[Feature] Let skill authors track review progress and resubmission history

[XiaoSeS]

Problem

Skill authors do not have a durable place to track the outcome of their review submissions. The current my-submissions view only returns pending tasks, so an item disappears after approval or rejection. Notifications help at the moment of a decision, but they do not provide a searchable progress view or preserve the sequence of review comments across repeated submissions.

The current same-version resubmission path also deletes all review tasks for the replaceable version. That makes an accurate attempt history impossible to reconstruct and removes useful governance context after an author addresses reviewer feedback and resubmits.

Proposed Solution

Add an author-facing review progress workflow as one end-to-end slice:

• Provide a paginated “Review Progress” page that groups entries by skill version and shows the latest status, submission/review times, latest comment, and attempt count.
• Support status filtering, skill/namespace search, and current-status summary counts without loading every historical task into memory.
• Let an author expand a row or open a detail view to see every submission attempt, numbered in submission order and displayed newest first.
• Preserve settled review tasks when the same version is resubmitted; only an obsolete still-pending task should be withdrawn.
• Apply the existing review visibility rules so only the submitter and authorized reviewers can read the history.
• Link the workflow from the author dashboard and provide a resubmit action for rejected entries.
• Add repository/query indexes and backend, frontend, authorization, and regression tests for multiple attempts, filtering, pagination, and empty states.

This should complement, not replace, review notifications. It is distinct from #205, which was resolved by notifying authors about review decisions.

Alternatives Considered

• Rely only on notifications: notifications are transient and do not provide a complete audit trail or multi-attempt context.
• Keep showing only pending submissions: authors still cannot inspect completed or rejected reviews after the task leaves the queue.
• Return every review task as a flat list: repeated attempts become noisy, current state is unclear, and pagination can split attempts for the same version unpredictably.

Impact

This changes review-task retention semantics for same-version resubmissions and adds read queries over historical review data. It requires authorization checks, a supporting database index, localized UI states, and care around pagination/query performance. Existing review approval and rejection behavior should remain unchanged.

Contract Or SDK Impact

Additive OpenAPI changes are expected: an endpoint for the current user's grouped review progress and an endpoint for authorized per-task/per-version history. Generated web API types must be regenerated. No existing endpoint or CLI protocol needs to change.

[github-actions]

Issue Triage

• Route: triage/core
• Priority: priority/p1 (3.9/5)
• Effort: effort/l (5/5)
• Confidence: 5/5
• Risk: high
• Analysis Mode: rules-only

Why

• Touches core SkillHub workflows (review, namespace, search).
• Contains urgency signals (regression, cannot).
• Open for 7 days; entering the 2-week closure warm-up window.
• Issue includes operator or product impact details.
• Text suggests a bounded change (text, link).

High-Risk Signals

• Mentions sensitive areas (auth, openapi).
• Issue mentions API, SDK, or contract changes.

Maintainer Brief

Summary: Skill authors do not have a durable place to track the outcome of their review submissions. The current my-submissions view only returns pending tasks, so an item disappears after approval or rejection. Notifications help at the moment of a decision, but they do not provide a searchable progress view or preserve the sequence of review comments across repeated submissions. The current same-version resubmission path also deletes all review tasks for the replaceable version. That makes an accurate attempt history impossible to reconstruct and removes useful governance context after an author addresses reviewer feedback and resubmits.
Why core:

• Touches a higher-risk area where automated fixes should not be trusted without maintainer review.
• Likely spans multiple modules or a public compatibility surface.
• Mentions sensitive areas (auth, openapi).
• Issue mentions API, SDK, or contract changes.
  Reproduction or operator path:
• Skill authors do not have a durable place to track the outcome of their review submissions. The current my-submissions view only returns pending tasks, so an item disappears after approval or rejection. Notifications help at the moment of a decision, but they do not provide a searchable progress view or preserve the sequence of review comments across repeated submissions.
• The current same-version resubmission path also deletes all review tasks for the replaceable version. That makes an accurate attempt history impossible to reconstruct and removes useful governance context after an author addresses reviewer feedback and resubmits.
  Suspected areas:
• Registry discovery and CLI query workflow
• Authentication, session, and identity integration
• Public API contract, generated SDKs, and compatibility surface
• Documentation, operator guidance, and CLI help output
  Risks to watch:
• Mentions sensitive areas (auth, openapi).
• Issue mentions API, SDK, or contract changes.
  Validation checklist:
• Validate the primary reported workflow end-to-end after the fix.
• Update or verify documentation and CLI help output so they match the implemented behavior.
• Check for downstream API/SDK/CLI compatibility expectations before shipping.

Next Action

• Hand the issue to a core maintainer and use a local programming agent for reproduction, scoping, and validation.

---

问题分流结果

• 路由: triage/core
• 优先级: priority/p1 (3.9/5)
• 修复投入: effort/l (5/5)
• 信息完整度: 5/5
• 风险: 高
• 分析模式: rules-only

原因

• 涉及 SkillHub 核心流程（review, namespace, search）
• 包含紧急信号（regression, cannot）
• 已打开 7 天，开始进入 2 周闭环预热窗口
• 包含用户或产品影响说明
• 文本显示改动范围较可控（text, link）

高风险信号

• 提到敏感区域（auth, openapi）
• 提到 API、SDK 或契约变更

维护者交接摘要

概要: Skill authors do not have a durable place to track the outcome of their review submissions. The current my-submissions view only returns pending tasks, so an item disappears after approval or rejection. Notifications help at the moment of a decision, but they do not provide a searchable progress view or preserve the sequence of review comments across repeated submissions. The current same-version resubmission path also deletes all review tasks for the replaceable version. That makes an accurate attempt history impossible to reconstruct and removes useful governance context after an author addresses reviewer feedback and resubmits.
为何进入 core:

• 触及高风险区域，未经 maintainer 审查不应直接信任自动修复
• 大概率跨多个模块或公共兼容面
• 提到敏感区域（auth, openapi）
• 提到 API、SDK 或契约变更
  复现路径或操作路径:
• Skill authors do not have a durable place to track the outcome of their review submissions. The current my-submissions view only returns pending tasks, so an item disappears after approval or rejection. Notifications help at the moment of a decision, but they do not provide a searchable progress view or preserve the sequence of review comments across repeated submissions.
• The current same-version resubmission path also deletes all review tasks for the replaceable version. That makes an accurate attempt history impossible to reconstruct and removes useful governance context after an author addresses reviewer feedback and resubmits.
  怀疑影响区域:
• Registry 发现与 CLI 查询流程
• 认证、会话与身份集成
• 公开 API 契约、生成 SDK 与兼容性表面
• 文档、操作指引与 CLI help 输出
  重点风险:
• 提到敏感区域（auth, openapi）
• 提到 API、SDK 或契约变更
  验证清单:
• 修复后端到端验证主报告流程
• 更新或核对文档与 CLI help 输出，确保其与实现行为一致
• 发布前检查下游 API/SDK/CLI 的兼容性预期

下一步

• 交给 core maintainer，并结合本地编程Agent协助完成复现、收敛范围与验证闭环