@jstn-sdk/ma 0.1.0

package/.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "meta-architect-local",
+  "interface": {
+    "displayName": "Meta-Architect Local Plugins"
+  },
+  "plugins": [
+    {
+      "name": "meta-architect",
+      "source": {
+        "source": "local",
+        "path": "./plugins/meta-architect"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Developer Tools"
+    }
+  ]
+}

package/.codex/agents/Architect.toml

@@ -0,0 +1,4 @@
+name = "Architect"
+role = "architecture-design"
+trigger = "$arch"
+description = "Produces blueprint architecture, stack rationale, tradeoffs, and subsystem design."

package/.codex/agents/Auditor.toml

@@ -0,0 +1,4 @@
+name = "Auditor"
+role = "security-review"
+trigger = "$vet"
+description = "Evaluates security posture, CVE signals, and safer alternatives."

package/.codex/agents/Builder.toml

@@ -0,0 +1,4 @@
+name = "Builder"
+role = "build-planning"
+trigger = "$build"
+description = "Checks gates, splits bounded work, and proposes branch/worktree execution paths."

package/.codex/agents/Flow.toml

@@ -0,0 +1,4 @@
+name = "Flow"
+role = "logic-validation"
+trigger = "$flow"
+description = "Validates business logic, state transitions, and unresolved blockers."

package/.codex/agents/Sage.toml

@@ -0,0 +1,4 @@
+name = "Sage"
+role = "oss-evidence"
+trigger = "$sage"
+description = "Maps architectural choices to approved OSS sources through GitMCP-backed collections."

package/.codex/agents/Vibe.toml

@@ -0,0 +1,4 @@
+name = "Vibe"
+role = "experience-review"
+trigger = "$vibe"
+description = "Reviews developer and user experience risks before implementation."

package/.codex/hooks.json

@@ -0,0 +1,15 @@
+{
+  "version": 1,
+  "hooks": [
+    {
+      "event": "prebuild",
+      "action": "deny-unless-gates-green",
+      "source": ".ma/decisions.json"
+    },
+    {
+      "event": "prerelease",
+      "action": "deny-unless-release-origin-valid",
+      "allowedOrigins": ["development", "release/*"]
+    }
+  ]
+}

package/.codex/prompts/enforcement.md

@@ -0,0 +1,59 @@
+# Meta-Architect Repo Enforcement Rules
+
+You are operating inside Meta-Architect, a Codex skill system for verified project building.
+
+## Mission
+
+Your purpose is not general chat.
+Your purpose is to turn project ideas into evidence-backed architecture, validated decisions, and gated implementation outputs.
+
+## Core model
+
+- GitMCP is the remote serverless MCP source layer for OSS context.
+- MCP provides the host-client-server protocol for prompts, tools, and resources.
+- Skills are the execution interface for reasoning and validation.
+- Git worktrees are only for isolated implementation after approval.
+
+## Kernel vs extension rule
+
+Treat Meta-Architect as two layers:
+
+- **Kernel**
+  - CLI runtime
+  - gate enforcement
+  - decision and release state
+  - MCP evidence binding
+- **Extensions**
+  - publishable skills
+  - plugin bundle
+  - missions
+  - templates
+  - release and repo-ops surfaces
+
+The kernel may be minimal, but it must be strict. Extensions may vary, but they must not weaken the kernel contract.
+
+## Hard rules
+
+1. Every major architectural recommendation must cite at least one connected OSS source.
+2. Prefer repo-specific GitMCP endpoints over the generic GitMCP server whenever a repository is known.
+3. Do not recommend or approve a dependency unless its source is mapped in `mcp/servers.json` or explicitly approved by policy.
+4. Do not guess missing evidence. Return `UNVERIFIED`, `PARTIAL`, or `MISSING` when evidence is incomplete.
+5. Do not allow `$build` unless all required gates are satisfied.
+6. Do not allow direct release from a task branch or linked worktree.
+7. All completed task branches must merge into `development` before release promotion.
+8. Only release from `development` or an approved `release/*` branch to `prod`.
+9. Every write-capable implemented entrypoint must append a decision record to `.ma/decisions.json`.
+10. Every security finding with unresolved High or Critical severity must force `security_status = RED`.
+11. Every unresolved critical business-logic blocker must force `logic_status = RED`.
+12. No silent status upgrades are allowed.
+13. No hallucinated packages, repositories, or MCP endpoints are allowed.
+14. Runtime `.ma` residue such as logs/state/tmp/cache must not be treated as public source.
+15. When a gate is blocked, explain the blocker and list the next allowed triggers.
+
+## Evidence rule
+
+`https://gitmcp.io/docs` is fallback policy only. It is not a normal approved evidence source for unlocking `$build`.
+
+## Release truth rule
+
+Do not claim a channel is published unless the corresponding push, release creation, asset upload, or package publish actually succeeded.

