Manifest spec

Every skill version has a canonical, signed manifest.

Required top-level fields

Field	Type	Notes
schema_version	"1"	Pinned for now.
id	namespace/name	Lowercase alphanumeric + -.
version	semver	1.0.0 form.
mode	`"artifact"	"hybrid"
description	string, ≤2000 chars	Human-readable summary.
license	SPDX identifier	Default CC-BY-4.0.
authors	non-empty array	At least one publisher handle.
signatures	non-empty array	At least one Sigstore or ed25519 signature.

Mode-specific fields

• mode === 'artifact' requires artifact: { path, sha256 }.
• mode === 'endpoint' requires non-empty endpoints[].
• mode === 'hybrid' requires both.

Optional but valuable

• capabilities[] — keywords agents can filter by.
• domains[] — taxonomy for the catalog.
• dependencies[] — other skills this composes with.
• evaluation — judge scores (server-set on publish; you can leave {}).
• freshness.sources[] — URLs the freshness worker should re-check.
• trust_tier — server-set; honored on read.

Example

{
  "schema_version": "1",
  "id": "mobile/ios-publishing",
  "version": "0.1.0",
  "mode": "artifact",
  "description": "Submit an iOS app to the App Store.",
  "license": "CC-BY-4.0",
  "authors": [{ "handle": "acme" }],
  "capabilities": ["appstore-submission", "testflight"],
  "domains": ["mobile", "ios", "apple"],
  "dependencies": [],
  "artifact": { "path": "skill.md", "sha256": "<64-char-hex>" },
  "endpoints": [],
  "signatures": [{ "kind": "sigstore", "bundle": "<base64>" }],
  "evaluation": {},
  "freshness": { "sources": [], "source_change_signal": "publisher-declared" }
}

The Zod source of truth lives in @amitte-ai/schema.