[mrgoonie]

Closes #123. Follow-ups to #121 / #100.

Changes, by item in #123

Item	Change
M1	Adds a trust array to the v2 golden vectors (release-manifest-v2.json). It covers the one positive signed-kit case, a remote-signed kit whose kit signature was verified over its own tree. The negatives are a mismatched digest, no verification, local-dev and skillx. The fixture is regenerated.
M2	Adds kit publish tests with a GitHub OIDC sxo_ token (plus a wrong-handle 403). Also adds a race of two publishes of one version with different origins. The race is deterministic: the first insert waits until both publishes have looked up the version, so the loser always takes the insertRelease conflict path and gets a 409.
M3	docs/deployment-guide.md: set SKILLX_SHARED_SKILL_ALIASES before the first production @agentkit release, with a smoke check.
L1	assertSameKitProvenance reuses the bounded, validating readManifest from release-read.ts. A missing, oversized or corrupt stored manifest now returns 500 release.storage_inconsistent instead of a 409 claiming origin "none". The log is labelled release publish replay.
L2	The API, CLI and publisher docs, the deployment guide and CLAUDE.md now say skillx-sh 0.6.0 and earlier report v2 manifests as failed verification, and that skillx-sh 0.7.0 or later is required (#122).
L3	A slug starting with ak- is refused for kit releases (400 identity.invalid, before auth). This matches kitIdentity (ak-plan → @agentkit/plan). The same rule is in the v2 manifest contract, with a rejected golden vector and an invalid-manifest fixture, and skillx publish --kit-origin now fails before packing.

Verification

• pnpm typecheck: clean.
• pnpm test: 124 files, 2427 passed, 3 skipped.
• pnpm build: OK.
• The new L1 and L3 tests fail on the old code: the corrupt manifest gave 409 and @agentkit/ak-review gave 200. They pass now.
• The race test passed in 6 consecutive runs after it was made deterministic.
• An isolated code-review subagent found no critical or high issues. I fixed its low findings in 27ce993: the contract gap, the race determinism, the log label and the CLI fail-fast.

Follow-up

• Personal kits: shared-skill guard protects no @agentkit kit release while SKILLX_SHARED_SKILL_ALIASES is unset #125: while SKILLX_SHARED_SKILL_ALIASES is unset, the default shared-skill guard matches no kit release. Changing that reverses a recorded design choice, so it needs a decision.
• AgentKit keeps only the v1 vector copy (docs/conformance/skillx/release-manifest-v1.json). The v2 vectors, now with trust, are ready for it to adopt.

Impact

• Docs: docs/api-reference.md, docs/cli-reference.md, docs/deployment-guide.md, the /docs/publishers page and CLAUDE.md.
• Data: no migration. feat(releases): skillx.release/v2 kit provenance for @agentkit releases #121 merged just before this, and no production @agentkit release exists yet, so no stored @agentkit/ak-* rows are affected.

---

Generated by Claude Code

[mrgoonie]

Heads-up from #125 / #128: once #128 lands, the shared-skill guard fails closed while SKILLX_SHARED_SKILL_ALIASES holds no valid identity. Every in-place overlay of an @agentkit/* skill is then 422 overlay.shared_alias. The new deployment-guide paragraph here says that while the variable is unset, a public kit "may overlay any other @agentkit/<name> skill in place". That sentence becomes false and should say that such overlays are refused until the list is set. The operator step itself is still needed, because it is what unblocks overlays of single-kit skills.

---

Generated by Claude Code