@techgoblin/gobstack 0.6.0-alpha.1 → 0.6.0-alpha.3

package/CHANGELOG.md

@@ -3,7 +3,23 @@
 One line per released version. `goblin-install --upgrade` prints the delta between the
 version recorded in a target's `.goblin/installed.json` and the source `VERSION`.
 
-## 0.6.0-alpha.1
+## Unreleased (feat/extras-catalogue)
+
+- **`gob extras`: the curated catalogue (the surface is seven verbs).** The catalogue
+  (`extras-catalogue/catalogue.tsv`, 41 researched rows in 17 columns: 18 RECOMMEND incl.
+  `impeccable`, MAYBE/SKIP carried with verdicts) is browsed (`list [category]`, `show <id>`)
+  and installed (`install <id...>` — skills per the sync_platforms pattern or `.gob/extras/`,
+  mcp rows as an ask-once `.mcp.json` merge, workflows into `.gob/playbooks/`). The catalogue
+  is the ALLOWLIST: an unknown id or a SKIP verdict refuses; installs copy from the vendored
+  `extras-catalogue/payload/` — no network, no download path.
+- **`gob init` suggests extras; it never installs them.** The AGENT BRIEF carries
+  `catalogue_suggestions` (matches-column rows; RECOMMEND pre-ticked, MAYBE visible and
+  unticked, SKIP never) and the `discover_extras` tier: web-found candidates proposed under a
+  fixed schema (`source_url`/`license`/`rationale`/`suggested_kind`), inert until the curator
+  promotes them into catalogue.tsv by PR or edit. `--write` honours only the proposal's TICKED
+  rows, through `gob extras install` itself — one allowlist, one code path.
+
+## 0.6.0-alpha.2
 
 The v2 breaking release: rules-first. The rules a repo is judged by move from a config file the
 installer generated into the file a new session already reads, the folder the engine is vendored

package/README.md

@@ -76,7 +76,7 @@ The measurement and the vacuous-pass reading are in `docs/CONTRACTS.md`.
 
 ## The `gob` CLI
 
-The v2 surface is six verbs. Everything else — audit, doctor, emit/sync, upgrade, install —
+The v2 surface is seven verbs. Everything else — audit, doctor, emit/sync, upgrade, install —
 is unwired in this alpha: the shim refuses the verb by name and prints the usage.
 
 | command | what it does |
@@ -85,6 +85,7 @@ is unwired in this alpha: the shim refuses the verb by name and prints the usage
 | `gob map` | the feature-map prompt + schema (`--heuristic [target]` runs the starter scanner); `--write <dir> [--force]` validates an agent-written map and installs it; never clobbers — an existing map refuses until `--force` |
 | `gob verify` | run the rule matrix against the current repo — `PASS`/`FAIL`/`SKIP` per row, exit 0 pass · 1 a check failed · 2 could not run · 3 the manifest is broken |
 | `gob bans` | run the ban list (per-pattern red lines over the source tree) |
+| `gob extras` | the curated extras catalogue: `list [category]` / `show <id>` / `install <id...> [­-target <dir>] [--platform <id>] [--with-mcp-config]` — init only SUGGESTS; installs come from the catalogue (the allowlist rule), never the web |
 | `gob mcp` | serve the harness to your coding agent over MCP stdio — three tools (`gob_verify`, `gob_map_status`, `gob_init_status`), local only, no SDK, no network |
 | `gob uninstall` | remove everything an install wrote, byte-exactly (`gob install --target <dir> --uninstall` is the same job) |
 
@@ -128,6 +129,62 @@ checks and the `.gitignore` block; no skills directory, and no files belonging t
 agent. The proposal schema's `sync_platforms:` line is where the platform choice is recorded
 when that surface lands.
 
+## Extras: the curated catalogue
+
+`gob extras` is the catalogue browser + installer for curated third-party agent skills, MCP
+servers and workflows — matched to your stack, suggested at init, installed only on an
+explicit command. The source of truth is `extras-catalogue/catalogue.tsv`, reviewed and
+carried by the curator (one row per candidate: source repo, license, stars, last push, which
+stacks it `matches`, what it `conflicts` with, and a verdict).
+
+    gob extras list [category]        # the catalogue, grouped: frontend | testing | game | node
+    gob extras show <id>              # one row, every field, + the install hint
+    gob extras install <id...>        # the only way an extra lands in your repo
+        [--target <dir>] [--platform <id>] [--with-mcp-config] [--dry-run]
+
+The verdict decides what each row can do: `RECOMMEND` rows are pre-ticked when `gob init`
+suggests, `MAYBE` rows are listed but never pre-ticked, and a `SKIP` row refuses install —
+it stays visible so the curation history is readable, but the curator declined it.
+
+**The license gate is hard.** A verdict alone never installs anything: every row carries a
+`license_status` (verified | pending | proprietary-confirmed-ok) and the date it was checked.
+Only `verified` installs. A row whose license is not yet resolved carries verdict
+`LICENSE-PENDING` — it is never pre-ticked at init, and `gob extras install` refuses it with
+`license pending verification` until a curator verifies the license and flips the row's data
+in `catalogue.tsv`. The gate reads the data, not the code: flipping a row installable is a
+catalogue edit (a new `license_status` + `license_check_date`), never an engine change.
+
+**The catalogue is the allowlist.** An id that is not a row in `catalogue.tsv` is refused by
+name; nothing is ever installed from a URL, a repo name, or a web search. Installs are
+offline by contract: skill and workflow rows copy from the vendored payload the curator
+maintains under `extras-catalogue/payload/` (a row with no payload refuses, with the named
+fix — it is never downloaded); `mcp` rows print the `mcp.json` snippet, and
+`--with-mcp-config` merges it into the target's `.mcp.json` — ask-once, never overwriting an
+entry you customized. A `--platform <id>` skill install copies into that platform's project
+skills root (the same paths the sync adapters record); with no `--platform`, skills land in
+the repo-neutral `.gob/extras/<skill-name>/`, and workflow rows copy into
+`.gob/playbooks/<id>/`. An existing file with different content is never clobbered.
+
+**`gob init` suggests; it never installs.** The AGENT BRIEF carries a
+`catalogue_suggestions` section: rows whose `matches:` column names the stack the scan found,
+RECOMMEND rows pre-ticked and MAYBE rows visible but unticked. The heuristic fallback
+(`--heuristic`) suggests from the same `matches:` column. `init --write` honours the
+proposal's TICKED rows and only those — unticked MAYBE lines install nothing — and it does
+the honouring by calling `gob extras install` itself, so the allowlist, the verdict refusals
+and the payload contract are one code path.
+
+**The `discover_extras` tier is proposals only.** The brief also asks the agent to search the
+web — with its own tools — for skills/MCPs/workflows that match the stack and are NOT in the
+catalogue, and to propose them under `discover_extras:` with a live `source_url`, the
+`license` found, and a one-line `rationale`. Nothing auto-installs from discovery: a human
+reviews the proposals, and the curator promotes accepted discoveries into `catalogue.tsv` by
+PR or direct edit. Until a row exists in the catalogue, `gob extras install` refuses it.
+
+**How a row is added** (the curation surface): propose it by PR or edit
+`extras-catalogue/catalogue.tsv` directly — the columns are the row schema
+`gob extras show` prints. A row lands with a verdict, a reviewer and a date; the tests pin
+the file's shape so a malformed row cannot ship.
+
 ## What it is not
 
