fix(registry): preserve root Skill snapshots

[harlan-zw]

🔗 Linked issue

Reported while exercising heyimjames/nikita-bier-consumer-apps through the site and CLI.

❓ Type of change

• 📖 Documentation
• 🐞 Bug fix
• 👌 Enhancement
• ✨ New feature
• 🧹 Chore
• ⚠️ Breaking change

📚 Description

Root Skills omitted supporting files from the registry. The file viewer also searched only nested Skill paths. Sync now stores a bounded root file inventory and its source commit. Reference reads and file links use that commit.

Root Skills inherit the Repository license when their instructions declare none. Failed behavior scans show an unavailable state. The public API returns an error instead of an empty behavior list.

Migration 0148 schedules every Skill Repository for a fresh snapshot, including dormant nested Skills. Legacy reference reads return 503 until that sync captures the source commit. The production workflow applies the migration before deploying the Worker.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

[harlan-zw]

Agent verification, using the built Worker and a local D1 database with migration 0148.

The Nikita Skill shows 9 files and the MIT Repository license. Opening onboarding.md renders its content. The LICENSE link uses commit f8b8a1828cd53e4aedaa39c3e2abb01e71660bc0. The released CLI reads the local public API successfully.

An isolated opencode smoke test loaded the skilld Skill and ran skilld view heyimjames/nikita-bier-consumer-apps/nikita-bier-consumer-apps against the local Worker. All five provenance graders passed. The Agent named James Frewin, the commit-pinned SKILL.md URL, and MIT. This was one directed case.

Production verification, 8 October 2026:

• PR 573 merged at commit 6b120f6c1d166c737726a37c9bd3090111156e10.
• Production deploy passed on descendant commit 0705d88f8baecf39466d187fc7e0aaf52913463e.
• Live detail and file inventory show 9 files, MIT, and source commit f8b8a1828cd53e4aedaa39c3e2abb01e71660bc0.
• All six reference files returned HTTP 200 with matching sizes and commit provenance.
• Released skilld 3.6.0 completed production view and run requests.
• Live browser opened onboarding.md. Its content rendered without browser errors.

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-08 10:27 UTC.

GitHub merged this pull request.

• Logged (15/100): Every image embedded in the PR description and its verification comment is unavailable, so the visual evidence for the headline fix is unauditable. View code
  • Ask an agent to verify and fix this finding
• Logged (45/100): Deploy creates a site-wide window in which every Skill's supporting-file read returns 503 until the forced resync backlog drains. View code
  • Ask an agent to verify and fix this finding
• Logged (35/100): Skills in tree-truncated repositories lose supporting-file reads permanently because no sweep will ever pin their snapshot commit. View code
  • Ask an agent to verify and fix this finding
• Logged (20/100): A behaviors rules regression now takes down the whole public API skill surface, not just the panel it decorates. View code
  • Ask an agent to verify and fix this finding
• Logged (12/100): A root Skill's file inventory includes other Skills' SKILL.md files, cluttering the viewer and inflating the file count. View code
  • Ask an agent to verify and fix this finding
• Logged (10/100): The public x-skilld-source header shows a literal '@unknown' ref for legacy rows until their repository resyncs. View code
  • Ask an agent to verify and fix this finding

Review completed. No finding above 80/100.

Selected findings run after merge and open separate pull requests.

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results