Governable AI Skill Execution under Operational Constraint: Encrypted Skill Packs, Trusted Execution Environments, and Executable Attestation

As AI systems become modular and agentic, capabilities are increasingly distributed as reusable "skills" executed across heterogeneous devices and environments. This distribution expands variance: unauthorized execution, tampered logic, replay, and post-deployment drift. In practice, the primary failure is not model quality but governance: the inability to verify, control, and stop or update execution safely under operational constraint. This paper proposes a minimal governance architecture for AI skill execution: encrypted skill packs executed inside a trusted execution environment (TEE), coupled with executable attestation and remote operational control. The design uses dynamic keying to decrypt skill code and execution metadata only within the intended environment, records execution logs as Merkle-DAG commitments, and transmits a root hash to an authorization server for integrity checks. A remote stop/update channel enables kill-switch and patching without relying on local goodwill. License enforcement is treated as a first-class control plane: execution is permitted only when runtime rights validation succeeds. The contribution is not a new cryptographic primitive. It is a practical governance surface: (i) encrypted distribution, (ii) environment-bound execution, (iii) attestable logging, (iv) remote stop/update, and (v) license-gated execution. We outline threat models, operational metrics, and evaluation protocols emphasizing audit completeness, control latency, and revocation effectiveness. The central claim is that AI skills are not governable at the level of possession or distribution alone; they become governable only at the level of conditionally admitted, attestable, and revocable execution.