New additive, nil-safe battery for subscribing to skill packages in the
Anthropic agent-skills format (SKILL.md manifest + bundled files):

- Manifest/ParseManifest: SKILL.md frontmatter+body parse & validation
  (name/description required, allowed-tools passthrough, kebab/length limits)
- Tree/Pack/LoadPack: self-contained file set, order-independent content
  digest (the pin identity + change signal), bundled-file listing, traversal-
  safe staging
- Source (DirSource, GitSource): Fetch returns tree + resolved ref; git clones
  to temp, reads subpath into memory, cleans up (self-contained tree)
- Subscription + Store + content-addressed PackCache, with Memory defaults
- Syncer: Subscribe pins; Check records a PENDING update but never moves the
  pin; Apply is the only re-pin (supply-chain guard — upstream can't silently
  change what an agent runs)
- Activate: resolved packs -> majordomo agent.Skill (catalog instructions +
  one skill_use tool) for progressive disclosure; Stage materializes files

Third distinct 'skill' concept, deliberately separate from executus/skill
(saved-agent noun) and majordomo/skill (eager capability bundle). Mort-side
wiring (convars, .skillpack commands, Agent.SkillPacks, allowed-tools shim)
is a later, separate step. Full unit + hermetic local-git tests; gofmt/vet
clean; race-tested.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

@@ -0,0 +44,4 @@
+		return ""
+	}
+	sorted := append([]*Pack(nil), packs...)
+	sort.Slice(sorted, func(i, j int) bool { return sorted[i].Manifest.Name < sorted[j].Manifest.Name })

@@ -0,0 +51,4 @@
+	b.WriteString("When a task matches one, call skill_use with its name to load its full instructions before proceeding.\n\n")
+	b.WriteString("Available skills:\n")
+	for _, p := range sorted {
+		fmt.Fprintf(&b, "- %s: %s\n", p.Manifest.Name, p.Manifest.Description)

@@ -0,0 +76,4 @@
+	}
+	byName := make(map[string]*Pack, len(packs))
+	for _, p := range packs {
+		byName[p.Manifest.Name] = p

@@ -0,0 +100,4 @@
+// pointer to its bundled files (with the staged path when known).
+func renderPackBody(p *Pack, stagedDir string) string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "# Skill: %s\n\n%s\n", p.Manifest.Name, p.Manifest.Body)

@@ -0,0 +118,4 @@
+// mount them (read-only is the host's concern) into a sandbox the agent's file
+// tools can read. Returns the pack's staged directory.
+func Stage(p *Pack, baseDir string) (string, error) {
+	dir := baseDir + "/" + p.Manifest.Name

@@ -0,0 +76,4 @@
+		AllowedTools: []string(fm.AllowedTools),
+		Body:         strings.TrimSpace(string(body)),
+	}
+	if len(fm.Metadata) > 0 {

@@ -0,0 +109,4 @@
+}
+
+// splitFrontmatter separates a leading `---`-delimited YAML block from the body.
+// Leading blank lines/BOM are tolerated. A missing or unterminated block is an

@@ -0,0 +180,4 @@
+	return out
+}
+
+func isKebab(s string) bool {

@@ -0,0 +42,4 @@
+	return &cp, nil
+}
+
+func (m *Memory) GetByName(_ context.Context, name string) (*Subscription, error) {

@@ -0,0 +48,4 @@
+// how a host stages a pack's files for a sandbox; the host owns mount/read-only
+// policy. Paths are cleaned and constrained to dir — a tree entry that escapes
+// (via .. or an absolute path) is rejected rather than written outside dir.
+func (t Tree) WriteTo(dir string) error {

@@ -0,0 +92,4 @@
+			bundled = append(bundled, p)
+		}
+	}
+	return &Pack{Manifest: m, Tree: t, Digest: t.Digest(), Bundled: bundled}, nil

@@ -0,0 +98,4 @@
+// readTree reads an entire fs.FS (rooted at ".") into a Tree, skipping
+// directories. It is the shared reader for DirSource and GitSource, so both
+// produce identical self-contained trees.
+func readTree(fsys fs.FS) (Tree, error) {

@@ -0,0 +122,4 @@
+
+// within reports whether dest is inside dir (defense against path traversal in
+// a staged tree).
+func within(dir, dest string) bool {

@@ -0,0 +94,4 @@
+	}
+	defer os.RemoveAll(tmp)
+
+	if _, err := g.run(ctx, "", "clone", "--quiet", g.URL, tmp); err != nil {

@@ -0,0 +98,4 @@
+		return nil, "", err
+	}
+	if ref != "" {
+		if _, err := g.run(ctx, tmp, "checkout", "--quiet", ref); err != nil {

@@ -0,0 +110,4 @@
+
+	root := tmp
+	if g.Subpath != "" {
+		clean := path.Clean("/" + g.Subpath) // normalize, strip leading ../

@@ -0,0 +21,4 @@
+// upstream later force-pushes or disappears. A host may back it with disk;
+// Memory is the default. Because the key IS the content digest, entries are
+// immutable and safe to share across subscriptions that pin the same bytes.
+type PackCache interface {

@@ -0,0 +13,4 @@
+// the pin), and apply (the explicit re-pin). It owns the supply-chain invariant
+// — the only call that changes the bytes an agent runs is Apply, always with an
+// actor recorded.
+type Syncer struct {

@@ -0,0 +73,4 @@
+	if err != nil {
+		return nil, "", err
+	}
+	if err := y.Store.Put(ctx, pack.Digest, pack.Tree); err != nil {

@@ -0,0 +87,4 @@
+	if err != nil {
+		return nil, err
+	}
+	if existing, err := y.Subs.GetByName(ctx, pack.Manifest.Name); err == nil {

@@ -0,0 +91,4 @@
+		return nil, fmt.Errorf("skillpack: already subscribed to %q (id %s)", pack.Manifest.Name, existing.ID)
+	}
+
+	sub := &Subscription{

@@ -0,0 +99,4 @@
+		Enabled:    true,
+	}
+	// Store the raw URL/subpath (String() may combine them for display).
+	if gs, ok := src.(GitSource); ok {

@@ -0,0 +151,4 @@
+	if err != nil {
+		return nil, []error{err}
+	}
+	for i := range subs {

@@ -0,0 +183,4 @@
+	if err != nil {
+		return nil, err
+	}
+	sub.pinTo(pack, sub.PendingSourceRef, by, y.now())

@@ -0,0 +30,4 @@
+		Store:     NewMemoryPackCache(),
+		Subs:      NewMemory(),
+		Now:       func() time.Time { return time.Unix(1000, 0) },
+		NewID:     func() string { n++; return "id-1" },