--- name: artifact-yylo description: Capture and retrieve durable YYLO Ledger artifact Records with intentional profiles, payload modes, provenance, retention, and secret-safe immutable evidence. category: project-management risk: safe source: https://github.com/yylo-dev/yylo-skills source_repo: yylo-dev/yylo-skills source_type: community date_added: '2026-09-19' license: MIT license_source: https://github.com/yylo-dev/yylo-skills/blob/main/LICENSE compatibility: Requires the `yy` CLI with the `artifact` record group installed. Captures immutable, secret-safe evidence with provenance and retention; never publishes or deploys. argument-hint: '[artifact or evidence to capture/find/inspect]' enable-shell-directives: true --- # Use YYLO artifact Records Treat Ledger as the source of truth for artifact identity and metadata. Use `yy ledger` in a YYLO controller or `yylo-ledger` standalone. Inspect `COMMAND artifact --help`; if unavailable, do not create store files manually. A Ledger Artifact Record is durable evidence, not an npm/Python release artifact and not an implicit request to publish or deploy. ## Classify before capture Choose the profile matching the evidence: - `stdout`: bounded process output; - `model-output`: an agent/model response; - `report`: a generated human- or machine-readable result; - `receipt`: evidence binding an operation and its inputs/outcome. Choose payload mode deliberately: - `inline`: small immutable bytes embedded in the Record; - `local`: immutable content-addressed bytes in Ledger storage; - `external`: immutable external bytes with URI, digest, and size; - `link`: URI reference without an immutable-byte guarantee. Prefer immutable evidence when later verification depends on exact bytes. A link must never be presented as content-addressed proof. ## Create explicitly Use file/stdin transport and provide the media type: ```bash yy ledger artifact create --title "Focused test report" --profile report \ --mode local --media-type application/json --file report.json ``` For external immutable content, provide the supported URI, SHA-256 digest, and size shown by installed help. Never embed URI credentials. Ledger rejects unsafe schemes, traversal, size/digest mismatches, oversized capture, and known secret patterns. Attach only supported, non-secret provenance such as actor, agent, model, session, run, invocation, task, or workflow identity. Task/workflow provenance uses immutable Record IDs. Select `temporary`, `standard`, or `permanent` retention deliberately; retention metadata does not itself authorize deletion. ## Operational-document boundary This storage convention applies only when the user/project has adopted YYLO Ledger. Repository instructions and the requested deliverable location take precedence; a generic artifact request does not authorize moving existing plans/docs into Ledger. Secret detection is defense in depth, not a guarantee: inspect and redact payloads before capture, including externally referenced bytes. Store new PDRs, architecture and migration contracts, plans, reports, receipts, and execution evidence as Artifact Records. Draft through a fresh external file, capture it with an intentional profile and immutable payload mode, read it back, and verify its ID, digest, size, provenance, retention, and history before removing the draft. Use the `report` profile for human-readable PDRs/contracts unless installed help provides a more specific approved profile. Product `docs/` is only for documentation shipped as part of the product. Never put operational evidence there to manufacture a task product diff. Preserve legacy `.juno_task/specs` files, but do not create new ones as a fallback. If the installed artifact API is unavailable, stop with the external draft intact and request a Ledger upgrade; do not put it in task bodies, responses, product docs, or manually managed controller paths. ## Find and verify ```bash yy ledger artifact search --profile report --projection summary --limit 20 -f json yy ledger artifact get RECORD_ID -f json yy ledger artifact history RECORD_ID -f ndjson ``` Use bounded metadata/summary projections before requesting payload details. Verify profile, mode, media type, digest, size, provenance, retention, revision, and immutable ID before relying on evidence. Artifact payloads are immutable evidence. Represent replacement with explicit predecessor/successor relationships and the installed revision-safe update contract; do not overwrite bytes or edit content objects. Archive is a lifecycle transition, not deletion. Release, publication, external upload, retention execution, and production mutation always require separate authority. ## Complete request $ARGUMENTS ## When to Use - You need to capture or retrieve durable YYLO Ledger artifact Records (stdout, model-output, report, receipt) with provenance, retention, and immutable payloads. - New operational PDRs, contracts, plans, reports, and receipts belong here - not in product docs, task bodies, or new `.juno_task/specs` files. ## Limitations - Payloads are immutable: represent replacement with predecessor/successor relations, never by overwriting bytes. Archive is a lifecycle transition, not deletion. - Secret-safe only: never embed URI credentials; Ledger rejects unsafe schemes, traversal, size/digest mismatches, and known secret patterns. - Retention metadata never authorizes deletion; release, publication, upload, and production mutation always need separate authority. ### Example ```bash yy ledger artifact search --profile report --projection summary --limit 20 -f json yy ledger artifact get RECORD_ID -f json ``` > Adapted from [yylo-dev/yylo-skills](https://github.com/yylo-dev/yylo-skills) (MIT) - v2.0.1; frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. --- Source attribution: yylo-dev/yylo-skills contributors, via Agentic Awesome Skills Original project: https://github.com/yylo-dev/yylo-skills License: MIT + CC-BY-4.0 License information: https://creativecommons.org/licenses/by/4.0/ Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2026 JUNO AI INC. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: yylo-dev/yylo-skills contributors, via Agentic Awesome Skills Original project: https://github.com/yylo-dev/yylo-skills Attribution basis: Recorded upstream repository Fields of work: Project & Program Management Roles: Project Manager Specialties: Specialty not specified Tools: Tool not specified Country applicability: Country not specified Classification basis: Dave AI task classification from package title, description, and declared metadata Instruction SHA-256: 4d645b6535cdc35682f2af54fc0c227b585a47981d3ce94335794d3bd2d90d10 Metadata reviewed: 2026-10-27 This metadata supersedes earlier Mega AI Hub catalog attribution. Original instruction and supporting files are preserved.