sylius-agent-skills — a digest that cannot go stale.

A configured digest is wrong from the first typo fix onwards

The SHA-256 digest in the index is computed over the document that is actually served, not stored in a configuration file. A stored value goes stale with the first typo fix on a skill — that is, with exactly the kind of change nobody classifies as release-relevant and therefore nobody accompanies with a checksum update.

The client bears the consequence, and it is unpleasant: it loads a perfectly intact skill, compares the digest, finds a mismatch and discards it — correctly, by the protocol, because from the outside a mismatch is indistinguishable from tampering. The second kind of damage comes from the same direction: an integrity check that fires regularly without cause gets switched off, and after that it protects nothing at all. A computed digest cannot drift.

If no skill is registered, the route at /.well-known/agent-skills/index.json answers 404 instead of an empty list. An empty list is a statement — it says this shop keeps an index and has nothing in it. The 404 says what is actually the case: nothing is offered here. A client can then keep looking instead of storing an empty result as the final answer.