Register NVIDIA FLARE skills

[holgerroth]

Onboarding type

• New product onboarding (new components.d/<slug>.yml file)
• Other (catalog change, README fix, infrastructure, etc.)

For new product onboarding — author affirmations

By submitting this PR, I confirm on behalf of my team:

• Skills cleared for open source release by the owning team, with all required approvals in place
• License selected: Apache 2.0 / CC-BY 4.0 / Dual (Apache 2.0 + CC-BY 4.0). Specify: Apache 2.0
• No new license or new third-party component introduced beyond what the source repo already carries
• Source repo is public and under an NVIDIA-owned GitHub org
• .agents/skills/ or skills/ path used for new entries (or existing path retained for legacy entries per components.d/<slug>.yml)

Reviewer checklist (OSS Skills PIC)

• Author confirmations above are checked
• components.d/<slug>.yml entry valid (required fields, unique catalog_dir, path exists in source repo, filename slug matches name)
• SKILL.md frontmatter spec-compliant (at least one sampled)
• No new license or third-party dependency introduced

All PRs

• All commits signed off with DCO (git commit -s).

Other context (for non-onboarding PRs)

Registers all nine NVIDIA FLARE skills from the stable NVIDIA/NVFlare:2.9 branch. The skills are intended to be installed as a complete set so shared references resolve through nvflare-shared.

Draft dependency: NVIDIA/NVFlare#5260 must merge with fresh, hash-valid artifacts for all nine skills before this PR is ready for review.

[holgerroth]

NVFlare PR #5260 has now merged into the 2.9 branch at e77bf33c1a6975d517362f50d154e7a3aaea67ef.

I verified that the merged skills tree is byte-identical to the final signed PR head and that all 160 resources across the nine skill.oms.sig manifests match their SHA-256 digests.

The remaining red source-onboarding result is the September 4 run against the pre-merge 2.9 state. This workflow does not run on ready_for_review, and I do not have permission to rerun it. Could a repository maintainer please rerun the failed source-onboarding workflow? No catalog content change should be necessary.

[holgerroth]

@mosheabr The fresh source-onboarding run after the reported fix is still failing on the same two benchmark verdicts:

• skills/nvflare-autofl: BENCHMARK.md overall verdict is INCOMPLETE, expected PASS
• skills/nvflare-shared: BENCHMARK.md overall verdict is INCOMPLETE, expected PASS

Fresh run: https://github.com/NVIDIA/skills/actions/runs/34659296791

PR #535 is open and ready for review on the unchanged head bf719ee. No repository files, signatures, or generated artifacts were changed.

[mosheabr]

Thanks Holger. Two things to fix, and one of them is ours.

1. Filename slug doesn't match the component name. The file is components.d/nvflare.yml but name: NVIDIA FLARE derives to nvidia-flare.yml. The catalog generates your README product row from that pairing, so a mismatch breaks the row. Either rename the file to nvidia-flare.yml, or change name: to NVFlare — I'd suggest the second, since it matches how the project brands itself. No re-sign needed for this; components.d/ lives in the catalog and isn't covered by any skill signature.

2. Two skills still report INCOMPLETE. After #5260, nvflare-autofl and nvflare-shared both carry all four artifacts — that part is sorted — but their benchmarks read Overall verdict: INCOMPLETE with Tier 2 showing NOT RUN. The other seven are PASS.

That was a bug on our side, now fixed — these two just ran on a version prior to the fix.

So: re-run /nvskills-ci on the 2.9 branch for those two skills and push the regenerated benchmarks, and push the slug fix here. I'll re-run the checks and merge.

[holgerroth]

Resolved both requested items:

• NVIDIA/NVFlare#5287 merged into 2.9 as b0438daaa4d3808cf62729feefa01f3063979463.
• NVSkills evaluation run 34713563744 regenerated nvflare-autofl and nvflare-shared with Overall verdict: PASS; post-artifact verification run 34719509201 also passed.
• All 160 resources across the nine signature manifests were hash-verified, and the other seven skill directories remained unchanged.
• Commit 996ad763e8c8fdb617d91f0ba1ff2e4dd3929b0e changes only the component name to NVFlare; it is GPG-signed and DCO-signed.
• Fresh source-onboarding run 34735765337 and all current PR checks pass. I made no generated catalog metadata or CUDA-Q changes.

@mosheabr, could you please re-review when convenient?

[mosheabr]

Both items from my earlier review are resolved — approving.

1. Filename slug — name: NVFlare now derives nvflare.yml. Matches.

2. Benchmark verdicts — all 9 skills now read **Overall verdict: PASS**. nvflare-autofl and nvflare-shared were re-signed 2026-09-12 on evaluator 1.5.6 and went INCOMPLETE → PASS.

Full checklist re-verified:

Check	Result
Source repo	NVIDIA/NVFlare public, NVIDIA-org, not archived, Apache-2.0; ref: 2.9 valid
Paths	all 9 declared paths present at ref: 2.9
Artifacts	all 9 carry skill.oms.sig, skill-card.md, evals/, BENCHMARK.md
Verdicts	9/9 PASS (read from the bolded callout, not a substring match)
Layout	flat, one-entry-per-skill, product-prefixed nvflare-*, unique catalog_dir
SKILL.md	sampled nvflare-convert-pytorch — name matches dir, description has positive and negative triggers, license Apache-2.0
DCO / authors	all 6 commits signed off; both checks green
Affirmations	all five ticked, license specified
Diff scope	components.d/nvflare.yml only — no README edit, no generated files

Two non-blocking follow-ups:

• links: sets only security: false; contributing and discussions also feed the README Getting Help table if NVFlare has them.
• nvflare-shared is a shared-assets bundle published as a standalone skill — nvflare-convert-pytorch loads ../nvflare-shared/references/... in eight places, so installing a single skill leaves dangling relative paths. Tracked as #298; this is the first production instance and worth prioritising that work.

Thanks for the quick turnaround on the re-sign.