ceo-orchestration 1.0.0

package/scripts/local/trading-readonly-escape-hatch.sh

@@ -0,0 +1,244 @@
+#!/usr/bin/env bash
+# trading-readonly-escape-hatch.sh — PLAN-083 §7.5 Owner-signed kill-switch
+# disable ceremony.
+#
+# Use ONLY when the framework's trading-readonly kill-switch has FAIL-CLOSED
+# (missing `.claude/repo-profile.yaml`) and the Owner needs to re-enable
+# trading actions in this repo.
+#
+# Contract:
+#   - Requires an Owner-authored `escape-hatch-justification.md` at the
+#     ceremony staging path (--justification-file FLAG or default).
+#   - Requires GPG signing key configured (`user.signingkey` set in git).
+#   - Produces a detached `.asc` signature of the justification file +
+#     emits an audit row via the framework's `_lib.audit_emit.emit_generic`
+#     with action `trading_kill_switch_disabled`.
+#   - Idempotent: if the justification SHA-256 matches an existing
+#     `.asc` signature next to it, the script re-emits the audit row
+#     (forensic re-attestation) but does NOT re-sign.
+#
+# Exit codes:
+#   0 — success (audit emitted; existing or new signature present)
+#   1 — missing justification file
+#   2 — justification file too short / malformed
+#   3 — GPG signing failed
+#   4 — audit emit error (audit row not written; rare; framework path)
+#   5 — usage error
+
+set -Eeuo pipefail
+IFS=$'\n\t'
+
+PROG="$(basename "$0")"
+
+usage() {
+  cat <<EOF
+$PROG — Owner-signed trading kill-switch escape hatch (PLAN-083 §7.5)
+
+Usage:
+  $PROG [--justification-file PATH] [--profile-path PATH]
+        [--audit-emit BOOL] [--repo-root PATH]
+
+Defaults:
+  --justification-file  \$REPO_ROOT/.claude/escape-hatch-justification.md
+  --profile-path        \$REPO_ROOT/.claude/repo-profile.yaml
+  --audit-emit          true
+  --repo-root           \$CLAUDE_PROJECT_DIR or \$(git rev-parse --show-toplevel)
+
+Required content in justification-file:
+  - Header line beginning with "# Trading kill-switch escape hatch"
+  - Justification paragraph >= 80 chars total (signed body)
+  - Owner GPG key configured (\`git config user.signingkey\` set)
+
+Exit codes:
+  0 success | 1 missing | 2 malformed | 3 gpg-fail | 4 audit-fail | 5 usage
+EOF
+}
+
+# ---------------------------------------------------------------------------
+# Argument parsing
+# ---------------------------------------------------------------------------
+
+JUSTIFICATION_FILE=""
+PROFILE_PATH=""
+AUDIT_EMIT="true"
+REPO_ROOT=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --justification-file) JUSTIFICATION_FILE="$2"; shift 2;;
+    --profile-path)       PROFILE_PATH="$2"; shift 2;;
+    --audit-emit)         AUDIT_EMIT="$2"; shift 2;;
+    --repo-root)          REPO_ROOT="$2"; shift 2;;
+    -h|--help)            usage; exit 0;;
+    *) echo "$PROG: error: unknown flag $1" >&2; usage; exit 5;;
+  esac
+done
+
+# ---------------------------------------------------------------------------
+# Resolve defaults
+# ---------------------------------------------------------------------------
+
+if [[ -z "$REPO_ROOT" ]]; then
+  if [[ -n "${CLAUDE_PROJECT_DIR:-}" ]]; then
+    REPO_ROOT="$CLAUDE_PROJECT_DIR"
+  else
+    REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo ".")"
+  fi
+fi
+
+if [[ -z "$JUSTIFICATION_FILE" ]]; then
+  JUSTIFICATION_FILE="${REPO_ROOT}/.claude/escape-hatch-justification.md"
+fi
+if [[ -z "$PROFILE_PATH" ]]; then
+  PROFILE_PATH="${REPO_ROOT}/.claude/repo-profile.yaml"
+fi
+
+# ---------------------------------------------------------------------------
+# Validate justification file
+# ---------------------------------------------------------------------------
+
+if [[ ! -f "$JUSTIFICATION_FILE" ]]; then
+  echo "$PROG: error: justification file missing: $JUSTIFICATION_FILE" >&2
+  cat >&2 <<EOF
+Author one with the required header + >=80-char body, then re-run.
