docs: regenerate rules from documentation@5cda815 - #77
docs: regenerate rules from documentation@5cda815#77harper-skills-sync[bot] wants to merge 1 commit into
Conversation
5da4a74 to
3a11978
Compare
harper-skills-sync
Bot
changed the title
kriszyp
left a comment
kriszyp
left a comment
There was a problem hiding this comment.
🤖 Reviewed with Codex
Proposed inline comments (anchors failed):
harper-best-practices/rules/vector-indexing.md:118: The source documentation’s complete example also overridesget(), becauserowFilterdoes not protect a direct primary-key GET. As written, an agent following this “row-level access control” recipe can secure searches and subscriptions while/Reports/<id>still returns another owner’s record. Please retain the source’sget(target)branch—attaching the filter for collection reads and explicitly authorizing loaded single records—or clearly scope this recipe as search/subscription-only. Since this file is generated, please also add direct-GET handling to generation coverage so later syncs cannot regress it.
— KrAIs (GPT-5)
harper-best-practices/rules/vector-indexing.md:119:rowFiltercannot evaluate delete tombstones, value-less invalidations, raw events, or published messages when they lack an authoritative row; without aneventFilter, those events are withheld. This recipe therefore silently loses deletes and similar events for otherwise authorized rows. Please preserve the source documentation’s caveat andeventFilterpattern (including its ID-prefix invariant), or explicitly state that this example delivers only full-row events.
— KrAIs (GPT-5)
harper-best-practices/rules/v5-upgrade.md:94:saveBeforeCommitbelongs in the options passed to Harper’screateBlob()API, as shown inharper-best-practices/rules/using-blob-datatype.md:50-54; it is not a nativeBlobconstructor option. Following this instruction as written can leave the transaction committing while streamed blob data is still being written. Please show the actual replacement, such ascreateBlob(source, { saveBeforeCommit: true }), and strengthen generation coverage so the API name cannot be lost on later syncs.
— KrAIs (GPT-5)
harper-best-practices/rules/v5-upgrade.md:148: This now presentsallowedDirectory: anyas a standalone migration example while removing the prior warning that production should retainallowedDirectory: appunless external module loading is genuinely required. An agent following the example can unnecessarily widen the component’s module-loading boundary. Please restore that warning next to the example, or omit the example from this general migration recipe.
— KrAIs (GPT-5)
harper-best-practices/rules/v5-upgrade.md:39: This generated code block prefixes a tab with spaces; the same issue occurs at line 48 and in the generated aggregate. Consequently,git diff --check origin/main...HEADfails with four whitespace errors. Please normalize the rule-body indentation and rebuild the aggregate.
— KrAIs (GPT-5)
| ## How It Works | ||
|
|
||
| 1. **Import `tables`**: Pull `tables` from the `harper` package. Each property on `tables` corresponds to a table defined in `schema.graphql`. | ||
| 1. **Import `tables`**: Import from the `harper` package. Each table defined in `schema.graphql` with `@table` is available as a property. |
There was a problem hiding this comment.
tables contains only tables from the default data database; a schema type declared with @table(database: "analytics"), as this regeneration now demonstrates elsewhere, is available through databases.analytics, not tables. Following this statement makes tables.Event unexpectedly undefined. Please preserve the default-database qualifier and direct readers to databases.<name> for non-default tables, with generation coverage for that distinction.
— KrAIs (GPT-5)
| - `@expiresAt` — marks a field as the record's absolute expiration time (Unix epoch ms) | ||
| - `@embed(source:, model:)` — computes an embedding vector when the source field is written; field type must be `[Float]` | ||
| - `@hidden` — suppresses the field from MCP tool descriptors and OpenAPI document (not an access-control mechanism) | ||
| Without `name`, the type name is used as the path segment. Omitting `@export` removes the REST/MQTT route (callers get 404) but does **not** protect the data — the table remains accessible through the Operations API and SQL subject to RBAC. |
There was a problem hiding this comment.
MQTT does not return HTTP 404 responses, so “returns 404 on REST/MQTT” conflates the REST and MQTT failure behavior. Please state the REST 404 behavior separately and describe MQTT as unavailable/not routed unless the source documentation defines a specific MQTT acknowledgment outcome.
— KrAIs (GPT-5)
|
|
||
| ```javascript | ||
| const record = await Product.update(target.id); | ||
| const record = await this.update(target.id); |
There was a problem hiding this comment.
The source example places this.update(target.id) inside a static resource method where both this and target exist. The generator removed that wrapper, so copying this standalone table-class recipe throws because neither identifier is defined. Please retain the enclosing method or use a self-contained call such as Product.update(productId), then protect the example shape in generation coverage.
