hash: resolve a symlinked root before walking

internal/adapters/hash/hash.go

@@ -66,6 +66,14 @@ func (h *Hasher) Hash(ctx context.Context, root string) (string, []artifact.File
 		return digest.Root(leaves), files, newest, nil
 	}
 
+	// WalkDir does not follow a symlinked root: it reports the link itself as
+	// a non-regular entry and yields no files, so a symlinked skill directory
+	// would land in the lockfile with the empty digest and its contents
+	// unhashed. Resolve the root once; symlinks inside the tree stay skipped.
+	if resolved, rerr := filepath.EvalSymlinks(root); rerr == nil {
+		root = resolved
+	}
+
 	walkErr := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
 			return err

internal/adapters/hash/hash_test.go

@@ -123,3 +123,33 @@ func TestHashContextCancelled(t *testing.T) {
 		t.Error("expected error from cancelled context")
 	}
 }
+
+// A skill directory may itself be a symlink (OpenClaude follows them when it
+// loads skills). WalkDir does not follow a symlinked root, so without
+// resolving it the walk yields no files and the artifact gets the empty
+// digest: it appears in the lockfile while its contents go unhashed, and an
+// edit behind the link passes verify. The hasher must resolve the root.
+func TestHashFollowsSymlinkedRoot(t *testing.T) {
+	dir := t.TempDir()
+	target := filepath.Join(dir, "real")
+	writeFile(t, filepath.Join(target, "SKILL.md"), "body")
+	link := filepath.Join(dir, "link")
+	if err := os.Symlink(target, link); err != nil {
+		t.Skipf("symlink not supported here: %v", err)
+	}
+
+	want, wantFiles, _, err := New().Hash(context.Background(), target)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, files, _, err := New().Hash(context.Background(), link)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(files) != len(wantFiles) || len(files) != 1 || files[0].Path != "SKILL.md" {
+		t.Fatalf("files via symlink = %+v, want %+v", files, wantFiles)
+	}
+	if got != want {
+		t.Errorf("digest via symlink = %s, want %s", got, want)
+	}
+}