@echopath-labs/forgerail 0.1.0-alpha.2 → 0.1.0-alpha.3

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "forgerail",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.3",
   "description": "Engineering guidance and governance for coding agents, with workspace diagnosis and composable capability packs.",
   "author": {
     "name": "EchoPath Labs",
@@ -33,8 +33,7 @@
     "defaultPrompt": [
       "Use ForgeRail to govern this engineering task.",
       "Diagnose this workspace before recommending governance changes.",
-      "Review this workspace for governance and recovery risks.",
-      "Trace duplicate capability ownership and identify the smallest remaining implementation boundary."
+      "Review workspace health or audit duplicated architecture ownership using the matching independent ForgeRail Skill."
     ],
     "brandColor": "#B45309"
   }

package/CHANGELOG.md

@@ -4,13 +4,20 @@
 
 No shipping changes yet.
 
+## 0.1.0-alpha.3 - 2026-08-31
+
+- Keep the main Agent Plugin within Codex's maximum of three `defaultPrompt` entries while preserving discovery and direct invocation for all four ForgeRail Skills.
+- Route the third starter prompt to either Workspace Health Review or the independently owned Architecture Convergence Audit without merging their ownership or activation boundaries.
+- Add deterministic prompt-cardinality validation and a fresh disposable-host compatibility check; classify unrelated `openai-primary-runtime/template-creator` icon warnings as external observations rather than ForgeRail failures.
+- Preserve the Skills-only, no-project-Node, no-implicit-`.forgerail/`, Apache-2.0, optional scoped npm CLI, and unscoped reservation boundaries from alpha.2.
+
 ## 0.1.0-alpha.2 - 2026-08-30
 
 - Add the built-in, independently invoked `architecture-convergence-audit` Pack with Analyze First, read-only behavior, evidence-backed ownership maps, retention burden, deletion-first slices, and no external-write or persisted-state authority.
 - Add private capability-harvest shadows plus sanitized Diagnosis and Health separation fixtures without changing existing Core nouns or creating a second Health Pack.
 - Prepare a Skills-only Universal Plugins Directory candidate with root-confined visual assets, five positive and three negative evaluations, deterministic validation, and no project Node.js or `.forgerail/` requirement.
 - Add ForgeRail-specific Privacy and Terms documents, GitHub Issues support, a confirmed Productivity category, and an all-platform-supported-regions intent while keeping publisher, permission, portal-format, submission, and publication gates explicit.
-- Preserve exact-tag Marketplace installation as the currently available route and keep the scoped npm CLI optional; alpha.2 remains a local source-first candidate until separately approved remote integration and release complete.
+- Preserve exact-tag Marketplace installation as the available route and keep the scoped npm CLI optional; alpha.2 subsequently completed its separately approved remote integration and prerelease publication.
 
 ## 0.1.0-alpha.1 - 2026-08-13
 

package/README.md

@@ -2,7 +2,7 @@
 
 ForgeRail is an engineering guidance and governance framework for Coding Agents.
 
-This canonical source is preparing `0.1.0-alpha.2` / `v0.1.0-alpha.2`. The candidate is not yet remotely integrated, released, or listed in the Universal Plugins Directory; the currently installable public version remains alpha.1.
+This canonical source is preparing the local `0.1.0-alpha.3` / `v0.1.0-alpha.3` forward-fix candidate. It is not yet remotely integrated, released, or listed in the Universal Plugins Directory; the currently installable public version remains alpha.2.
 
 It observes a workspace, recommends improvements only when evidence warrants them, composes applicable rules, launches the host Agent with explicit scope and approval boundaries, and verifies observable results. It does not replace the Agent or force a new specification system onto the project.
 
@@ -53,7 +53,7 @@ node scripts/forgerail.mjs adoption-plan --workspace scripts/fixtures/workspaces
 The optional official npm package is `@echopath-labs/forgerail`; it exposes the same deterministic CLI through the short `forgerail` binary shim. The unscoped `forgerail` package remains a reservation and is not the product install path.
 
 ```bash
-npm install --global @echopath-labs/forgerail@0.1.0-alpha.1
+npm install --global @echopath-labs/forgerail@0.1.0-alpha.2
 forgerail validate
 forgerail diagnose --workspace .
 forgerail adoption-plan --workspace . --host codex
@@ -64,7 +64,7 @@ forgerail adoption-plan --workspace . --host codex
 The intended future default is the Universal Plugins Directory UI, but ForgeRail is not listed there yet. Until a separate submission, review, and publication complete, install the released exact ForgeRail Marketplace snapshot:
 
