create-agdf 0.13.5 → 0.13.7

package/generated/plugins/agdf/runtime/create-agdf/lib/runtime/plugin-provenance.js

@@ -0,0 +1,206 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+
+export const INSTALLATION_PROVENANCE_FILE = ".agdf-installation.json";
+export const LEGACY_LOCAL_INSTALL_FILE = ".agdf-local-install.json";
+
+const EXPECTED_PROFILES = Object.freeze({
+  "source-development": Object.freeze({ runtime: "absent", installable: false, machineValidation: "unavailable" }),
+  "runtime-plugin": Object.freeze({ runtime: "required", installable: true, machineValidation: "local_exact_version_digest" }),
+  "opencode-config-local": Object.freeze({ runtime: "config_local_package", installable: true, machineValidation: "local_exact_version" }),
+  "portable-skills": Object.freeze({ runtime: "absent", installable: true, machineValidation: "unavailable_or_external_required" }),
+});
+
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function digestDirectory(root) {
+  const files = [];
+  function visit(directory) {
+    for (const name of readdirSync(directory).sort()) {
+      const path = join(directory, name);
+      const stats = statSync(path);
+      if (stats.isDirectory()) visit(path);
+      else if (stats.isFile()) files.push(path);
+    }
+  }
+  visit(root);
+  const hash = createHash("sha256");
+  for (const path of files) {
+    hash.update(relative(root, path).replaceAll("\\", "/"));
+    hash.update("\0");
+    hash.update(readFileSync(path));
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+
+export function digestNormalizedPluginSource(root, canonicalVersion) {
+  const files = [];
+  function visit(directory) {
+    for (const name of readdirSync(directory).sort()) {
+      const path = join(directory, name);
+      const stats = statSync(path);
+      if (stats.isDirectory()) visit(path);
+      else if (stats.isFile()) files.push(path);
+    }
+  }
+  visit(root);
+  const hash = createHash("sha256");
+  for (const path of files) {
+    const normalizedPath = relative(root, path).replaceAll("\\", "/");
+    if ([INSTALLATION_PROVENANCE_FILE, LEGACY_LOCAL_INSTALL_FILE].includes(normalizedPath)) continue;
+    let content = readFileSync(path);
+    if (normalizedPath === ".codex-plugin/plugin.json") {
+      const manifest = readJson(path);
+      if (!manifest) throw new Error(`Invalid Codex plugin manifest: ${path}`);
+      content = `${JSON.stringify({ ...manifest, version: canonicalVersion }, null, 2)}\n`;
+    }
+    hash.update(normalizedPath);
+    hash.update("\0");
+    hash.update(content);
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+
+export function validateDistributionProfiles(definition) {
+  const contract = definition?.distributionProfiles;
+  if (contract?.schemaVersion !== 1) return { status: "invalid", reason: "profile_invalid" };
+  if (contract.marketplaceIdentities?.durable !== "agdf"
+      || contract.marketplaceIdentities?.generatedRepository !== "agdf-repo") {
+    return { status: "invalid", reason: "profile_invalid" };
+  }
+  for (const [profileId, expected] of Object.entries(EXPECTED_PROFILES)) {
+    const observed = contract.profiles?.[profileId];
+    if (!observed
+        || Object.keys(observed).length !== Object.keys(expected).length
+        || Object.keys(expected).some((key) => observed[key] !== expected[key])) {
+      return { status: "invalid", reason: "profile_invalid" };
+    }
+  }
+  if (Object.keys(contract.profiles ?? {}).length !== Object.keys(EXPECTED_PROFILES).length) {
+    return { status: "invalid", reason: "profile_invalid" };
+  }
+  return { status: "matched", contract };
+}
+
+export function inspectGeneratedRepositoryMarketplace(targetDir) {
+  const marketplacePath = join(targetDir, ".agents", "plugins", "marketplace.json");
+  if (!existsSync(marketplacePath)) return { status: "absent", marketplacePath };
+  const marketplace = readJson(marketplacePath);
+  const plugin = marketplace?.plugins?.length === 1 ? marketplace.plugins[0] : null;
+  const pluginPath = plugin?.source?.source === "local" ? plugin.source.path : null;
+  if (marketplace?.name !== "agdf-repo" || plugin?.name !== "agdf" || pluginPath !== "./plugins/agdf") {
+    return { status: "invalid", reason: "repository_marketplace_invalid", marketplacePath };
+  }
+  const pluginRoot = resolve(targetDir, pluginPath);
+  const rel = relative(resolve(targetDir), pluginRoot);
+  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    return { status: "invalid", reason: "repository_marketplace_path_escape", marketplacePath };
+  }
+  const definition = readJson(join(pluginRoot, "meta", "agdf-plugin.definition.json"));
