ainb · feat/skill-manager · tmux-verify G5

The toolkit as an external skill provider

ainb users browse the curated catalog — 93 toolkit-owned skills + vetted external — in the [b] modal and via ainb skill browse --catalog ainb, then install any pick across every tool home. CODE COMPLETE 4 / 6 GATES GREEN HUMAN GATE PENDING

113

catalog entries

96 + 17

owned + external

40+

unit/integ tests

~20

tripwires green

network in tests

A−

review security

Update — scope expanded + reviewed. The catalog now also carries the npx / claude-plugin / mcp classes (4 + 11 + 2 = 17 external), shown in the [b] shelf with a kind badge. Those install by running their documented command (npx skills add …, claude plugin install …, claude mcp add …) via sh -c, gated behind a 2-step confirm (first Enter shows the exact command, second runs it) — sourced only from the vetted toolkit release index. A scoped code review graded it Good, Security A−, no Critical; all 2 Medium + 3 Minor findings were applied. Separately, the post-merge drift that had silently broken all ~20 skill-manager tmux tripwires locally (home-marker + ainb-hooks nudge) was repaired — every one green again.

What shipped

The agents-in-a-box toolkit is now an external provider of skills that ainb users browse and install — not baked in. A new AinbCuratedCatalogBackend (alongside the existing SkillsShHttpBackend, behind the same CatalogBackend trait) surfaces one curated shelf: the toolkit's own skills and the vetted external-dependencies.yaml entries.

TUI — [b] opens the browse modal, defaulting to the curated (ainb) catalog; Tab toggles to skills.sh. A blank Enter lists the whole curated shelf (it's small + local); typing filters.
CLI — ainb skill browse --catalog ainb prints the same shelf; --catalog skills (default) keeps the skills.sh path.
Install — selecting any entry routes through the existing ainb source add + ainb skill install flow: owned → the pinned GitHub release, external → its real upstream, deployed to every tool home.
Index — published as a GitHub release asset (catalog-index.json), fetched by a pinned tag ([skills].catalog_release, default latest). The owned install URIs pin that same tag, so a browse and its installs always agree on bytes.

Architecture

SKILL.md frontmatter ┐ ┌ pinned by [skills].catalog_release external-deps.yaml ┴─▶ xtask gen-catalog-index ─▶ catalog-index.json ──┐ (93 owned + 3 external) (GitHub release asset)│ ▼ [b] modal / CLI ◀── CatalogHit ◀── AinbCuratedCatalogBackend (offline-mockable) │ AINB_CATALOG_INDEX_FILE = zero-network tests ▼ ainb source add + ainb skill install ─▶ deploy to every tool home

Proof — the live journey (tmux-verify G2/G3)

A vhs recording drives the real binary against an offline curated index. Every frame was read and asserted — not blank-checked.

Full curated browse + install journey — **Full journey:** `m` → SkillManager · `b` → curated modal · `Enter` → shelf · `Enter` → install. Entirely offline.

Curated shelf showing owned and external — **Frame: the curated shelf.** Title reads `Browse Catalog (ainb curated)`. The shelf shows BOTH an owned entry (`aaa-curated-owned` → `stevengonsalvez/agents-in-a-box`) and a vetted-external entry (`zzz-curated-external` → `acme/external-skill`), with the `[Tab] switch catalog` affordance. This is the success-criterion "shows BOTH" check, frame-true.

Install success toast and new source — **Frame: after install.** A green ✓ installed toast; the Sources panel gained a new source (`file-tmp-ainb-curated-jour`) — the selected entry was installed from its upstream and deployed. The tripwire additionally asserts the manifest + lockfile on disk.

Test output

G1 — live tmux tripwire, non-flaky ×3 (offline)

# curated browse → install, real binary in tmux
run 1  test result: ok. 1 passed ... finished in 8.76s
run 2  test result: ok. 1 passed ... finished in 8.34s
run 3  test result: ok. 1 passed ... finished in 8.80s

G4 — catalog unit + integration tests (zero network)

ainb-skill-core  catalog_index   test result: ok. 10 passed
ainb-cli         catalog_curated test result: ok.  7 passed
ainb-cli         skill_browse    test result: ok.  5 passed   # incl. curated --catalog ainb

Shipped — 9 atomic commits

Commit	Change
`60322927`	skill-core: CatalogIndex types + pure transforms (10 tests)
`6e630b3e`	fix: repair malformed `sentry-cli` frontmatter close (real product bug)
`6781b407`	xtask: `gen-catalog-index` generator + snapshot
`e0258e12`	cli: `AinbCuratedCatalogBackend` over the release index (7 tests)
`c763ce2a`	cli: `skill browse --catalog ainb` (5 tests)
`a67cb808`	tui: browse the curated catalog in the `[b]` modal + `Tab` toggle
`d1036624`	test: live tmux tripwire for curated `[b]` browse + install
`1a12574f` / `8693f456`	docs/ci: `[skills].catalog_release` pin + release publish step
`5e6b0f96`	test: vhs journey scaffolding

Gates

Gate	What	Status
G1	tmux tripwire — comprehensive, non-flaky ×3	GREEN
G2/G3	vhs journey, every frame READ + asserted	GREEN
G4	catalog tests + my code clippy-clean	GREEN
G5	this explainer, live on here.now	THIS PAGE
G6	HTML solid → human validates	STEVIE

Known limitations & follow-ups

External scope. v1 includes github-repo external entries that resolve to an installable subpath (3 of them). multi-subpath dirs install best-effort; repo-root-only externals are omitted because the install flow requires a @ref/path URI.
Deferred catalog classes. npx / claude-plugin / mcp-server entries from external-dependencies.yaml aren't a single gh: unit, so they're not in the browse shelf yet.
Pre-existing tripwire drift (not this feature). A main-merge home redesign dropped the "Welcome to AINB" banner and added an ainb-hooks install nudge that intercepts keys — silently breaking ~18 other skill-manager tmux tripwires locally (they SKIP in CI without tmux, so it's invisible). The 2 browse tripwires are repaired (home marker → Skills (manager) tile + seed install.json prompt_dismissed); the other 18 want the same mechanical sweep.

Generated for the /tmux-verify G5 gate · branch feat/skill-manager · all artifacts real (no placeholders). The human gate (G6) is Stevie.