 ```bash
-codex plugin marketplace add echopath-labs/forgerail --ref v0.1.0-alpha.1
+codex plugin marketplace add echopath-labs/forgerail --ref v0.1.0-alpha.2
 codex plugin add forgerail@echopath-labs
 ```
 
@@ -74,4 +74,4 @@ The Agent Plugin does not require Node.js or `package.json` in the target projec
 
 ## Status
 
-The immutable public alpha.1 remains the current install source. Alpha.2 is a local source-first candidate containing Architecture Convergence, the reviewed Utopia capability harvest, Directory readiness, and ForgeRail-specific Privacy and Terms. Its proposed version and tag do not authorize public projection application, remote integration, release, or Directory submission/publication.
+The immutable public alpha.2 remains the current install source. Alpha.3 is a local source-first forward fix that limits the main Plugin to three starter prompts while keeping all four Skills independently discoverable and invokable. Its proposed version and tag do not authorize public projection application, remote integration, release, or Directory submission/publication.

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 ForgeRail 是面向 Coding Agent 的工程引航与治理框架。
 
-当前 canonical source 正在准备 `0.1.0-alpha.2` / `v0.1.0-alpha.2`。该候选尚未完成远端集成、发布或 Universal Plugins Directory 上线；当前可安装的公开版本仍是 alpha.1。
+当前 canonical source 正在准备本地 `0.1.0-alpha.3` / `v0.1.0-alpha.3` forward-fix 候选。该候选尚未完成远端集成、发布或 Universal Plugins Directory 上线；当前可安装的公开版本仍是 alpha.2。
 
 它观察工作区，在证据表明存在缺口时提出建议，组装适用规约，以明确的范围和审批边界发起宿主 Agent 工作，并核验可观察结果。它不替代 Agent，也不强迫项目采用新的规格系统。
 
@@ -30,7 +30,7 @@ Control System 迁移现已加入版本化 Workspace/Profile、Task Control、Re
 可选官方 npm 包为 `@echopath-labs/forgerail`，安装后仍提供简短的 `forgerail` 命令入口，用于离线校验、只读诊断和合同闭环；Agent Plugin 本身不依赖该 CLI 才能使用。未作用域 `forgerail` 只保留名称占位，不是正式安装入口。
 
 ```bash
-npm install --global @echopath-labs/forgerail@0.1.0-alpha.1
+npm install --global @echopath-labs/forgerail@0.1.0-alpha.2
 forgerail validate
 ```
 
@@ -39,7 +39,7 @@ forgerail validate
 未来面向人的默认入口是 Universal Plugins Directory 界面，但 ForgeRail 当前尚未在该目录上线。在独立提交、审查与发布完成前，请安装已经发布的精确 ForgeRail Marketplace 快照：
 
