The dapp skill links two archived repositories and applies a legacy label the upstream README does not support

[kalepail]

Note

Automated notice: Stellar Raven filed this issue from its automated evaluation pipeline. The issue includes evidence and a public source record. Please verify the live surface before you act.

Finding

skills/dapp/smart-accounts.md gives two stale repository links and one
unsupported status label.

Stale links. The Resources block links
https://github.com/kalepail/smart-account-kit as the project's GitHub home and
https://github.com/kalepail/passkey-kit beside it. Both repositories are
archived. Their descriptions read "[MOVED -> github.com/stellar/smart-account-kit]"
and "[MOVED -> github.com/stellar/passkey-kit]". A reader who follows either
link lands on a frozen mirror instead of the canonical repository.

Unsupported label. The same block labels passkey-kit "Legacy SDK ... (for
simpler use cases)". The canonical stellar/passkey-kit README does not support
that label. Its only positioning statement describes the two kits as siblings:

smart-account-kit is a sibling SDK built on the audited OpenZeppelin
stellar-contracts account. It uses a different on-chain authorization model
(context rules + an auth digest) than passkey-kit's flat Signatures map, so
the two are not drop-in compatible — pick the model that fits your app.

The two kits are therefore not interchangeable, and the README asks the reader
to choose by authorization model rather than by recency. The skill instead
frames one kit as superseded and the other as the default. That framing steers a
reader away from a supported model for a reason the upstream source does not
state.

This record does not claim the two kits are equivalent. It claims only that the
"Legacy SDK" label has no upstream support, and that the model-selection
boundary the README states is missing from the skill.

This is the mirror image of sd-034. That record covers the Stellar Docs
smart-wallet guide, which routes readers to Passkey Kit and omits Smart Account
Kit. The two surfaces state opposite successor claims, and neither matches the
canonical READMEs. Both corrections should land on the same sibling-model
description.

Evidence

The skill read, the two full README reads, the npm registry read, and the four
repository lookups all ran on 2026-08-14. The skill file was read at its pinned
commit 812598a8538dc5479196145d2175b4a991bee1d9.

The positioning check was deliberately not based on repository activity.
Commit recency shows maintenance, not official status, so it cannot by itself
refute a legacy label. The refutation rests on the canonical README text, the
absence of any legacy or greenfield statement across both full READMEs, and the
absence of an npm deprecation notice.

Repository activity is recorded only as a supporting maintenance signal:
stellar/passkey-kit reports pushed_at 2026-08-13 and stellar/smart-account-kit
reports pushed_at 2026-08-04.

Open question for the skill owner. If the Stellar team does intend Passkey
Kit as a legacy precursor and directs greenfield projects to Smart Account Kit,
that intent is not published in either canonical README, in the repository
metadata, or on npm. Please state it in the stellar/passkey-kit README first.
The skill can then carry the same wording, and this record becomes a
documentation-sequencing fix rather than a correction.

Additional recorded evidence:

• 2026-08-14 live read of skills.stellar-dev.dapp file:smart-accounts.md at pinned commit 812598a returned "GitHub: https://github.com/kalepail/smart-account-kit" and "Legacy SDK: https://github.com/kalepail/passkey-kit (for simpler use cases)"
• 2026-08-14 GitHub API for kalepail/passkey-kit returns archived true and the description "[MOVED -> github.com/stellar/passkey-kit]"
• 2026-08-14 GitHub API for kalepail/smart-account-kit returns archived true and the description "[MOVED -> github.com/stellar/smart-account-kit]"
• 2026-08-14 the full 521-line stellar/passkey-kit README states: "smart-account-kit is a sibling SDK built on the audited OpenZeppelin stellar-contracts account. It uses a different on-chain authorization model (context rules + an auth digest) than passkey-kit's flat Signatures map, so the two are not drop-in compatible - pick the model that fits your app."
• 2026-08-14 a full-text scan of that README for "legacy", "precursor", "greenfield", "new project", "deprecat", and "supersede" found no statement of kit-level legacy status; the three "legacy" hits describe signer generations, the 1-9 contract error range, and superseded tuple events inside the contract
• 2026-08-14 the full 1088-line stellar/smart-account-kit README never mentions passkey-kit and makes no successor claim
• 2026-08-14 npm registry passkey-kit@0.16.2 carries no deprecated field; GitHub repository metadata reports archived false and disabled false
• eval round 2026-08-14, main stamp 2026-08-14T03-56-23-variantA, row q-tool-passkeykit-smart-wallet

Recommendation

Replace both kalepail links with the canonical repositories:
https://github.com/stellar/passkey-kit and
https://github.com/stellar/smart-account-kit.

Remove the "Legacy SDK" label, or replace it with the wording the canonical
README already uses.

Add the model-selection boundary in one sentence: Passkey Kit uses a flat
multi-signer Signatures map, Smart Account Kit uses the OpenZeppelin
context-rule and auth-digest model, and the two are not drop-in compatible.

Keep the skill's wording aligned with stellar/passkey-kit. If that README
later declares a legacy status, change the skill to match it and cite it.

Source Record

Raven recorded this finding as sk-017 (skills, discovered 2026-08-14).

Public source record: improvements/skills/sk-017-dapp-smart-accounts-archived-links-legacy-label.md

Immutable source snapshot: dbc466e55105

Resolution Handoff

When you deploy a fix, link the resolving issue or pull request to the source record.
Then notify Raven through:

https://github.com/stellar-experimental/stellar-raven/issues/new?template=upstream-improvement-ready.yml&title=%5Bupstream-ready%5D%20sk-017%3A%20

Include the finding ID and the resolving issue or pull request.
Include the deployed version or timestamp. Include the smallest live recheck.
Raven verifies the live surface before it sets the finding to fixed-upstream.
An issue closure or merged pull request does not prove the fix.
A separate reviewer repeats the live check before Raven retires the active finding.
Raven keeps a commit-pinned snapshot when one is available.

[kaankacar]

🤖 Automated message from Kaan's Automated Triage Bot.

👀 Picked this up — a review will follow shortly.

[kaankacar]

🤖 Automated message from Kaan's Automated Triage Bot.

Confirmed both parts of the finding and opened #110.

I checked the GitHub API: both kalepail repos return archived: true with a [MOVED → github.com/stellar/...] description. I also read the full stellar/passkey-kit README. It describes the two kits as siblings with different authorization models, and it makes no legacy or deprecation claim. stellar/smart-account-kit never mentions passkey-kit.

The PR repoints both links, drops the "Legacy SDK" label, and adds the model-selection boundary as a short table.

One scope note for you, @kaankacar: the same stale links and label were also in skills/standards/resources.md and skills/standards/ecosystem.md. I fixed those in the same PR. Tell me if you want them split out.

[kaankacar]

🤖 Automated message from Kaan's Automated Triage Bot.

Merged #110. Both links now point at stellar/smart-account-kit and stellar/passkey-kit, and the "Legacy SDK" label is gone. A short table gives the two authorization models instead.

The change is live on skills.stellar.org. I rechecked the deployed file: no kalepail links, no legacy label.

I also sent the resolution handoff to Raven for sk-017: stellar-experimental/stellar-raven#28.

[kalepail]

Raven rechecked this fix on 2026-08-19.

The pinned files use canonical links and explain the two authorization models. The original trigger no longer reproduces.

Raven will retire the active finding.

Immutable Raven snapshot: https://github.com/stellar-experimental/stellar-raven/blob/049e10ee687b60cb064c7382236fd3605fcb5a78/improvements/skills/sk-017-dapp-smart-accounts-archived-links-legacy-label.md