feat(registry): reproducible AgentKit foundation publishing and pinned whole-tree artifact API

Start by reading the generic package contract at packages/contracts/src/package-manifest.ts and the linked SkillX #34 and AgentKit #2275 contracts; then inspect the listed identity, schema, publishing, scanning, and import/scan route files. Compare those paths with the AgentKit skill directories, kit.yaml, and the CLI package and release builder. Done means a verified deterministic whole-tree package, immutable authenticated publishing and pinned resolution, plus a standalone AgentKit example published manually and through CI with matching digests and the required negative tests.

Parent / cross-repo

Implementation slice of SkillX #34 and #21, tracked by SkillX #31; counterpart AgentKit #2274 and design prerequisite AgentKit #2275. Keep #34 as contract owner for generic registry, not a second registry implementation.

Objective

Create a first-class, trusted AgentKit publisher integration using SkillX's generic immutable whole-directory package/release model: export one self-contained AK foundation skill from the canonical AK repo and publish it manually and through scoped CI with exactly reproducible bytes; expose safe pinned artifact resolution for AgentKit consumers. Do not port AK's installer to TypeScript.

Start with real code

• SkillX packages/contracts/src/package-manifest.ts, packages/skill-identity, apps/web/app/lib/db/registry-schema.ts, packages/cli/src/commands/publish.ts, apps/web/app/lib/security/content-scanner.ts, Github import/scan routes. Audit existing implementation vs phase-2 roadmap #34.
• AK kits/{core,engineer,marketing}/skills, kit.yaml, CLI package/release builder and exported resource closure.
• Check exact upstream HEAD, doc ownership and current storage/migrations before designing migrations. Current skillx use emits SKILL.md text/metadata, not installable nested packages.

Scope / deliverables

1. Define deterministic package closure: full recursive file manifest for SKILL.md, references/, scripts/, assets/, modules/, nested arbitrary regular files plus declared runtime/deps; reject symlink, special file, hardlink, traversal, archive bombs, unsafe modes, secrets and overlimit resources with stable errors. Explicit policy for tests/build artefacts/metadata.
2. Reuse skillx.package/v1 package identity (@agentkit/ak-...), exact semver/release state. Separate source identity (Git repo+path+commit) from namespace ownership and immutable artifact digest. Release version cannot be overwritten with different bytes.
3. Stable deterministic pack process (canonical relative paths, file ordering, timestamps, modes, UTF-8/machine-independent canonical manifest; no platform-dependent hash drift). Per-file SHA-256, archive SHA-256, SBOM/dependency metadata where applicable. Publish idempotently.
4. Secure R2/artifact distribution through explicit versioned metadata + entitlement aware authorization + short-lived URL/stream and integrity checks; no link construction or redirects that bypass auth. Cache-policy and revocation/yank semantics documented for offline local digests.
5. Publisher auth: scoped CI credential or OIDC trusted publish (where supported), namespace ownership, minimal permissions, no secrets in build output/README. Sign/attest artifact provenance if approved contract; do not block existing skill discovery unnecessarily.
6. AK mapping: publish one small truly standalone foundation skill first, manually and through CI; reject bundles missing dependencies/hooks/sidecars rather than misrepresenting them as runnable. Curated kit export only after closure verified and SkillX #36.
7. Stable read-only inspect/resolve/download API contract supporting exact release+digest and compatibility metadata for Go consumer. Existing skillx use remains backwards compatible, labeled discovery-only when incomplete; no runtime execution during resolve.
8. Security release lifecycle: draft/quarantine/review/publish/yank, publisher key rotation, replay controls and revoked/compromised source handling.

Required negative/repro tests

• 94-file-style nested resources preserved; manifests/digests identical from clean builds; same version with changed bytes rejected; cross-runtime archive hash consistency.
• Zip-slip / tar traversal, symlink pointing out, case/Unicode collision, Windows reserved paths, oversized/duplicate entries, malicious executable bit, leaked credential fixtures, malformed metadata, dependency closure missing.
• Auth bypass on private/paid packages, forged namespace, CI publish token with overbroad permissions, partial upload, concurrent idempotent publish/retry, yanked/quarantined resolution.
• Manual vs CI publishing of same snapshot yields identical digest; install/read path has no implicit code execution.

Agent implementation prompt

Implement a vertical slice within Phase 2 with its existing schema/migrations and tests, not a parallel marketplace. Read SkillX instructions, #21/#31/#34 and AK #2275 contract first. Produce an explicit contract+threat model and repo-file references. First implement deterministic full-tree pack+verify, then immutable upload/resolve/auth, finally a scoped AgentKit example publisher. Preserve existing routes/CLI use/search. Keep backward compatibility and feature flags for incomplete public APIs. Every failed verification must fail closed; never curl | sh. Open focused PR(s) with exact tests, artifact digests, no mutable latest refs, migration and rollback notes. Coordinate the API shape with the AgentKit SourceProvider issue before finalizing.

Non-goals

SkillX universal runtime installer, AK native installer rewrite, auto-activation of hooks/scripts, user personalization, paid creator settlement.

Acceptance

• Generic #34 contracts reused, no duplicate schema ownership.
• Complete standalone skill published to SkillX manually + CI reproducibly.
• Signed/attested publisher provenance decision documented and integrity verified.
• Pinned, entitled artifact metadata+bytes resolvable by AK without executing.
• Private/quarantined/yanked behavior and path/adversarial tests pass.
• Cross-link implementation PR and AgentKit consumer issue.