+Example template:
+
+  # Trading kill-switch escape hatch
+
+  Justification: <Owner-authored paragraph explaining why the
+  fail-CLOSED state should be reverted; reference relevant
+  ticket/incident; minimum 80 chars total>.
+EOF
+  exit 1
+fi
+
+JUST_BODY="$(cat "$JUSTIFICATION_FILE")"
+JUST_LEN="${#JUST_BODY}"
+
+if (( JUST_LEN < 80 )); then
+  echo "$PROG: error: justification too short (got $JUST_LEN chars, need >=80)" >&2
+  exit 2
+fi
+
+if ! grep -q '^# Trading kill-switch escape hatch' "$JUSTIFICATION_FILE"; then
+  echo "$PROG: error: justification file missing required header" >&2
+  echo "   expected line: '# Trading kill-switch escape hatch'" >&2
+  exit 2
+fi
+
+# Compute SHA-256 of the justification body (forensic + idempotency key).
+if command -v shasum >/dev/null 2>&1; then
+  JUST_SHA="$(shasum -a 256 "$JUSTIFICATION_FILE" | awk '{print $1}')"
+elif command -v sha256sum >/dev/null 2>&1; then
+  JUST_SHA="$(sha256sum "$JUSTIFICATION_FILE" | awk '{print $1}')"
+else
+  echo "$PROG: error: neither shasum nor sha256sum available" >&2
+  exit 2
+fi
+
+JUST_SHA_PREFIX="${JUST_SHA:0:16}"
+
+# ---------------------------------------------------------------------------
+# GPG signing (idempotent)
+# ---------------------------------------------------------------------------
+
+ASC_PATH="${JUSTIFICATION_FILE}.asc"
+
+if [[ -f "$ASC_PATH" ]]; then
+  # Verify the existing signature matches the current justification.
+  if gpg --verify "$ASC_PATH" "$JUSTIFICATION_FILE" >/dev/null 2>&1; then
+    echo "$PROG: existing signature verified; re-emitting audit row only"
+    SIGNED_NEW="false"
+  else
+    echo "$PROG: existing $ASC_PATH does not verify; re-signing"
+    rm -f "$ASC_PATH"
+    SIGNED_NEW="true"
+  fi
+else
+  SIGNED_NEW="true"
+fi
+
+if [[ "$SIGNED_NEW" == "true" ]]; then
+  SIGNING_KEY="$(git config --get user.signingkey 2>/dev/null || echo "")"
+  if [[ -z "$SIGNING_KEY" ]]; then
+    echo "$PROG: error: git user.signingkey not configured" >&2
+    echo "   run: git config --global user.signingkey <KEYID>" >&2
+    exit 3
+  fi
+  if ! gpg --local-user "$SIGNING_KEY" \
+        --output "$ASC_PATH" \
+        --detach-sign --armor "$JUSTIFICATION_FILE" 2>/dev/null; then
+    echo "$PROG: error: gpg detached-sign failed" >&2
+    exit 3
+  fi
+  echo "$PROG: signed $ASC_PATH with key $SIGNING_KEY"
+fi
+
+# Get signer fingerprint (best-effort).
