[eezzekl]

Summary

• go.mod declared module github.com/ezzek/skill-sync while the repository is github.com/eezzekl/skill-sync — the final l was missing.
• go install has therefore never worked, for any published version.
• Adds a guard test for an invariant no existing test could observe, and fixes the same typo in the SECURITY.md advisory URL.

The bug

Present since the initial commit dac6be6 (verified with git log -L1,1:go.mod), so v1.0.0, v0.1.0 and v0.2.0 all shipped the wrong path:

$ go install github.com/eezzekl/skill-sync/cmd/[email protected]
go: github.com/eezzekl/skill-sync/cmd/[email protected]: version constraints conflict:
	module declares its path as: github.com/ezzek/skill-sync
	        but was required as: github.com/eezzekl/skill-sync

Homebrew, Scoop and direct tarball downloads were unaffected — they distribute prebuilt binaries, so this never surfaced through the normal install paths.

Why no test caught it

A wrong module path is internally consistent: every import agrees with go.mod, so the compiler is satisfied and the entire suite passes. The mismatch is only observable to an external consumer resolving the module through the proxy.

That is precisely the kind of invariant that needs an explicit guard, so cmd/skill-sync/module_path_test.go now asserts the declared path against the canonical repository URL. It fails on the old path with a direct diagnostic:

--- FAIL: TestGoModDeclaresCanonicalModulePath
    go.mod module path mismatch:
      declared:  github.com/ezzek/skill-sync
      canonical: github.com/eezzekl/skill-sync
    A mismatch breaks `go install` for every consumer.

Changes

File	Change
go.mod	Module path corrected (single-line diff; go.sum untouched)
cmd/skill-sync/module_path_test.go	New guard test for the canonical module path
cmd/skill-sync/main.go, internal/** (31 files)	Import paths updated
SECURITY.md	Fix the 404 private vulnerability reporting URL
openspec/changes/skill-import/{design,tasks}.md	Update import examples
odd/tasks/fix-module-path.md	Task breakdown and recorded evidence

Test plan

• RED go test ./cmd/skill-sync/ → module path mismatch, as quoted above
• GREEN go test -race ./... → 19 packages pass, 0 failures
• go vet ./... → clean
• gofmt -l → clean
• Cross-compile → all 6 GoReleaser targets (linux/darwin/windows × amd64/arm64) build
• --version wiring intact: skill-sync version 1.1.0-rc via ldflags (the Homebrew formula test depends on this)

Note on versioning

This is released as v1.1.0. Deleting the stray v1.0.0 tag cannot fix the version ordering: proxy.golang.org has permanently cached v1.0.0, v0.1.0 and v0.2.0, and its @latest currently resolves to v1.0.0. The proxy is immutable, so only a semver-greater tag moves it.

Breaking change

The module path changed. Any importer must switch to github.com/eezzekl/skill-sync — though in practice nothing could have imported the old path successfully.