 Not a rules document (every rule carries a runnable check or is explicitly counted as

package/VERSION

@@ -1 +1 @@
-0.6.0-alpha.1
+0.6.0-alpha.3

package/bin/goblin

@@ -5,6 +5,8 @@
 #   gob map     [target] [--agent | --heuristic] [--write <dir>] [--force]
 #   gob verify  [--only <id[,id...]>] [--json] [--list] [--source <path>]
 #   gob bans    [--only <id[,id...]>] [--list]
+#   gob extras  list [category] | show <id> | install <id...> [--target <dir>]
+#                    [--platform <id>] [--with-mcp-config] [--dry-run]
 #   gob mcp                                     serve the harness over MCP stdio
 #   gob uninstall --target <dir>
 #   gob --version
@@ -48,6 +50,7 @@ gob — the gobstack command line.
   gob map     [target] [--agent | --heuristic] [--write <dir>] [--force]
   gob verify  [--only <id[,id...]>] [--json] [--list] [--source <path>]
   gob bans    [--only <id[,id...]>] [--list]
+  gob extras  list [category] | show <id> | install <id...>   # the curated extras catalogue
   gob mcp     serve the harness to your agent over MCP stdio (verify/map/init tools)
   gob uninstall --target <dir>
   gob --version
@@ -97,6 +100,12 @@ case "$CMD" in
   bans)
     exec bash "$SRC/bin/goblin-bans" "$@"
     ;;
+  extras)
+    # The curated catalogue browser + installer (bin/goblin-extras): list/show/install
+    # over extras-catalogue/catalogue.tsv. The catalogue is the ALLOWLIST: nothing is
+    # ever installed that a catalogue row does not name, and `gob init` only suggests.
+    exec bash "$SRC/bin/goblin-extras" "$@"
+    ;;
   mcp)
     # The MCP stdio server (bin/goblin-mcp.js): JSON-RPC 2.0 over stdin/stdout, a LOCAL
     # tool server over the vendored harness — no API call, no socket. node is the same

package/bin/goblin-audit

@@ -23,7 +23,7 @@
 #      because an empty record reads to SC-07 as "clean" and that would be a fabricated pass
 set -uo pipefail
 
-GOBLIN_AUDIT_VERSION="0.6.0-alpha.1"
+GOBLIN_AUDIT_VERSION="0.6.0-alpha.3"
 
 usage() { sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
 

package/bin/goblin-bans

@@ -28,7 +28,7 @@
 
 set -uo pipefail
 
-GOBLIN_BANS_VERSION="0.6.0-alpha.1"
+GOBLIN_BANS_VERSION="0.6.0-alpha.3"
 SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 # shellcheck source=goblin-lib.sh
 . "$SELF_DIR/goblin-lib.sh"