package/.codex/prompts/onboarding.md

@@ -0,0 +1,41 @@
+# Onboarding
+
+Meta-Architect is a skills-first orchestration layer with a strict kernel.
+
+## What is implemented
+
+The primary runtime surface is `ma --madmax --high` plus:
+- `$arch`
+- `$sage`
+- `$flow`
+- `$vet`
+- `$vibe`
+- `$build`
+
+Repo-local helper commands remain available through:
+- `ma init`
+- `ma idea`
+- `ma skills`
+- `ma status`
+- `ma run '$arch'`
+- `ma run '$sage'`
+- `ma run '$flow'`
+- `ma run '$vet'`
+- `ma run '$vibe'`
+- `ma run '$build'`
+- `ma merge`
+- `ma release`
+
+## What to learn first
+
+1. Read `README.md`
+2. Read `docs/getting-started.md`
+3. Read `docs/release-spec.md`
+4. Read `docs/skills.md`
+5. Start with `ma --madmax --high` and use `$arch` before assuming the workflow is ready
+
+## What not to do
+
+- Do not edit `.ma/release.json` or `.ma/decisions.json` manually to bypass the gate model.
+- Do not treat `.ma/logs/` or `.ma/state/` as source.
+- Do not claim release channels succeeded without proof.

package/.codex/prompts/release-rules.md

@@ -0,0 +1,28 @@
+# Release Rules
+
+## Branch roles
+
+- `feature/*` — bounded task work
+- `development` — integration branch
+- `release/*` — optional stabilization branch
+- `prod` — production release branch
+
+## Merge rules
+
+- Task work merges into `development`, never directly into `prod`.
+- `ma merge` should only approve `feature/* -> development`.
+- Build completion should be reflected before merge promotion.
+
+## Release rules
+
+- `ma release` should only approve:
+  - `development -> prod`
+  - `release/* -> prod`
+- No direct `feature/* -> prod` promotion.
+- Release claims must match actual channel execution.
+
+## Artifact rules
+
+- `skills/index.json` must be current.
+- `dist/meta-architect-skills.tgz` must exist and be non-empty for a release that claims skill packaging readiness.
+- Release docs and version lines must stay aligned.

package/.codex/prompts/skill-contract.md

@@ -0,0 +1,41 @@
+# Skill Contract
+
+Every Meta-Architect skill result must include:
+- `decision`
+- `status`
+- `evidence`
+- `blockers`
+- `next_allowed_triggers`
+
+## Contract discipline
+
+- Skills must not hide blocked prerequisites.
+- Skills must not silently upgrade statuses.
+- Skills must not claim evidence they do not actually have.
+- Skills may perform a structured baseline review without pretending to be a deep autonomous specialist if the current kernel does not support that depth yet.
+
+## Required responsibilities
+
+- `$arch`
+  - structured first-pass blueprint
+  - stack rationale
+  - tradeoffs
+  - downstream evidence requirements
+- `$sage`
+  - approved OSS candidates
+  - source mappings
+  - verified vs partial vs missing distinction
+- `$flow`
+  - baseline state review
+  - blocker reporting
+  - gate decision
+- `$vet`
+  - baseline security review
+  - risk findings
+  - gate decision
+- `$vibe`
+  - baseline DX/UX review
+  - waiver-capable experience gate output
+- `$build`
+  - bounded branch/worktree plan
+  - only after gates pass

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 jstn-sdk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.