research: probe two registry properties a per-skill scan cannot see

[Ap6pack]

Where this came from

Clustering the 78,233-skill snapshot by content_sha256 (no new scanning, data already on the registry-snapshots branch) surfaced two things:

skills:                78,233
  no content hash:      2,033
distinct hashes:       73,310
hashes seen >1 time:    1,729
skills in a dupe set:   4,619   (5.9%)

And the 2,033 without a hash are not scan failures:

HTTP 409  AMBIGUOUS_SKILL_SLUG   1,614
HTTP 404  (no code)                419

The two questions

1. Who owns the contested slugs? 1,614 slugs are claimed by more than one publisher. The API refuses to resolve them, replying "Found multiple skills with the slug X; specify which one you want to install". 1password is among them. These 1,614 are every skill this project has no verdict for at all, and they are not a random 2% of the registry: they are specifically the names more than one person wanted. The snapshot truncates the error body at ~300 chars so only the first ownerHandle survives, which is why this has to be re-fetched.

2. Do duplicates actually ship the same package? content_sha256 covers SKILL.md only. Two skills with identical documentation can ship different code. If they do, "byte-identical duplicate" is the wrong phrase and any claim about takedown blast radius built on it is wrong too. This fetches each clone's referenced files and compares their hashes.

What this is not

Neither mode convicts anything. Both report structure, deliberately: a claim about registry shape shouldn't depend on the rule engine being correctly calibrated, and the last week has been a sustained argument for why that matters. Four divergence leads read, four withdrawn, all false positives of our own making.

One design note

report_clones prints NO DATA for clusters where every fetch failed, and refuses to print a summary at all if that's every cluster:

summary: 0 identical, 0 divergent, 0 with no referenced files, 2 unreachable

Every cluster failed to fetch. This says nothing about the
registry -- it says the run had no network reach. Not a result.

Verified by running it from the sandbox, which can't reach clawhub.ai. Without that, an offline run and a genuinely clean registry produce the same output.

Ruff clean, compiles, cluster loading smoke-tested offline against the live snapshot.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DNoTXU8k3pfSBzR7aJubqL

---

Generated by Claude Code