# Agent Toolkit: portfolio evidence

This record describes public commit 06c24b37b4655317844a2d7092270ab1a1aad5a4, checked September 21, 2026.

- Source: https://github.com/KaustubhLall/agent-toolkit/tree/06c24b37b4655317844a2d7092270ab1a1aad5a4
- CI run: https://github.com/KaustubhLall/agent-toolkit/actions/runs/35645682954
- Authorship: https://github.com/KaustubhLall/agent-toolkit/blob/06c24b37b4655317844a2d7092270ab1a1aad5a4/AUTHORSHIP.md
- Upstream notices: https://github.com/KaustubhLall/agent-toolkit/blob/06c24b37b4655317844a2d7092270ab1a1aad5a4/THIRD_PARTY.md

The public manifest lists 25 enrolled standalone skills. The CI job logs report the same 23 tests passing on Windows, macOS and Linux with Node.js 22, followed by distribution verification. These counts describe the pinned release, not all future syncs. The portfolio review read the existing run; it did not execute the installer, change automation, rerun tests or invoke skills.

The workflow figure is a source-derived explanation of publisher review and consumer ownership checks, not a captured execution. Read verification.json for source-blob SHA256 identities, job links and limitations. A local working checkout can use different newline bytes; these hashes identify exact Git blobs.

Kaustubh Lall authored the harness, preferences and integration design. Imported methods and reference material retain their separate upstream authors and licenses. This evidence package contains curated public metadata only, with no private publisher configuration or receiving-machine receipts.

## Scope

File/setup integration checks do not prove an assistant invoked every installed skill, recreate unavailable native tools, certify privacy review or demonstrate better coding outcomes. SHA256 checks are integrity comparisons, not signed attestation. The configured publisher must be online, and receiving machines pull updates explicitly.

## Verify these files

SHA256SUMS.txt lists verification.json and this guide. Compare SHA256 over the exact downloaded bytes using your preferred checksum tool. The self-referential checksum file is excluded.

## Publication recovery limitation

The fingerprint check applies to newly generated exports with requireReview enabled. Pending eligible commits can be retried before that check, using commit shape, generated-path and content checks without a persisted review fingerprint receipt. The workflow figure labels its publisher lane accordingly. This is a documented limitation, not a repaired sync implementation.