 ```bash
-codex plugin marketplace add echopath-labs/forgerail --ref v0.1.0-alpha.1
+codex plugin marketplace add echopath-labs/forgerail --ref v0.1.0-alpha.2
 codex plugin add forgerail@echopath-labs
 ```
 
@@ -47,4 +47,4 @@ codex plugin add forgerail@echopath-labs
 
 Agent Plugin 不要求目标项目安装 Node.js 或存在 `package.json`；npm/npx 始终只是可选维护与验证工具。
 
-不可变 public alpha.1 仍是当前安装来源。Alpha.2 是本地 source-first 候选，包含 Architecture Convergence、已审查的 Utopia capability harvest、Directory readiness 和 ForgeRail 专属 Privacy/Terms。拟议版本/tag 不授权应用公开投影、远端集成、发布或 Directory submit/publish。
+不可变 public alpha.2 仍是当前安装来源。Alpha.3 是本地 source-first forward fix：主 Plugin 收敛为三条 starter prompts，同时四个 Skills 继续独立发现与调用。拟议版本/tag 不授权应用公开投影、远端集成、发布或 Directory submit/publish。

package/directory/README.md

@@ -9,7 +9,7 @@ The candidate follows the OpenAI submission guidance observed on 2026-08-30:
 - <https://developers.openai.com/plugins/build/plugins>
 - <https://developers.openai.com/plugins/deploy/submission>
 
-The alpha.2 source candidate records the user-confirmed `Productivity` category, GitHub Issues support, repository Privacy and Terms URLs, and an intent to make ForgeRail available in all platform-supported regions. The live portal's exact region enumeration remains `pending_confirmation`; no country list is invented locally.
+The alpha.3 forward-fix candidate records the user-confirmed `Productivity` category, GitHub Issues support, repository Privacy and Terms URLs, and an intent to make ForgeRail available in all platform-supported regions. It also keeps the main Plugin within Codex's maximum of three starter prompts while preserving four independently owned Skills. The live portal's exact region enumeration remains `pending_confirmation`; no country list is invented locally.
 
 Before any Platform draft or submission, a human must still verify the publisher identity, Apps Management Write permission, live portal region encoding, accepted asset format, and exact final public source. `submission-candidate.json` records every unresolved item; `evaluations.json` contains the local positive and negative evaluation cases. Remote Git integration cannot grant Directory submission or publication authority.
 

package/directory/release-notes-alpha3.md

@@ -0,0 +1,7 @@
+# ForgeRail 0.1.0-alpha.3 release notes candidate
+
+ForgeRail alpha.3 is a narrow host-compatibility forward fix. The main Agent Plugin now exposes three reviewed starter prompts, which stays within the Codex host limit, while all four Skills remain independently discoverable and directly invokable.
+
+The third prompt is an either-or router: it directs a workspace-health request to `$workspace-health-review` or a duplicated-architecture-ownership request to `$architecture-convergence-audit`. It does not merge those Skills, make either depend on the other, or activate both implicitly.
+
+The candidate retains the alpha.2 Skills-only Directory shape, public Privacy and Terms, GitHub Issues support, Productivity category, all-platform-supported-regions intent, optional scoped npm CLI, no project Node.js requirement, and no implicit `.forgerail/` state. Directory submission, release, and lifecycle approvals remain separate and are not granted by this candidate.

package/directory/submission-candidate.json

@@ -2,7 +2,7 @@
   "schemaVersion": "1.0",
   "candidateType": "openai-universal-plugin-directory",
   "submissionType": "skills_only",
-  "status": "local_alpha2_source_candidate",
+  "status": "local_alpha3_forward_fix_candidate",
   "approval": { "type": "submission_approval", "status": "not_granted" },
   "officialBaseline": {
     "observedAt": "2026-08-30",
@@ -13,7 +13,7 @@
   },
   "plugin": {
     "id": "forgerail",
-    "version": "0.1.0-alpha.2",
+    "version": "0.1.0-alpha.3",
     "manifest": ".codex-plugin/plugin.json",
     "skills": [
       "forgerail",
@@ -43,8 +43,7 @@
     "starterPrompts": [
       "Use ForgeRail to govern this engineering task.",
       "Diagnose this workspace before recommending governance changes.",
-      "Review this workspace for governance and recovery risks.",
-      "Audit this architecture for duplicated capability ownership."
+      "Review workspace health or audit duplicated architecture ownership using the matching independent ForgeRail Skill."
     ]
   },
   "availability": {
@@ -58,8 +57,8 @@
   },
   "releaseNotes": {
     "state": "candidate",
-    "path": "./directory/release-notes-alpha2.md",
-    "value": "ForgeRail alpha.2 adds an independently invoked read-only architecture convergence audit and prepares a Skills-only Directory candidate with public Privacy and Terms, deterministic evaluations, and no project-local Node.js or persistent ForgeRail state requirement."
+    "path": "./directory/release-notes-alpha3.md",
+    "value": "ForgeRail alpha.3 keeps all four independent Skills discoverable while reducing the main Plugin to three reviewed starter prompts, matching the Codex host limit without changing Skill ownership, invocation, or project mutation boundaries."
   },
   "evaluationFile": "./directory/evaluations.json",
   "unresolvedGates": [

package/docs/installation.md

@@ -2,16 +2,16 @@
 
 ForgeRail is primarily an Agent Plugin. The npm package is an optional deterministic CLI and compatibility payload.
 
-The canonical source currently proposes `@echopath-labs/forgerail@0.1.0-alpha.2` / `v0.1.0-alpha.2`, but that candidate is not yet remotely integrated or released. Do not construct an installation command from a local version proposal. The commands below remain bound to the currently released alpha.1 until a separately approved alpha.2 release completes.
+The canonical source currently proposes the local `@echopath-labs/forgerail@0.1.0-alpha.3` / `v0.1.0-alpha.3` forward fix, but that candidate is not yet remotely integrated or released. Do not construct an installation command from a local version proposal. The commands below remain bound to the currently released alpha.2.
 
 ## Install
 
 The intended default human route is the Universal Plugins Directory in ChatGPT or Codex. ForgeRail is **not currently available there**: the local Skills-only candidate still needs separately approved submission, OpenAI review, and developer publication. When a verified ForgeRail listing becomes available, use that interface and confirm the publisher and requested capabilities before installation.
 
-The current available Agent Plugin route is the immutable `v0.1.0-alpha.1` EchoPath Labs Marketplace snapshot:
+The current available Agent Plugin route is the immutable `v0.1.0-alpha.2` EchoPath Labs Marketplace snapshot:
 