+SIGNER_FPR=""
+if command -v gpg >/dev/null 2>&1; then
+  SIGNER_FPR="$(gpg --verify "$ASC_PATH" "$JUSTIFICATION_FILE" 2>&1 \
+    | grep -oE '[0-9A-F]{40}' | head -1 || echo "")"
+fi
+SIGNER_FPR_PREFIX="${SIGNER_FPR:0:16}"
+
+# ---------------------------------------------------------------------------
+# Audit emit (best-effort; framework path)
+# ---------------------------------------------------------------------------
+
+AUDIT_OK="skip"
+if [[ "$AUDIT_EMIT" == "true" ]]; then
+  PYTHON_BIN="${PYTHON:-python3}"
+  if ! command -v "$PYTHON_BIN" >/dev/null 2>&1; then
+    PYTHON_BIN="python"
+  fi
+  AUDIT_PY="${REPO_ROOT}/.claude/hooks/_lib/audit_emit.py"
+  if [[ -f "$AUDIT_PY" ]] && command -v "$PYTHON_BIN" >/dev/null 2>&1; then
+    if env REPO_ROOT="$REPO_ROOT" PYTHONPATH="${REPO_ROOT}/.claude/hooks" "$PYTHON_BIN" - <<PY 2>/dev/null
+import os, sys
+sys.path.insert(0, os.path.join(os.environ.get("REPO_ROOT", "."), ".claude/hooks"))
+try:
+    from _lib import audit_emit
+    audit_emit.emit_generic(
+        "trading_kill_switch_disabled",
+        justification_sha256_prefix="${JUST_SHA_PREFIX}",
+        signer_fingerprint_prefix="${SIGNER_FPR_PREFIX}",
+        signed_new=("${SIGNED_NEW}" == "true"),
+        justification_length=int("${JUST_LEN}"),
+    )
+except Exception as exc:
+    print(f"audit_emit failed: {exc}", file=sys.stderr)
+    sys.exit(1)
+PY
+    then
+      AUDIT_OK="ok"
+    else
+      AUDIT_OK="failed"
+      echo "$PROG: warning: audit emit failed (forensic gap)" >&2
+    fi
+  else
+    AUDIT_OK="unavailable"
+    echo "$PROG: warning: audit_emit module unavailable; audit row skipped" >&2
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Report + exit
+# ---------------------------------------------------------------------------
+
+cat <<EOF
+$PROG: escape-hatch ceremony complete
+  justification : $JUSTIFICATION_FILE
+  signature     : $ASC_PATH (newly signed: $SIGNED_NEW)
+  just-sha256   : $JUST_SHA_PREFIX...
+  signer-fpr    : ${SIGNER_FPR_PREFIX:-unknown}...
+  audit-emit    : $AUDIT_OK
+  profile-path  : $PROFILE_PATH
+EOF
+
+# If audit emit was requested but failed, surface as exit 4 (forensic gap).
+if [[ "$AUDIT_EMIT" == "true" && "$AUDIT_OK" == "failed" ]]; then
+  exit 4
+fi
+
+exit 0

package/scripts/measure-repo-size.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# measure-repo-size.sh — print ceo-orchestration adopter scale tier.
+# PLAN-062 Phase 5 — see docs/ADOPTER-SCALE-TIERS.md.
+#
+# Stdlib only. Works on macOS + Linux. No Python, no npm, nothing.
+#
+# Usage:
+#   bash scripts/measure-repo-size.sh           # measure current repo
+#   bash scripts/measure-repo-size.sh /path     # measure given repo
+#
+# Exit codes:
+#   0 — measured successfully (Tier 0/1/2 printed)
+#   1 — repo path doesn't exist or is not a directory
+
+REPO_DIR="${1:-$(pwd)}"
+
+if [ ! -d "$REPO_DIR" ]; then
+    echo "error: $REPO_DIR is not a directory" >&2
+    exit 1
+fi
+
+# Counted file extensions — common code + docs + config
+EXT_RE='\.(py|ts|tsx|js|jsx|go|rs|java|kt|swift|rb|php|cs|cpp|c|h|hpp|md|yaml|yml|toml)$'
+
+# Excluded directory components (anywhere in path)
+EXCLUDE_RE='/(\.git|node_modules|vendor|\.venv|venv|dist|build|__pycache__|\.pytest_cache|target|out)/'
+
+# Use git ls-files if we're in a git repo (respects .gitignore, faster)
+# Fall back to find otherwise.
+LOC=0
+if git -C "$REPO_DIR" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    # git ls-files path
+    FILES=$(git -C "$REPO_DIR" ls-files 2>/dev/null \
+            | grep -E "$EXT_RE" 2>/dev/null \
+            | grep -vE "$EXCLUDE_RE" 2>/dev/null \
+            || true)
+    if [ -n "$FILES" ]; then
+        # Count lines via xargs with absolute paths
+        LOC=$(echo "$FILES" \
+              | sed "s|^|$REPO_DIR/|" \
+              | xargs wc -l 2>/dev/null \
+              | awk '/total/ {sum += $1} {last = $1} END {print (sum > 0 ? sum : last+0)}')
+    fi
+else
+    # find fallback
+    FILES=$(find "$REPO_DIR" -type f 2>/dev/null \
+            | grep -E "$EXT_RE" 2>/dev/null \
+            | grep -vE "$EXCLUDE_RE" 2>/dev/null \
+            || true)
+    if [ -n "$FILES" ]; then
+        LOC=$(echo "$FILES" \
+              | xargs wc -l 2>/dev/null \
+              | awk '/total/ {sum += $1} {last = $1} END {print (sum > 0 ? sum : last+0)}')
+    fi
+fi
+
+LOC=${LOC:-0}
+
+# Estimate tokens (1 LoC ≈ 8-12 tokens for typical code mix; use 10 as midpoint)
+TOKENS_EST=$((LOC * 10))
+
+# Tier classification
+if [ "$LOC" -lt 50000 ]; then
+    TIER="0 (Vibecoder solo)"
+    RECMD="Core only. Skip sidecar. Skip HyDE."
