Why versioning matters
Skill versions keep published work stable while new publishes move forward. Publishing only appends a new immutable version row and advances the parent skill’s latestVersion. Each row stores the manifest, content hash, publisher information, and timestamps, so earlier versions stay available for inspection.
Skill publishes follow the repository’s root package.json version, not just the skill files. When SKILL.md, supporting files, or a skill’s SKILL_MAP entry changes, bump that root version before publishing. The publish workflow stamps that version into .claude-plugin/marketplace.json, and the version guard stops a publish when staged skill content changes without a version bump.
How readers select a version
When you ask your agent for a skill without naming a version, Gloria returns the current head by default. Pinning a version number bypasses that head and returns the exact immutable version instead. The version history reads newest first and includes createdBy and createdAt, so the published trail stays easy to inspect.
Marketplaces and sync
External marketplaces act as organization-scoped subscriptions to upstream public repositories. Gloria records them as metadata-only skill rows rather than full bundles stored in Gloria. In the unified read model, a marketplace skill shows source: marketplace:<id>, author: marketplace, and latestVersion: 0.
Installing a marketplace skill means subscribing to the marketplace and using the host agent’s native install flow. Gloria never copies the external bundle content into its own store.
Marketplace sync refreshes the catalog from upstream and records the sync result, detected agents, lastSyncedAt, lastError, manifestName, and status. A transient empty resync does not wipe an existing catalog.
System skill reconciliation follows the same safety rule. Missing entries seed from the template tree, changed entries bump when the content hash changes, unchanged entries stay put, and org-authored skills are never clobbered.