 ```bash
-codex plugin marketplace add echopath-labs/forgerail --ref v0.1.0-alpha.1
+codex plugin marketplace add echopath-labs/forgerail --ref v0.1.0-alpha.2
 codex plugin add forgerail@echopath-labs
 ```
 
@@ -20,6 +20,7 @@ Start a new Codex task after installation so discovery uses the installed snapsh
 - `$forgerail`;
 - `$forgerail-workspace-diagnosis`;
 - `$workspace-health-review`.
+- `$architecture-convergence-audit`.
 
 This Agent Plugin route does not require the target project to have Node.js, `package.json`, `node_modules`, or the optional npm CLI.
 
@@ -47,14 +48,14 @@ Host task/thread APIs are not portable. Codex, Claude Code, Cursor, and other ho
 The npm package is not required by the Agent Plugin. The official package is organization-scoped as `@echopath-labs/forgerail`; the unscoped `forgerail` package remains a reservation and is not an install or rollback source. After registry publication, use an exact scoped prerelease when validating or diagnosing a workspace:
 
 ```bash
-npx --yes @echopath-labs/forgerail@0.1.0-alpha.1 validate
-npx --yes @echopath-labs/forgerail@0.1.0-alpha.1 diagnose --workspace .
+npx --yes @echopath-labs/forgerail@0.1.0-alpha.2 validate
+npx --yes @echopath-labs/forgerail@0.1.0-alpha.2 diagnose --workspace .
 ```
 
 For a persistent CLI shim:
 
 ```bash
-npm install --global @echopath-labs/forgerail@0.1.0-alpha.1
+npm install --global @echopath-labs/forgerail@0.1.0-alpha.2
 forgerail validate
 ```
 
@@ -91,4 +92,4 @@ Re-register the last validated Marketplace tag and reinstall the selected Plugin
 
 Creating or submitting a Universal Plugins Directory draft, publishing a reviewed listing, publishing npm, moving `latest`, pushing a public candidate, tagging, creating a GitHub Release, or changing AGW lifecycle requires its own exact approval and receipt.
 
-See the historical [ForgeRail 0.1.0-alpha.1 Release Runbook](release.md) for the current release and the [ForgeRail 0.1.0-alpha.2 Candidate Runbook](release-alpha2.md) for the proposed source-first gate order. Neither document grants execution authority.
+See the historical [ForgeRail 0.1.0-alpha.1 Release Runbook](release.md), the [ForgeRail 0.1.0-alpha.2 Candidate Runbook](release-alpha2.md), and the proposed [ForgeRail 0.1.0-alpha.3 Forward-Fix Runbook](release-alpha3.md). None grants execution authority.

package/docs/installation.zh-CN.md

@@ -2,18 +2,18 @@
 
 ForgeRail 的主要形态是 Agent Plugin；npm 包是可选的确定性 CLI 与兼容载荷。
 
-canonical source 当前拟议 `@echopath-labs/forgerail@0.1.0-alpha.2` / `v0.1.0-alpha.2`，但该候选尚未远端集成或发布。不要根据本地版本提案自行拼装安装命令。以下命令继续绑定当前已发布 alpha.1，直到另行批准的 alpha.2 发布完成。
+canonical source 当前拟议本地 `@echopath-labs/forgerail@0.1.0-alpha.3` / `v0.1.0-alpha.3` forward fix，但该候选尚未远端集成或发布。不要根据本地版本提案自行拼装安装命令。以下命令继续绑定当前已发布 alpha.2。
 
 面向人的目标默认入口是 ChatGPT 或 Codex 中的 Universal Plugins Directory。ForgeRail **当前尚未在该目录上线**：本地 Skills-only 候选仍需独立提交审批、OpenAI 审查和开发者发布。以后只有在核对真实 ForgeRail listing、publisher 和能力请求后，才应从界面安装。
 
-当前可用的 Agent Plugin 路径是不可变的 EchoPath Labs Marketplace `v0.1.0-alpha.1` 快照：
+当前可用的 Agent Plugin 路径是不可变的 EchoPath Labs Marketplace `v0.1.0-alpha.2` 快照：
 
