--- title: "Hosted Provider Validation" description: "Records exact hosted provider-validation pins, covered surfaces, and explicit fallback boundaries." --- > Documentation Index > Fetch the complete documentation index at: https://nimbus.focal.host/llms.txt > Use this file to discover all available pages before exploring further. # Hosted Provider Validation > Generated from `@skillset/registry`. Ordinary Skillset builds and checks remain offline; this evidence runs only in the separate hosted workflow. The [maintainer runbook](https://github.com/outfitter-dev/skillset/blob/24800e02ed4e7150ea1bc7130c35603c98ea9da2/docs/development/features/feature-registry.md#hosted-provider-validation-refresh) explains how to refresh, validate, and record this evidence. | Lane | Authority | Exact pin | Source published | Retrieved | Last successful validation | Targets | Covered surfaces | | --- | --- | --- | --- | --- | --- | --- | --- | | `agent-skills-reference` | standards-reference | `69ef37e9424c0a7ea9dd2293b559e43ec8176379` | 2026-08-09T20:36:04.000Z | 2026-09-11T23:20:27.000Z | [2026-10-13T14:31:12.000Z](https://github.com/outfitter-dev/skillset/actions/runs/38413936666/job/115353218414) for `69ef37e9424c0a7ea9dd2293b559e43ec8176379` | claude, codex, cursor | every generated SKILL.md | | `claude-product` | product-validator | `@anthropic-ai/claude-code@2.1.269` | 2026-09-11T18:12:49.253Z | 2026-09-11T23:20:27.000Z | [2026-10-13T14:31:12.000Z](https://github.com/outfitter-dev/skillset/actions/runs/38413936666/job/115353218414) for `@anthropic-ai/claude-code@2.1.269` | claude | claude marketplace, claude plugin manifest, claude plugin skills | | `codex-authoring` | provider-source | `6b9826e3aa83b1a5947db50f4332cb9c65f1b340` | 2026-09-09T21:43:48.000Z | 2026-09-11T23:20:27.000Z | [2026-10-13T14:31:12.000Z](https://github.com/outfitter-dev/skillset/actions/runs/38413936666/job/115353218414) for `6b9826e3aa83b1a5947db50f4332cb9c65f1b340` | codex | codex marketplace source resolution, codex plugin manifest, codex plugin skills | | `cursor-authoring` | provider-source | `f5bdd6826fd0a0d9cbc4347134c3a74a200b9d9d` | 2026-09-11T01:17:03.000Z | 2026-09-11T23:20:27.000Z | [2026-10-13T14:31:12.000Z](https://github.com/outfitter-dev/skillset/actions/runs/38413936666/job/115353218414) for `f5bdd6826fd0a0d9cbc4347134c3a74a200b9d9d` | cursor | cursor marketplace, cursor plugin manifest | ## Acquisition Evidence ### agent-skills-reference - archive: [immutable source](https://codeload.github.com/agentskills/agentskills/tar.gz/69ef37e9424c0a7ea9dd2293b559e43ec8176379) — `sha256:0c9eabbe602095c4f4d771ee55bf74f6bc7e1c770f25d4fe29ce9802981daa20` - dependency: `skills-ref frozen upstream lock@0.1.0` — `sha256:c2d1b9a8638e81f763f04928e8107741886160b6bda2b8cb9784336bebeec94a` ### claude-product - npm: [immutable source](https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-2.1.269.tgz) — `sha512-osSbRU1KjlAfhVSgso7g+KxCr5DLNlfm7xeRPpm/c9s+7HGqQLHbkUYvjepbe6TiHJa9iSeirW/t7vW4sZhTIQ==` - npm: [immutable source](https://registry.npmjs.org/@anthropic-ai/claude-code-linux-x64/-/claude-code-linux-x64-2.1.269.tgz) — `sha512-Ti+9oKbf2p9pJuMMj1Fv+6YzljREpy9cx6SN7NV7Zik/vaaXPxC8u+cDiGF7HnPPJ5HsLbmwKoh3BnE3IhdAeQ==` ### codex-authoring - source: [immutable source](https://raw.githubusercontent.com/openai/codex/6b9826e3aa83b1a5947db50f4332cb9c65f1b340/codex-rs/skills/src/assets/samples/plugin-creator/scripts/validate_plugin.py) — `sha256:f4eeadb733b28b0c3e714de263a76d6542866a672f3e99bdffcf4dbcdf85e944` - source: [immutable source](https://raw.githubusercontent.com/openai/codex/6b9826e3aa83b1a5947db50f4332cb9c65f1b340/codex-rs/skills/src/assets/samples/plugin-creator/scripts/identifier_validation.py) — `sha256:a6d51ce4a9a7e8f85626ff5808a467a67574e7f8cdf1167ffb467c5f67e57223` - npm: [immutable source](https://registry.npmjs.org/@openai/codex/-/codex-0.154.0-linux-x64.tgz) — `sha512-a4FI3A8sGtwGrOqltrPbrS2hajrHQG591EwmRfiRoLMb10VxdBtUGW4gu6IJVYENiYGA7k3P4jlRHEoCZU/s9Q==` - dependency: `PyYAML@6.0.3` ([artifact](https://files.pythonhosted.org/packages/8b/9d/b3589d3877982d4f2329302ef98a8026e7f4443c765c46cfecc8858c6b4b/pyyaml-6.0.