fix(distribution): reconcile public skill evidence

PROVENANCE.md

@@ -7,13 +7,14 @@
 - Live capability snapshot: MCP `initialize` and `tools/list` returned 51
   read-only tools across website research, brand assets, Apple App Store,
   Google Play, YouTube, Reddit, and Hacker News.
-- Distribution: public GitHub source consumed by the official `skills` CLI and
-  skills.sh indexing.
+- Distribution: public GitHub source consumed by the official `skills` CLI;
+  skills.sh indexes this source asynchronously and its repository-path pages
+  are not proof that each focused skill is a real indexed listing.
 - Canonical Agent Skills source: `https://github.com/replynodes/replynodes-agent-skills`.
-  The currently verified skills.sh source page is
+  The canonical skills.sh repository page is
   `https://www.skills.sh/replynodes/replynodes-agent-skills/replynodes`, with
-  the focused logo page at
-  `https://www.skills.sh/replynodes/replynodes-agent-skills/brand-logo`.
+  `brand-logo` included in the source taxonomy but pending a verified focused
+  registry listing.
 - Acquisition hub: `https://github.com/replynodes/free-markdown-brand-logo-api`.
   It contains examples only and no duplicate Agent Skills files.
 - ClawHub migration: verified. ClawHub latest

references/canonical-skill-inventory-2026-10-06.md

@@ -1,5 +1,7 @@
 # Canonical skill inventory and taxonomy gate
 
+> Historical snapshot: the keyless classifications and quota conclusions below predate the gateway rollout. See [`references/keyless-readback-2026-10-09.md`](keyless-readback-2026-10-09.md) for the later production readback; do not use this snapshot as current route truth.
+
 Observed at **2026-10-06 UTC**. Repository head: [`2869acc`](https://github.com/replynodes/replynodes-agent-skills/tree/2869acc), equal to `origin/main`. This is the issue [#56](https://github.com/replynodes/replynodes-agent-skills/issues/56) discovery/decision gate. The related [replynodes-fetcher #715](https://github.com/replynodes/replynodes-fetcher/issues/715) page was read live on 2026-10-06: it is open and contains only its specification/body, with no comments or production evidence.
 
 ## Method, boundaries, and decision rule

references/keyless-readback-2026-10-09.md

@@ -0,0 +1,26 @@
+# Keyless production readback
+
+Observed **2026-10-09 UTC** against the canonical ReplyNodes production hosts,
+without credentials. This readback supersedes the older keyed-only snapshots in
+`canonical-skill-inventory-2026-10-06.md` and `slug-migration-2026-10-07.md`.
+
+| GET route | Result | Rate-limit evidence |
+| --- | --- | --- |
+| `https://api.replynodes.com/v1/brand/logo?domain=replynodes.com` | `200` JSON | limit `20`, remaining `18`, reset at UTC midnight |
+| `https://api.replynodes.com/v1/web/search?query=replynodes` | `400 invalid_request` | limit `10`, remaining `8`, reset at UTC midnight |
+| `https://api.replynodes.com/v1/appstore/search?term=notion&country=us&num=1` | `200` JSON | limit `10`, remaining `7`, reset at UTC midnight |
+| `https://api.replynodes.com/v1/webcontext/scrape?url=https%3A%2F%2Freplynodes.com%2F` | `200` JSON | limit `10`, remaining `9`, reset at UTC midnight |
+| `https://api.replynodes.com/v1/googleplay/search?term=notion&country=us&limit=1` | `200` JSON | limit `10`, remaining `9`, reset at UTC midnight |
+| `https://md.replynodes.com/https://replynodes.com/` | `429 anonymous_limit_reached` | limit `20`, remaining `0`, `Retry-After` observed |
+| `https://brand.replynodes.com/replynodes.com.json` | `429 anonymous_limit_reached` | limit `20`, remaining `0`, `Retry-After` observed |
+| `https://api.replynodes.com/v1/brand/retrieve?domain=replynodes.com` | `401 invalid_or_expired_token` | no anonymous quota; keyed control route |
+
+The Markdown and Brand hosts were already exhausted for the shared client-IP
+bucket, so this readback does not claim a fresh `200` response for those hosts.
+The documented web-search `text` form returned `504 gateway_timeout` twice;
+that is recorded as an upstream availability limitation, not converted into a
+success claim. Reddit, YouTube, and Hacker News routes were not probed here.
+
+The observed headers and typed `anonymous_limit_reached` envelope support the
+Tier A/Tier B wording in the public skills. This file records production
+evidence only; it does not create telemetry or claim retained users.

references/slug-migration-2026-10-07.md

@@ -51,6 +51,8 @@ reconciled the metadata to `internal: false` to match the shipped public surface
 the Logo host as an existing anonymous surface). The `brand-logo` slug itself is
 unchanged.
 
+> Historical snapshot: the keyed-only classifications below predate the gateway rollout. See [`references/keyless-readback-2026-10-09.md`](keyless-readback-2026-10-09.md) for current production evidence. The control route `/v1/brand/retrieve` remains keyed.
+
 ## Capability classification used for the rewrite
 
 Source: `replynodes-fetcher` PR #727 and `docs/anonymous-daily-quota.md`

skills.sh.json

@@ -17,7 +17,8 @@
       "title": "Brand research",
       "description": "ReplyNodes keyless, read-only brand research for AI agents — brand discovery, identity, public logos, colors, fonts, styleguide, typography, and design tokens.",
       "skills": [
-        "brand-kit"
+        "brand-kit",
+        "brand-logo"
       ]
     }
   ]

tests/test-distribution.sh

@@ -53,6 +53,21 @@ skills = {
 assert "company-research" in skills, "company-research missing from skills.sh taxonomy"
 # Preserve the approved #714/#56 public skill, including the renamed provider slug.
 assert "app-store-api" in skills, "app-store-api missing from skills.sh taxonomy"
+# Every production skill marked public must be represented in the canonical
+# taxonomy; this prevents a public focused skill from silently becoming an
+# ungrouped registry surface.
+public = set()
+for skill_file in [root / "SKILL.md", *sorted((root / "skills").glob("*/SKILL.md"))]:
+    text = skill_file.read_text(encoding="utf-8")
+    match = re.search(r"(?m)^name:\s*([A-Za-z0-9_-]+)\s*$", text)
+    internal = re.search(r"(?m)^\s*internal:\s*(true|false)\s*$", text)
+    assert match and internal, f"{skill_file} must declare name and internal"
+    if internal.group(1) == "false":
+        public.add(match.group(1))
+assert public == skills & public, (
+    "all public production skills must be present in skills.sh taxonomy: "
+    f"missing={sorted(public - skills)}"
+)
 # Legacy/internal aliases must not be presented as public acquisition choices.
 for legacy in (
     "app-store-research",