create-agdf 0.13.4 → 0.13.6

package/README.md

@@ -126,7 +126,9 @@ it does not localize the CLI lifecycle card.
 The `codex` and `claude` commands install from the complete plugin built into the released
 `create-agdf` package. They atomically stage it under an AGDF-owned user-data marketplace, register
 that stable local path through the host CLI and verify the exposed version. Source `plugin/` therefore
-contains no generated runtime bytes, and routine installed validation does not depend on the GitHub
+contains no generated runtime bytes and the source checkout exposes no installable root marketplace.
+The staged plugin contains one installation-provenance marker and the shared exact-version runtime;
+routine installed validation does not depend on the GitHub
 checkout, npm cache, PATH or registry. Rerunning either command performs the explicit update and
 migrates only the exact known legacy AGDF GitHub marketplace; foreign same-name registrations fail
 closed and failed host operations restore the prior owned stage.
@@ -137,6 +139,10 @@ Use the `codex-repo` target when AGDF should be available only inside one reposi
 
 After `npm create agdf@latest -- codex-repo`, restart Codex in that repository, open `/plugins`, select `This repository` and install `agdf`.
 
+`codex-repo` is a generated runtime-complete repository projection. It is distinct from this
+runtime-free source checkout and is validated before lifecycle status treats `agdf@agdf-repo` as
+active.
+
 Use the `opencode` target to install the AGDF npm plugin as a user-wide OpenCode hook:
 
 ```bash

package/generated/plugins/agdf/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agdf",
-  "version": "0.13.4",
+  "version": "0.13.6",
   "description": "AI Governance & Delivery Framework (AGDF) is a governance framework for agentic work. Its first implementation provides a control layer for governed AI-assisted software delivery. It combines workflow skills, explicit gates, control templates and machine-readable repository checks to keep work aligned with approved scope and make evidence a prerequisite for consequential gate transitions. Supported workflows include brownfield analysis, task-plan review, QA decisions, durable run state and auditable delivery closeout. AGDF is an independent open-source project, not a security sandbox, compliance certification or autonomous release system.",
   "keywords": [
     "agentic",

package/generated/plugins/agdf/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agdf",
-  "version": "0.13.4",
+  "version": "0.13.6",
   "description": "Control layer for governed AI-assisted delivery.",
   "author": {
     "name": "Arndt Gold",
@@ -34,9 +34,8 @@
     "composerIcon": "./assets/agdf-icon.svg",
     "logo": "./assets/agdf-logo.svg",
     "defaultPrompt": [
-      "Assess whether AGDF is proportionate for this repository and request before proposing any implementation. Explain AGDF's purpose and practical benefits, weigh governance overhead against the project's delivery risk, and recommend the lightest suitable path — or explicitly advise against AGDF where it would add more process than value.",
+      "Assess whether AGDF fits this request and recommend the lightest safe path before proposing implementation.",
       "Start this request under AGDF governance.",
-      "Create durable AGDF control state for this repository.",
       "Close this delivery run with an auditable AGDF report."
     ],
     "brandColor": "#14B8A6"

package/generated/plugins/agdf/hooks/session-start.sh

@@ -3,11 +3,40 @@
 # Activates a compact AGDF runtime reminder for the agent session.
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PLUGIN_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 META_DIR="$(cd "${SCRIPT_DIR}/../meta" && pwd)"
 ROUTER="${META_DIR}/agdf-agent-router.md"
 CONSTITUTION="${META_DIR}/agdf-constitution.md"
 RUNTIME_CONTRACT="${META_DIR}/agdf-runtime-contract.md"
 CONFIG_PATH="${PWD}/.agdf/control/config.json"
+LOCAL_RUNTIME="${PLUGIN_DIR}/runtime/agdf-local.js"
+
+RUNTIME_HINT="AGDF runtime: profile=source-development evidence=source_checkout machine_validation=unavailable provenance=not_applicable."
