v0.2.0

Added

• oss-skill bundles a validator at scripts/validate.mjs that checks a repository against R-SKL-01 through R-SKL-05. It needs Node 22 or later, or Bun, and nothing installed: it imports only Node built-in modules, reads files, and makes no network call.
• STANDARD.md gains R-SKL-05, a script a skill ships uses sh or Node with no dependencies, because it runs on the reader's machine rather than the author's, and R-SKL-06, every host a repository claims support for has a committed manifest or a documented install command.
• Plugin manifests for Codex CLI at .codex-plugin/plugin.json and Cursor at .cursor-plugin/plugin.json, Codex's own marketplace at .agents/plugins/marketplace.json, and an .opencode/skills symlink. Each host now finds the skills where it scans.
• A documentation site generated from STANDARD.md and the skills, served at oss-kit.svyatov.com and redeployed on every push to main. Every rule has its own page, so a rule can be linked and read without installing anything.
• Install, getting started, and adoption guides on that site. The install guide covers every claimed harness, one section each.
• oss-ci covers static-site deployment, for GitHub Pages and GitLab Pages. It carries no rule, since no rule requires a project to publish a site, so the skill asks before writing a deploy and writes none for a project that only builds a site as a check.
• The README declares the public API that Semantic Versioning covers: skill names and paths, rule IDs and what they require, the bundled validator's command line, and the manifest paths each host reads.

Changed

• R-SKL-02 now names the validator oss-skill bundles. The rule already accepted any specification validator, so what it requires has not changed.
• oss-harden reads the upstream project's newest release before pinning an action, component, or image, and reports a lagging major to the user instead of freezing it. R-SEC-01 and R-SEC-06 accept a SHA regardless of the age of the tag behind it, so a stale pin used to pass unquestioned and then read as audited.
• The README install section shows the two fastest commands and links to the install guide.
• Every plugin and marketplace manifest describes oss-kit as Curated agent skills for open source maintainers, the same line the site carries. The manifests called it an opinionated quality bar, so the pitch a reader saw depended on whether they arrived through a plugin browser or the site.
• Security reports go through GitHub private vulnerability reporting, now enabled on this repository. Email stays the fallback.
• CONTRIBUTING.md names the documentation site build. CI requires that check, and the guide used to say the repository has no build step, so a contributor who touched site/ passed every documented command and still failed the merge.

Removed

• The skills-ref validator is no longer installed in CI or named in the contributing guide. The bundled oss-skill validator replaces it, so the project no longer depends on a tool whose upstream describes it as for demonstration only.