@master/internal-skills

Publicly distributed for first-party Master repositories. This is an internal contract, pinned to an exact version by each consumer.

Create .agents/master-skills.json with { "skills": ["master-site", "master-design", "master-writing"] }, then run master-skills sync. Commit .agents/skills/ and .agents/skills/.master-lock.json. CI runs master-skills check.

Synchronization is explicit. Installation never writes to a repository or global skill directory. Locally modified managed files and conflicting unmanaged files stop synchronization before any writes. Product skills outside the selected managed files are preserved. Edit shared skills in the Master repository; keep product extensions in their own skill directories.

Publishing

Master's publish.yml workflow validates the site and packages, retains the packed archives, then publishes those exact bytes through npm Trusted Publishing. The trusted publisher is GitHub repository master-co/master, workflow publish.yml, with no GitHub environment. Versions are committed before dispatch; consumers upgrade exact pins after registry integrity verification. No npm token is stored in GitHub. Master remains private, so these releases use OIDC without public provenance attestations.

Design source

Master Design is generated from the canonical portable skill in master-co/design. design-source.json pins the complete content snapshot and per-file hashes. In the Master checkout, explicitly run bun run design:sync /path/to/reviewed/skills/master-design, then bun run design:check. Review and commit that snapshot before publishing; consumers use the existing explicit skill sync. Installation never fetches a branch or modifies global skills. Edit site and writing skills here, and design guidance in its source repository.