+elif [ "$LOC" -lt 1000000 ]; then
+    TIER="1 (Lightweight Enterprise)"
+    RECMD="Install LightRAG sidecar. HyDE optional (yes if multi-skill team)."
+else
+    TIER="2 (Heavy Enterprise)"
+    RECMD="Sidecar mandatory. HyDE recommended. Build org extensions."
+fi
+
+# Format LoC with thousand separators (POSIX-portable; fall back to plain).
+# Note: printf "%'d" depends on LC_ALL / LC_NUMERIC. Under LC_ALL=POSIX or
+# LC_ALL=C the separators silently drop (output is unformatted but valid).
+# This is acceptable degradation; ADOPTER-SCALE-TIERS.md docs the formatted
+# variant. To force separators on macOS: export LC_ALL=en_US.UTF-8
+LOC_FMT=$(printf "%'d\n" "$LOC" 2>/dev/null || echo "$LOC")
+TOKENS_FMT=$(printf "%'d\n" "$TOKENS_EST" 2>/dev/null || echo "$TOKENS_EST")
+
+cat <<EOF
+=== ceo-orchestration scale tier check ===
+Repo: $REPO_DIR
+
+Counted: .py .ts .tsx .js .jsx .go .rs .java .kt .swift
+         .rb .php .cs .cpp .c .h .hpp .md .yaml .yml .toml
+Excluded: .git/ node_modules/ vendor/ .venv/ venv/ dist/ build/
+          __pycache__/ .pytest_cache/ target/ out/
+
+LoC (best effort, includes blanks/comments): $LOC_FMT
+Estimated tokens (~10 tok/LoC):              ~$TOKENS_FMT
+
+→ Tier: $TIER
+→ Recommendation: $RECMD
+
+See docs/ADOPTER-SCALE-TIERS.md for the full per-tier checklist.
+EOF

package/scripts/npm-rebuild.sh

@@ -0,0 +1,172 @@
+#!/usr/bin/env bash
+# =========================================================================
+# scripts/npm-rebuild.sh — regenerate the npm/ bundle from canonical sources.
+#
+# Closes Session 75 Codex Finding 3 + Owner D1 lock (2026-04-29):
+# the `npm/` directory is GENERATED, not hand-edited. Source-of-truth is
+# the canonical `.claude/`, `templates/`, `SPEC/v1/`, `VERSION` at the
+# repo root. CI gate `verify-npm-bundle-sync` enforces this.
+#
+# What it does:
+#   1. Validate working tree clean enough to compare hashes.
+#   2. Rsync .claude/hooks/ + .claude/scripts/ into npm/.claude/.
+#   3. Rsync templates/ into npm/templates/.
+#   4. Rsync SPEC/v1/ into npm/SPEC/v1/.
+#   5. Copy VERSION → npm/VERSION (so the two files are bit-identical).
+#   6. Rewrite npm/package.json `version` field to match VERSION via jq
+#      (or a Python fallback if jq is missing).
+#   7. Smoke-pack via `npm pack --dry-run` if `npm` is available.
+#
+# Usage:
+#   bash scripts/npm-rebuild.sh
+#
+# Exit codes:
+#   0 — bundle in sync
+#   1 — rsync / copy failure
+#   2 — version-bump failure
+#   3 — npm-pack smoke failure
+# =========================================================================
+
+set -u
+set -o pipefail
+
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO"
+
+GRN=$'\033[0;32m'; RED=$'\033[0;31m'; YLW=$'\033[0;33m'; BLU=$'\033[0;34m'; RST=$'\033[0m'
+info() { echo "${BLU}[*]${RST} $*"; }
+ok()   { echo "${GRN}[OK]${RST} $*"; }
+warn() { echo "${YLW}[!]${RST} $*"; }
+fail() { echo "${RED}[X]${RST} $*" >&2; }
+
+if [ ! -f VERSION ]; then
+  fail "VERSION file missing — run from repo root"
+  exit 1
+fi
+if [ ! -d npm ]; then
+  fail "npm/ directory missing — run from repo root"
+  exit 1
+fi
+
+VERSION="$(tr -d '[:space:]' < VERSION)"
+info "Rebuilding npm/ bundle for VERSION=$VERSION"
+
+# ---------------------------------------------------------------------
+# Rsync canonical .claude/{hooks,scripts} → npm/.claude/
+# Exclude pytest cache, .coverage, *.bak, *.pyc, __pycache__.
