Problem
Installed skillsets are receipt-backed project dependencies, but skill lock, sync, and verify operate only on standalone skills returned by check::load_project_skills.
A project containing only skillsets can therefore produce an effectively empty dependency lock, and later sync/verify without reproducing those skillsets.
Relevant code is in src/manifest.rs and src/check.rs.
Proposed change
Add first-class skillset entries to both the project manifest and lockfile. Each locked skillset should preserve:
- catalog name;
- immutable source URL and revision;
sourceRoot;- explicit member list;
- receipt/tree digest.
sync should restore through the normal atomic skillset installation path. verify should validate the installed receipt, declared members, and digest. The unified active-name collision policy should apply across locked standalone and grouped dependencies.
Acceptance
Priority
P0 — reproducibility contract.
Problem
Installed skillsets are receipt-backed project dependencies, but
skill lock,sync, andverifyoperate only on standalone skills returned bycheck::load_project_skills.A project containing only skillsets can therefore produce an effectively empty dependency lock, and later sync/verify without reproducing those skillsets.
Relevant code is in
src/manifest.rsandsrc/check.rs.Proposed change
Add first-class skillset entries to both the project manifest and lockfile. Each locked skillset should preserve:
sourceRoot;syncshould restore through the normal atomic skillset installation path.verifyshould validate the installed receipt, declared members, and digest. The unified active-name collision policy should apply across locked standalone and grouped dependencies.Acceptance
lockrecords the full pinned skillset dependency.sync; the exact skillset is restored.verifysucceeds on the restored tree.verifyto fail clearly.Priority
P0 — reproducibility contract.