[mrgoonie]

Closes #100. Refs #88, #99, #98, bestagentkits/agentkit#2623.

Summary

• @skillx/contracts
  • Adds a skillx.release/v2 manifest. It is v1 plus a required, closed provenance member: {provider: "skillx"} or {provider: "kit", origin: "remote-signed" | "local-dev"}.
  • The identity must match the provider. @agentkit/* requires kit, and kit requires @agentkit/*. A v2 skillx slug must not use the ak- alias.
  • v1 is unchanged. release-manifest-v1.json is byte-for-byte the same and still verifies.
  • New golden vectors in fixtures/release-manifest-v2.json (sha256 ab70849b…d259) cover valid manifests, tampering, downgrade and upgrade, and non-canonical encoding.
• Trust: releaseTrust(manifest, {kitVerifiedReleaseDigest}) returns signed-kit only for origin: remote-signed, and only when the caller verified the kit signature of the tree with that releaseDigest. A registry signature always gives local-unverified.
• Ingest
  • The registry keeps signing every ordinary release as v1, so existing v1 verifiers (skillx-sh 0.5.0, the AgentKit Go client) keep working. Only kit releases are signed as v2.
  • @agentkit/* is accepted only when all of these hold:
    • metadata provenance.provider = "kit";
    • a key scoped releases:publish:@agentkit;
    • the key's user owns the active, admin-provisioned agentkit publisher.
  • @agentkit/* without kit provenance is still 403 identity.reserved_publisher, decided before authorization. Kit provenance on any other publisher is 400 identity.invalid.
  • Republishing the same tree with a different origin returns 409.
• Readers: release-read and MCP get_release work unchanged. Release-read revalidates stored manifests with the v2-aware validator. The new tests check that a signed release status verifies against a v2 manifest.
• CLI: adds skillx release publish --kit-origin <remote-signed|local-dev>.
• Docs: docs/api-reference.md, docs/cli-reference.md, docs/system-architecture.md, CLAUDE.md, and the public /docs/publishers page.

Review

An isolated code review found no way for a non-kit or unauthorized caller to publish @agentkit. These follow-ups from the review are fixed in 6d54ed2:

• Files are split to stay under 200 lines.
• A replay with a different origin returns 409.
• Kit trust is tied to the release digest.
• The stored schema version is taken from the signed manifest.
• KIT_ORIGINS is no longer duplicated in the CLI.
• Tests added for the CLI metadata header, a kit release without origin after authorization, and the release status of a v2 manifest.

Left as is, with the evidence: @agentkit/ak-<x> stays publishable. It follows kitIdentity in @skillx/skill-tree, which maps kit directory ak-<x> to @agentkit/<x>, and the shared rule checkReservedAlias allows ak- slugs for @agentkit.

Test plan

• pnpm -r run typecheck: clean
• pnpm test: 101 files, 2107 passed, 3 skipped
• release-vectors.test.ts (v1) still matches the committed file; release-vectors-v2.test.ts matches the new one.

Follow-up

After deploy, the foundations can be republished as @agentkit/<slug> with --kit-origin remote-signed and a releases:publish:@agentkit key, instead of @bestagentkits/<x> (#99). The AgentKit verifier is in a separate PR on bestagentkits/agentkit (#2623).

---

Generated by Claude Code