+if [[ -f "${PLUGIN_DIR}/.agdf-installation.json" && ! -f "${LOCAL_RUNTIME}" ]]; then
+  RUNTIME_HINT="AGDF runtime: profile=runtime-plugin evidence=installed_plugin_root machine_validation=unavailable provenance=unverified. Use the supported AGDF install/update command, then restart the host and retry in a fresh session."
+fi
+if [[ -f "${LOCAL_RUNTIME}" ]]; then
+  RUNTIME_HINT="AGDF runtime: profile=runtime-plugin evidence=unverified machine_validation=unavailable provenance=unverified. Retry the surface-local runtime probe or use the supported AGDF install/update command."
+  RUNTIME_JSON="$(AGDF_SURFACE="${AGDF_SURFACE:-plugin}" node "${LOCAL_RUNTIME}" --resolve-only --json 2>/dev/null || true)"
+  RUNTIME_RENDERED="$(RUNTIME_JSON="${RUNTIME_JSON}" node <<'NODE' 2>/dev/null || true
+try {
+  const value = JSON.parse(process.env.RUNTIME_JSON || "{}");
+  const profile = value.distribution_profile || "runtime-plugin";
+  const evidence = value.evidence_plane || "unverified";
+  const version = value.plugin_version || value.observed_version || value.expected_version || "unknown";
+  const provenance = value.provenance_status || "unverified";
+  const validation = value.machine_validation || "unavailable";
+  const root = value.plugin_root || "unavailable";
+  console.log(`AGDF runtime: profile=${profile} evidence=${evidence} version=${version} provenance=${provenance} machine_validation=${validation} root=${root}.`);
+} catch {
+  console.log("AGDF runtime: profile=runtime-plugin evidence=unverified machine_validation=unavailable provenance=invalid. Retry the surface-local runtime probe or use the supported AGDF install/update command.");
+}
+NODE
+)"
+  if [[ -n "${RUNTIME_RENDERED}" ]]; then
+    RUNTIME_HINT="${RUNTIME_RENDERED}"
+  fi
+fi
 
 CONFIG_HINT="Project config: .agdf/control/config.json not found. Use npx --yes @agdf/cli@latest config --language de|en to persist the project language."
 if [[ -f "${CONFIG_PATH}" ]]; then
@@ -33,6 +62,8 @@ fi
 cat <<EOF
 AGDF active.
 
+${RUNTIME_HINT}
+
 Use the installed AGDF skills as workflow controls.
 For a new build, change, extension, refactor, CLI, app, fix with product semantics, unclear approval, or unclear next step, use gate-check before implementation or later-gate artefacts.
 ${CONFIG_HINT}

package/generated/plugins/agdf/meta/agdf-plugin.definition.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "id": "agdf",
-  "version": "0.13.4",
+  "version": "0.13.6",
   "displayName": "AI Governance & Delivery Framework",
   "developerName": "Arndt Gold",
   "description": "Control layer for governed AI-assisted delivery.",
@@ -33,9 +33,8 @@
       "Write"
     ],
     "defaultPrompt": [
-      "Assess whether AGDF is proportionate for this repository and request before proposing any implementation. Explain AGDF's purpose and practical benefits, weigh governance overhead against the project's delivery risk, and recommend the lightest suitable path — or explicitly advise against AGDF where it would add more process than value.",
+      "Assess whether AGDF fits this request and recommend the lightest safe path before proposing implementation.",
       "Start this request under AGDF governance.",
-      "Create durable AGDF control state for this repository.",
       "Close this delivery run with an auditable AGDF report."
     ],
     "hooks": "hooks/hooks.json"
@@ -44,9 +43,8 @@
     "skillPrefix": "",
     "agentRouter": "meta/agdf-agent-router.md",
     "defaultPrompt": [
-      "Assess whether AGDF is proportionate for this repository and request before proposing any implementation. Explain AGDF's purpose and practical benefits, weigh governance overhead against the project's delivery risk, and recommend the lightest suitable path — or explicitly advise against AGDF where it would add more process than value.",
+      "Assess whether AGDF fits this request and recommend the lightest safe path before proposing implementation.",
       "Start this request under AGDF governance.",
-      "Create durable AGDF control state for this repository.",
       "Close this delivery run with an auditable AGDF report."