package/bin/goblin-extras

@@ -0,0 +1,360 @@
+#!/usr/bin/env bash
+# goblin-extras — `gob extras`: the curated catalogue browser + installer (v2 W-extras).
+#
+#   gob extras list [category]                 the catalogue, grouped by category
+#   gob extras show <id>                       one row, every field, + the install hint
+#   gob extras install <id...> [--target <dir>] [--platform <id>]
+#                    [--with-mcp-config] [--dry-run]
+#
+# The ALLOWLIST RULE (non-negotiable): only ids that exist in catalogue.tsv are ever
+# installed. An id the catalogue does not carry is refused by name — there is no path from
+# a URL or a repo name on this command to a file write. `gob init` SUGGESTS rows and never
+# auto-installs; a human (or the proposal the human approves) names ids explicitly, and
+# the curator maintains the catalogue (add a row = PR or edit catalogue.tsv).
+#
+# Verdicts: RECOMMEND rows install; MAYBE rows install (an explicit choice, never
+# pre-ticked at init); SKIP rows refuse — the curator's verdict is the contract.
+# THE LICENSE GATE (W-license, hard): verdict RECOMMEND|MAYBE alone is not enough —
+# a row installs only when its catalogue license_status is `verified`. Rows with an
+# unresolved license carry verdict LICENSE-PENDING (never pre-ticked at init) and
+# refuse install with `license pending verification` until the curator flips the
+# DATA (license_status + license_check_date), never this file.
+#
+# NO NETWORK. Skill and workflow installs copy from a VENDORED PAYLOAD the curator
+# maintains under extras-catalogue/payload/<id>/ (payload/README.md is the layout
+# contract); a row whose payload is absent is refused with the named fix, never
+# downloaded. MCP installs are a printed mcp.json snippet plus — with
+# --with-mcp-config — a merge into the target's .mcp.json that never overwrites an
+# existing server entry (the ask-once rule .mcp.json has always had).
+#
+# Skill destinations follow the sync_platforms pattern: --platform <adapter-id> copies
+# each vendored skill dir under that adapter's project skills root (read from
+# adapters/<id>/adapter.tsv, column skills_path_project); with no --platform the skill
+# lands in the repo-neutral .gob/extras/<skill-name>/ (standalone repos). Workflows copy
+# the payload into .gob/playbooks/<id>/.
+#
+# Exit codes: 0 ok | 1 a refusal (named path + fix) | 2 bad input.
+# No npm, no jq, no yq, no network. bash/awk/sed/grep only (python3 only for the
+# .mcp.json merge, where a hand-rolled JSON edit would corrupt files it must not).
+
+set -uo pipefail
+
+SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SRC=$(cd "$SELF_DIR/.." && pwd)
+# shellcheck source=goblin-lib.sh
+. "$SELF_DIR/goblin-lib.sh"
+
+g_info() { printf '%s\n' "$*"; }
+
+usage() { sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
+
+# ---- the catalogue source (overridable for tests) ------------------------------
+# The default is the shipped catalogue; GOB_EXTRAS_CATALOGUE points a test at a fixture.
+# Same for the payload root: a test vendors a fixture payload and aims the installer at it.
+CATALOGUE="${GOB_EXTRAS_CATALOGUE:-$SRC/extras-catalogue/catalogue.tsv}"
+PAYLOAD="${GOB_EXTRAS_PAYLOAD:-$SRC/extras-catalogue/payload}"
+
+die() { g_err "extras: $*"; exit "${2:-2}"; }
+
+# catalogue_row <id> — the whole data row (tab-separated), empty when absent.
+catalogue_row() {
+  awk -F'\t' -v id="$1" 'NR>1 && $1==id { print; exit }' "$CATALOGUE"
+}
+
+# catalogue_field <row> <n> — the nth tab field of a row.
+catalogue_field() { printf '%s' "$1" | awk -F'\t' -v n="$2" '{ print $n }'; }
+
+# catalogue_ids — every id, file order.
+catalogue_ids() { awk -F'\t' 'NR>1 && $1!="" { print $1 }' "$CATALOGUE"; }
+
+# category_order — the categories in catalogue file order of first appearance.
+category_order() { awk -F'\t' 'NR>1 && !seen[$2]++ { print $2 }' "$CATALOGUE"; }
+
+# ---- adapters (the platform enum is data, never literals) ----------------------
+# MD-01: agent-family names are read from adapters/<id>/adapter.tsv at run time, never
+# written here — the same discipline the sync engine's assembled platform list keeps.
+adapter_ids() {
+  for t in "$SRC"/adapters/*/adapter.tsv; do
+    [ -f "$t" ] || continue
+    awk -F'\t' '!/^#/ && NF>1 && $1!="id" { print $1 }' "$t"
+  done
+}
+
+# adapter_skills_root <id> — the PROJECT skills root (the pattern with its
+# `<name>/SKILL.md` tail stripped), one dot-dir per agent family. Read at run time;
+# the family names live in the adapter tables, never here (the MD-01 discipline).
+adapter_skills_root() {
+  local t="$SRC/adapters/$1/adapter.tsv" pat
+  [ -f "$t" ] || return 0
+  pat=$(awk -F'\t' '!/^#/ && NF>1 && $1!="id" { print $4 }' "$t")
+  [ -n "$pat" ] || return 0
+  printf '%s\n' "${pat%%<name>*}"
+}
+
+# ---- list ----------------------------------------------------------------------
+cmd_list() {
+  local want="${1:-}"
+  [ -f "$CATALOGUE" ] || die "catalogue not found: $CATALOGUE" 2
+  if [ -n "$want" ]; then
+    # An unknown category is bad input, not an empty table: a typo must not read as
+    # "the catalogue has nothing here". Captured, not piped: under pipefail a `grep -q`
+    # match closes the pipe early and SIGPIPE-kills the producer (pipeline 141), which
+    # would read as "unknown category" for a category the catalogue carries.
+    CATS=$(category_order)
+    printf '%s\n' "$CATS" | grep -qx "$want" || die "unknown category '$want' (want one of: $(printf '%s' "$CATS" | tr '\n' ' '))" 2
+  fi
+  local total
+  total=$(catalogue_ids | wc -l | tr -d ' ')
+  g_info "gob extras — the curated catalogue ($total rows; RECOMMEND pre-ticks at init, MAYBE is visible but never pre-ticked, SKIP refuses install; LICENSE-PENDING rows refuse install until their license is verified)"
+  g_info "install: gob extras install <id...>   ·   one row: gob extras show <id>"
+  local cat
+  for cat in $(category_order); do
+    [ -z "$want" ] || [ "$cat" = "$want" ] || continue
+    printf '\n[%s]\n' "$cat"
+    printf '  %-34s %-8s %-7s %-24s %-10s %-16s %s\n' "id" "kind" "stars" "license" "verdict" "lic-status" "matches"
+    awk -F'\t' -v cat="$cat" 'NR>1 && $2==cat {
+      printf "  %-34s %-8s %-7s %-24s %-10s %-16s %s\n", $1, $3, $9, $8, $15, $18, $11
+    }' "$CATALOGUE"
+  done
+  return 0
+}
+
+# ---- show ----------------------------------------------------------------------
+cmd_show() {
+  local id="${1:-}"
+  [ -n "$id" ] || die "show: an id is required (gob extras list)" 2
+  [ -f "$CATALOGUE" ] || die "catalogue not found: $CATALOGUE" 2
+  local row
+  row=$(catalogue_row "$id")
+  [ -n "$row" ] || die "unknown id '$id' — gob extras list names the catalogue" 2
+  local labels=(id category kind name source_repo path_within_repo has_skill_md license
+                stars last_push matches conflicts requires install_hint verdict
+                reviewed_by reviewed_date license_status license_check_date)
+  local i
+  for i in $(seq 1 19); do
+    printf '%-18s %s\n' "${labels[$((i-1))]}:" "$(catalogue_field "$row" "$i")"
+  done
+  return 0
+}
+
+# ---- install -------------------------------------------------------------------
+TARGET="" PLATFORM="" WITH_MCP=0 DRYRUN=0 IDS=()
+parse_install() {
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --target)          TARGET="${2:-}"; shift 2 ;;
+      --platform)        PLATFORM="${2:-}"; shift 2 ;;
+      --with-mcp-config) WITH_MCP=1; shift ;;
+      --dry-run)         DRYRUN=1; shift ;;
+      --yes)             shift ;;   # accepted for pipe parity; install is already explicit
+      -h|--help)         usage; exit 0 ;;
+      -*)                die "install: unknown option: $1" 2 ;;
+      *)                 IDS+=("$1"); shift ;;
+    esac
+  done
+  [ "${#IDS[@]}" -gt 0 ] || die "install: at least one id is required (gob extras list)" 2
+  [ -f "$CATALOGUE" ] || die "catalogue not found: $CATALOGUE" 2
+  TARGET="${TARGET:-$PWD}"
+  TARGET=$(g_expand_tilde "$TARGET")
+  [ -d "$TARGET" ] || die "--target is not a directory: $TARGET" 2
+  TARGET=$(cd "$TARGET" && pwd)
+  if [ -n "$PLATFORM" ]; then
+    # Captured, not piped (see cmd_list: pipefail + grep -q closes the pipe early and
