fix(install): restore locked revisions without re-resolving requirements #7

Summary

skill install can update a dependency while restoring it. For a source pinned from a branch or version range, restoration resolves the original requirement again instead of checking out the revision already recorded in skills.resolved.

README.md:73–75 promises that install materializes pinned skills.

Code evidence at b742a99:

• Sources/Core/RuntimeService.swift:555–560 loads pins and calls resolvedSource.
• Sources/Core/RuntimeService.swift:1295–1329 prioritizes pin.requirement; the fallback also prioritizes ref/branch over revision.
• Sources/Core/ProcessRunner.swift:74–94 fetches and checks out the newly resolved candidate.
• Sources/Core/ProcessRunner.swift:199–200 resolves branch requirements to origin/.
• Sources/Core/RuntimeService.swift:935–961 invokes Installer.install.
• Sources/Core/InstallLock.swift:175–198 replaces the stored state and skill hash during merge.

Impact: clean restores are not reproducible. install can change both installed content and the lockfile without an explicit update request.

Reproduction

Proposed steps; not executed for this report.

1. Under a temporary root, create separate source and project directories.

2. Initialize source as a Git repository with branch main.

3. Commit skills/demo/SKILL.md with name: demo, a nonempty description, and body text identifying commit A.

4. From project, run:

   skill add <absolute-temporary-source-path> \
     --branch main --scope project --agent codex --skill demo --mode copy

5. Save a copy of .agent/skills.resolved and note its revision A.

6. Change the source skill body to identify commit B, then commit B on main.

7. Move project/.agents/skills/demo into a backup directory under the temporary root. Keep skills.resolved and the cache.

8. Run:

   skill install --scope project
   cat .agents/skills/demo/SKILL.md
   cat .agent/skills.resolved

A version-range variant is to add from tag 1.0.0 using --from 1.0.0, then publish tag 1.1.0 before restoration.

Expected Behavior

install restores revision A and its locked content without advancing the pin. A separate explicit update operation may resolve the moving branch or range.

If the locked revision cannot be obtained, fail with a clear error rather than substituting a newer revision.

Completion checks:

• Branch and range requirements restore their locked revision with both warm and empty caches.
• The resolved revision and skill content hash remain unchanged.
• Explicit update still advances eligible dependencies.
• Run swift test.

Actual Behavior

The branch is re-resolved to B, B's content is installed, and the new revision/hash are merged into skills.resolved.

This does not mean every source always upgrades: a fixed revision or an unchanged exact tag can still resolve to the same content.

No duplicate issue was found. Issue #4 concerns changes to an --all source's membership, not revision restoration.

Environment

• skill version: 0.2.1.
• Source inspected: b742a99; affected source matches v0.2.1.
• Swift version: not obtained in the read-only sandbox.
• OS: macOS 27.0.1 (26A434).
• Architecture: arm64.
• Validation: static inspection only; reproduction not executed.