Skill Governance

This skill keeps Claude Code skill marketplaces and their caches aligned with their source repositories. The source directory is the single source of truth; the cache is a derived copy. When the source changes, the cache must be rebuilt through official claude plugin commands, not by hand-copying files.

Governance Principles

1. Source is truth — The local source repo is canonical. If the cache is older or different, rebuild the cache from source.
2. Official methods only — Use claude plugin marketplace, claude plugin update, claude plugin uninstall, and claude plugin install. Manual cache deletion or file copying is only a cleanup step, never the primary installation method.
3. Scope preservation — Reinstall each plugin at the scope (user or project) where it was originally installed.
4. One version per skill in cache — After syncing, remove old semver version subdirectories so only the latest remains.
5. No-op safety — Drift checks are read-only. Sync and cleanup run only after user confirmation or an explicit trigger.
6. Workspace dirs are not plugins — Ignore *-workspace, dist, scripts, tests, references, demos, and other non-plugin directories when deciding what belongs in the cache.
7. Retire loose skills, do not destroy them — For untracked userSettings skills that have no SSOT or are obsolete duplicates, move the active directory to a dated retired-skills/ backup instead of deleting outright.

What to ignore when comparing source to cache

.git, .in_use, .security-scan-passed, .orphaned_at, .DS_Store, .gitignore, __pycache__, .pytest_cache, .venv, node_modules, *.pyc, *.pyo.

Also ignore top-level directories that are not skills: *-workspace, dist, scripts, tests, references, demos.