+#
+# PLAN-119-FOLLOWUP WS-1: `--delete-excluded` removes excluded items that are
+# ALREADY in the destination from a prior run. Plain `--delete-after` only
+# deletes dest items absent from source AND not excluded — so stale
+# `__pycache__/`/`*.pyc` that entered the bundle before these excludes existed
+# would otherwise persist forever (perf debate R-PERF4).
+# ---------------------------------------------------------------------
+RSYNC_FLAGS=(-a --delete-after --delete-excluded
+  --exclude='__pycache__/' --exclude='*.pyc' --exclude='.pytest_cache/'
+  --exclude='.coverage' --exclude='*.bak' --exclude='*.bak.*')
+
+mkdir -p npm/.claude
+
+# ---------------------------------------------------------------------
+# PLAN-119-FOLLOWUP WS-1 — prune stale out-of-scope subtrees under npm/.claude/.
+# `npm/.claude/` is gitignored build state. `npm-rebuild.sh` only owns
+# hooks/+scripts/, but a prior `install-npm.sh` (`cp -r .claude`) can leave a
+# multi-GB `npm/.claude/plans/` here. `npm pack --dry-run` (below) STATs the
+# whole tree to apply `.npmignore`, so a stale 4.3GB / 250k-file plans/ makes
+# the smoke take ~430s and times out the dev-env test (CI starts clean, so it
+# passes there — a structural parity gap). plans/ is gitignored,
+# `.npmignore`-excluded from the shipped tarball, and never synced — pruning it
+# is safe and is the real root-cause fix (perf debate R-PERF1/Must-fix-2).
+NPM_CLAUDE_PLANS="$REPO/npm/.claude/plans"
+if [ -n "${REPO:-}" ] && [ -d "$NPM_CLAUDE_PLANS" ]; then
+  info "Pruning stale out-of-scope npm/.claude/plans (not part of the bundle)"
+  rm -rf "$NPM_CLAUDE_PLANS"
+  ok "stale npm/.claude/plans pruned"
+fi
+
+info "Syncing .claude/hooks → npm/.claude/hooks"
+rsync "${RSYNC_FLAGS[@]}" .claude/hooks/ npm/.claude/hooks/ || { fail "hooks rsync failed"; exit 1; }
+ok ".claude/hooks synced"
+
+info "Syncing .claude/scripts → npm/.claude/scripts"
+rsync "${RSYNC_FLAGS[@]}" .claude/scripts/ npm/.claude/scripts/ || { fail "scripts rsync failed"; exit 1; }
+ok ".claude/scripts synced"
+
+info "Syncing templates → npm/templates"
+rsync "${RSYNC_FLAGS[@]}" templates/ npm/templates/ || { fail "templates rsync failed"; exit 1; }
+ok "templates synced"
+
+info "Syncing SPEC/v1 → npm/SPEC/v1"
+mkdir -p npm/SPEC
+rsync "${RSYNC_FLAGS[@]}" SPEC/v1/ npm/SPEC/v1/ || { fail "SPEC rsync failed"; exit 1; }
+ok "SPEC/v1 synced"
+
+# ---------------------------------------------------------------------
+# Copy VERSION → npm/VERSION (bit-identical).
+# ---------------------------------------------------------------------
+cp -f VERSION npm/VERSION || { fail "VERSION copy failed"; exit 1; }
+ok "npm/VERSION = $VERSION"
+
+# ---------------------------------------------------------------------
+# Rewrite npm/package.json version field.