+  const runtimeManifest = readJson(join(pluginRoot, "runtime", "runtime-manifest.json"));
+  const codexManifest = readJson(join(pluginRoot, ".codex-plugin", "plugin.json"));
+  const claudeManifest = readJson(join(pluginRoot, ".claude-plugin", "plugin.json"));
+  const runtimeRoot = join(pluginRoot, "runtime");
+  const runtimePackageRoot = join(pluginRoot, "runtime", "create-agdf");
+  const runtimeEntrypoint = resolve(runtimeRoot, runtimeManifest?.entrypoint ?? "");
+  const runtimeEntrypointRel = relative(runtimeRoot, runtimeEntrypoint);
+  if (validateDistributionProfiles(definition).status !== "matched"
+      || definition?.version !== runtimeManifest?.version
+      || codexManifest?.version !== definition?.version
+      || claudeManifest?.version !== definition?.version
+      || !/^[a-f0-9]{64}$/.test(runtimeManifest?.digest ?? "")
+      || !existsSync(join(runtimeRoot, "agdf-local.js"))
+      || !runtimeManifest?.entrypoint
+      || runtimeEntrypointRel === ".."
+      || runtimeEntrypointRel.startsWith(`..${sep}`)
+      || isAbsolute(runtimeEntrypointRel)
+      || !existsSync(runtimeEntrypoint)
+      || !existsSync(runtimePackageRoot)) {
+    return { status: "invalid", reason: "repository_runtime_incomplete", marketplacePath, pluginRoot };
+  }
+  let runtimeDigest;
+  try { runtimeDigest = digestDirectory(runtimePackageRoot); } catch {
+    return { status: "invalid", reason: "repository_runtime_incomplete", marketplacePath, pluginRoot };
+  }
+  if (runtimeDigest !== runtimeManifest.digest) {
+    return { status: "invalid", reason: "runtime_digest_mismatch", marketplacePath, pluginRoot };
+  }
+  return {
+    status: "matched",
+    marketplacePath,
+    pluginRoot,
+    selector: `${plugin.name}@${marketplace.name}`,
+    runtimeDigest,
+  };
+}
+
+export function inspectInstallationProvenance(pluginRoot, {
+  definition,
+  runtimeManifest,
+  pluginVersion,
+  allowLegacy = false,
+} = {}) {
+  const markerPath = join(pluginRoot, INSTALLATION_PROVENANCE_FILE);
+  const legacyPath = join(pluginRoot, LEGACY_LOCAL_INSTALL_FILE);
+  if (!existsSync(markerPath)) {
+    if (allowLegacy && existsSync(legacyPath)) {
+      const marker = readJson(legacyPath);
+      if (!marker
+          || marker.schema_version !== 1
+          || marker.owner !== "create-agdf"
+          || marker.kind !== "codex_local_development_projection"
+          || marker.canonical_version !== definition.version
+          || marker.codex_install_version !== pluginVersion
+          || !/^[a-f0-9]{64}$/.test(marker.source_digest ?? "")) {
+        return { status: "invalid", reason: "installation_provenance_invalid", marker };
+      }
+      let observedSourceDigest;
+      try { observedSourceDigest = digestNormalizedPluginSource(pluginRoot, definition.version); } catch {
+        return { status: "invalid", reason: "source_digest_mismatch", marker };
+      }
+      return observedSourceDigest === marker.source_digest
+        ? { status: "legacy", marker, observedSourceDigest, reason: "legacy_installation_provenance" }
+        : { status: "invalid", reason: "source_digest_mismatch", marker, observedSourceDigest };
+    }
+    const profile = validateDistributionProfiles(definition);
+    if (profile.status !== "matched") return profile;
+    return { status: "missing", reason: "installation_provenance_missing" };
+  }
+  const profile = validateDistributionProfiles(definition);
+  if (profile.status !== "matched") return profile;
+  const marker = readJson(markerPath);
+  if (!marker
+      || marker.schema_version !== 1
+      || marker.owner !== "create-agdf"
+      || marker.profile_id !== "runtime-plugin"
+      || marker.marketplace_id !== profile.contract.marketplaceIdentities.durable
+      || marker.canonical_version !== definition.version
+      || marker.codex_install_version !== pluginVersion
+      || marker.runtime_digest !== runtimeManifest?.digest
+      || !/^[a-f0-9]{64}$/.test(marker.source_digest ?? "")) {
+    return { status: "invalid", reason: "installation_provenance_invalid", marker };
+  }
+  let observedSourceDigest;
+  try {
+    observedSourceDigest = digestNormalizedPluginSource(pluginRoot, definition.version);
+  } catch {
+    return { status: "invalid", reason: "source_digest_mismatch", marker };
+  }
+  if (observedSourceDigest !== marker.source_digest) {
+    return { status: "invalid", reason: "source_digest_mismatch", marker, observedSourceDigest };
+  }
+  return { status: "matched", marker, observedSourceDigest };
+}
+
+export const distributionProfileContract = Object.freeze({
+  expectedProfiles: EXPECTED_PROFILES,
+});

