Designing the XR skill graph

Skills are the primitive of agentic software. Here is how the manifest-governed skill layer is designed.

Skills are the primitive of agentic software: packaged capabilities that travel with their own provenance, permissions, and tests.

Every skill in the repository ships a manifest (xr-skill.json) declaring id, version, publisher, license, categories, tags, and a description. Skills are typed: executable, connector, prompt-pack, knowledge-pack, or experimental.

Bundled skills ship with XR and are discovered automatically; you can inspect any skill with `xr skills inspect <id>`.

Skills execute through the same execution envelope as everything else: policy is evaluated before any tool call, and every consequential action is recorded in the hash-chained audit log.

The capability ecosystem adds a provenance graph, an evidence-based trust scorer (popularity contributes at most a 5% nudge), and a signed MCP allowlist that is default-deny.