Containers solved software distribution for a specific reason: the artifact, the registry, and the runtime were standardized separately. You can pull nginx:1.27 from Docker Hub, GHCR, or a private Harbor instance, run it on containerd, CRI-O, or Docker, and the thing works because the OCI spec draws the lines in the right places.
I’ve been building AI skills — small, focused agent capabilities — for about eighteen months. The question that keeps surfacing: why are we distributing these as git clones and pip installs?
What if operational skills — compliance workflows, identity patterns, code-review harnesses — were distributed across a heterogeneous fleet the same way containers are?
What a skill actually is
A skill, for our purposes, is a versioned bundle: prompt templates, tool definitions, a scored eval harness, maybe a small model adapter, and metadata about which base models it has been validated against. It is smaller than a container, more opinionated than a prompt, and — crucially — has a surface area that needs governance.
That last word is the whole thesis. A skill named gdpr-review needs to be cryptographically signed, pinned to exact model versions, and distributed to a running fleet with the same story you have for a container. Not a curl-to-bash, not a forked git repo.
Why OCI
OCI artifacts are a general-purpose packaging format with a registry, a pull path, content addressing, and a signature story via Sigstore. Every cloud already has a registry. Every CI system already authenticates against one. The infrastructure exists.
- Versioning — immutable tags, semver, digests.
- Signing — Sigstore / cosign, same as containers.
- Delivery — pull from registry at runtime, cache on-node, lifecycle with cluster events.
- Policy — admission control via the same Kyverno / OPA patterns that already exist for images.
What we’re shipping
agentisan is our working implementation: a Python package of shared sub-agent primitives, distributed as an OCI artifact alongside a library of 25+ Claude Code skills. The format is deliberately boring — a manifest, a blob of YAML and Python, and a detached signature. The interesting part is what it unlocks: a skill registry becomes a control plane for agent capabilities across a fleet, with audit trails, revocation, and canary delivery.
Where this is going
The skill registry is one layer. The other is a runtime that knows how to evaluate a skill against a fleet of heterogeneous models — some cloud, some local, some air-gapped — and route work by capability and policy. We are building toward a world where a regulated enterprise can pin a redaction skill to its in-VPC deployment, rotate it on a schedule, and attest to regulators that every inference ran the signed version.
That is not a research problem. It is a plumbing problem, and plumbing problems are the ones worth solving.