     ]
   },
@@ -254,10 +252,33 @@
       "boundary": "supports Quality Readiness; no final QA decision"
     }
   ],
-  "marketplaces": {
-    "repository": {
-      "name": "agdf-repo",
-      "displayName": "This repository"
+  "distributionProfiles": {
+    "schemaVersion": 1,
+    "marketplaceIdentities": {
+      "durable": "agdf",
+      "generatedRepository": "agdf-repo"
+    },
+    "profiles": {
+      "source-development": {
+        "runtime": "absent",
+        "installable": false,
+        "machineValidation": "unavailable"
+      },
+      "runtime-plugin": {
+        "runtime": "required",
+        "installable": true,
+        "machineValidation": "local_exact_version_digest"
+      },
+      "opencode-config-local": {
+        "runtime": "config_local_package",
+        "installable": true,
+        "machineValidation": "local_exact_version"
+      },
+      "portable-skills": {
+        "runtime": "absent",
+        "installable": true,
+        "machineValidation": "unavailable_or_external_required"
+      }
     }
   }
 }

package/generated/plugins/agdf/runtime/agdf-local.js

@@ -7,5 +7,12 @@ import { fileURLToPath } from "node:url";
 import { runLocalValidator } from "./create-agdf/lib/runtime/local-validator.js";
 
 const runtimeRoot = fileURLToPath(new URL(".", import.meta.url));
+const pluginRoot = fileURLToPath(new URL("../", import.meta.url));
 const manifest = JSON.parse(readFileSync(new URL("./runtime-manifest.json", import.meta.url), "utf8"));
-process.exitCode = runLocalValidator({ runtimeRoot, expectedVersion: manifest.version, surface: process.env.AGDF_SURFACE || "plugin" }, process.argv.slice(2));
+process.exitCode = runLocalValidator({
+  runtimeRoot,
+  pluginRoot,
+  expectedPluginRoot: process.env.CLAUDE_PLUGIN_ROOT || undefined,
+  expectedVersion: manifest.version,
+  surface: process.env.AGDF_SURFACE || "plugin",
+}, process.argv.slice(2));

package/generated/plugins/agdf/runtime/create-agdf/generated/plugins/agdf/meta/agdf-plugin.definition.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "id": "agdf",
-  "version": "0.13.4",
+  "version": "0.13.6",
   "displayName": "AI Governance & Delivery Framework",
   "developerName": "Arndt Gold",
   "description": "Control layer for governed AI-assisted delivery.",
@@ -33,9 +33,8 @@
       "Write"
     ],
     "defaultPrompt": [
-      "Assess whether AGDF is proportionate for this repository and request before proposing any implementation. Explain AGDF's purpose and practical benefits, weigh governance overhead against the project's delivery risk, and recommend the lightest suitable path — or explicitly advise against AGDF where it would add more process than value.",
+      "Assess whether AGDF fits this request and recommend the lightest safe path before proposing implementation.",
       "Start this request under AGDF governance.",
-      "Create durable AGDF control state for this repository.",
       "Close this delivery run with an auditable AGDF report."
     ],
     "hooks": "hooks/hooks.json"
@@ -44,9 +43,8 @@
     "skillPrefix": "",
     "agentRouter": "meta/agdf-agent-router.md",
     "defaultPrompt": [
-      "Assess whether AGDF is proportionate for this repository and request before proposing any implementation. Explain AGDF's purpose and practical benefits, weigh governance overhead against the project's delivery risk, and recommend the lightest suitable path — or explicitly advise against AGDF where it would add more process than value.",
+      "Assess whether AGDF fits this request and recommend the lightest safe path before proposing implementation.",
       "Start this request under AGDF governance.",
-      "Create durable AGDF control state for this repository.",
       "Close this delivery run with an auditable AGDF report."