+    # SIGPIPE-kills the producer — a valid platform id read as unknown).
+    ADAPTERS=$(adapter_ids)
+    printf '%s\n' "$ADAPTERS" | grep -qx "$PLATFORM" \
+      || die "unknown --platform '$PLATFORM' (the adapters this checkout ships: $(printf '%s' "$ADAPTERS" | tr '\n' ' '))" 2
+  fi
+}
+
+# resolve_one <id> — validates against the ALLOWLIST, the curator's verdicts and the
+# LICENSE GATE; prints the row. Every install path goes through here: no row, no
+# install; no verified license, no install. That is the whole allowlist rule plus the
+# hard gate, in one gate.
+resolve_one() {
+  local id="$1" row verdict lic
+  row=$(catalogue_row "$id")
+  # Captured, not piped (pipefail + grep -q early-exit trap — see cmd_list).
+  if [ -n "$row" ]; then
+    verdict=$(catalogue_field "$row" 15)
+    lic=$(catalogue_field "$row" 18)
+  else
+    die "unknown id '$id' — nothing outside catalogue.tsv is ever installed (gob extras list names the allowlist)" 2
+  fi
+  case "$verdict" in
+    RECOMMEND|MAYBE|LICENSE-PENDING) ;;
+    SKIP) die "id '$id' carries verdict SKIP — the curator declined it; it stays visible in the catalogue but refuses install" 1 ;;
+    *) die "id '$id' carries verdict '$verdict' — not an installable verdict (RECOMMEND|MAYBE|SKIP|LICENSE-PENDING)" 2 ;;
+  esac
+  # THE LICENSE GATE (hard, data-driven): a row whose catalogue says its license is
+  # not verified never installs — the verdict alone is not consulted. A curator flips
+  # a row to installable by fixing the data (license_status=verified + a check date),
+  # never by touching this file.
+  case "$lic" in
+    verified) ;;
+    pending|proprietary-confirmed-ok|"")
+      die "id '$id' refuses install: license pending verification — see catalogue.tsv license_check_date" 1 ;;
+    *)
+      die "id '$id' carries license_status '$lic' — not a known status (verified|pending|proprietary-confirmed-ok)" 2 ;;
+  esac
+  printf '%s\n' "$row"
+}
+
+# copy_tree <src> <dst> — byte-copy with the installer's ownership gate: an existing
+# file is left alone when identical (unchanged) and REFUSED when it differs (a file the
+# project wrote is never clobbered silently). Returns 0 ok, 1 on a refusal (named).
+COPY_REFUSALS=0
+copy_tree() {
+  local src="${1%/}" dst="$2" f rel sd dd
+  [ -d "$src" ] || die "payload missing: $src" 2
+  while IFS= read -r f; do
+    rel="${f#"$src"/}"
+    dd="$dst/$rel"
+    if [ "$DRYRUN" -eq 1 ]; then
+      g_info "plan: ${dd#"$TARGET"/}"
+      continue
+    fi
+    mkdir -p "$(dirname "$dd")" || die "cannot create $(dirname "$dd")" 1
+    if [ -f "$dd" ]; then
+      if [ "$(g_sha256_file "$dd")" = "$(g_sha256_file "$f")" ]; then
+        g_info "unchanged ${dd#"$TARGET"/}"
+      else
+        g_err "refusing to overwrite ${dd#"$TARGET"/}: it exists with different content and goblin-stack did not install it — remove or rename it first"
+        COPY_REFUSALS=$((COPY_REFUSALS + 1))
+      fi
+      continue
+    fi
+    cp "$f" "$dd" || die "cannot write $dd" 1
+    g_info "wrote ${dd#"$TARGET"/}"
+  done < <(find "$src" -type f | sort)
+  return 0
+}
+
+# install_skill <row> — copy the payload's skill dirs into the platform skills root
+# (per sync_platforms) or .gob/extras/ (standalone).
+install_skill() {
+  local row="$1" id name src_root dst_root d n=0
+  id=$(catalogue_field "$row" 1)
+  src_root="$PAYLOAD/$id"
+  [ -d "$src_root" ] \
+    || die "no vendored payload for '$id' at $src_root — extras install needs no network: vendor the accepted skill dirs there first (see extras-catalogue/payload/README.md)" 2
+  if [ -n "$PLATFORM" ]; then
+    dst_root="$TARGET/$(adapter_skills_root "$PLATFORM")"
+    dst_root="${dst_root%/}/"
+  else
+    dst_root="$TARGET/.gob/extras"
+  fi
+  [ -n "$(adapter_skills_root "$PLATFORM")" ] || [ -z "$PLATFORM" ] \
+    || die "adapter '$PLATFORM' carries no project skills path" 2
+  for d in "$src_root"/*/; do
+    [ -d "$d" ] || continue
+    name=$(basename "$d")
+    n=$((n + 1))
+    g_info "extras: skill $name -> ${dst_root#"$TARGET"/}$name/"
+    copy_tree "$d" "$dst_root/$name"
+  done
+  [ "$n" -gt 0 ] || die "payload for '$id' holds no skill dirs ($src_root/*/ with SKILL.md each) — see extras-catalogue/payload/README.md" 2
+  return 0
+}
+
+# install_workflow <row> — copy the payload into .gob/playbooks/<id>/.
+install_workflow() {
+  local row="$1" id src dst
+  id=$(catalogue_field "$row" 1)
+  src="$PAYLOAD/$id"
+  [ -d "$src" ] \
+    || die "no vendored payload for '$id' at $src — vendor the playbook files there first (see extras-catalogue/payload/README.md)" 2
+  dst="$TARGET/.gob/playbooks/$id"
+  g_info "extras: workflow $id -> ${dst#"$TARGET"/}/"
+  copy_tree "$src" "$dst"
+  return 0
+}
+
+# install_mcp <row> — print the mcp.json snippet; --with-mcp-config merges it into
+# the target's .mcp.json. The merge NEVER overwrites: an existing entry for the same
+# server name must match the generated bytes (no-op) or the merge refuses (ask-once).
+install_mcp() {
+  local row="$1" id hint cmd rest first_arg
+  id=$(catalogue_field "$row" 1)
+  hint=$(catalogue_field "$row" 14)
+  case "$hint" in
+    npx\ *|npm\ exec\ *)
+      read -r cmd rest <<< "$hint"
+      first_arg="$rest" ;;
+    *)
+      if [ "$WITH_MCP" -eq 1 ]; then
+        die "id '$id' carries install_hint '$hint' — only an 'npx <package>' hint can be merged into .mcp.json; follow the row's own hint by hand" 1
+      fi
+      g_info "extras: mcp $id — install per the row's own hint: $hint (no .mcp.json snippet is generated for it)"
+      return 0 ;;
+  esac
+  local snippet
+  snippet=$(python3 -c 'import json,sys; print(json.dumps({"mcpServers": {sys.argv[1]: {"command": sys.argv[2], "args": sys.argv[3].split()}}}, separators=(",",":")))' "$id" "$cmd" "$first_arg")
+  g_info "extras: mcp $id — mcp.json snippet:"
+  g_info "  $snippet"
+  [ "$WITH_MCP" -eq 1 ] || return 0
+  [ "$DRYRUN" -eq 0 ] || { g_info "plan: merge $id into ${TARGET#.}/.mcp.json"; return 0; }
+  MERGE_OUT=$(MCP_ID="$id" MCP_SNIPPET="$snippet" python3 - "$TARGET/.mcp.json" <<'PYEOF'
+import json, os, sys
+path = sys.argv[1]
+mcp_id = os.environ["MCP_ID"]
+snippet = json.loads(os.environ["MCP_SNIPPET"])
+server = snippet["mcpServers"][mcp_id]
+data = {}
+if os.path.exists(path):
+    raw = open(path).read().strip()
+    if raw:
+        try:
+            data = json.loads(raw)
+        except ValueError:
+            sys.stderr.write("extras: refusing %s: it is not valid JSON - edit it by hand\n" % path)
+            sys.exit(1)
+servers = data.setdefault("mcpServers", {})
+if mcp_id in servers:
+    if servers[mcp_id] == server:
+        print("extras: unchanged %s (already carries the %s registration)" % (path, mcp_id))
+        sys.exit(0)
+    sys.stderr.write("extras: refusing to overwrite the existing %s entry in %s - an mcp registration you customized is the project's (ask-once)\n" % (mcp_id, path))
+    sys.exit(1)
+servers[mcp_id] = server
+with open(path, "w") as fh:
+    json.dump(data, fh, separators=(",", ":"))
+    fh.write("\n")
+print("extras: merged %s into %s" % (mcp_id, path))
+PYEOF
+  )
+  local rc=$?
+  [ -n "$MERGE_OUT" ] && printf '%s\n' "$MERGE_OUT"
+  [ "$rc" -eq 0 ] || exit 1
+  return 0
+}
+
+cmd_install() {
+  parse_install "$@"
+  [ "$DRYRUN" -eq 0 ] || g_info "extras: --dry-run (nothing is written)"
+  local id row
+  for id in "${IDS[@]}"; do
+    row=$(resolve_one "$id") || exit $?
+    case "$(catalogue_field "$row" 3)" in
+      skill)    install_skill "$row" ;;
+      workflow) install_workflow "$row" ;;
+      mcp)      install_mcp "$row" ;;
+      *)        die "row '$id' carries unknown kind '$(catalogue_field "$row" 3)' (want skill|mcp|workflow)" 2 ;;
+    esac
+  done
+  [ "$COPY_REFUSALS" -eq 0 ] || die "$COPY_REFUSALS file(s) refused (named above) — nothing overwritten" 1
+  return 0
+}
+
+# ---- dispatch ------------------------------------------------------------------
+CMD="${1:-}"
+[ -n "$CMD" ] || { usage; exit 2; }
+shift
+case "$CMD" in
+  list)    cmd_list "$@" ;;
+  show)    cmd_show "$@" ;;
+  install) cmd_install "$@" ;;
+  -h|--help|help) usage; exit 0 ;;
+  *) g_err "extras: unknown subcommand: $CMD"; usage >&2; exit 2 ;;
+esac
+exit 0

