ai.lock Lockfile

ai.lock is generated by spm and committed to your repo. It pins every version selector from ai.json to an immutable commit SHA, giving you reproducible installs: everyone who runs spm install from the same ai.lock gets exactly the same skill content.

How it relates to ai.json

ai.json ──resolve──▶ ai.lock ──fetch/project──▶ materialized skills

• ai.json says what you want (e.g. "branch": "main" or "tag": "v1.2.0").
• ai.lock records exactly which commit that resolved to.

ai.json selector	pinned in ai.lock as
tag	resolved commit SHA
branch	resolved commit SHA
commit	itself

Full plugins declared under plugins are pinned the same way, and ai.lock additionally records each plugin's bundled skill set so spm status can tell the materialized plugin skills apart from stale leftovers.

Commit it

Commit both ai.json and ai.lock. Never commit the materialized skills — spm keeps those gitignored.

git add ai.json ai.lock
git commit -m "chore: pin skills"

Updating pins

branch and tag selectors only move when you ask them to:

spm update            # re-resolve all skills to latest, rewrite ai.lock
spm update reviewer   # re-resolve just one skill

Until you run spm update, spm install always reproduces the exact commits recorded in ai.lock — even for a skill declared as "branch": "main".

Fresh clones

On a fresh clone or a new worktree, spm install reads ai.lock, repopulates the global fetch cache, and re-materializes the project-local skills. See Worktrees & Fresh Clones.