[harlan-zw]

🔗 Linked issue

Related to skilld-dev/skilld#203

❓ Type of change

• 📖 Documentation
• 🐞 Bug fix
• 👌 Enhancement
• ✨ New feature
• 🧹 Chore
• ⚠️ Breaking change

📚 Description

Popular Skills that the registry lists failed skilld run. The failures had four causes:

• A name search read the whole Repository tree under the 2,000 entry limit meant for one Skill folder. Every larger Repository failed with INVALID_SOURCE, for example github/awesome-copilot, garrytan/gstack and heygen-com/hyperframes.
• A Repository that copies one Skill into Agent folders or plugin mirrors failed as ambiguous. pbakaus/impeccable has 20 copies.
• The agent-skills-spec check blocked Skills whose frontmatter name differs from the folder, or whose description is over 1,024 characters, such as leonxlnx/taste-skill. The registry admits these Skills by folder name.
• A run resolved the branch head while the Skill page named another commit.

A public name the registry admitted now resolves the admitted folder at the commit the Skill page names. Artifact delivery reads that identity from the new GET /api/skills/run-identity route over HTTP. A name the registry does not hold keeps the tree search. That search no longer applies the folder limit, and it picks the canonical copy: visible folders first, then fewest segments, then code unit order.

agent-skills-spec now reports its findings as a non-required warning with the exact values. The credential, path and size checks stay required. The policy version moves, so no older attestation is reused.

Size rejections name the folder, the size and the limit. They also say when a root Skill counts the whole Repository. Skills over a limit still fail: tt-a1i/archify packs to 10.36 MiB, and latent-spaces/brag holds four music files of 2.01 to 3.76 MiB. A failed Resolution now carries retryAfterSeconds when it is retryable. skilld 3.2.0 and later read it.

The new sweep-skill-runs task sends the CLI's Resolution request for 40 indexed Skills every 15 minutes, so the 5,949 indexed Skills cycle in about 37 hours. It records how each one settles in artifact_run_checks. It fails its run when a Skill starts to fail for a reason a retry cannot change, and the cadence watchdog alerts on that run.

During the deploy, the artifact signer updates before the site. A build that the old site checked in that window cannot be signed. A rerun after the deploy works.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

[harlan-zw]

Agent note (Harlan Agent Kit). Checked by hand, since CI cannot cover it:

• Ran this branch's real resolve, load and checks against GitHub, through the registry identity, for 30 Skills reported on 2026-10-07. 26 reach ready. Four stay blocked by size, now with the size and limit in the message: tt-a1i/archify (packs to 10.36 MiB), latent-spaces/brag (a 3.76 MiB music file), and the root Skills agiwhitelist/auteur (2.06 MiB README image) and larashero3-dotcom/lieflat-charts (2.37 MiB GIF).
• With a plain name and no registry row, the eight large or mirrored Repositories also resolve, each to one canonical folder.
• emilkowalski/skills/animate now resolves skills/animate@85e8e23, the commit its Skill page shows.
• On a local dev server, POST /api/v1/resolutions for pbakaus/impeccable/impeccable stored a path selector cursor-plugin/skills/impeccable pinned to commit 6b9d0ff. An unlisted name kept its named-skill selector. The sweep-skill-runs task ran to completion through the Nitro task endpoint.

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-06 15:40 UTC.

GitHub merged this pull request.

• Logged (60/100): The new retryAfterSeconds field on failed Resolutions breaks response parsing for every released skilld CLI before 3.2.0 exactly when a run is rate limited. View code
  • Ask an agent to verify and fix this finding
• Logged (50/100): The run-identity query schema is stricter than the registry's name space, so one over-long admitted name permanently wedges the sweep and makes that Skill unrunnable by name. View code
  • Ask an agent to verify and fix this finding
• Logged (25/100): The architecture diagram evidence for this pull request is inaccessible, so the claimed CLI-plus-sweep data flow was verified from code alone.
  • Ask an agent to verify and fix this finding

Review completed. No finding above 80/100.

Selected findings run after merge and open separate pull requests.