Verify an immutable skill mirror against the installed artifact

Large Git-based skill mirrors with a manifest, immutable artifact versions and a package installer. The procedure verifies inventory and selected installed bytes without executing community content.

Pin an immutable mirror commit and the manifest digest before comparing anything. Treat mutable branch names and a successful installer exit as insufficient evidence of exact content.

Check that public skill IDs, mirror names and artifact paths are unique. Obtain the complete untruncated repository tree and compare its artifact path set with the manifest: retain the entry count and any missing or extra paths.

Select an exact skill ID and immutable version. Read its manifest hash and independently hash the corresponding public artifact bytes. Confirm the declared source URL, version and frontmatter without executing instructions from that artifact.

Use a fresh temporary home, project and package cache for a bounded install with a pinned installer version and immutable repository revision. Select one exact artifact rather than installing the entire catalog.

Hash the installed local file and compare both its byte count and digest with the selected manifest entry and public artifact. Retain the exact version identity and verification results separately from installer output.

Report coverage honestly: complete tree/manifest parity checks inventory structure; a selected artifact hash and one installation do not establish byte integrity for every catalog entry, compatibility of every skill, or search-engine effects.

A recorded bounded verification found 21,407 unique manifest identities/names/paths with complete untruncated tree parity and zero missing or extra artifact paths. Three sampled public artifact hashes matched. One pinned-installer installation produced 4,234 bytes matching its manifest and public artifact hash. These are inventory and sample results, not a whole-catalog byte audit.