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl)) — `sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc` ### cursor-authoring - source: [immutable source](https://raw.githubusercontent.com/cursor/plugins/f5bdd6826fd0a0d9cbc4347134c3a74a200b9d9d/scripts/validate-plugins.mjs) — `sha256:1b38ddfecf37f292acfa80a3c575f13bfca07d9e06f0ddfc9b72df3ed4dbb929` - source: [immutable source](https://raw.githubusercontent.com/cursor/plugins/f5bdd6826fd0a0d9cbc4347134c3a74a200b9d9d/schemas/plugin.schema.json) — `sha256:31db124b1c7e43c22abb13ebf7e7c74556482e480fd492b80638d815c85b96b1` - source: [immutable source](https://raw.githubusercontent.com/cursor/plugins/f5bdd6826fd0a0d9cbc4347134c3a74a200b9d9d/schemas/marketplace.schema.json) — `sha256:50c85058bf329588401fd2fc93180a574fa64abbb6c2606400febfb6f4d094e8` - dependency: `ajv@8.20.0` ([artifact](https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz)) — `sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==` - dependency: `ajv-formats@3.0.1` ([artifact](https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz)) — `sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==` - dependency: `fast-deep-equal@3.1.3` ([artifact](https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz)) — `sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==` - dependency: `fast-uri@3.1.5` ([artifact](https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz)) — `sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==` - dependency: `json-schema-traverse@1.0.0` ([artifact](https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz)) — `sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==` - dependency: `require-from-string@2.0.2` ([artifact](https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz)) — `sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==` ## Coverage Boundaries ### agent-skills-reference Negative canary: SKILL.md without required description frontmatter. - Agent Skills is a portable standards-floor reference check, not proof of any provider runtime contract. - Internal conformance fallback: provider-specific skill metadata and runtime behavior (`packages/core/src/provider-format-conformance.ts`; `packages/core/src/__tests__/adapter-conformance-coverage.test.ts`, `packages/core/src/__tests__/adapter-conformance.test.ts`, `packages/core/src/__tests__/provider-format-conformance.test.ts`). ### claude-product Negative canary: invalid JSON in .claude-plugin/plugin.json. - Product validation proves authoring ingestion shape, not installation, trust, activation, or runtime behavior. - Internal conformance fallback: Skillset output ownership and provenance, render-result coverage (`packages/core/src/provider-format-conformance.ts`; `packages/core/src/__tests__/adapter-conformance-coverage.test.ts`, `packages/core/src/__tests__/adapter-conformance.test.ts`, `packages/core/src/__tests__/provider-format-conformance.test.ts`). ### codex-authoring Negative canary: missing name in .codex-plugin/plugin.json. - The released plugin-creator script is an authoring validator, not a whole-provider or runtime-hook validator. - The released Codex consumer proves read-only marketplace discovery and local source resolution, not installation, trust, activation, or runtime behavior. - Internal conformance fallback: hooks, render-result coverage, runtime consumption (`packages/core/src/provider-format-conformance.ts`; `packages/core/src/__tests__/adapter-conformance-coverage.test.ts`, `packages/core/src/__tests__/adapter-conformance.test.ts`, `packages/core/src/__tests__/provider-format-conformance.test.ts`). ### cursor-authoring Negative canary: missing name in .cursor-plugin/plugin.json. - The provider-owned source validator covers marketplace and manifest authoring, but does not inspect hook files. The hosted hook probes are Skillset-owned internal authoring conformance, not Cursor product or runtime proof. - The public schema and shipped Cursor Agent 2026.07.23-e383d2b disagree on category and tags placement; Skillset preserves the conflict and does not synthesize either field from keywords. - The shipped Cursor Agent bundle is recorded as runtime-consumer evidence only (sha256:b3b9931f3817c1b269b49148be70965830811d52b2aee98b9513247675838040). - Internal conformance fallback: category and tags authority conflict, cursor hook authoring conformance, render-result coverage, runtime consumption (`packages/core/src/provider-format-conformance.ts`; `packages/core/src/__tests__/adapter-conformance-coverage.test.ts`, `packages/core/src/__tests__/adapter-conformance.test.ts`, `packages/core/src/__tests__/provider-format-conformance.test.ts`, `packages/core/src/hooks.ts`). Source: https://nimbus.focal.host/skillset/reference/provider-validation/index.mdx