package/bin/goblin-init

@@ -37,6 +37,8 @@ SRC=$(cd "$SELF_DIR/.." && pwd)
 # shellcheck source=goblin-lib.sh
 . "$SELF_DIR/goblin-lib.sh"
 VERSION=$(cat "$SRC/VERSION" 2>/dev/null || printf 'unknown')
+# The extras catalogue (overridable for tests, the same env var goblin-extras reads).
+CATALOGUE_TSV="${GOB_EXTRAS_CATALOGUE:-$SRC/extras-catalogue/catalogue.tsv}"
 
 g_info() { printf '%s\n' "$*"; }
 
@@ -61,6 +63,7 @@ done
 for dep in git awk sed grep; do
   command -v "$dep" >/dev/null 2>&1 || { g_err "missing dependency: $dep"; exit 2; }
 done
+command -v python3 >/dev/null 2>&1 || { g_err "missing dependency: python3 (the extras .mcp.json merge needs it)"; exit 2; }
 [ -f "$SRC/VERSION" ] || { g_err "no VERSION at $SRC — is this a gobstack checkout?"; exit 2; }
 TARGET="${TARGET:-$PWD}"
 TARGET=$(g_expand_tilde "$TARGET")
@@ -120,7 +123,47 @@ back one proposal file. Do this now:
    - gate_commit_cmd: ONE command that proves the repo is healthy and must stay green
      (a real test/lint command from package.json — never a placeholder)
 
-3. WRITE the proposal file exactly in the SCHEMA below, at a path you choose (for
+3. THE CATALOGUE — `catalogue_suggestions` (init SUGGESTS, it never installs):
+
+   Read the bundled catalogue (`gob extras list` shows it; the file is
+   `extras-catalogue/catalogue.tsv` in the package). From it, build the
+   `catalogue_suggestions:` list for this repo:
+
+   - rows whose `matches:` column names this repo's detected stack (the words you
+     found in step 1 — react, vue, playwright, godot, unity, node, postgres, …);
+   - RECOMMEND rows are pre-ticked (write `- id` with `[x]`); MAYBE rows are
+     listed but NOT pre-ticked (`[ ]`) — they are visible choices, never defaults;
+   - a row whose `conflicts:` names an id you also picked: pick at most one of them;
+   - SKIP rows are never suggested and refuse install; leave them out entirely.
+
+   Record the picks in the proposal's summary section under `catalogue_suggestions:`
+   (one `- [x] <id>  # <why>` line each). NOTHING installs at init: installing is a
+   separate, explicit step the human runs —
+
+       npx @techgoblin/gobstack extras install <id...>
+
+4. DISCOVER — `discover_extras` (proposals only, nothing auto-installs):
+
+   ALSO search the web with your own tools for agent skills / MCP servers / workflows
+   that match this repo's stack and are NOT in the bundled catalogue. For each
+   discovery, propose one entry in the summary under `discover_extras:` with exactly
+   these keys:
+
+       discover_extras:
+         - id: <short-kebab-id>
+           source_url: <the repo or docs URL you actually fetched>
+           license: <spdx or "unknown — verify">
+           rationale: <one line — what it adds to THIS repo>
+           suggested_kind: <skill|mcp|workflow>
+
+   Rules: verify the URL is live before proposing it; state the license you found;
+   never propose anything you did not actually read. Proposals are INERT — nothing
+   auto-installs from discovery, and no discovery reaches this repo from the CLI.
+   A human reviews the proposals, then the curator promotes accepted discoveries
+   into catalogue.tsv by PR or direct edit. Until a row exists in the
+   catalogue, `gob extras install` refuses it — the catalogue is the allowlist.
+
+5. WRITE the proposal file exactly in the SCHEMA below, at a path you choose (for
    example .gob-init-proposal.md), then run:
 
        npx @techgoblin/gobstack init --write <proposal-path>
@@ -145,6 +188,15 @@ sync_platforms: <optional array — the agent platform ids the sync reads>
 
 - <one bullet per decision: what you scanned, what you chose, why>
 - <framework / package manager / test command found>
+- catalogue_suggestions:
+    - [x] <catalogue id>  # <one line why — RECOMMEND rows pre-ticked>
+    - [ ] <catalogue id>  # <a MAYBE row: visible, never pre-ticked>
+- discover_extras:
+    - id: <kebab-id>
+      source_url: <live URL>
+      license: <spdx or "unknown — verify">
+      rationale: <one line>
+      suggested_kind: <skill|mcp|workflow>
 ============================================================================== ==
 BRIEF
 }
@@ -169,6 +221,40 @@ print_heuristic() {
   for d in app pages routes src; do
     [ -d "$TARGET/$d" ] && printf 'route/entry root candidate: %s/\n' "$d"
   done
+  # The catalogue_suggestions fallback: rows whose `matches:` cell names a token the
+  # heuristic scan actually saw in this repo (package.json deps + lockfile + config
+  # files). The SAME matches column the agent brief reads — the fallback suggests from
+  # the catalogue, never from its own private list. Verdicts are respected: only
+  # RECOMMEND rows pre-tick; MAYBE rows print unticked; SKIP rows never appear.
+  if [ -f "$CATALOGUE_TSV" ]; then
+    local scan
+    scan=$(cat "$TARGET/package.json" "$TARGET"/*.lock "$TARGET"/pnpm-lock.yaml \
+              "$TARGET"/vue.config.* "$TARGET"/nuxt.config.* "$TARGET"/godot/project.godot \
+              "$TARGET"/unity/ProjectSettings/ProjectVersion.txt 2>/dev/null | tr 'A-Z' 'a-z')
+    if [ -n "$scan" ]; then
+      local ticked="" maybe=""
+      while IFS=$'\t' read -r cid ccat ckind cname crepo cpath chmd clic cstars cpush \
+                          cmatches cconf creq chint cverdict cby cdate; do
+        [ -n "$cid" ] || continue
+        case "$cverdict" in RECOMMEND|MAYBE) ;; *) continue ;; esac
+        local hit=0 tok
+        for tok in $cmatches; do
+          case "$scan" in *"$tok"*) hit=1; break ;; esac
+        done
+        [ "$hit" -eq 1 ] || continue
+        case "$cverdict" in
+          RECOMMEND) ticked="$ticked    - [x] $cid  # matches this repo ($cmatches)"$'\n' ;;
+          MAYBE)     maybe="$maybe    - [ ] $cid  # matches, verdict MAYBE (not pre-ticked)"$'\n' ;;
+        esac
+      done < "$CATALOGUE_TSV"
+      if [ -n "$ticked$maybe" ]; then
+        printf 'catalogue_suggestions (heuristic — verify the matches before trusting):\n'
+        printf '%s' "$ticked"
+        printf '%s' "$maybe"
+        printf 'install later with: gob extras install <id...> (init itself installs nothing)\n'
+      fi
+    fi
+  fi
   if [ "$got" -eq 0 ] && [ ! -d "$TARGET/src" ]; then
     printf 'no package.json, no src/ — the scan above is empty; say so in the summary\n'
   fi
@@ -233,10 +319,17 @@ EMAIL=$(g_agents_read "$PROP" owner_email)
 [ -n "$EMAIL" ] || EMAIL=$( cd "$TARGET" && git config user.email 2>/dev/null )
 [ -n "$EMAIL" ] || EMAIL="you@example.com"
 SYNC_SEL=$(g_agents_list "$PROP" sync_platforms | tr '\n' ' ')
+# The extras the proposal's human approved (catalogue_suggestions tick lines in the
+# summary). Only TICKED ids count — an unticked MAYBE line is a visible choice the
+# human did not make. Every id is re-resolved through the catalogue's own allowlist
+# gate in goblin-extras (unknown id -> refusal; SKIP verdict -> refusal): a proposal
+# cannot install anything the catalogue does not carry.
+EXTRAS_SEL=$(sed -n '/catalogue_suggestions:/,/^[^ -]/{s/^[[:space:]]*-[[:space:]]*\[x\][[:space:]]*\([A-Za-z0-9_-]*\).*/\1/p;}' "$PROP" | sort -u | tr '\n' ' ')
 
 if [ "$DRYRUN" -eq 1 ]; then
   g_info "gob init --write --dry-run: validated OK (class $CLASS, branch $BRANCH, owner $EMAIL, 1+ gate)"
   g_info "  sync: ${SYNC_SEL:-none}"
+  g_info "  extras: ${EXTRAS_SEL:-none}"
   g_info "  would write: AGENTS.md (body + gob block), .gob/engine/, HANDOFF.md"
   exit 0
 fi
@@ -310,11 +403,27 @@ for p in $SYNC_SEL; do
     RC=$?; g_err "sync $p failed (exit $RC)"; exit "$RC"; }
 done
 
