[sjunepark]

This draft preserves seven unpublished private KICPA skill registrations on top of current main, including upstream Darty and the v1.2 reconciliation behavior. The canonical and embedded registries agree at 50 entries.

The current changes are not ready to merge: they extend the public kicpa profile with private sources. Merging them now would introduce private repository access requirements for existing projects. The selected design keeps kicpa public and puts these registrations in a separate kicpa-private profile after authenticated fetching is supported.

Work remaining before ready for review

• Implement the authenticated-fetch feasibility checkpoint and access model in plans/sjskills-private-github-sources.md.
• Move the seven recovered registrations to kicpa-private, preserving public-only behavior.
• Implement authentication, cache/review evidence separation, and controlled process/CLI coverage required by the plan.
• Complete required checks and supported native CI, then update the PR around the final implementation.

Validation of the recovered draft

• Targeted Go registry/profile contract tests passed.
• All 12 Node registry and audit-wrapper tests passed.
• Bounded independent review confirmed upstream behavior is preserved and identified the private-profile design conflict above.
• Private fetching, installation, and update behavior are not implemented or validated by this draft.

The full original working state is retained locally in recovery stash 038118178cce4759e3acebf854f19b36723488fc. This PR does not publish a CLI release or reconcile skills on real machines.