— KrAIs (GPT-5)
| - Sorting by a bare `@primaryKey` with no conditions raises `HdbError: <attribute> is not indexed and not combined with any other conditions`. Add an open-ended condition or pass `allowFullScan: true`. | ||
| - Selecting a relationship field without filtering on it behaves as a **LEFT JOIN**. Adding a condition on a related attribute (e.g. `attribute: ['author', 'name']`) behaves as an **INNER JOIN**. | ||
| - `tables` calls run in a trusted server-side context and do **not** automatically apply the target table's role permissions. Enforce authorization in your own application logic. | ||
| - Sorting by a non-indexed `attribute` with zero `conditions` throws `HdbError: <attribute> is not indexed and not combined with any other conditions`. Add a condition or pass `allowFullScan: true`. |
There was a problem hiding this comment.
This regeneration removes every mention of limit, offset, and the sort descriptor’s descending/next properties even though Query Object remains a primary source. An agent using this rule can no longer construct pagination or deterministic tie-breaking. Please retain a concise query-options section and add these core option names to generation coverage so later summaries cannot silently discard them.
— KrAIs (GPT-5)
| 5. **Implement logout via `context.session.delete`**: Check that `context.session` exists, then call `context.session.delete(context.session.id)` to end the session. | ||
|
|
||
| Duration strings follow the `jsonwebtoken` package format (e.g., `1d`, `12h`, `60m`). | ||
| 6. **Choose the right auth mechanism for the client**: Cookie-based sessions are intended for browser clients. For non-browser clients (CLI tools, mobile apps, service-to-service), use JWT issuance instead. |
There was a problem hiding this comment.
The supplemental JWT Authentication documentation still provides create_authentication_tokens and refresh_operation_token flows through server.operation(). This regeneration tells non-browser clients to use JWT issuance but removes every API call and example needed to do so, so an agent cannot implement the recommendation. Please restore concise issue/refresh examples and the current-user authorization behavior, and add the operation names to generation coverage so later syncs cannot discard the supplemental source again.
— KrAIs (GPT-5)
| ``` | ||
|
|
||
| 9. **Use unique database names** in plugins or applications to avoid table naming collisions, since all tables default to the `data` database. | ||
| 7. **Use unique database names in plugins**: All tables default to the `data` database. Specify a unique `database` argument in `@table` to avoid naming collisions when building plugins or applications. |
There was a problem hiding this comment.
The selected Schema field-directives source documents @embed, @createdTime, @updatedTime, @expiresAt, and field-level @hidden. This regeneration no longer mentions embeddings or audit timestamps at all and shows @expiresAt without explaining that it takes an absolute Unix-millisecond timestamp. Please restore concise coverage of these directives—including the [Float] and absolute-time constraints—and make their identifiers generation requirements.
— KrAIs (GPT-5)
| type Product @table { | ||
| id: Long @primaryKey | ||
| name: String @indexed | ||
| name: String |
There was a problem hiding this comment.
This regenerated fence combines spaces before a tab. The same pattern appears in this rule’s other GraphQL examples, in programmatic-table-requests.md, and in their generated AGENTS.md mirrors; git diff --check origin/main...HEAD reports 14 errors. Please normalize both source rules, rebuild the aggregate, and add a diff-check generation guard so another successful sync cannot commit mixed indentation.
— KrAIs (GPT-5)
3a11978 to
2b3feb6
Compare
harper-skills-sync
Bot
changed the title
harper-skills-sync
Bot
changed the title
a7dfe1d to
6fc535a
Compare
harper-skills-sync
Bot
changed the title
6fc535a to
9ac5b3f
Compare
harper-skills-sync
Bot
changed the title
9ac5b3f to
036702a
Compare
harper-skills-sync
Bot
changed the title
1 participant
Automated regeneration of docs-driven skill rules, now synced to
HarperFast/documentation@5cda815.Why these rules changed
Each rule regenerated because its source content differs from the docs commit it was last synced from. The trigger commit is not necessarily what changed a given rule — drift accumulates across every docs commit since the rule’s recorded baseline (below).
schema-design-tooling— last synced from docs@3749d0cautomatic-apis— last synced from docs@3749d0cquerying-rest-apis— last synced from docs@3749d0cchecking-authentication— last synced from docs@b7fbddaprogrammatic-table-requests— last synced from docs@3749d0cdeploying-to-harper-fabric— last synced from docs@6bf676denabling-mcp— last synced from docs@d7d2ddbcustom-mcp-tools— last synced from docs@d7d2ddbDocs commits since baseline (
d7d2ddb..5cda815)Produced by
.github/workflows/generate.yaml. Review the diff as you would any rule change — the generator reads the docs build output and rewritesmode: generate/ importsmode: directrule bodies, then reassembles AGENTS.md. See docs/plans/docs-driven-skills.md.🤖 Generated with Claude Code