail, the failure mode targets which
extension point to refactor first. Evidence-driven, no major-version
refactor slot.
Notes for cold authors
- Run
help({topic: "frontmatter"})for the updated 5-kind OutputKind set. - Adopters integrating new substrates: see
docs/adopter-playbook.md
for the Case-1 vs Case-2 framing — this is the most important
decision in your wiring. ${VAR}interpolation, the canonical$ llm/$ memorysurfaces,
bare-form bridge dispatch, the v0.7.2 typed contracts — all unchanged
in v0.7.3. Existing skills run as-is unless they used# Output: slack:
or# Output: card:(rewrite toprompt-context:or use MCP dispatch).
Breaking Changes
- Dropped `slack` and `card` from `OutputKind`; adopters must use `$ slack.post ...` MCP dispatch or `# Output: prompt-context:` instead.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Skillscript
All releases →Related context
Related tools
Earlier breaking changes
- v0.35.0 Editing `# Deadline:` on an approved skill drops it to Draft (signature invalidates).
Beta — feedback welcome: [email protected]