 ```bash
-codex plugin marketplace add echopath-labs/forgerail --ref v0.1.0-alpha.1
+codex plugin marketplace add echopath-labs/forgerail --ref v0.1.0-alpha.2
 codex plugin add forgerail@echopath-labs
 ```
 
-安装后启动一个新的 Codex 任务，使插件发现基于已安装快照。新任务必须发现 `$forgerail`、`$forgerail-workspace-diagnosis` 和 `$workspace-health-review`。需要可复现安装时，不要用可变分支替代精确 tag。
+安装后启动一个新的 Codex 任务，使插件发现基于已安装快照。新任务必须发现 `$forgerail`、`$forgerail-workspace-diagnosis`、`$workspace-health-review` 和 `$architecture-convergence-audit`。需要可复现安装时，不要用可变分支替代精确 tag。
 
 通过该 Agent Plugin 路径使用 ForgeRail，不要求目标项目安装 Node.js，也不要求存在 `package.json`、`node_modules` 或可选 npm CLI。
 
@@ -54,13 +54,13 @@ alpha.1 只有 Codex Host Adapter 是 `supported`；Claude Code 与 Cursor 以 `
 Agent Plugin 不依赖 npm CLI。官方包名为 `@echopath-labs/forgerail`；未作用域 `forgerail` 只保留名称占位，不是安装或回滚来源。registry 发布后，可用精确 scoped 版本执行离线校验和只读诊断：
 
