alignment_status: confirmed
Expert Review - Publish Readiness Audit
This page records the package and skill audit for the next `skillpacks` / `@glexcorp/gskp` release from the `agentic-skills` source checkout.
./publish.sh --dry-run patch reached npm auth preflight for 0.1.18 and failed with E401 Unauthorized from npm whoami. Source/package gates are ready, but real publishing is blocked until npm auth is restored for the expected publisher.
Table Of Contents
Verdict
The only confirmed blocker was a cross-pack recommendation gap in `session-triage`: benchmark-regression output could name `benchmark-test-skill` without carrying the `agentic-skills-bench` install prerequisite into the direct recommendation text. The fix is in both Claude and Codex mirrors and bumped `session-triage` from `v0.7` to `v0.8` with archive snapshots.
Scope
`skillpacks` and `@glexcorp/gskp` npm packages from `packages/skillpacks/build`.
`npm view skillpacks version` and `npm view @glexcorp/gskp version` both returned `0.1.17`; local source is `0.1.17`, so the next normal target is patch `0.1.18`.
411 packaged skills, 527 active `SKILL.md` files including nested framework skills, and 42 packs in the staged package build.
No real npm publish, npm tag, or git release tag was created by this audit.
Finding Fixed
| Severity | Surface | Evidence | Resolution |
|---|---|---|---|
| fixed blocker | `packs/session-analytics/*/session-triage/SKILL.md` | `scripts/skill-pack-routing-audit.sh` reported four gaps where `benchmark-test-skill` required `agentic-skills-bench`. | Updated both mirrors so benchmark-regression loop-closing recommendations include `npx skillpacks install agentic-skills-bench` when unavailable; archived `v0.7`, bumped to `v0.8`, and updated changelogs. |
Verification Evidence
| Gate | Status | Notes |
|---|---|---|
| `scripts/skill-versions.sh --missing` | pass | All 527 skills have a version field. |
| `scripts/skill-archive-audit.sh --strict` | pass | 411 skills checked; no archive violations. |
| `scripts/base-skill-version-parity-audit.sh` | pass | 2 targeted base pairs checked; no failures. |
| `scripts/skill-deps.sh --broken` | pass | No broken references found. |
| `scripts/skill-mirror-parity-audit.sh` | pass | 178 mirrored pairs checked; 116 approved drifts; no failures. |
| `scripts/skill-pack-routing-audit.sh` | pass | Passed after the `session-triage` routing fix. |
| `node scripts/upgrade-alignment-page.mjs --check` | pass | 309 ownable generated bundles checked; no updates needed. |
| `node scripts/upgrade-interrogation-page.mjs --check` | pass | 20 ownable generated bundles checked; no updates needed. |
| `scripts/validate-skills-catalog-export.sh` | pass | Catalog export artifacts are fresh after regenerating and staging them. |
| `npm --workspace packages/skillpacks run test:node` | pass | 175 tests passed; 0 failed. |
| `npm --workspace packages/skillpacks run build:check` | pass | Convention bundle audit, manifest check, and package staging boundary passed for 411 active skills. |
Package Boundary
The exact publish target check `npm pack ./packages/skillpacks/build --dry-run --json --silent` passed. The dry-run package reported `skillpacks@0.1.17`, tarball size about 10.2 MB, unpacked size about 63.0 MB, `entryCount: 3718`, and no bundled dependency payload.
Package staging reported source fingerprint `d5aa5f7742233e50fbcc5bf418a1c869e60d073d9350ef7fdd3f52f95f54f984` for 411 skills and 42 packs.
Publish Gate
./publish.sh --dry-run patch failed before source mutation during npm auth preflight for skillpacks@0.1.18 and @glexcorp/gskp@0.1.18.
Error evidence: npm error code E401 and 401 Unauthorized - GET https://registry.npmjs.org/-/whoami. The script instructed logging in to https://registry.npmjs.org/ as glexcorp before a real publish.
No package version bump or publish was left behind; the failure happened in the pre-bump auth gate.
Next Work
Next work: restore npm auth for the expected publisher, then rerun the strict dry run from a clean tree. Publish only after explicit user approval.
Recommended next command: npm login --registry https://registry.npmjs.org/