+# ---------------------------------------------------------------------
+if command -v jq >/dev/null 2>&1; then
+  tmp="$(mktemp -t npm-pkg-XXXXXX.json)"
+  jq --arg v "$VERSION" '.version = $v' npm/package.json > "$tmp" \
+    && mv "$tmp" npm/package.json \
+    || { fail "jq package.json bump failed"; rm -f "$tmp"; exit 2; }
+else
+  python3 - "$VERSION" <<'PY' || { fail "python package.json bump failed"; exit 2; }
+import json, sys, pathlib
+v = sys.argv[1]
+p = pathlib.Path("npm/package.json")
+data = json.loads(p.read_text(encoding="utf-8"))
+data["version"] = v
+p.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
+PY
+fi
+ok "npm/package.json version = $VERSION"
+
+# ---------------------------------------------------------------------
+# Optional: npm-pack smoke (catches obvious package errors before publish).
+# ---------------------------------------------------------------------
+if command -v npm >/dev/null 2>&1; then
+  info "Running npm pack --dry-run smoke"
+  pack_json="$( (cd npm && npm pack --dry-run --json 2>/dev/null) )"
+  pack_rc=$?
+  if [ "$pack_rc" -ne 0 ]; then
+    fail "npm pack --dry-run failed"
+    (cd npm && npm pack --dry-run 2>&1 | tail -10)
+    exit 3
+  fi
+  ok "npm pack --dry-run clean"
+  # PLAN-119-FOLLOWUP WS-1 — tarball bloat/leak guard (PLAN-118 AC-B8 recurrence),
+  # FAIL-CLOSED. A clean bundle is ~2178 files (measured S184, VERSION 1.0.0). A
+  # leak of the gitignored .claude/plans/ sandbox (~250k files) — what made the
+  # dev-env pack take ~430s — would blow past this. Ceiling 6000 = ~2.75x headroom
+  # over the current bundle for legit growth (more skills/ADRs) while staying ~40x
+  # below a plans/ leak. Parse the structured `--json` entryCount (robust across
+  # npm versions); if the count cannot be determined the guard FAILS rather than
+  # silently skipping (Codex 019e73ab P1-B).
+  NPM_PACK_FILE_CEILING=6000
+  pack_files="$(printf '%s' "$pack_json" | python3 -c 'import sys, json
+d = json.load(sys.stdin); o = d[0] if isinstance(d, list) else d; print(int(o["entryCount"]))' 2>/dev/null)"
+  if [ -z "$pack_files" ]; then
+    fail "could not determine npm pack file count from --json entryCount — failing CLOSED (PLAN-119-FOLLOWUP WS-1 tarball guard)"
+    exit 3
+  fi
+  if [ "$pack_files" -gt "$NPM_PACK_FILE_CEILING" ]; then
+    fail "npm pack would ship $pack_files files (> $NPM_PACK_FILE_CEILING ceiling) — a stale .claude/plans/ or other out-of-scope tree likely leaked into the bundle (PLAN-118 AC-B8 / PLAN-119-FOLLOWUP WS-1)."
+    exit 3
+  fi
+  ok "npm pack file count $pack_files within ceiling $NPM_PACK_FILE_CEILING"
+else
+  warn "npm not installed — skipping pack smoke (CI will catch on publish)"
+fi
+
+echo ""
+ok "npm/ bundle regenerated. Stage with:"
+echo "    git add npm/"
+echo "    git diff --stat npm/ | tail -5"
+echo ""
+warn "Per Owner D1: do NOT hand-edit anything under npm/. Generated only."

package/scripts/publish-plugin.sh

@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+# =============================================================================
+# publish-plugin.sh — regenerate the `ceo` plugin from the live framework and
+# publish it to the private plugin-marketplace repo. Idempotent / re-runnable.
+#
+# WHY YOU run this (not the assistant): the Claude Code auto-mode classifier
+# blocks an agent from bulk-pushing a materialized tree to a separate,
+# agent-created repo (a generic data-exfiltration guard). Your own shell is
+# outside that rail, and your `gh`/git auth is the authorization of record.
+#
+# Cycle: evolve the framework -> run this -> team runs `/plugin update`.
+# The plugin is GENERATED from the live `.claude/`, never hand-edited; `dist/`
+# stays gitignored so the build never pollutes or duplicates the framework.
+#
+# Config (env overrides, all optional):
+#   CEO_MARKETPLACE_REPO   target repo      (default: <origin-owner>/ceo-marketplace)
+#   CEO_PUBLISH_WORKDIR    scratch clone    (default: /tmp/ceo-marketplace-publish)
+#   CEO_PUBLISH_AUTHOR_NAME / _AUTHOR_EMAIL  commit identity
+#                          (default: git user.name + <owner>@users.noreply.github.com,
+#                           noreply keeps the marketplace history clean for a public open)
+# =============================================================================
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+# Derive the GitHub owner from this repo's origin (no hard-coded handle).