-# ------------------------------------------------------------- mcp config -----
-# The --write mode lands the same .mcp.json (ask-once, never overwrite).
+# ------------------------------------------------------------- extras ----------
+# The proposal's TICKED catalogue_suggestions install through the goblin-extras
+# allowlist itself — one code path, one set of refusals (unknown id, SKIP verdict,
+# missing payload). init --write never copies an extra by its own hand: the catalogue
+# is the allowlist, and the CLI is the only installer. A refusal fails the whole
+# --write (the human re-ticks).
+#
+# ORDER MATTERS: --with-mcp-config writes the gob registration FIRST, then the mcp-kind
+# extras merge INTO it — the other order would leave .mcp.json carrying only the extra
+# and do_mcp_config would refuse it (the generated-bytes ask-once check). Extras mcp
+# merges are themselves ask-once: an entry you customized is never overwritten.
 if [ "$WITH_MCP" -eq 1 ]; then
   do_mcp_config || exit 1
 fi
+if [ -n "$EXTRAS_SEL" ]; then
+  for xid in $EXTRAS_SEL; do
+    printf 'gob init [run] extras install %s\n' "$xid"
+    bash "$SRC/bin/goblin-extras" install "$xid" --target "$TARGET" || {
+      RC=$?; g_err "extras install $xid failed (exit $RC) — fix the proposal's catalogue_suggestions and re-run"; exit "$RC"; }
+  done
+fi
 
 # --------------------------------------------------------------------- done ----
 printf '\n'

package/bin/goblin-install

@@ -31,7 +31,7 @@
 
 set -uo pipefail
 
-GOBLIN_INSTALL_VERSION="0.6.0-alpha.1"
+GOBLIN_INSTALL_VERSION="0.6.0-alpha.3"
 SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 SRC=$(cd "$SELF_DIR/.." && pwd)
 # shellcheck source=goblin-lib.sh

package/bin/goblin-lib.sh

@@ -16,7 +16,7 @@
 #     - name: typecheck        four-space-indented second member of a list entry
 #       cmd: npx tsc --noEmit
 
-GOBLIN_LIB_VERSION="0.6.0-alpha.1"
+GOBLIN_LIB_VERSION="0.6.0-alpha.3"
 
 # ---------------------------------------------------------------- output -----
 # g_trunc <width> <text> — fold a long detail to one line at <width> columns, keeping the

package/bin/goblin-upgrade

@@ -30,7 +30,7 @@
 # `git revert` of this command's own two commits (W3-SPEC §5).
 set -uo pipefail
 
-GOBLIN_UPGRADE_VERSION="0.6.0-alpha.1"
+GOBLIN_UPGRADE_VERSION="0.6.0-alpha.3"
 
 usage() { sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
 

package/bin/goblin-verify

@@ -19,7 +19,7 @@
 
 set -uo pipefail
 
-GOBLIN_VERIFY_VERSION="0.6.0-alpha.1"
+GOBLIN_VERIFY_VERSION="0.6.0-alpha.3"
 SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 # shellcheck source=goblin-lib.sh
 . "$SELF_DIR/goblin-lib.sh"

package/bin/goblin.js

@@ -10,6 +10,7 @@
 //   gob map    [...]                      -> bin/goblin-map (prompt+schema; --heuristic fallback)
 //   gob verify [...]                      -> bin/goblin-verify
 //   gob bans   [...]                      -> bin/goblin-bans
+//   gob extras [...]                      -> bin/goblin-extras (curated catalogue)
 //   gob mcp                               -> bin/goblin-mcp.js (the MCP stdio server)
 //   gob uninstall [--target <dir>]        -> bin/goblin-install --uninstall
 //   no args | -h/--help | any other first arg -> this file's short usage, exit 2.
@@ -37,7 +38,7 @@ if (arg0 === "--version" || arg0 === "-V" || arg0 === "-v") {
   process.exit(0);
 }
 
-const SCRIPT = { init: "goblin-init", map: "goblin-map", verify: "goblin-verify", bans: "goblin-bans", mcp: "goblin-mcp.js" };
+const SCRIPT = { init: "goblin-init", map: "goblin-map", verify: "goblin-verify", bans: "goblin-bans", extras: "goblin-extras", mcp: "goblin-mcp.js" };
 const [cmd, ...rest] = process.argv.slice(2);
 
 // No args, a help flag, or an unrecognized first arg: short usage, exit 2. A bare
@@ -51,6 +52,7 @@ function usage() {
 "  gob init      start here — prints the agent brief + proposal schema; --write installs it",
 "  gob verify    run the rule matrix against the current repo",
 "  gob bans      run the ban list (per-pattern red lines over the source tree)",
+"  gob extras    browse + install the curated extras catalogue (list | show | install)",
 "  gob map       print the feature-map prompt + schema; --heuristic scans instead",
 "  gob mcp       serve the harness to your agent over MCP stdio (verify/map/init tools)",
 "  gob uninstall --target .          remove exactly what an install wrote (preimages)",

package/docs/GUIDE.md

@@ -3,7 +3,7 @@
 A step-by-step guide for your first week. **Read this before the README.** The README tells you
 what the pieces are; this tells you what to *do*, in order, and what you should see when it works.
 
-Version: `0.6.0-alpha.1` · Last measured: 2026-10-09 · Every command and every output below was run on a
+Version: `0.6.0-alpha.2` · Last measured: 2026-10-09 · Every command and every output below was run on a
 real repository while writing this guide.
 
