Registry

Every artifact is a git tree. The name is publisher/slug, the version is a semver tag, the content-address is a SHA. hm://lattice/plan-work-review@2.4.1 resolves to a signed tag, an SBOM, and a permission manifest. If that sounds like npm, it is because npm was the last time a capability market worked, and also the last time one became a global supply-chain incident. We are repeating both, with a fail-closed default.

The tree always contains SKILL.md or HARNESS.md, a manifest declaring fs.read, fs.write, network, exec, and secrets, and a signature over the SHA. Community-tier artifacts may omit the signature. They then cannot load on a fleet with prodOnlySigned, which is the production default. Certified-tier means Northstar scanned the tree. Managed-tier means the lab that published it will take the phone call.

Compatibility is a list of harness slugs, not a slogan. A Skill that claims “*” is lying; progressive disclosure still needs a loader the harness actually ships. Pin Anthropic’s progressive-disclosure advance on any runtime that claims Skills support and did not invent the loader yesterday.

Entitlement is checked at install and at deploy. A seat license that covers 140 Cursor agents will not admit the 141st replica. A usage license counts hosted agent-hours. An enterprise license is fleet-scoped and does not care how many workers you spawn under the supervisor you already paid for.