     ]
   },
@@ -254,10 +252,33 @@
       "boundary": "supports Quality Readiness; no final QA decision"
     }
   ],
-  "marketplaces": {
-    "repository": {
-      "name": "agdf-repo",
-      "displayName": "This repository"
+  "distributionProfiles": {
+    "schemaVersion": 1,
+    "marketplaceIdentities": {
+      "durable": "agdf",
+      "generatedRepository": "agdf-repo"
+    },
+    "profiles": {
+      "source-development": {
+        "runtime": "absent",
+        "installable": false,
+        "machineValidation": "unavailable"
+      },
+      "runtime-plugin": {
+        "runtime": "required",
+        "installable": true,
+        "machineValidation": "local_exact_version_digest"
+      },
+      "opencode-config-local": {
+        "runtime": "config_local_package",
+        "installable": true,
+        "machineValidation": "local_exact_version"
+      },
+      "portable-skills": {
+        "runtime": "absent",
+        "installable": true,
+        "machineValidation": "unavailable_or_external_required"
+      }
     }
   }
 }

package/generated/plugins/agdf/runtime/create-agdf/lib/runtime/local-validator.js

@@ -1,8 +1,14 @@
-import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import process from "node:process";
+import {
+  INSTALLATION_PROVENANCE_FILE,
+  digestDirectory,
+  inspectGeneratedRepositoryMarketplace,
+  inspectInstallationProvenance,
+  validateDistributionProfiles,
+} from "./plugin-provenance.js";
 
 function readJson(path) {
   try {
@@ -12,27 +18,12 @@ function readJson(path) {
   }
 }
 
-export function digestDirectory(root) {
-  const files = [];
-  function visit(directory) {
-    for (const name of readdirSync(directory).sort()) {
-      const path = join(directory, name);
-      const stats = statSync(path);
-      if (stats.isDirectory()) visit(path);
-      else if (stats.isFile()) files.push(path);
-    }
-  }
-  visit(root);
-  const hash = createHash("sha256");
-  for (const path of files) {
-    hash.update(relative(root, path).replaceAll("\\", "/"));
-    hash.update("\0");
-    hash.update(readFileSync(path));
-    hash.update("\0");
-  }
-  return hash.digest("hex");
+function canonicalPath(path) {
+  try { return realpathSync(path); } catch { return resolve(path); }
 }
 
+export { digestDirectory };
+
 function envelope(machineValidation, options, evidence = {}) {
   return {
     schema_version: "1",
@@ -42,6 +33,14 @@ function envelope(machineValidation, options, evidence = {}) {
     observed_version: evidence.observedVersion ?? null,
     source: evidence.source ?? null,
     registry_access: false,
+    distribution_profile: evidence.distributionProfile ?? null,
+    evidence_plane: evidence.evidencePlane ?? null,
+    canonical_version: evidence.canonicalVersion ?? options.expectedVersion ?? null,
+    plugin_version: evidence.pluginVersion ?? null,
+    runtime_digest: evidence.runtimeDigest ?? null,
+    source_digest: evidence.sourceDigest ?? null,
+    plugin_root: evidence.pluginRoot ?? null,
+    provenance_status: evidence.provenanceStatus ?? null,
     ...(evidence.reason ? { reason: evidence.reason } : {}),
   };
 }
@@ -51,17 +50,17 @@ export function resolveLocalValidator(options) {
     const packageManifest = readJson(join(options.ownedPackageRoot, "package.json"));
     const observedVersion = packageManifest?.version ?? null;
     if (!packageManifest) {
-      return { envelope: envelope("unavailable", options, { source: "config_local_package", reason: "package_missing" }) };
+      return { envelope: envelope("unavailable", options, { source: "config_local_package", evidencePlane: "opencode_config_local", distributionProfile: "opencode-config-local", reason: "package_missing" }) };
     }
     if (observedVersion !== options.expectedVersion) {
-      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "config_local_package" }) };
+      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "config_local_package", evidencePlane: "opencode_config_local", distributionProfile: "opencode-config-local" }) };
     }