 ---
@@ -524,6 +524,7 @@ same commands are available outside any repo through the npm CLI: `gob init` / `
              [--with-mcp-config]
     gob map [--heuristic [target]] [--write <dir>] [--force]
     gob mcp                                  # the MCP stdio server (three tools, local only)
+    gob extras list | show <id> | install <id...>   # the curated extras catalogue
 
     .gob/bin/goblin-verify [--only <id[,id...]>] [--json] [--list]
     .gob/bin/goblin-bans           # run the ban list
@@ -570,6 +571,36 @@ Named procedures, installed as project-local skills. Each has a measurable verif
 | P14 | `goblin-drift-audit` | a recorded claim disagrees with the artifact |
 | P15 | `goblin-re-mobile` | one shipped Android build must be understood as facts for study |
 
+### The extras catalogue (suggestions, not installs)
+
+`gob extras` browses and installs the curated extras catalogue — third-party agent skills,
+MCP servers and workflows the curator reviewed and carried in `extras-catalogue/catalogue.tsv`.
+The one rule to hold onto: **init suggests, the catalogue allows, you install.**
+
+    gob extras list                  # the whole catalogue, grouped by category
+    gob extras list testing          # one category: frontend | testing | game | node
+    gob extras show playwright-mcp   # one row, every field
+    gob extras install playwright-mcp --target .        # mcp: prints the mcp.json snippet
+    gob extras install taste-skill --target . --platform claude   # skill: .claude/skills/taste/
+    gob extras install taste-skill --target .                   # no platform: .gob/extras/taste/
+
+Verdicts: a `RECOMMEND` row is pre-ticked when `gob init` suggests; a `MAYBE` row is listed
+but never pre-ticked; a `SKIP` row refuses install (visible history, declined candidate).
+The license gate rides on top, hard: a row installs only when its `license_status` is
+`verified` — a `LICENSE-PENDING` row (license unresolved) is never pre-ticked and
+`gob extras install` refuses it with `license pending verification` until the curator flips
+the row's data in `catalogue.tsv`.
+Nothing installs at init — `gob init --write` honours only the rows your proposal ticks, and
+it installs them by calling `gob extras install`, so the allowlist is one code path. An id
+that is not in the catalogue is refused; installs copy from the vendored payload in the
+package (no network), and an mcp row merges into `.mcp.json` only with `--with-mcp-config`,
+never overwriting an entry you customized.
+
+The brief also asks your agent to propose discoveries (`discover_extras:`): web-found skills
+that match the stack but are not in the catalogue, each with a live URL, a license and a
+rationale. Proposals are inert; the curator promotes accepted ones into `catalogue.tsv` by PR
+or edit, and only then can `gob extras install` name them.
+
 ### Where the real documentation lives
 
 | File | Read it for |

package/extras-catalogue/catalogue.tsv

@@ -0,0 +1,42 @@
+id	category	kind	name	source_repo	path_within_repo	has_skill_md	license	stars	last_push	matches	conflicts	requires	install_hint	verdict	reviewed_by	reviewed_date	license_status	license_check_date
+taste-skill	frontend	skill	taste-skill	Leonxlnx/taste-skill	.	yes	MIT	93730	2026-10-07	react nextjs vue nuxt frontend ui design	-	none	copy-folder	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+vercel-agent-skills	frontend	skill	vercel-labs agent skills (react pack)	vercel-labs/agent-skills	skills/	skill	none (verify per-skill)	32078	2026-08-28	react nextjs frontend ui design	-	none	copy-folder	LICENSE-PENDING	harvey	2026-10-08	pending	2026-10-09
+anthropic-frontend-design	frontend	skill	frontend-design (anthropics/skills)	anthropics/skills	frontend-design	yes	none (verify per-skill)	180150	2026-10-05	frontend ui react vue design	-	none	copy-folder	LICENSE-PENDING	harvey	2026-10-08	pending	2026-10-09
+vuejs-skills	frontend	skill	vuejs-ai skills (vue 3 pack)	vuejs-ai/skills	skills/	skill	MIT	2889	2026-05-30	vue nuxt frontend	-	none	copy-folder	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+ux-ui-agent-skills	frontend	skill	ux-ui agent skills (design tokens, WCAG)	plugin87/ux-ui-agent-skills	skills/	skill	MIT	1551	2026-10-08	frontend ui design accessibility	-	none	copy-folder	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+impeccable	frontend	skill	impeccable (design language)	pbakaus/impeccable	.dotagent-dir/	skill	Apache-2.0	78552	2026-10-07	frontend ui design	-	none	copy-folder	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+playwright-mcp	testing	mcp	Playwright MCP (Microsoft, official)	microsoft/playwright-mcp	-	no	Apache-2.0	37929	2026-10-08	playwright e2e testing browser automation	-	node >= 18	npx @playwright/mcp@latest	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+chrome-devtools-mcp	testing	mcp	Chrome DevTools MCP (official)	ChromeDevTools/chrome-devtools-mcp	-	no	Apache-2.0	53117	2026-10-08	browser debugging cdp e2e performance	-	node >= 18	npx chrome-devtools-mcp@latest	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+playwright-skill	testing	skill	playwright-skill (no MCP registration)	lackeyjb/playwright-skill	.	yes	MIT	3180	2026-10-01	playwright e2e testing	-	playwright installed	copy-folder	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+webapp-testing	testing	skill	webapp-testing (anthropics/skills)	anthropics/skills	webapp-testing	yes	none (verify per-skill)	180150	2026-10-05	e2e testing browser playwright	-	playwright installed	copy-folder	LICENSE-PENDING	harvey	2026-10-08	pending	2026-10-09
+godot-ai	game	mcp	Godot AI (hi-godot)	hi-godot/godot-ai	-	no	MIT	2862	2026-10-08	godot game	-	see repo README	see repo README	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+godot-mcp	game	mcp	Godot MCP (community default)	Coding-Solo/godot-mcp	-	no	MIT	5976	2026-04-16	godot game	godot-ai	see repo README	see repo README	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+godotprompter	game	skill	GodotPrompter (66 godot skills)	jame581/GodotPrompter	skills/	skill	MIT	798	2026-10-06	godot game	-	none	copy-folder	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+unity-mcp	game	mcp	Unity MCP (CoplayDev)	CoplayDev/unity-mcp	-	no	MIT	14767	2026-10-07	unity game	-	unity editor + see repo README	see repo README	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+awesome-gamedev-skills	game	skill	awesome gamedev agent skills (74 skills, harvest source)	gamedev-skills/awesome-gamedev-agent-skills	skills/	skill	Apache-2.0	1365	2026-09-27	game godot unity unreal phaser threejs bevy pygame	-	none	copy-folder	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+supabase-agent-skills	node	skill	Supabase agent skills (official)	supabase/agent-skills	skills/	skill	MIT	2708	2026-10-02	node backend supabase database auth	-	none	copy-folder	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+pg-aiguide	node	mcp	pg-aiguide (Timescale, postgres)	timescale/pg-aiguide	-	no	Apache-2.0	1860	2026-10-07	node postgres database backend	-	see repo README	see repo README	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+hono-skills	node	skill	Hono agent skills (official)	honojs/skills	skills/	skill	MIT	13	2026-10-08	node hono backend api	-	none	copy-folder	RECOMMEND	harvey	2026-10-08	verified	2026-10-09
+superdesign-skill	frontend	skill	superdesign-skill (design iteration loop)	superdesigndev/superdesign-skill	.	yes	MIT	633	2026-08-21	frontend ui design	taste-skill vercel-agent-skills	none	copy-folder	MAYBE	harvey	2026-10-08	verified	2026-10-09
+garden-skills	frontend	skill	garden-skills (collection, harvest source)	ConardLi/garden-skills	skills/	skill	MIT	12771	2026-07-12	frontend ui design	-	none	copy-folder	MAYBE	harvey	2026-10-08	verified	2026-10-09
+dev-browser	testing	skill	dev-browser (general web browser skill)	SawyerHood/dev-browser	.	yes	MIT	6656	2026-09-05	browser e2e testing	playwright-mcp	none	copy-folder	MAYBE	harvey	2026-10-08	verified	2026-10-09
+currents-playwright-best-practices	testing	skill	playwright best practices (Currents.dev)	currents-dev/playwright-best-practices-skill	.	yes	MIT	393	2026-07-21	playwright e2e testing	testdino-playwright-skill	none	copy-folder	MAYBE	harvey	2026-10-08	verified	2026-10-09
+testdino-playwright-skill	testing	skill	playwright best practices (TestDino)	testdino-hq/playwright-skill	.	yes	MIT	389	2026-09-06	playwright e2e testing	currents-playwright-best-practices	none	copy-folder	MAYBE	harvey	2026-10-08	verified	2026-10-09
+unity-mcp-alt	game	mcp	Unity-MCP (IvanMurzak, skills + CLI)	IvanMurzak/Unity-MCP	-	no	Apache-2.0	4400	2026-10-04	unity game	unity-mcp	unity editor + see repo README	see repo README	MAYBE	harvey	2026-10-08	verified	2026-10-09
+cc-game-studios	game	workflow	Game-Studios mega-pack (49 agents, 72 skills)	Donchitos/Cc-S-B	.	skill	MIT	25900	2026-10-08	game godot unity	-	none	copy-folder	MAYBE	harvey	2026-10-08	verified	2026-10-09
+godot-ui-integration	game	skill	godot-ui-integration (design to godot UI)	zimo-xiao-zheng/godot-ui-integration	.	yes	MIT	275	2026-08-23	godot game ui	-	none	copy-folder	MAYBE	harvey	2026-10-08	verified	2026-10-09
+agent-nestjs-skills	node	skill	NestJS agent skills	Kadajett/agent-nestjs-skills	skills/	skill	none (verify)	289	2026-07-23	node nestjs backend api	-	none	copy-folder	LICENSE-PENDING	harvey	2026-10-08	pending	2026-10-09
+openapi-to-skills	node	skill	openapi-to-skills (spec to skills generator)	neutree-ai/openapi-to-skills	.	skill	Apache-2.0	342	2026-06-23	node api openapi	-	none	copy-folder	MAYBE	harvey	2026-10-08	verified	2026-10-09
+do-app-platform-skills	node	skill	DigitalOcean App Platform skills	digitalocean-labs/do-app-platform-skills	skills/	skill	MIT	37	2026-10-04	node deployment database	-	none	copy-folder	MAYBE	harvey	2026-10-08	verified	2026-10-09
+agent-skills-standard	node	skill	agent-skills-standard (per-framework best practice)	HoangNguyen0403/agent-skills-standard	skills/	skill	MIT	572	2026-10-08	node backend typescript	-	none	copy-folder	MAYBE	harvey	2026-10-08	verified	2026-10-09
+frontend-design-toolkit	frontend	workflow	Frontend-Design-Toolkit (list, harvest source)	wilwaldon/cc-frontend-design-toolkit	.	skill	none	1176	2026-04-11	frontend ui design	-	none	copy-folder	SKIP	harvey	2026-10-08	pending	2026-10-09
+nuxt-skills	frontend	skill	nuxt-skills (vue/nuxt/nuxthub)	onmax/nuxt-skills	skills/	skill	none	719	2026-10-06	vue nuxt frontend	-	none	copy-folder	SKIP	harvey	2026-10-08	pending	2026-10-09
+design-audit	frontend	skill	design-audit (UI/UX checklist)	wonjyou/design-audit	.	yes	none	8	2026-03-28	frontend ui design	-	none	copy-folder	SKIP	harvey	2026-10-08	pending	2026-10-09
+vibe-coded-website-review	frontend	skill	vibe-coded-website-review (YC design review)	zuocharles/vibe-coded-website-review	.	yes	none	0	2026-03-29	frontend ui design	-	none	copy-folder	SKIP	harvey	2026-10-08	pending	2026-10-09
+qa-skills	testing	workflow	qa-skills (e2e generation pipeline)	neonwatty/qa-skills	.	skill	MIT	33	2026-05-03	e2e testing	-	none	copy-folder	SKIP	harvey	2026-10-08	verified	2026-10-09
+agentmantis-test-skills	testing	skill	test-skills (playwright e2e pack)	agentmantis/test-skills	skills/	skill	MIT	12	2026-04-08	playwright e2e testing	-	none	copy-folder	SKIP	harvey	2026-10-08	verified	2026-10-09
+invisible-playwright-mcp	testing	mcp	invisible_playwright_mcp (anti-detect)	feder-cr/invisible_playwright_mcp	-	no	none	2660	2026-10-08	browser e2e playwright	-	see repo README	see repo README	SKIP	harvey	2026-10-08	pending	2026-10-09
+mcp-unity	game	mcp	mcp-unity (CoderGamester, superseded)	CoderGamester/mcp-unity	-	no	MIT	1922	2026-09-03	unity game	unity-mcp	unity editor + see repo README	see repo README	SKIP	harvey	2026-10-08	verified	2026-10-09
+godot-mcp-native	game	mcp	Godot-MCP-Native (duplicate function)	yurineko73/Godot-MCP-Native	-	no	MIT	836	2026-08-03	godot game	godot-mcp	see repo README	see repo README	SKIP	harvey	2026-10-08	verified	2026-10-09
+fastify-skills	node	skill	fastify-skills (undocumented)	TheCodePace/fastify-skills	skills/	skill	none	12	2026-10-08	node fastify backend	-	none	copy-folder	SKIP	harvey	2026-10-08	pending	2026-10-09
+drizzle-orm-skill	node	skill	drizzle-orm-skill (no credible alternative exists)	oldirty/drizzle-orm-skill	.	yes	none	0	2026-02-24	node drizzle orm database	-	none	copy-folder	SKIP	harvey	2026-10-08	pending	2026-10-09

