Follow-ups from jonathanhefner's review on the skill-set prototype:
- Relative member URLs now resolve per RFC 3986 against the URL the
index/catalog was ACTUALLY retrieved from (post-redirect), so an
index that redirects to a CDN resolves its members against the CDN
location, not the original well-known path.
- Archive format detection checks the Content-Type header first
(application/gzip, application/zip, + common aliases) and only falls
back to the URL file extension when the header is absent or generic,
per agentskills #254.
- AI Catalog entries carrying inline 'data' instead of 'url' are now
supported for both skill-set entries and nested sub-catalogs; inline
indexes get the same $schema gating, and their relative member URLs
resolve against the catalog's retrieved location.
Prototype of the skill-set layering discussed with agentskills.io:
- AI Catalog (/.well-known/ai-catalog.json) entries typed
application/agent-skills+json point at an agentskills PR #254
discovery index and represent an installable skill set.
- The optional io.hermes.skill-set extension carries set-level usage
intent: a suggested load-alias command and a shared instruction
preamble. Clients that ignore the extension still install the
correct set.
- tools/skill_set_catalog.py implements the client: $schema gating,
required sha256 digest verification, skill-md + archive (.tar.gz/.zip)
artifacts, and #254 archive-safety rules (traversal/absolute-path/
link rejection, decompression caps).
- hermes skills install-set <url> installs every member through the
existing quarantine -> scan -> install pipeline, then creates the
/<name> skill bundle so the whole set loads in one turn.
- scripts/publish_skill_set.py is the publisher-side counterpart:
builds the static .well-known tree (catalog + index + artifacts)
from local skill directories with byte-stable archives.
Teknium