     const entrypoint = join(options.ownedPackageRoot, "bin", "create-agdf.js");
     if (!existsSync(entrypoint)) {
-      return { envelope: envelope("unavailable", options, { observedVersion, source: "config_local_package", reason: "entrypoint_missing" }) };
+      return { envelope: envelope("unavailable", options, { observedVersion, source: "config_local_package", evidencePlane: "opencode_config_local", distributionProfile: "opencode-config-local", reason: "entrypoint_missing" }) };
     }
     return {
-      envelope: envelope("owned_version_matched", options, { observedVersion, source: "config_local_package" }),
+      envelope: envelope("owned_version_matched", options, { observedVersion, source: "config_local_package", evidencePlane: "opencode_config_local", distributionProfile: "opencode-config-local", provenanceStatus: "matched" }),
       executable: process.execPath,
       prefixArgs: [entrypoint],
     };
@@ -73,30 +72,116 @@ export function resolveLocalValidator(options) {
     return { envelope: envelope("version_mismatch", options, { source: "plugin_bundle", reason: "manifest_invalid" }) };
   }
   if (manifest) {
+    const pluginRoot = canonicalPath(options.pluginRoot ?? join(options.runtimeRoot, ".."));
+    if (options.expectedPluginRoot && canonicalPath(options.expectedPluginRoot) !== pluginRoot) {
+      return { envelope: envelope("version_mismatch", options, { source: "plugin_bundle", pluginRoot, evidencePlane: "loaded_session", distributionProfile: "runtime-plugin", provenanceStatus: "mismatch", reason: "plugin_root_mismatch" }) };
+    }
+    const definition = readJson(join(pluginRoot, "meta", "agdf-plugin.definition.json"));
+    const profile = validateDistributionProfiles(definition);
+    if (profile.status !== "matched") {
+      return { envelope: envelope("version_mismatch", options, { source: "plugin_bundle", pluginRoot, distributionProfile: "runtime-plugin", provenanceStatus: "invalid", reason: "profile_invalid" }) };
+    }
+    const codexManifest = readJson(join(pluginRoot, ".codex-plugin", "plugin.json"));
+    const claudeManifest = readJson(join(pluginRoot, ".claude-plugin", "plugin.json"));
+    const pluginVersion = codexManifest?.version ?? null;
+    if (!codexManifest || !claudeManifest || claudeManifest.version !== definition.version) {
+      return { envelope: envelope("version_mismatch", options, { source: "plugin_bundle", pluginRoot, pluginVersion, canonicalVersion: definition.version, distributionProfile: "runtime-plugin", provenanceStatus: "invalid", reason: "manifest_invalid" }) };
+    }
     const packageRoot = join(options.runtimeRoot, "create-agdf");
     if (!existsSync(packageRoot)) {
-      return { envelope: envelope("unavailable", options, { source: "plugin_bundle", reason: "package_missing" }) };
+      return { envelope: envelope("unavailable", options, { source: "plugin_bundle", pluginRoot, pluginVersion, distributionProfile: "runtime-plugin", reason: "runtime_missing" }) };
     }
     const packageManifest = readJson(join(packageRoot, "package.json"));
     const observedVersion = packageManifest?.version ?? manifest.version ?? null;
     if (observedVersion !== options.expectedVersion || manifest.version !== options.expectedVersion) {
-      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "plugin_bundle" }) };
+      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "plugin_bundle", pluginRoot, pluginVersion, canonicalVersion: definition.version, distributionProfile: "runtime-plugin" }) };
     }
     let observedDigest = null;
     try { observedDigest = digestDirectory(packageRoot); } catch {}
     if (!observedDigest || manifest.digest !== observedDigest) {
-      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "plugin_bundle", reason: "digest_mismatch" }) };
+      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "plugin_bundle", pluginRoot, pluginVersion, canonicalVersion: definition.version, runtimeDigest: observedDigest, distributionProfile: "runtime-plugin", reason: "runtime_digest_mismatch" }) };
     }
