feat(validation): enforce the pinned Agent Skills instruction-body rule with ecosystem-lint provenance (#133)

[ScriptedAlchemy]

Summary

The Agent Skills spec-lint slice of #133, resolved under the issue's honesty rules:

• @skill-tools/core@0.2.2 evaluated, not integrated (2026-09-02): the package is genuine (github.com/skill-tools/skill-tools, Apache-2.0 — not one of the npm squats the issue warns about), but its lint is lower fidelity than the pinned contract: it pins no spec revision, its description-length warning is internally inconsistent (fires <10 chars, message says 50), it accepts unknown frontmatter extensions the pinned closed schema rejects, and it downgrades name/directory mismatch to a warning where the pinned spec mandates equality. Full dated evaluation — npm metadata, tarball sha1/integrity, the 17 observed rule ids, six limitations — recorded in schemas/agent-skills/PROVENANCE.json and pinned by the schema test.
• The one mandatory rule the evaluation surfaced as missing is enforced natively: an emitted SKILL.md with valid frontmatter but no Markdown instruction body now fails artifact validation as AB6034 (registered with recovery; recovery-coverage test updated), matching the pinned spec's frontmatter-followed-by-content requirement. Negative fixture added; two existing empty-body fixtures updated to carry instructions.

Changeset: minor, agent-bundle.

Test plan (all local, on the rebase over e84ec83)

• pnpm build
• pnpm typecheck
• pnpm lint — 0 errors, 0 warnings (1019 files)
• pnpm test:unit — 2615 passed, 0 failed, 5 skipped

Tracking

• Advances Adopt pinned schemas and ecosystem validators for generated plugin conformance (build-time + doctor) #133 (skills lint slice). With feat(codex): validate bundles against pinned schemas with honest host-devtools evidence (#133) #326/feat(cursor): validate bundles against pinned schemas and loader contract with honest devtools evidence (#133) #327 this completes the per-ecosystem bytes-at-rest validator scope; the conformance CI lane and doctor static findings remain in flight.

[changeset-bot]

🦋 Changeset detected

Latest commit: ccc8ef4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T23:21:45.183157Z	ccc8ef4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.