[Docs]: document issuer.org rules and align ARPA-driven skills to ARPAHLS

[rosspeili]

Type of fix

Other

What needs to be fixed?

issuer.org was never formally documented. This issue adds a simple org policy, updates contributor docs, and aligns existing ARPA-driven registry skills where org is missing or does not yet reflect ARPA’s design ownership.

Not a blame exercise — past issues/PRs without ARPAHLS are fine; we are setting rules going forward and cleaning up bundles/docs where ARPA drove the skill.

---

Org policy (going forward)

Skill origin	issuer.org
ARPA-maintainer proposal (issue + design steering by ARPA)	ARPAHLS required — may also list a third-party org (e.g. ARPAHLS + partner)
Third-party proposal (external drove issue/design)	Contributor org or omit org
ARPA-native / ARPA-audited registry skill	ARPAHLS or ARPAHLS + third party — not empty, not third-party-only

Individual issuer.name, email, and github stay with the credited author; org reflects design ownership, not who wrote every line of code, especially when skills grow further than original design and/or a lot of contributors are involved in sharpening one skill.

The differentiation here is important for trust model. ARPAHLS should mean, we proposed the skill, we designed it, we were involved in architecture, auditing, testing, active maintenance etc.

---

Retroactive bundle + doc updates

Where ARPA drove proposal/design/audit, set issuer.org: ARPAHLS in manifest.yaml and matching card.json, and fix catalog/doc Issuer lines:

• security/prompt_injection_firewall — AO → ARPAHLS
• creative/bg_remover, data_engineering/novelty_extractor — empty → ARPAHLS
• Other skills already ARPAHLS — verify only
• wellness/mental_coach — keep AO (third-party–driven; documented exception)

---

Docs to update (minimal)

• CONTRIBUTING.md — short Issuer org subsection with the table above
• docs/contributing/ai_native_workflow.md — one-line pointer in manifest checklist
• templates/python_skill/ — replace vague YOUR ORG with the same rule (ARPA-driven → ARPAHLS; third-party → their org or omit)
• docs/skills/README.md + affected skill pages — Issuer column matches manifest

Non-goals: CI org enforcement (unless trivial), changing credited authors, skill logic changes.

Done when: policy is documented in one place; listed skills + catalog aligned; pytest tests/test_skill_issuer.py passes; CHANGELOG.md [Unreleased] note.

Affected Page(s)

CONTRIBUTING.md, docs/contributing/ai_native_workflow.md, docs/skills/README.md, docs/skills/prompt_injection_firewall.md, docs/skills/bg_remover.md, docs/skills/novelty_extractor.md, docs/skills/mental_coach.md, templates/python_skill/manifest.yaml, templates/python_skill/card.json, templates/python_skill/README.md, skills/security/prompt_injection_firewall/manifest.yaml, skills/security/prompt_injection_firewall/card.json, skills/creative/bg_remover/manifest.yaml, skills/creative/bg_remover/card.json, skills/data_engineering/novelty_extractor/manifest.yaml, skills/data_engineering/novelty_extractor/card.json, skills/wellness/mental_coach/manifest.yaml (verify only), .github/ISSUE_TEMPLATE/01_skill_proposal.yml (optional)

[mrmasa88]

Hey! @rosspeili

Thanks for writing this down — the distinction between design ownership and
authorship is the right one, and having it documented removes a real ambiguity.

No objection to the firewall entry: security/prompt_injection_firewall came out
of #46/#48, the design direction was yours, and the move to security/ was your
call during review. That is ARPA-driven by this policy's definition.

One request, using the option the policy already allows: could that entry be
ARPAHLS, AO rather than ARPAHLS alone? AO built and maintains the skill and
is still the party that would pick up a v0.2 upgrade, so joint attribution seems
to match the intent of the "ARPAHLS + third party" row. Happy either way — if you
would rather keep single-org entries for consistency across the registry, say so
and I will not push it.

Also fine with wellness/mental_coach staying AO. Thanks for making the
distinction rather than applying it uniformly.

Warm regards,

Masa

[rosspeili]

Hey @mrmasa88 fair point and yes, it will be both ARPAHLS, and AO. The point is not to remove orgs, especially for original skill designs, but to add ARPA as an extra trusted layer for skills we were involced in direction and design. There is also the idea of org categories circulating internally. Eg. AO/mental_health.

Feel free to pick the issue if you wanna patch this or I'll sort soon.

V