     const entrypoint = resolve(options.runtimeRoot, manifest.entrypoint ?? "");
     const entrypointRelative = relative(options.runtimeRoot, entrypoint);
     if (!manifest.entrypoint || entrypointRelative === ".." || entrypointRelative.startsWith(`..${sep}`) || isAbsolute(entrypointRelative)) {
-      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "plugin_bundle", reason: "invalid_entrypoint" }) };
+      return { envelope: envelope("version_mismatch", options, { observedVersion, source: "plugin_bundle", pluginRoot, pluginVersion, canonicalVersion: definition.version, runtimeDigest: observedDigest, distributionProfile: "runtime-plugin", reason: "invalid_entrypoint" }) };
     }
     if (!existsSync(entrypoint)) {
-      return { envelope: envelope("unavailable", options, { observedVersion, source: "plugin_bundle", reason: "entrypoint_missing" }) };
+      return { envelope: envelope("unavailable", options, { observedVersion, source: "plugin_bundle", pluginRoot, pluginVersion, canonicalVersion: definition.version, runtimeDigest: observedDigest, distributionProfile: "runtime-plugin", reason: "entrypoint_missing" }) };
+    }
+    const installed = existsSync(join(pluginRoot, INSTALLATION_PROVENANCE_FILE));
+    let provenanceStatus = "not_applicable";
+    let sourceDigest = null;
+    let evidencePlane = "loaded_session";
+    if (installed) {
+      const provenance = inspectInstallationProvenance(pluginRoot, {
+        definition,
+        runtimeManifest: manifest,
+        pluginVersion,
+      });
+      provenanceStatus = provenance.status;
+      sourceDigest = provenance.marker?.source_digest ?? null;
+      if (provenance.status !== "matched") {
+        return { envelope: envelope("version_mismatch", options, {
+          observedVersion,
+          source: "plugin_bundle",
+          pluginRoot,
+          pluginVersion,
+          canonicalVersion: definition.version,
+          runtimeDigest: observedDigest,
+          sourceDigest,
+          distributionProfile: "runtime-plugin",
+          evidencePlane: "loaded_session",
+          provenanceStatus,
+          reason: provenance.reason,
+        }) };
+      }
+    } else if (existsSync(join(pluginRoot, ".agdf-local-install.json"))) {
+      return { envelope: envelope("unavailable", options, {
+        observedVersion,
+        source: "plugin_bundle",
+        pluginRoot,
+        pluginVersion,
+        canonicalVersion: definition.version,
+        runtimeDigest: observedDigest,
+        distributionProfile: "runtime-plugin",
+        evidencePlane: "loaded_session",
+        provenanceStatus: "missing",
+        reason: "installation_provenance_missing",
+      }) };
+    } else {
+      const generatedRepository = inspectGeneratedRepositoryMarketplace(resolve(pluginRoot, "..", ".."));
+      if (pluginVersion !== definition.version
+          || generatedRepository.status !== "matched"
+          || canonicalPath(generatedRepository.pluginRoot) !== pluginRoot) {
+        return { envelope: envelope("unavailable", options, {
+          observedVersion,
+          source: "plugin_bundle",
+          pluginRoot,
+          pluginVersion,
+          canonicalVersion: definition.version,
+          runtimeDigest: observedDigest,
+          distributionProfile: "runtime-plugin",
+          evidencePlane: "installed_plugin_root",
+          provenanceStatus: "missing",
+          reason: "installation_provenance_missing",
+        }) };
+      }
+      evidencePlane = "generated_bundle";
     }
     return {
-      envelope: envelope("owned_version_matched", options, { observedVersion, source: "plugin_bundle" }),
+      envelope: envelope("owned_version_matched", options, {
+        observedVersion,
+        source: "plugin_bundle",
+        pluginRoot,
+        pluginVersion,
+        canonicalVersion: definition.version,
+        runtimeDigest: observedDigest,
+        sourceDigest,
+        distributionProfile: "runtime-plugin",
+        evidencePlane,
+        provenanceStatus,
+      }),
       executable: process.execPath,
       prefixArgs: [entrypoint],
     };