Skill packages
What you'll find here
The craik.skill_package contract — reusable instructions,
entrypoints, docs, and assets. Packages don't carry plugin runtime
authority.
No runtime authority on packages.
Runtime authority is always false. Any executable
authority must be represented through the separate plugin governance
and grant model.
What it records
Package id · name · version · description
One or more entrypoints
Expected input & output schemas
Context requirements
Required inputs, trust boundary, missing-context behavior.
Documentation files
Asset paths
Provenance links
Optional plugin descriptor link
Docs and at least one entrypoint are required.
Versioning
package_version must be semantic-version-like: MAJOR.MINOR.PATCH
with an optional prerelease or build suffix, such as 1.2.3-beta.1
or 1.2.3+build.7. Partial versions like 1.2 are rejected so
operators can compare package revisions deterministically.
Required Boundaries
Skill packages describe reusable instructions and examples. Scope is
recorded by craik.skill_registry, invocation context is recorded by
craik.skill_invocation_context, and executable authority remains in
the plugin governance model. A package that needs runtime side effects
links to a plugin descriptor instead of carrying authority itself.
Every expected input schema must have a matching context requirement. The requirement records whether the input is required, the trust boundary where it is valid, and what the runtime should do if the input is missing: reject the invocation, require an omission record, or continue in degraded mode. This keeps skill packages from depending on implicit agent state.