Maintenance & hardening release. (The 98-skill content milestone shipped in v1.6.0 with the ARA category.)
📊 Inventory reconciled to 98 skills / 23 categories
Corrected stale counts that had drifted apart across CLAUDE.md (said 90), CONTRIBUTING.md (86/22), the README sync line (87), WELCOME.md and the npm package README (86/22), plus wrong per-category listings (TorchTitan, SwanLab, A-Evolve, ML Training Recipes, Cosmos Policy/OpenPI/OpenVLA-OFT, the paper-writing skills).
🛡️ Drift guard
New scripts/check-inventory.sh + check-inventory.yml CI job fails whenever documented counts diverge from the actual SKILL.md count on disk.
📦 Marketplace sync hardening
sync-skills.yml prunes build artifacts before zipping and fails loudly above 190 files instead of hitting the marketplace's 200-file rejection (#57).
🔒 Security
CLI deps (chalk/inquirer/ora) pinned to exact patched versions with a regenerated lockfile — inquirer@9.3.8 clears the tmp path-traversal advisory (GHSA-52f5-9888-hmc6). npm audit reports 0 vulnerabilities.
Note: v1.7.0 was tagged internally but never published — its publish failed on a lockfile desync introduced by the dep pins; v1.7.1 is the corrected, published release.
📦 npm: `npm i -g @orchestra-research/ai-research-skills@1.7.1` (published via OIDC trusted publishing with Sigstore provenance)