 ```bash
-npx --yes @echopath-labs/forgerail@0.1.0-alpha.1 validate
-npx --yes @echopath-labs/forgerail@0.1.0-alpha.1 diagnose --workspace .
-npm install --global @echopath-labs/forgerail@0.1.0-alpha.1
+npx --yes @echopath-labs/forgerail@0.1.0-alpha.2 validate
+npx --yes @echopath-labs/forgerail@0.1.0-alpha.2 diagnose --workspace .
+npm install --global @echopath-labs/forgerail@0.1.0-alpha.2
 ```
 
 升级时注册新的精确 Marketplace tag，重新安装已选择的插件，再启动新的 Codex 任务验证 Skill 发现与只读诊断；npm CLI 只能在精确 `@echopath-labs/forgerail` 版本之间升级。回滚时重新注册最近已验证 tag，或退回冻结的 AGW 版本；卸载可选 CLI 使用 `npm uninstall --global @echopath-labs/forgerail`，不得删除项目记录、Agent instructions 或 Git 历史。
 
 创建或提交 Universal Plugins Directory draft、发布已审查 listing、npm 发布、移动 `latest`、推送公共候选、tag、GitHub Release 和 AGW 生命周期变更都属于各自独立的精确审批门。
 
-当前发布的历史门序见 [ForgeRail 0.1.0-alpha.1 发布 Runbook](release.zh-CN.md)，拟议 source-first 门序见 [ForgeRail 0.1.0-alpha.2 候选 Runbook](release-alpha2.zh-CN.md)。两份文档都不授予执行权限。
+历史门序见 [ForgeRail 0.1.0-alpha.1 发布 Runbook](release.zh-CN.md)与 [ForgeRail 0.1.0-alpha.2 候选 Runbook](release-alpha2.zh-CN.md)，拟议 forward-fix 门序见 [ForgeRail 0.1.0-alpha.3 Runbook](release-alpha3.zh-CN.md)。这些文档都不授予执行权限。

package/docs/release-alpha3.md

@@ -0,0 +1,25 @@
+# ForgeRail 0.1.0-alpha.3 Forward-Fix Runbook
+
+This source-first runbook governs the proposed `@echopath-labs/forgerail@0.1.0-alpha.3`, tag `v0.1.0-alpha.3`, and matching Agent Plugin projection. It does not grant `remote_integration_approval`, `release_approval`, `submission_approval`, `rollback_approval`, or `lifecycle_change_approval`. The unscoped `forgerail@0.0.0-reserved.0` remains a reservation and must never receive product code or serve as an install or rollback source.
+
+## Candidate integration
+
+The public candidate is an ordinary child of the observed remote `main`. That observed base is exactly `dba155d7f7092a3f852bf2c0244a35bd153fcedb`. A future exact `remote_integration_approval` may push only the signed commit to `codex/forgerail-alpha3-scoped`, create one Draft PR, and observe Node.js 22 and 24 Plugin Contracts CI. The Draft PR base and publication comparison baseline remain bound to the observed remote `main`.
+
+Any correction is an ordinary source-first successor commit. Do not force push, rewrite the candidate, transition the PR to Ready, merge, tag, publish, or create a release under remote-integration authority. Install and discover each external Capability Pack separately; availability never implies authentication, enablement, or mutation authority.
+
+## Compatibility proof
+
+The main Plugin must expose no more than three `defaultPrompt` entries while all four Skills remain independently discoverable and directly invokable. The third prompt is an either-or router between Workspace Health Review and Architecture Convergence Audit; it does not merge their ownership or activate both. Validate the exact projection in a fresh disposable Codex host and fail only on a ForgeRail-owned prompt-overflow warning. Icon path warnings owned by `openai-primary-runtime/template-creator` are external observations and must not be repaired by copying or editing that Plugin.
+
+## Separate release gate
+
+Only a later exact `release_approval` can authorize Ready/merge, scoped npm publication, dist-tags, annotated tag, GitHub prerelease, and disposable consumer verification. The merged public `main` tree must equal the final signed projection tree before release validation begins.
+
+Run Node.js 22 and 24 checks for Core, contracts, external Packs, frozen AGW behavior coverage, release source, Directory readiness, disposable consumer lifecycle, pack metadata, and audit. Verify GitHub API/SSH/npm identity as `chasechou007` without exposing credentials. Preserve Apache-2.0, the unscoped reservation, and the immutable alpha.1 and alpha.2 package/tag history.
+
+Do not unpublish or move an immutable version or Git tag. A shipped defect requires a forward version. Installation and diagnosis must leave project files unchanged unless the user separately approves an exact managed binding; return a Host Binding Receipt and confirm no implicit `.forgerail/` state.
+
+## Independent Directory and lifecycle gates
+
+Universal Plugins Directory draft, submission, review publication, verified publisher identity, Apps Management Write, portal regions and assets remain under a separate `submission_approval` or publication gate. AGW deprecation, redirect, archive, or deletion requires `lifecycle_change_approval`. No approval is transitive.

package/docs/release-alpha3.zh-CN.md

@@ -0,0 +1,25 @@
+# ForgeRail 0.1.0-alpha.3 Forward-Fix Runbook
+
+本 source-first runbook 约束拟议的 `@echopath-labs/forgerail@0.1.0-alpha.3`、tag `v0.1.0-alpha.3` 与对应 Agent Plugin 投影。文档本身不授予 `remote_integration_approval`、`release_approval`、`submission_approval`、`rollback_approval` 或 `lifecycle_change_approval`。未作用域 `forgerail@0.0.0-reserved.0` 继续只作占位，不得接收产品代码，也不是安装或回滚来源。
+
+## 候选集成
+
+公共候选是已观测远端 `main` 的普通子 commit。该基线精确为 `dba155d7f7092a3f852bf2c0244a35bd153fcedb`。未来精确 `remote_integration_approval` 只能把签名 commit 推到 `codex/forgerail-alpha3-scoped`，创建一个 Draft PR，并观察 Node.js 22 and 24 Plugin Contracts CI。Draft PR base 与 publication comparison baseline 继续绑定已观测远端 `main`。
