feat(skill-author): record research sources as skill provenance

Adds a sources provenance step to the skill creation workflow so the
chain from research output to skill content is traceable. Closes #4.

- New scaffold template `assets/templates/references/sources.md` mirroring
  the research skill's sources.md format (slug → URL, description,
  contributing files, status)
- `source_keys` commented-out optional field added to the SKILL.md
  template, mirroring how research topic files link back to sources
- New Step 5 in the creation workflow: populate references/sources.md
  from research input (attributing contributing skill files) or delete it
  if no research was provided; add source_keys to SKILL.md and any
  references/*.md files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

plugins/kyberforge/skills/skill-author/README.md

@@ -40,6 +40,7 @@ If the destination is inside a plugin directory, read `references/deployment-mod
 | `assets/templates/README.md` | Annotated README template for the new skill |
 | `assets/templates/scripts/README.md` | Placeholder for bundled scripts |
 | `assets/templates/references/README.md` | Placeholder for reference docs |
+| `assets/templates/references/sources.md` | Sources provenance template for new skills |
 | `assets/templates/assets/README.md` | Placeholder for static assets |
 | `assets/templates/tests/README.md` | Placeholder for test files |
 | `tests/new-skill.bats` | Bats test suite for `scripts/new-skill.sh` |

plugins/kyberforge/skills/skill-author/SKILL.md

@@ -47,7 +47,7 @@ Extract the skill from a real task you've done — a skill refined from real exe
 
 If any are missing, stop and ask the user before proceeding.
 
-**Requires `/skill-audit`** — used in Step 5 for final validation. Both skills ship in the kyberforge plugin and are co-installed. If `/skill-audit` is unavailable, stop and ask the user to install the kyberforge plugin before continuing.
+**Requires `/skill-audit`** — used in Step 6 for final validation. Both skills ship in the kyberforge plugin and are co-installed. If `/skill-audit` is unavailable, stop and ask the user to install the kyberforge plugin before continuing.
 
 ### Step 1 — Scaffold
 
@@ -180,7 +180,19 @@ not in `scripts/`. See `tests/README.md` for setup instructions.
 
 If not needed, delete the placeholder READMEs and their directories.
 
-### Step 5 — Validate and close
+### Step 5 — Populate or delete `references/sources.md`
+
+If a research `sources.md` is present in the conversation context:
+
+1. Read it and filter to entries with `` `extracted` `` status only.
+2. For each entry, determine which skill files it contributed to (SKILL.md and any files in references/ that drew from it). Update `Contributing files` accordingly — list skill files, not research topic files.
+3. Write the updated content to `references/sources.md`.
+4. Add `source_keys` to the frontmatter of `SKILL.md` (under `metadata`) listing the slugs of sources that informed it.
+5. For each file in `references/` that was informed by research sources, add `source_keys` frontmatter (same format as research topic files) listing the relevant slugs.
+
+If no research `sources.md` is in context, delete `references/sources.md`.
+
+### Step 6 — Validate and close
 
 Run `/skill-audit` on `<destination-dir>/<skill-name>`.
 

plugins/kyberforge/skills/skill-author/assets/templates/SKILL.md

@@ -31,6 +31,13 @@ description: >
 # Optional. Arbitrary key-value map. Common keys: author, version, category.
 # No restrictions on keys or values.
 
+# source_keys:
+#   - source-slug-one
+#   - source-slug-two
+# Optional. Populated when this skill was built from /research output.
+# Lists slugs from references/sources.md that informed this file.
+# Also add source_keys to each references/*.md file that was informed by research.
+
 # allowed-tools: Bash Read Write
 # Optional (experimental — support varies by client).
 # Space-separated list of pre-approved tools.

plugins/kyberforge/skills/skill-author/assets/templates/references/sources.md

@@ -0,0 +1,13 @@
+# Sources
+
+<!-- Populated at Step 5 of skill authoring, after all skill files are written.
+     For each research source with status `extracted`, record which skill files
+     it contributed to under Contributing files.
+     Delete this file if no research sources were provided as input. -->
+
+## FILL IN: source-slug
+
+- **URL:** FILL IN
+- **Description:** FILL IN
+- **Contributing files:** FILL IN: list skill files this source informed (e.g. SKILL.md, references/foo.md)
+- **Status:** `extracted`