Teaching My Partner's AI a Skill Without Handing Over My Stack

At 10:50 PM on 7/21, I did not hand my partner an API key, repository access, or a link into the registry that gives our agent system its internal shape. I shipped the first pass of a skill badge instead.

The badge is a self contained capability draft for my partner to hand to their AI. It carries the skill, the intended behavior, and enough operating context for another agent to use it. It does not carry the rest of my stack with it. It is pre scrubbed, review gated, and stays a draft until a human has checked it. It never auto commits and it never pushes itself.

On 7/21, I had just consolidated the platform around a registry spine with L1, L2, and L3 information boundaries, including a tenancy registry and a regenerable drill down terminal. Those components solve an internal problem. They are not an appropriate bundle to transfer across a partner boundary just because the useful part began inside them.

The useful thing was smaller than the system that made it

The first question was not, “How do I connect our agents?” It was, “What capability can cross the boundary without dragging its runtime assumptions across with it?”

That changed the design immediately. An internal skill can rely on private repository paths, tracker identifiers, durable memories, registry entries, and agent conventions that make sense only inside one operating environment. A partner’s AI cannot safely inherit those assumptions. Giving it the whole environment would solve the context problem by creating an access problem.

The skill badge is the compiled form of that work. I start with a skill inside my own system, reduce it to the behavior another agent actually needs, replace identity bearing references with equivalent anonymous ones, and keep the mechanism intact. The destination agent gets a bounded artifact it can reason over. It does not get a tunnel into the infrastructure that produced the artifact.

L1, L2, and L3 were information boundaries, not labels for a documentation cleanup. The badge applies that discipline to an AI handoff. It preserves the capability and sequence necessary to use it, then stops before it reaches private runtime coordinates.

I picked a document because the other choices were worse

A direct connection between the two environments was the obvious option, and I rejected it. It would let the partner agent resolve missing context by reaching backward into my system. It would also turn every future request into a permissions question. The capability should travel. The stack should stay home.

I also rejected a copied chat prompt. A prompt pasted into a conversation looks portable, but it has no durable review point. It drifts as soon as someone edits it, and it does not tell the recipient which constraints were intentional, which details were substituted, or which private material was removed. A badge is a file that can be inspected before it is used. That is a much better contract.

The third option was automatic export. An agent generated artifact can be technically complete and still be wrong for partner use. A private hostname, task identifier, field name, or key name can turn a useful handoff into an unnecessary disclosure. The first pass shipped as a review gated draft so the human check remains part of the system.

The scrub has to preserve the mechanism

This is where most anonymization fails. Deleting the specific parts produces a skill that says things like “review the relevant data” or “follow the workflow.” Nobody can build from that. The badge has to preserve the actual order of operations, the failure condition, the schema shape, the thresholds, and the decisions that make the skill useful.

What changes are the identifying coordinates. A private project becomes a bounded equivalent. An internal path becomes a role based reference. A real person, customer, or domain is replaced, not erased. The recipient still sees what the agent should inspect, what it should produce, and when it should stop. They just do not receive the names and routes that belong to our environment.

The diagnostic path on 7/21 was useful because it made the failure mode plain. At first glance, this looked like an agent access problem. The local skill had context that the partner’s AI did not. The tempting response was to widen access until the context gap disappeared.

It was actually a packaging problem. The original skill was coupled to a system that knew how to find its own context. The partner agent needed a self contained version of the decision procedure, not an invitation to navigate the system. Once I treated the handoff as compilation rather than connection, the right boundaries became obvious.

That is also why the badge does not auto commit or push. A generated artifact is an output, not a decision. It has to be read as if it came from outside the boundary, because it effectively did. The review gate lets us check that the substituted details still preserve the operational shape, that nothing identifying slipped through, and that the capability is still worth handing over.

A shared capability is not shared infrastructure

The first skill badge on 7/21 was small, but it established the contract I wanted. We can move a useful behavior between our agent environments without pretending they are one environment. My partner gets something their AI can use. I retain responsibility for the system behind it. Both sides get a clear point to review before the artifact becomes part of anyone else’s workflow.

The important boundary is not between people and agents. It is between a capability and the private machinery that made it possible. If I can compile the first into a reviewable badge, I can share the work without exporting the whole shop behind it.

dxdev LESSON · paste into your AI coding agent
LESSON: A capability can cross a partner boundary without the private system that built it crossing along with it
SOURCE: dxdev.com/blog/skill-badges-for-partner-ai
WHAT HAPPENED: Rather than hand a business partner an API key, repository access, or a link into the internal registry that gives an agent system its shape, a useful internal skill was compiled into a self-contained "skill badge" for the partner's own AI to use, carrying the capability and enough operating context to be usable while leaving behind the private repository paths, tracker identifiers, durable memories, and registry entries that only make sense inside the originating environment. A direct connection between the two environments was rejected because it would let the partner's agent resolve missing context by reaching backward into the private system, turning every future request into a permissions question; a copied chat prompt was rejected because it has no durable review point and drifts as soon as it's edited; automatic, unreviewed export was rejected because a generated artifact can be technically complete and still leak a private hostname, identifier, or key name. The scrub had to preserve the actual mechanism, the order of operations, the failure conditions, the schema shape, the thresholds, while replacing only the identifying coordinates, since deleting the specifics instead of substituting them produces a skill too vague to build from; the badge stays a human-reviewed draft that never auto-commits or auto-pushes, because a generated artifact crossing a boundary is an output to be checked, not a decision already made.
THE RULE: When a capability needs to cross to another party's AI, compile it into a self-contained, reviewed artifact that preserves the actual mechanism while replacing identifying coordinates, rather than connecting the two environments directly. Deleting specifics produces something too vague to use; the scrub has to substitute equivalent detail, not erase it, and a human has to review the result before it leaves.
CHECK MY CODE, then report PASS or FAIL with file:line for each:
  1. Any plan to give an external partner's AI or system direct access, an API key, repository access, a registry connection, into an internal system, rather than a compiled, self-contained capability artifact.
  2. Any cross-boundary AI-facing artifact, a shared skill, a prompt, a spec, that has been anonymized by deleting specifics, such as replacing concrete steps with vague instructions, rather than substituting equivalent non-identifying detail that preserves the actual mechanism.
  3. Any automatically-generated cross-boundary artifact that can commit, push, or otherwise take effect without a human review step confirming no identifying information slipped through.
THEN PRINT: a table (check, PASS/FAIL, evidence, fix) + a verdict (applies / partially / OUT_OF_SCOPE / no) + the single most important next action.