+
+任何修正都必须形成普通的 source-first successor commit。remote integration 权限不允许 force push、历史重写、转 Ready、merge、tag、publish 或创建 Release。每个外部 Capability Pack 分别安装与发现；可用不等于认证、启用或获得 mutation authority。
+
+## 兼容性证明
+
+主 Plugin 的 `defaultPrompt` 不得超过三条，同时四个 Skills 必须继续独立发现与直接调用。第三条只是 Workspace Health Review 与 Architecture Convergence Audit 的二选一路由，不合并 owner，也不同时激活两者。必须在 fresh disposable Codex host 验证精确投影，只有 ForgeRail 自有 prompt overflow warning 才判失败。归属 `openai-primary-runtime/template-creator` 的 icon 路径告警是 external observation，不得通过复制或修改该外部 Plugin 修复。
+
+## 独立发布门
+
+只有后续精确 `release_approval` 才能授权 Ready/merge、scoped npm 发布、dist-tag、annotated tag、GitHub prerelease 与一次性消费者验证。发布验证开始前，合并后的公共 `main` tree 必须等于最终签名 projection tree。
+
+在 Node.js 22 和 24 上运行 Core、contracts、external Packs、冻结 AGW 行为覆盖、release source、Directory readiness、一次性 consumer、pack metadata 与 audit。不得暴露凭据地确认 GitHub API/SSH/npm 身份为 `chasechou007`。保持 Apache-2.0、未作用域占位，以及不可变 alpha.1/alpha.2 package/tag 历史。
+
+Do not unpublish 或移动不可变 version/tag。已发布缺陷使用前向版本修复。安装和诊断默认不修改项目；只有用户另行批准精确 managed binding 后才写入，并返回 Host Binding Receipt，确认没有隐式 `.forgerail/` 状态。
+
+## 独立 Directory 与生命周期门
+
+Universal Plugins Directory draft、submit、review publication、verified publisher identity、Apps Management Write、portal regions/assets 继续属于独立 `submission_approval` 或 publication gate。AGW deprecation、redirect、archive 或 deletion 需要 `lifecycle_change_approval`。任何审批都不传递。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@echopath-labs/forgerail",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.3",
   "description": "Deterministic validation and diagnosis CLI for the ForgeRail Agent Plugin.",
   "license": "Apache-2.0",
   "type": "module",

package/scripts/build-universal-directory-candidate.mjs

@@ -54,8 +54,8 @@ const result = {
   approvalStatus: candidate.approval.status,
   product: manifest.name,
   pluginVersion: manifest.version,
-  privateBaseline: "59c7bb52f16cda2d47a8a49bb43860517f9bd7eb",
-  sourceDate: "2026-08-30",
+  privateBaseline: "ebf1851300b549c97cd909cbe7354c32661f5063",
+  sourceDate: "2026-08-31",
   inventory,
   contentDigest: sha256(JSON.stringify(inventory)),
   unresolvedGates: candidate.unresolvedGates,

package/scripts/forgerail.mjs

@@ -229,7 +229,7 @@ function validatePlugin() {
   const manifestPath = resolve(root, ".codex-plugin/plugin.json");
   const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
   if (manifest.name !== "forgerail") errors.push("Plugin name must be forgerail");
-  if (manifest.version !== "0.1.0-alpha.2") errors.push("Plugin version must be 0.1.0-alpha.2");
+  if (manifest.version !== "0.1.0-alpha.3") errors.push("Plugin version must be 0.1.0-alpha.3");
   if (manifest.license !== "Apache-2.0") errors.push("Plugin license must be Apache-2.0");
   const expectedSkills = ["architecture-convergence-audit", "forgerail", "forgerail-workspace-diagnosis", "workspace-health-review"];
   const actualSkills = readdirSync(resolve(root, "skills"), { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();

package/scripts/shadow-comparison.mjs

@@ -87,7 +87,7 @@ for (const scenario of scenarios) {
 const result = {
   schemaVersion: "1.0",
   agwBaseline: "plugins/agent-workflow-governance@0.2.0-canonical",
-  forgeRailCandidate: "plugins/forgerail@0.1.0-alpha.2-canonical",
+  forgeRailCandidate: "plugins/forgerail@0.1.0-alpha.3-canonical",
   scenarios,
   covered: scenarios.filter((item) => item.passed).length,
   unresolved: scenarios.filter((item) => !item.passed).map((item) => item.id),

package/scripts/validate-release.mjs

@@ -6,9 +6,9 @@ import { fileURLToPath } from "node:url";
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const expectedPackageName = "@echopath-labs/forgerail";
-const expectedVersion = "0.1.0-alpha.2";
+const expectedVersion = "0.1.0-alpha.3";
 const expectedTag = `v${expectedVersion}`;
-const expectedDate = "2026-08-30";
+const expectedDate = "2026-08-31";
 const expectedPlugins = [
   "forgerail",
   "forgerail-cross-workspace-orchestration",
@@ -101,7 +101,7 @@ for (const name of expectedPlugins) {
 
 const installation = `${read("docs/installation.md")}\n${read("docs/installation.zh-CN.md")}`;
 for (const phrase of [
-  "codex plugin marketplace add echopath-labs/forgerail --ref v0.1.0-alpha.1",
+  "codex plugin marketplace add echopath-labs/forgerail --ref v0.1.0-alpha.2",
   "codex plugin add forgerail@echopath-labs",
   "codex plugin add forgerail-cross-workspace-orchestration@echopath-labs",
   "codex plugin add forgerail-github-rulesets@echopath-labs",
@@ -136,8 +136,8 @@ record("package-adapters", packageJson.files?.includes("adapters/"), packageJson
 record("package-templates", packageJson.files?.includes("templates/"), packageJson.files ?? null);
 record("no-apply-adoption-script", !read("scripts/forgerail.mjs").includes('command === "apply-adoption"'), "no apply-adoption command");
 
-const releaseEnglish = read("docs/release-alpha2.md");
-const releaseChinese = read("docs/release-alpha2.zh-CN.md");
+const releaseEnglish = read("docs/release-alpha3.md");
+const releaseChinese = read("docs/release-alpha3.zh-CN.md");
