@jstn-sdk/ma 0.1.13 → 0.14.0

package/support-bundle.json

@@ -0,0 +1,114 @@
+{
+  "schemaVersion": "1.0.0",
+  "bundleVersion": "0.14.0",
+  "compatibility": {
+    "node": ">=20",
+    "managedBy": "@jstn-sdk/ma"
+  },
+  "assets": [
+    {
+      "name": "mcp",
+      "class": "runtime",
+      "source": "mcp",
+      "destination": "mcp",
+      "type": "directory",
+      "required": true
+    },
+    {
+      "name": "sprint-release",
+      "class": "guidance",
+      "source": "sprint/07-release.md",
+      "destination": "sprint/07-release.md",
+      "type": "file",
+      "required": true
+    },
+    {
+      "name": "prompts",
+      "class": "guidance",
+      "source": ".codex/prompts",
+      "destination": "prompts",
+      "type": "directory",
+      "required": true
+    },
+    {
+      "name": "active-autonomy-hook",
+      "class": "runtime",
+      "source": "scripts/active-autonomy-hook.mjs",
+      "destination": "scripts/active-autonomy-hook.mjs",
+      "type": "file",
+      "required": true
+    },
+    {
+      "name": "skills-install",
+      "class": "runtime",
+      "source": "scripts/skills-install.js",
+      "destination": "scripts/skills-install.js",
+      "type": "file",
+      "required": true
+    },
+    {
+      "name": "plugin-skills",
+      "class": "plugin",
+      "source": "skills",
+      "destination": "plugins/meta-architect/skills",
+      "type": "directory",
+      "required": true
+    },
+    {
+      "name": "plugin-manifest",
+      "class": "plugin",
+      "source": "plugins/meta-architect/.codex-plugin/plugin.json",
+      "destination": "plugins/meta-architect/.codex-plugin/plugin.json",
+      "type": "file",
+      "required": true
+    },
+    {
+      "name": "plugin-app",
+      "class": "plugin",
+      "source": "plugins/meta-architect/.app.json",
+      "destination": "plugins/meta-architect/.app.json",
+      "type": "file",
+      "required": true
+    },
+    {
+      "name": "plugin-mcp",
+      "class": "plugin",
+      "source": "plugins/meta-architect/.mcp.json",
+      "destination": "plugins/meta-architect/.mcp.json",
+      "type": "file",
+      "required": true
+    },
+    {
+      "name": "plugin-obsidian",
+      "class": "plugin",
+      "source": "plugins/meta-architect/obsidian",
+      "destination": "plugins/meta-architect/obsidian",
+      "type": "directory",
+      "required": true
+    },
+    {
+      "name": "templates",
+      "class": "guidance",
+      "source": "templates/AGENTS.md",
+      "destination": "templates/AGENTS.md",
+      "type": "file",
+      "required": true
+    },
+    {
+      "name": "docs-readme",
+      "class": "documentation",
+      "source": "docs/README.md",
+      "destination": "docs/README.md",
+      "type": "file",
+      "required": true
+    },
+    {
+      "name": "docs-reference",
+      "class": "documentation",
+      "source": "docs/reference",
+      "destination": "docs/reference",
+      "type": "directory",
+      "required": false
+    }
+  ]
+}

package/templates/AGENTS.md

@@ -17,6 +17,10 @@ The primary trigger surfaces are:
 
 No implementation should proceed as if it were approved unless the required architecture, evidence, logic, and security gates are satisfied.
 
+## External review findings rule
+
+Every finding reported by the `chatgpt-codex-connector` must be reviewed, implemented or explicitly resolved with evidence, and re-checked before the change is considered complete. Do not dismiss, skip, or claim resolution for a finding until the affected behavior is verified by the smallest appropriate test, check, or reproduction. A pull request remains unresolved while any connector finding lacks a recorded resolution and fresh verification evidence.
+
 ## Kernel vs extension model
 
 Meta-Architect should be treated as a core system plus extension surfaces:
@@ -63,8 +67,8 @@ If any required field is missing, red, or unverified, the workflow should stop a
 
 ### Merge and release rule
 
-- `feature/*` work merges into `development`
-- release promotion is allowed only from `development` or approved `release/*`
+- `feature/*` work merges into `dev`
+- release promotion is allowed only from `dev` or approved `release/*`
 - no direct `feature/* -> prod`
 
 ## Evidence rule

package/templates/quality/ai-quality-rules.yml

@@ -0,0 +1,37 @@
+rules:
+  - id: ai-missing-fetch-timeout
+    languages: [javascript, typescript]
+    message: Network calls require an AbortController or timeout boundary.
+    severity: ERROR
+    patterns:
+      - pattern: fetch($URL)
+      - pattern-not: fetch($URL, {...})
+  - id: ai-dynamic-code-execution
+    languages: [javascript, typescript]
+    message: Dynamic code execution is forbidden.
+    severity: ERROR
+    patterns:
+      - pattern: eval(...)
+      - pattern: new Function(...)
+  - id: ai-log-injection
+    languages: [javascript, typescript]
+    message: User-controlled values must be sanitized before logging.
+    severity: WARNING
+    pattern: console.log(...)
+  - id: ai-raw-database-payload
+    languages: [javascript, typescript]
+    message: Database writes must use an allowlisted payload.
+    severity: ERROR
+    patterns:
+      - pattern: $DB.updateOne(...)
+      - pattern: $DB.create(...)
+  - id: ai-no-any-types
+    languages: [typescript]
+    message: Generated TypeScript must not use any.
+    severity: ERROR
+    pattern: $TYPE: any
+  - id: ai-unbounded-timer
+    languages: [javascript, typescript]
+    message: Timers require lifecycle cleanup.
+    severity: WARNING
+    pattern: setTimeout(...)