+OWNER="$(gh repo view --json owner -q .owner.login 2>/dev/null || true)"
+[ -n "$OWNER" ] || OWNER="$(git remote get-url origin 2>/dev/null | sed -E 's#.*[:/]([^/]+)/[^/]+(\.git)?$#\1#' || true)"
+
+# An explicit CEO_MARKETPLACE_REPO wins and does NOT require owner discovery — the
+# script may run from a source archive with no gh auth and no origin (Codex P2).
+if [ -n "${CEO_MARKETPLACE_REPO:-}" ]; then
+  MARKETPLACE_REPO="$CEO_MARKETPLACE_REPO"
+  [ -n "$OWNER" ] || OWNER="${MARKETPLACE_REPO%%/*}"   # derive fallback owner for the default author email
+else
+  [ -n "$OWNER" ] || { echo "!! could not determine GitHub owner (no gh auth / no origin) — set CEO_MARKETPLACE_REPO=<owner>/<repo>"; exit 1; }
+  MARKETPLACE_REPO="${OWNER}/ceo-marketplace"
+fi
+WORK="${CEO_PUBLISH_WORKDIR:-/tmp/ceo-marketplace-publish}"
+AUTHOR_NAME="${CEO_PUBLISH_AUTHOR_NAME:-$(git config user.name || echo "$OWNER")}"
+AUTHOR_EMAIL="${CEO_PUBLISH_AUTHOR_EMAIL:-${OWNER}@users.noreply.github.com}"
+
+echo "== publish-plugin =="
+echo "  framework:   $REPO_ROOT"
+echo "  marketplace: $MARKETPLACE_REPO"
+echo "  workdir:     $WORK"
+
+echo
+echo "== 1) Build plugin from live .claude/ =="
+python3 scripts/build-plugin.py
+PLUGIN_SRC="$REPO_ROOT/dist/ceo-plugin"
+MKT_SRC="$REPO_ROOT/dist/ceo-marketplace"
+[ -d "$PLUGIN_SRC" ] || { echo "  !! build did not produce $PLUGIN_SRC"; exit 1; }
+VERSION="$(python3 -c "import json,sys;print(json.load(open('$PLUGIN_SRC/.claude-plugin/plugin.json'))['version'])")"
+echo "  plugin version: $VERSION"
+
+echo
+echo "== 2) Fresh working clone of the marketplace repo =="
+# Safety guard (Codex P2): CEO_PUBLISH_WORKDIR is a documented override; never
+# rm -rf a path that could be valuable (root, $HOME, the framework repo, or an
+# unrelated checkout). Only a fresh path or our own prior marketplace clone is deletable.
+WORK_ABS="$(cd "$WORK" 2>/dev/null && pwd || echo "$WORK")"
+case "$WORK_ABS" in
+  ""|"/"|"$HOME"|"$REPO_ROOT"|"$REPO_ROOT"/*)
+    echo "  !! refusing rm -rf on CEO_PUBLISH_WORKDIR='$WORK_ABS' (protected path) — pick a dedicated scratch dir"; exit 1;;
+esac
+if [ -e "$WORK_ABS" ]; then
+  if [ -d "$WORK_ABS/.git" ]; then
+    _u="$(git -C "$WORK_ABS" remote get-url origin 2>/dev/null || true)"
+    case "$_u" in
+      *"$MARKETPLACE_REPO"*) : ;;   # our own prior clone — safe to refresh
+      *) echo "  !! '$WORK_ABS' is a git checkout of '${_u:-unknown}', not $MARKETPLACE_REPO — refusing to delete"; exit 1;;
+    esac
+  elif [ -n "$(ls -A "$WORK_ABS" 2>/dev/null)" ]; then
+    echo "  !! '$WORK_ABS' exists, is non-empty, and is not a marketplace clone — refusing to delete (set CEO_PUBLISH_WORKDIR to a fresh path)"; exit 1
+  fi
+fi
+rm -rf "$WORK"
+if gh repo view "$MARKETPLACE_REPO" >/dev/null 2>&1; then
+  gh repo clone "$MARKETPLACE_REPO" "$WORK" -- -q
+  EXISTS=1
+  echo "  cloned existing $MARKETPLACE_REPO"
+else
+  mkdir -p "$WORK"
+  git -C "$WORK" init -b main -q
+  EXISTS=0
+  echo "  repo does not exist yet — will create on push"
+fi
+
+echo
+echo "== 3) Materialize content (plugin + marketplace.json + README + .gitignore) =="
