[Ruling A on #22649] create-objectstack installs the skills catalog from the installed @objectstack/skills package, not from GitHub main; the scaffolded project depends on it at the spec's version #22659

Restart-when: npm view @objectstack/skills version answers a version (the package is published and installable)

The hold replaces the blocker line that named #22658. #22658 closed on PR #22692, but the package itself ships in PR #22691, which is still open, and this card's unlock test is the consumer's install. The hold comment below gives the reading.

Filing gate ③: a task the maintainer directed by ruling — #22649 letter A, maintainer 「22649 同意 A」, record 6096124407 (skills seat 1, session_01RdnZdPZH9ByduzPRWuH9tN, this seat's session chat, 2026-10-10). Ruling-ref: 6096124407. The cli-lane third of that ruling's execution; filed by the skills seat under the maintainer's direct-dispatch channel; triage may re-grade on first touch. ⛔ Not a claim.

Reader: the domain:cli seat, after #22658 (the @objectstack/skills package) is published and installable — the unlock test is the consumer's install (npm view @objectstack/skills version answers), not the merge. Surface: packages/create-objectstack/src/skills-install.ts, packages/create-objectstack/src/index.ts (the --skip-skills path and the closing summary), the project templates' package.json (a dependency on @objectstack/skills at the same version as @objectstack/spec), created-summary.ts and the scaffold e2e / created-summary tests. ⛔ No change to skills/**.

Done when

• A scaffolded project's package.json depends on @objectstack/skills at the version it depends on @objectstack/spec (the fixed group keeps them equal).
• After <pm> install, the catalog lands in the chosen agent's directory from node_modules/@objectstack/skills: through npx skills experimental_sync if [Ruling A on #22649] @objectstack/skills: the published skills catalog ships as a versioned package in the fixed group — the build copies skills/** in and files lists only it; the compatibility line and metadata.version derive from the package version #22658's measurement says the layout fits, otherwise by the scaffolder's own copy (one function; the same one-agent destination rule skills-install.ts's header measured). The GitHub npx skills add objectstack-ai/objectstack/skills command disappears from the scaffolder's output and its summary; the summary prints the package-based re-install command.
• --skip-skills keeps its meaning; --skip-install implies no skills yet (nothing in node_modules) and the summary says how to get them.
• The scaffold e2e asserts the installed skill set equals the package's catalog (count and names); the created-summary test's phase-3 layout follows the new installer.
• Changeset: minor for create-objectstack (a scaffolded project's dependency set changes); Clause-②: no.

Workload (per the ruling): M; precedent packages/create-objectstack/src/skills-install.ts (the one-agent install rework) and its e2e.

Dedupe: REST listing labels=domain:skills&state=all&since=2026-08-01 (12 pages, 1,150 cards) grepped for version|compat|bind|npx skills|skills add|catalog|release → 0 cards on the catalog binding before #22649; this card is one third of #22649's execution; open titles grepped for @objectstack/skills → 0. Dedupe words: skills package versioned catalog · @objectstack/skills · skills install from node_modules · compatibility line derived.

Generated by Claude Code