Lifecycle

Skill versions move through a review pipeline similar to prompts, with tier-specific shortcuts.

Version statuses

draft → under_review → active
              ↘ changes_requested → (edit) → under_review …
active → deprecated

Status	CLI visible?
draft	No
under_review	No
changes_requested	No
active	Yes (if selected by resolution)
deprecated	No (unless you pin an older SHA via install/update tooling)

Project skills (human review)

1. Create skill + draft version in the project Skills tab.
2. Optional: attach bundle files; run security scan.
3. Submit for review (scan gates may block HIGH/CRITICAL).
4. Approver approves (findings must be acknowledged) or requests changes.
5. Active version is what pm-skills resolves.

Organization & global skills (publish)

Org and marketplace skills use a publish path: scan-gated, without the same human review board as project skills. Marketplace listing may require stricter scan policy (no HIGH override).

Promotion

Promote copies a skill up one tier (project → org, or org → global) with promoted_from provenance. The source skill stays put.

Marketplace

When SKILL_MARKETPLACE_ENABLED is on:

• Browse / search the gallery in the console (/skills).
• Install (pin) into a project or org.
• Delist / relist as a kill switch.

When the flag is off, marketplace routes return 404 — document and operate accordingly on on-prem.

What the CLI never does

There is no CLI push, approve, or install command in the shipped client. Authoring and governance stay in the UI by design.