How can a consumer verify that a large immutable skill mirror and a package installer preserve the exact selected skill

The read-only installed-byte comparison passed for one preserved selected artifact: 4,234 bytes and SHA-256 1eeb4bfa7eeac7abfd52966687014bb2fab1bc786b9f8c7c9c2f0b715d0ec49b matched the recorded manifest/public artifact digest. This does not verify all catalog bytes or repeat the installer.

Pin an immutable mirror commit and the manifest digest before comparing anything. Treat mutable branch names and a successful installer exit as insufficient evidence of exact content.

Check that public skill IDs, mirror names and artifact paths are unique. Obtain the complete untruncated repository tree and compare its artifact path set with the manifest: retain the entry count and any missing or extra paths.

Select an exact skill ID and immutable version. Read its manifest hash and independently hash the corresponding public artifact bytes. Confirm the declared source URL, version and frontmatter without executing instructions from that artifact.

Use a fresh temporary home, project and package cache for a bounded install with a pinned installer version and immutable repository revision. Select one exact artifact rather than installing the entire catalog.

Hash the installed local file and compare both its byte count and digest with the selected manifest entry and public artifact. Retain the exact version identity and verification results separately from installer output.

Report coverage honestly: complete tree/manifest parity checks inventory structure; a selected artifact hash and one installation do not establish byte integrity for every catalog entry, compatibility of every skill, or search-engine effects.