feat: consumer installer with per-skill lockfile and managed delivery#204

Open

LadyBluenotes wants to merge 31 commits into

mainfrom

feat/secure-installer-0.4

Commits on Jul 25, 2026

feat(sync): replace rmSync with unlinkSync and rmdirSync for link removal
LadyBluenotes
committed
test(benchmarks): exercise lock verification in catalogue benchmarks
LadyBluenotes
committed
feat(delivery): add delivery job to PR workflow and implement delivery tests
LadyBluenotes
committed
test(scanner): pin current consumer discovery behavior
LadyBluenotes
committed
refactor(exclude): write package.json through the shared JSONC config helpers
LadyBluenotes
committed
fix(lockfile): say when a lockfile was written by a newer Intent
LadyBluenotes
committed
fix(install): reject only exclusions that hide an enabled skill
LadyBluenotes
committed
test: pin audience and declined-package policy status
LadyBluenotes
committed
feat(policy): enforce skill-level intent.skills entries on every surface
LadyBluenotes
committed
refactor(policy): compile the skill source policy once per load
LadyBluenotes
committed
perf(load): reuse the already-read config on the full-scan path
LadyBluenotes
committed
fix(sync): decline new skills without revoking allowed siblings
LadyBluenotes
committed
feat(install): record partial skill selections as allow entries
LadyBluenotes
committed
refactor(hooks): run session hooks through the CLI
LadyBluenotes
committed
feat(install): deliver skills through lifecycle hooks
LadyBluenotes
committed
feat(install): report deltas and detect agent targets
LadyBluenotes
committed
test: pin released config shapes against policy changes
LadyBluenotes
committed
feat(install): encourage the Intent devDependency instead of requiring it
LadyBluenotes
committed
fix(install): pin the version in generated Intent commands
LadyBluenotes
committed