Hard Requirements (Must Pass)
These are non-negotiable. Your PR will not be merged without meeting all of these:Follows SDK pattern
main.py extends MatchingCapability and has both register_capability() and call() methodsBlocked Imports and Keywords
These imports and patterns are not allowed for security, isolation, and multi-tenant safety:| Blocked | Why | Use Instead |
|---|---|---|
print() | Bypasses structured logging | self.worker.editor_logging_handler |
open() (raw) | Unmanaged filesystem access | self.capability_worker.read_file() / write_file() |
redis | Direct datastore coupling | Platform-provided helpers |
connection_manager | Breaks isolation & multi-tenant safety | CapabilityWorker APIs |
user_config | Can leak/mutate global state | CapabilityWorker / worker APIs |
exec() | Insecure dynamic code execution | Not allowed |
eval() | Insecure dynamic code execution | Not allowed |
pickle | Insecure deserialization | Use json instead |
dill | Insecure deserialization | Use json instead |
shelve | Insecure deserialization | Use json instead |
marshal | Insecure deserialization | Use json instead |
asyncio.sleep() | Session management bypass | self.worker.session_tasks.sleep() |
asyncio.create_task() | Session management bypass | self.worker.session_tasks.create() |
Full documentation: Blocked Imports and Keywords
Common Violations
Using print() for debugging
Using print() for debugging
Don’t do this:Do this instead:
Direct file operations
Direct file operations
Don’t do this:Do this instead:
Using asyncio directly for delays
Using asyncio directly for delays
Don’t do this:Do this instead:
Creating tasks without session management
Creating tasks without session management
Don’t do this:Do this instead:
SDK Pattern Requirements
Your ability must follow the correct SDK structure:Required Class Structure
resume_normal_flow() on Every Exit
This is one of the most common issues. Every path out of your ability must callresume_normal_flow():
Nice to Have (Strongly Encouraged)
These improve quality but won’t block your PR:- Spoken responses are short and natural (1-2 sentences per
speak()call) - Exit/stop handling in looping abilities (“exit”, “stop”, “cancel”)
- Inline comments explaining non-obvious logic
- Follows patterns from docs/patterns.md
- Graceful degradation when external services are unavailable
- Helpful error messages for users when things go wrong
Remember: This is voice interaction, not text chat. Keep responses conversational and concise.
What We Don’t Review For
We explicitly don’t block PRs for:- Whether an external API will keep working forever (APIs change - that’s okay)
- Whether it’s the “best” possible implementation (good enough is good enough)
- Future SDK compatibility (we’ll help with migrations when needed)
- Highly specific edge cases (we focus on common paths)
Common Issues and Fixes
Missing resume_normal_flow() on error path
Missing resume_normal_flow() on error path
Problem: Only calling
resume_normal_flow() in the success caseFix: Use a finally block to ensure it’s always called:Hardcoded API keys in code
Hardcoded API keys in code
Problem: Then in README:
api_key = "sk-abc123xyz"Fix: Use placeholders and document in README:Long spoken responses
Long spoken responses
Problem: Multi-paragraph responses that work in text but sound robotic when spokenFix: Break into shorter, conversational chunks:
No error handling on API calls
No error handling on API calls
Problem: API calls with no try/exceptFix: Always wrap external operations:
Files in wrong directory
Files in wrong directory
Problem: Submitted to
official/ or root directoryFix: All community contributions must be in:Pre-Submission Self-Review
Before submitting, go through this quick checklist:Getting Review Feedback
When you receive review feedback:- Read the full review - Reviewers often explain why changes are needed
- Ask questions - If something is unclear, ask in the PR comments
- Make changes - Push new commits to your branch (PR updates automatically)
- Respond to comments - Let reviewers know what you changed
- Be patient - Reviews can take 3-5 business days
Maintainers want to merge your PR! Review feedback is to ensure quality and security, not to block contributions.