 const releaseDocs = `${releaseEnglish}\n${releaseChinese}`;
 for (const phrase of [
   "remote_integration_approval",
@@ -146,7 +146,7 @@ for (const phrase of [
   expectedVersion,
   expectedTag,
   "Node.js 22 and 24",
-  "codex/forgerail-alpha2-scoped",
+  "codex/forgerail-alpha3-scoped",
   "Do not unpublish",
   "AGW",
   "Host Binding Receipt",

package/scripts/validate-universal-directory.mjs

@@ -64,11 +64,11 @@ function validateMarkdownLinks(relativePath) {
 }
 
 assert(candidate.submissionType === "skills_only", "candidate is Skills-only");
-assert(candidate.status === "local_alpha2_source_candidate", "candidate status is local alpha.2 source preparation");
+assert(candidate.status === "local_alpha3_forward_fix_candidate", "candidate status is local alpha.3 forward-fix preparation");
 assert(candidate.approval.status === "not_granted", "submission approval is not granted");
 assert(candidate.plugin.id === manifest.name, "candidate and manifest Plugin identity match");
 assert(candidate.plugin.version === manifest.version, "candidate and manifest version match");
-assert(candidate.plugin.version === "0.1.0-alpha.2", "candidate version is alpha.2");
+assert(candidate.plugin.version === "0.1.0-alpha.3", "candidate version is alpha.3");
 assert(packageJson.version === candidate.plugin.version, "optional scoped package version matches candidate");
 assert(candidate.plugin.mcpServers.length === 0, "candidate has no MCP server requirement");
 assert(candidate.plugin.authentication === "none", "candidate has no authentication requirement");
@@ -76,6 +76,18 @@ assert(candidate.plugin.coreRequirements.projectPackageJson === false, "Core req
 assert(candidate.plugin.coreRequirements.projectNodeModules === false, "Core requires no project node_modules");
 assert(candidate.plugin.coreRequirements.npmCli === "optional", "npm CLI is optional");
 
+const expectedDefaultPrompts = [
+  "Use ForgeRail to govern this engineering task.",
+  "Diagnose this workspace before recommending governance changes.",
+  "Review workspace health or audit duplicated architecture ownership using the matching independent ForgeRail Skill.",
+];
+assert(Array.isArray(manifest.interface.defaultPrompt), "defaultPrompt is an array");
+assert(manifest.interface.defaultPrompt.length <= 3, "defaultPrompt stays within the Codex maximum of three");
+assert(manifest.interface.defaultPrompt.length === expectedDefaultPrompts.length, "defaultPrompt exposes the three reviewed intents");
+assert(new Set(manifest.interface.defaultPrompt).size === manifest.interface.defaultPrompt.length, "defaultPrompt entries are unique");
+assert(manifest.interface.defaultPrompt.every((prompt) => typeof prompt === "string" && prompt.trim().length > 0), "defaultPrompt entries are non-empty strings");
+assert(JSON.stringify(manifest.interface.defaultPrompt) === JSON.stringify(expectedDefaultPrompts), "defaultPrompt entries match the reviewed governance, diagnosis, and either-or review router");
+
 for (const skill of candidate.plugin.skills) {
   assert(existsSync(resolve(pluginRoot, "skills", skill, "SKILL.md")), `declared Skill exists: ${skill}`);
 }
@@ -96,8 +108,8 @@ for (const field of ["websiteUrl", "supportUrl", "privacyPolicyUrl", "termsOfSer
 }
 assert(candidate.availability.intent.state === "confirmed_by_user" && candidate.availability.intent.value === "all_platform_supported_regions", "all-platform-supported-regions intent is user-confirmed");
 assert(candidate.availability.portalEnumeration.state === "pending_confirmation" && candidate.availability.portalEnumeration.values.length === 0, "portal region enumeration remains pending without an invented country list");
-assert(candidate.releaseNotes.state === "candidate" && candidate.releaseNotes.path === "./directory/release-notes-alpha2.md", "alpha.2 release notes path is explicit");
-assert(existsSync(resolve(pluginRoot, candidate.releaseNotes.path)), "alpha.2 release notes file exists");
+assert(candidate.releaseNotes.state === "candidate" && candidate.releaseNotes.path === "./directory/release-notes-alpha3.md", "alpha.3 release notes path is explicit");
+assert(existsSync(resolve(pluginRoot, candidate.releaseNotes.path)), "alpha.3 release notes file exists");
 
 const privacy = readFileSync(resolve(pluginRoot, "PRIVACY.md"), "utf8");
 const terms = readFileSync(resolve(pluginRoot, "TERMS.md"), "utf8");
@@ -107,7 +119,7 @@ for (const phrase of ["Skills-only Agent Plugin", "does not operate its own serv
 for (const phrase of ["Apache License 2.0", "without warranties", "You are responsible", "external actions", "does not provide legal advice", "service-level agreement"]) {
   assert(terms.includes(phrase), `Terms contain required boundary: ${phrase}`);
 }
-for (const path of ["PRIVACY.md", "TERMS.md", "README.md", "README.zh-CN.md", "docs/installation.md", "docs/installation.zh-CN.md", "docs/release-alpha2.md", "docs/release-alpha2.zh-CN.md"]) {
+for (const path of ["PRIVACY.md", "TERMS.md", "README.md", "README.zh-CN.md", "docs/installation.md", "docs/installation.zh-CN.md", "docs/release-alpha3.md", "docs/release-alpha3.zh-CN.md"]) {
   validateMarkdownLinks(path);
 }