package/extras-catalogue/payload/README.md

@@ -0,0 +1,14 @@
+# extras-catalogue/payload/ — the vendored extras payload
+
+`gob extras install` needs **no network**: every skill or workflow it writes is copied
+from this directory. One directory per catalogue id:
+
+    payload/<id>/<skill-name>/SKILL.md      # a skill row: one directory per skill
+    payload/<id>/…                          # a workflow row: the playbook files verbatim
+
+`mcp` rows carry no payload — their install is the generated mcp.json snippet.
+
+Until a row's payload is vendored, installing it is REFUSED with exit 2 and a named fix
+(never a download): vendor the accepted upstream copy here first, respecting the row's
+license cell. The placeholder payloads shipped today mark the layout only — the curator
+replaces them with the reviewed upstream bytes.

package/extras-catalogue/payload/taste-skill/taste/REFERENCE.md

@@ -0,0 +1,3 @@
+# taste — reference
+
+Placeholder reference page for the vendored payload layout.

package/extras-catalogue/payload/taste-skill/taste/SKILL.md

@@ -0,0 +1,9 @@
+---
+name: taste
+description: Design-taste guardrails so agent UI output is not generic. Vendored from the catalogue row 'taste-skill'; replace with the curated upstream copy.
+---
+# taste
+
+Vendored placeholder payload — the curator replaces this directory with the accepted
+upstream skill (catalogue row `taste-skill`, MIT). Layout contract: one directory per
+skill, each with a SKILL.md.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techgoblin/gobstack",
-  "version": "0.6.0-alpha.1",
+  "version": "0.6.0-alpha.3",
   "description": "Agent-discipline toolkit: one verify command, an enforcement matrix, and LIMITS. bash engine, npm shim.",
   "bin": {
     "goblin": "bin/goblin.js",
@@ -23,6 +23,8 @@
     "automations/",
     "bans/",
     "docs/",
+    "extras-catalogue/catalogue.tsv",
+    "extras-catalogue/payload/",
     "roles.yaml",
     "VERSION",
     "CHANGELOG.md"