feat(skills): publish the skills catalog as @objectstack/skills in the fixed group

.changeset/22658-skills-package.md

@@ -0,0 +1,8 @@
+---
+"@objectstack/skills": minor
+"@objectstack/spec": patch
+---
+
+New published package `@objectstack/skills`: the ObjectStack skills catalog (`skills/**` of the repository), shipped in the changeset `fixed` group so it always carries the version of the `@objectstack/*` packages it teaches. Its build copies the catalog into `dist/skills/<skill>/…` byte for byte (the layout the skills CLI's `experimental_sync` reads from `node_modules`), and `files` lists only that tree. The repository's `skills/**` stays the one source of truth and the documented `next` channel; nothing a consumer writes changes.
+
+`@objectstack/spec`: `llms.txt`'s package-ecosystem count reads 69 with `@objectstack/skills` joining the scope.

.changeset/config.json

@@ -10,6 +10,7 @@
   "fixed": [
     [
       "@objectstack/spec",
+      "@objectstack/skills",
       "@objectstack/cli",
       "@objectstack/console",
       "@objectstack/cloud-connection",

.github/workflows/ci.yml

@@ -205,6 +205,11 @@ jobs:
               # touching a `scripts/pm/` tool or a `scripts/check-*` gate.
               - 'turbo.json'
               - 'tsup.config.ts'
+              # `@objectstack/skills#build` copies the repository root's
+              # `skills/**` into its publish tree, so that catalog is a build
+              # input of a task `pnpm build` runs (turbo.json declares it as
+              # `$TURBO_ROOT$/skills/**`; check-ci-filter-parity holds it here).
+              - 'skills/**'
               - 'scripts/build-input-hash.mjs'
               - 'scripts/check-dev-prereqs.mjs'
               - 'scripts/check-dts-emitted.mjs'

content/docs/protocol/backward-compatibility.mdx

@@ -112,7 +112,7 @@ Read the **Breaking?** column, not the version number: during the launch window
 1. **RFC (Request for Comments)** — Breaking changes are proposed as GitHub issues with the `protocol:breaking` label.
 2. **Deprecation** — The old behavior is deprecated in a MINOR release (see timeline above).
 3. **Migration Guide** — A detailed migration guide is published before the removal lands, in the release notes for the version that carries it.
-4. **Release** — During the launch window the breaking change ships in the next **MINOR** version, carrying a changeset entry marked `**BREAKING**`. `scripts/check-changeset-no-major.mjs` fails any pull request that declares a `major` bump, because under lockstep one `major` would promote all 69 published packages.
+4. **Release** — During the launch window the breaking change ships in the next **MINOR** version, carrying a changeset entry marked `**BREAKING**`. `scripts/check-changeset-no-major.mjs` fails any pull request that declares a `major` bump, because under lockstep one `major` would promote all 70 published packages.
 
 ---
 
@@ -190,7 +190,7 @@ The `@objectstack/spec` package provides additional stability guarantees:
 
 ### Which surfaces this covers
 
-**All of them.** This is not scoped to an experimental corner or a pre-release channel: all **69** packages published from this repository belong to a single Changesets `fixed` group, so they share one version number and one policy. No published surface is exempt.
+**All of them.** This is not scoped to an experimental corner or a pre-release channel: all **70** packages published from this repository belong to a single Changesets `fixed` group, so they share one version number and one policy. No published surface is exempt.
 
 The convention is enforced rather than informal — `scripts/check-changeset-no-major.mjs` fails any pull request that introduces a `major` bump, because under lockstep a single `major` on one package would promote the entire stack.
 

packages/skills/.gitignore

@@ -0,0 +1,4 @@
+# The publish tree: `skills/**` of the repository root, copied in by
+# `scripts/sync-catalog.mjs` (the package's `build`). Never committed — the
+# repository root's `skills/**` is the one source of truth.
+dist/

packages/skills/README.md

@@ -0,0 +1,55 @@
+# @objectstack/skills
+
+**The ObjectStack skills catalog, shipped at the version of the packages it teaches.**
+
+This package contains nothing but `dist/skills/`: a byte-for-byte copy of the
+[`skills/`](https://github.com/objectstack-ai/objectstack/tree/main/skills) tree
+of the `objectstack-ai/objectstack` repository — one directory per skill, each
+with its `SKILL.md`, `references/`, `rules/` and `evals/` — taken at the commit
+that released this version.
+
+It is published from the Changesets `fixed` group, so its version is always the
+version of `@objectstack/spec`, `@objectstack/cli` and every other
+`@objectstack/*` package released with it. A project that depends on
+`@objectstack/skills@17.7.0` reads the skills written for `@objectstack/spec`
+17.7.0 — never the ones already teaching the next major, and never a catalog
+that has moved on since the project was created.
+
+## Installing the skills into an agent's directory
+
+The catalog is read from `node_modules`, so it follows the version the project
+depends on. With this package in `devDependencies`, the
+[skills CLI](https://www.npmjs.com/package/skills) syncs it into the detected
+agent's own skills directory (`.claude/skills/` for Claude Code, and so on):
+
+```sh
+npm install --save-dev @objectstack/skills
+npx skills experimental_sync
+```
+
+`experimental_sync` discovers the skills at `dist/skills/<skill>/SKILL.md` of
+every dependency and links or copies them for the agent runtimes it detects
+(`--agent <name>` names one; `--copy` copies instead of linking). Re-running it
+after `pnpm up @objectstack/skills` — which moves with the rest of the
+`@objectstack/*` set — refreshes the installed catalog.
+
+## The `next` channel
+
+The repository's `skills/` tree on `main` is the catalog of the **next**
+release. `npx skills add objectstack-ai/objectstack/skills --skill '*' --agent claude-code -y`
+reads it directly from GitHub — for trying the skills of the version that is
+not published yet, not for a released project.
+
+## How the tree is produced
+
+`scripts/sync-catalog.mjs`, this package's `build`, wipes `dist/` and copies the
+repository's `skills/**` into `dist/skills/**`, reads the copy back and
+refuses to finish unless the two trees are equal, file for file and byte for
+byte. Its `prepublishOnly` runs the same comparison, so a stale or absent copy is
+never published. The copy is gitignored; the repository's `skills/**` is the one source
+of truth, reviewed and gated there.
+
+## Related
+
+- [Skills reference](https://objectstack.ai/docs/ai/skills-reference) — every skill in the catalog, with what it covers.
+- [`@objectstack/spec`](https://www.npmjs.com/package/@objectstack/spec) — the schemas the skills point at (`node_modules/@objectstack/spec/src/**/*.zod.ts`), shipped at the same version.

packages/skills/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@objectstack/skills",
+  "version": "17.7.0",
+  "description": "The published ObjectStack skills catalog \u2014 the repository's skills/** tree, shipped at the version of the @objectstack/* packages it teaches.",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/objectstack-ai/objectstack/tree/main/packages/skills",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/objectstack-ai/objectstack.git",
+    "directory": "packages/skills"
+  },
+  "bugs": {
+    "url": "https://github.com/objectstack-ai/objectstack/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "exports": {
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "node scripts/sync-catalog.mjs --self-test && node scripts/sync-catalog.mjs",
+    "prepublishOnly": "node scripts/sync-catalog.mjs --check"
+  },
+  "keywords": [
+    "objectstack",
+    "skills",
+    "agent-skills",
+    "claude-code",
+    "ai"
+  ]
+}