+rm -rf "$WORK/ceo-plugin" "$WORK/.claude-plugin"
+mkdir -p "$WORK/.claude-plugin"
+cp "$MKT_SRC/.claude-plugin/marketplace.json" "$WORK/.claude-plugin/marketplace.json"
+cp -R "$PLUGIN_SRC" "$WORK/ceo-plugin"
+# scrub build cruft (scoped to the plugin tree; never touches .git)
+find "$WORK/ceo-plugin" -type d -name '__pycache__' -exec rm -rf {} + 2>/dev/null || true
+find "$WORK/ceo-plugin" -type f \( -name '*.pyc' -o -name '*.pyo' -o -name '.DS_Store' \) -delete 2>/dev/null || true
+# resolve install placeholders in the published plugin README (portable, via python)
+python3 - "$WORK/ceo-plugin/README.md" "$MARKETPLACE_REPO" <<'PY'
+import sys
+path, repo = sys.argv[1], sys.argv[2]
+t = open(path, encoding="utf-8").read()
+t = t.replace("<owner>/<your-marketplace-repo>", repo).replace("ceo@<your-marketplace>", "ceo@ceo-marketplace")
+open(path, "w", encoding="utf-8").write(t)
+PY
+# marketplace root README + .gitignore
+MKT_NAME="$(basename "$MARKETPLACE_REPO")"
+printf '# %s (private)\n\nClaude Code plugin marketplace hosting the **ceo** plugin (CEO Orchestration).\n\n## Install\n```\n/plugin marketplace add %s\n/plugin install ceo@ceo-marketplace\n```\n\nGenerated from ceo-orchestration via `scripts/publish-plugin.sh` — do not hand-edit `ceo-plugin/`.\n' "$MKT_NAME" "$MARKETPLACE_REPO" > "$WORK/README.md"
+printf '__pycache__/\n*.pyc\n*.pyo\n.DS_Store\n' > "$WORK/.gitignore"
+
+echo
+echo "== 4) Cleanliness gate (no OWNER absolute path leaks into the artifact) =="
+# Match the OWNER's REAL home + username paths (fixed strings), NOT the generic
+# /Users//home/ token: legit runtime modules — notably _lib/replay_redact.py, which
+# REDACTS personal paths — carry /Users/ and /home/ as regex patterns and must not
+# false-positive. build-plugin.py already sanitizes the owner's own absolute path.
+USER_NAME="$(id -un 2>/dev/null || whoami)"
+GATE_PATTERNS=(-e "${HOME}/" -e "/Users/${USER_NAME}/" -e "/home/${USER_NAME}/")
+HITS=$(grep -rIlF "${GATE_PATTERNS[@]}" "$WORK" --exclude-dir=.git 2>/dev/null | wc -l | tr -d ' ' || true)
+echo "  owner-path hits ($USER_NAME): $HITS  (must be 0)"
+[ "$HITS" = "0" ] || { echo "  !! owner absolute path present:"; grep -rIlF "${GATE_PATTERNS[@]}" "$WORK" --exclude-dir=.git; exit 1; }
+
+echo
+echo "== 5) Commit + push =="
+git -C "$WORK" add -A
+if [ "$EXISTS" = "1" ] && git -C "$WORK" diff --cached --quiet 2>/dev/null; then
+  echo "  no changes vs published marketplace — nothing to publish."
+  exit 0
+fi
+git -C "$WORK" -c user.name="$AUTHOR_NAME" -c user.email="$AUTHOR_EMAIL" \
+  commit -q -m "Publish ceo plugin v$VERSION (generated from ceo-orchestration)"
+if [ "$EXISTS" = "1" ]; then
+  git -C "$WORK" push origin main
+else
+  gh repo create "$MARKETPLACE_REPO" --private --source="$WORK" --remote=origin --push \
+    --description "Private Claude Code plugin marketplace — ceo (CEO Orchestration)"
+fi
+
+echo
+echo "== Done — ceo v$VERSION published to $MARKETPLACE_REPO =="
+echo "  First time:  /plugin marketplace add $MARKETPLACE_REPO  &&  /plugin install ceo@ceo-marketplace"
+echo "  Updates:     /plugin update   (run by each team member in their Claude Code)"