Add project-level skills lock file (POC)#5715

Open

samuv wants to merge 20 commits into

mainfrom

poc-thv-skills-lock

Commits on Jul 8, 2026

Add project-level skills lock file with sync and upgrade commands

samuv
and
cursoragent
committed
Extend lockfile schema with contentDigest and validation

samuv
and
cursoragent
committed
Split SkillLockService from SkillService

samuv
and
cursoragent
committed
Add managed flag for lock-managed skill installs

samuv
and
cursoragent
committed
Harden install hooks and materialize toolhive.requires

samuv
and
cursoragent
committed
Implement RFC sync with check, adopt, and prune

samuv
and
cursoragent
committed
Implement RFC upgrade with preview and ref-change guard

samuv
and
cursoragent
committed
Wire lock service through API, client, and CLI

samuv
and
cursoragent
committed
Document skills lock file sync and upgrade behavior

samuv
and
cursoragent
committed
Rename SyncResult UpToDate field to fix codespell

samuv
and
cursoragent
committed
Add provenance and unsigned fields to skills lockfile

samuv
and
cursoragent
committed
Add Sigstore verifier and signer packages for skills

samuv
and
cursoragent
committed
Store verified Sigstore bundles on installed skills

samuv
and
cursoragent
committed
Verify Sigstore signatures during project-scope installs

samuv
and
cursoragent
committed
Re-verify stored bundles offline during skill sync

samuv
and
cursoragent
committed
Block skill upgrades on signer identity changes

samuv
and
cursoragent
committed
Sign OCI artifacts after skill push

samuv
and
cursoragent
committed
Expose Sigstore install and push flags in API and CLI

samuv
and
cursoragent
committed
Document skills lock Sigstore trust model and update tests

samuv
and
cursoragent
committed
Skip signing in registry-lookup install E2E push

samuv
and
cursoragent
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add project-level skills lock file (POC)#5715

Add project-level skills lock file (POC)#5715
samuv wants to merge 20 commits into
mainfrom
poc-thv-skills-lock

Commits on Jul 8, 2026

Add project-level skills lock file with sync and upgrade commands

Extend lockfile schema with contentDigest and validation

Split SkillLockService from SkillService

Add managed flag for lock-managed skill installs

Harden install hooks and materialize toolhive.requires

Implement RFC sync with check, adopt, and prune

Implement RFC upgrade with preview and ref-change guard

Wire lock service through API, client, and CLI

Document skills lock file sync and upgrade behavior

Rename SyncResult UpToDate field to fix codespell

Add provenance and unsigned fields to skills lockfile

Add Sigstore verifier and signer packages for skills

Store verified Sigstore bundles on installed skills

Verify Sigstore signatures during project-scope installs

Re-verify stored bundles offline during skill sync

Block skill upgrades on signer identity changes

Sign OCI artifacts after skill push

Expose Sigstore install and push flags in API and CLI

Document skills lock Sigstore trust model and update tests

Skip signing in registry-lookup install E2E push