feat(registry/types): add signer-identity provenance to Skill

registry/types/data/skill.schema.json

@@ -85,6 +85,9 @@
         "$ref": "#/$defs/skill_package"
       }
     },
+    "provenance": {
+      "$ref": "#/$defs/provenance"
+    },
     "metadata": {
       "type": "object",
       "description": "Official metadata from the SKILL.md file",
@@ -168,6 +171,52 @@
         }
       }
     },
+    "provenance": {
+      "type": "object",
+      "description": "Expected signer identity for this skill, checked on first install instead of trust-on-first-use. Every field is optional: an absent or empty value leaves that dimension unconstrained. Mirrors the server provenance definition in publisher-provided.schema.json, with two deliberate differences. First, no 'format' keywords, because the Go Provenance struct serializes unset fields as empty strings and an empty string does not satisfy 'uri' or 'hostname'. Second, 'attestation' is not accepted and 'additionalProperties' is false: the verifier only compares an expected attestation when the artifact also carries one, so a declared attestation constraint would be silently skipped against a signature that has none. Rejecting the key keeps the contract fail-closed -- a constraint this path cannot enforce is refused loudly rather than ignored. The same strictness makes a misspelled constraint key an error instead of a silently dropped guarantee.",
+      "additionalProperties": false,
+      "properties": {
+        "sigstore_url": {
+          "type": "string",
+          "description": "Sigstore TUF repository host for provenance verification",
+          "examples": [
+            "tuf-repo.github.com",
+            "tuf-repo-cdn.sigstore.dev"
+          ]
+        },
+        "repository_uri": {
+          "type": "string",
+          "description": "Repository URI used for provenance verification"
+        },
+        "repository_ref": {
+          "type": "string",
+          "description": "Repository reference used for provenance verification"
+        },
+        "signer_identity": {
+          "type": "string",
+          "description": "Identity of the signer for provenance verification",
+          "examples": [
+            "/.github/workflows/build-skills.yml"
+          ]
+        },
+        "runner_environment": {
+          "type": "string",
+          "description": "Build environment where the skill was built",
+          "examples": [
+            "github-hosted",
+            "gitlab-hosted",
+            "self-hosted"
+          ]
+        },
+        "cert_issuer": {
+          "type": "string",
+          "description": "Certificate issuer for provenance verification",
+          "examples": [
+            "https://token.actions.githubusercontent.com"
+          ]
+        }
+      }
+    },
     "skill_repository": {
       "type": "object",
       "description": "Source repository metadata",

registry/types/skills_types.go

@@ -77,6 +77,17 @@ type Skill struct {
 	Icons []SkillIcon `json:"icons,omitempty"`
 	// Packages is the list of packages for the skill.
 	Packages []SkillPackage `json:"packages,omitempty"`
+	// Provenance is the expected signer identity for this skill, checked on
+	// first install instead of trust-on-first-use. Absent means unconstrained
+	// — most catalog entries won't have this for a while, and that must not
+	// break installs; it's an opt-in tightening per entry, not a requirement.
+	//
+	// Only the identity fields are honored. Setting Provenance.Attestation
+	// makes Validate fail: the verifier compares an expected attestation only
+	// when the artifact also carries one, so the constraint would be silently
+	// skipped against a signature that has none. Refusing it loudly keeps the
+	// contract fail-closed until that gap is fixed.
+	Provenance *Provenance `json:"provenance,omitempty" yaml:"provenance,omitempty"`
 	// Metadata is the official metadata of the skill as reported in the
 	// SKILL.md file.
 	Metadata map[string]any `json:"metadata,omitempty"`