The lockfile for agent skills

Repertoire installs a skill into every coding agent you use, then pins it with a
lockfile you commit. The same skills arrive on every laptop and CI job, and an
edit you made by hand is never overwritten.

repertoire add zensical --target all

That line finds zensical in a skill catalog, checks the package, copies it into
each agent's own skills directory, and records a content digest per target.
repertoire update refreshes the copies it owns and refuses the ones you
changed.

Install · Documentation · Why a lockfile

Why a lockfile

Copying a SKILL.md folder works once. It does not survive a second agent, a
teammate, or a CI job.

A skill is a folder with a SKILL.md that teaches an agent how to do
something. Codex, Claude Code, Cursor, Gemini CLI, Copilot and the rest read the
same format and look in different directories. That is the whole problem, and it
is a package-management problem.

Install

Linux and macOS:

curl -fsSL https://raw.githubusercontent.com/phillarmonic/repertoire-ai/master/install.sh | bash

Windows: download repertoire-setup-<version>.exe from the
latest release,
or run the installer script in PowerShell:

irm https://raw.githubusercontent.com/phillarmonic/repertoire-ai/master/install.ps1 | iex

Go 1.27 or newer:

go install github.com/phillarmonic/repertoire-ai/cmd/repertoire@latest

Five minutes to a lockfile

# What the built-in catalog offers
repertoire list --available

# Install into every supported agent
repertoire add zensical --target all

# What Repertoire now manages, and where each copy came from
repertoire show zensical

show prints the catalog, the commit, the digest, and the integrity of every
copy. That output is the point of the tool.

Prove it does not overwrite you

Edit an installed skill, then update:

echo "my local note" >> ~/.claude/skills/zensical/SKILL.md
repertoire update

update stops and exits 1 when a copy was edited locally, naming the skill and
the target. Pass --force when you mean it. This is the behaviour that separates
a package manager from a copier, and it takes about twenty seconds to check.

A team, in one committed file

# repertoire.yaml
schema: 1
skills:
  zensical:
    catalog: phillarmonic
  repertoire:
    catalog: phillarmonic

repertoire bootstrap   # on a new machine or in CI
repertoire sync        # same, after fetching catalog changes

Catalogs

A catalog is a Git repository with a repertoire.yaml. Point at your existing
repository and it works even without one: a source with no manifest is read as a
loose catalog,
and any directory holding a valid SKILL.md becomes a skill.

repertoire catalog add [email protected]:example/private-skills.git --name company
repertoire catalog init            # scaffold a new catalog repository

Catalogs use your normal Git credentials. Repertoire stores no tokens and sends
no telemetry.

Signed skills

A catalog can require signed commits, and a trusted skill ships
REPERTOIRE.digest.asc, a detached signature over its content digest.
Verification runs locally in a temporary keyring, imports only the keys named in
the trust block, and never contacts a keyserver. A failed check stops add,
install, update and bootstrap before the lock is written.

Let your agent drive it

repertoire add repertoire --target all

Then ask the agent to install a skill, write a repertoire.yaml, or scaffold a
private catalog. The skill knows the commands and the safety rules.

Which command do I want?

Supported agents

Agent Skills, Aider, Amp, Antigravity, Claude Code, Cline, CodeBuddy, Codex,
GitHub Copilot, Cursor, Devin, Factory Droid, DeepSeek Harness, Gemini CLI,
Hermes, Junie, Kilo Code, Kimi Code, Kiro, OpenClaw, OpenCode, Pi, Roo Code,
Trae, VS Code, Windsurf, and more. The full target table is in
Targets and security.

Documentation

Full documentation lives at
phillarmonic.github.io/repertoire-ai:

• Set up a project or team
• Let your agent drive Repertoire
• Command reference
• Private and company catalogs
• Troubleshooting
• Concepts:
  Manifests and state,
  Catalogs,
  Targets and security

Browse the docs locally with xdrun docs.

What it does not do

• It does not host skills. A catalog is a Git repository you control.
• It does not run or sandbox a skill. A skill is instructions; the agent acts.
• It does not manage CLAUDE.md, AGENTS.md or settings files, except files a
  skill itself ships.
• Signatures are opt-in per catalog. Without a trust block, a digest still
  detects change, but it does not establish who published the change.

Development

xdrun ci
uv run zensical build --clean --strict

See Contributing.