[SDK-001] Add typed SkillPackage models

[AdeGneus]

Context

Downstream repos need a typed representation of the skill package contract instead of unsafe Mapping[str, object] access. This issue creates the SDK boundary for skill package validation and consumption.

Scope

• Create ori_sdk/skill_package.py.
• Define frozen dataclasses for SkillPackage, Trigger, ActionRef, and ActionsSection.
• Add SkillYamlNormaliser.load_and_validate(path) -> SkillPackage.
• Add a canonical fixture under tests/fixtures/skill_package_v1.json.
• Export public models from ori_sdk.__init__ when stable.

Non-Goals

• Does not execute skill hook code.
• Does not replace runtime SkillLoader; it mirrors the external contract only.
• Does not implement decorator-based authoring.

Technical Specification

The normaliser must parse YAML/JSON skill metadata, enforce required fields, preserve explicit action_tier, and return typed immutable objects. Validation should align with runtime v0.9.0-beta.2 but avoid importing runtime internals.

Acceptance Criteria

• Typed models exist and are immutable.
• Valid fixture round-trips into SkillPackage.
• Invalid missing required fields are rejected with typed SDK errors.
• pytest, mypy, and ruff pass.

Tests Required

Test	Verifies
test_skill_package_loads_fixture	Valid fixture becomes typed SkillPackage.
test_skill_package_rejects_missing_action_tier	Bad skill metadata is rejected.
test_skill_package_defaults_are_explicit	No hidden tier defaults are introduced.

Additional Test Coverage / Edge Cases

• Reject triggers missing action_tier; no implicit default tier is allowed.
• Reject duplicate trigger names and malformed trigger names.
• Reject actions.defaults entries that reference undeclared actions or undeclared triggers.
• Preserve field ordering/values across fixture round-trip where JSON contract stability matters.
• Validate both minimal valid skill packages and fully populated packages with prompts, sensors, and actions.
• Ensure frozen dataclasses cannot be mutated after construction.

Invariants — Do Not Violate

• SDK mirrors ori-specs and runtime contracts; it must not redefine runtime behavior.

Dependencies

Blocked by:

• Nothing

Unblocks:

• [SDK-002] Add Ed25519 signing module #4 — SDK-002 Add Ed25519 signing module
• [SDK-003] Add Hub API client #5 — SDK-003 Add Hub API client
• [CLI-008] Implement skills install through Hub client ori-cli#10 — CLI-008 Implement skills install through Hub client

Contract References

• ori-specs/skill-package/v1.md
• Runtime ori/skills/loader.py validation behavior
• SDK Phase 2 Implementation Reference

Priority

poc-critical

Suggested Labels

ready, poc-critical