package/generated/plugins/agdf/runtime/create-agdf/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agdf/local-validator-runtime",
-  "version": "0.13.5",
+  "version": "0.13.7",
   "private": true,
   "type": "module"
 }

package/generated/plugins/agdf/runtime/runtime-manifest.json

@@ -2,7 +2,7 @@
   "schema_version": "1",
   "generated": true,
   "source": "create-agdf/cli",
-  "version": "0.13.5",
+  "version": "0.13.7",
   "entrypoint": "create-agdf/bin/agdf-validator.js",
-  "digest": "8a076d7647c39ea3c19f6cc7c30052d798ec65abe705b56065c784f2bebc8068"
+  "digest": "05afaf9ec478d50900a79cbdda8fcd7c61fa5627f4770ba093b19908fa6df91b"
 }

package/generated/plugins/agdf/scripts/check-runtime-integrity.mjs

@@ -1,7 +1,8 @@
+import { createHash } from "node:crypto";
 import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { dirname, join, resolve } from "node:path";
+import { dirname, join, relative, resolve } from "node:path";
 
 const scriptPluginRoot = resolve(fileURLToPath(new URL("..", import.meta.url)));
 
@@ -46,7 +47,6 @@ function hasPluginLayout(root) {
 function hasSourceLayout(root) {
   return hasPluginLayout(join(root, "plugin"))
     && [
-      ".claude-plugin/marketplace.json",
       "agdf/package.json",
       "create-agdf/package.json",
       "pages/package.json",
@@ -92,9 +92,12 @@ try {
   console.error("- AGDF_AGENT_SKILLS_VALIDATOR_MISSING: scripts/agent-skills-conformance.mjs must be present and loadable");
   process.exit(1);
 }
-const marketplacePath = sourceMode ? join(repoRoot, ".claude-plugin", "marketplace.json") : null;
+const codexSourceMarketplacePath = sourceMode ? join(repoRoot, ".agents", "plugins", "marketplace.json") : null;
+const claudeSourceMarketplacePath = sourceMode ? join(repoRoot, ".claude-plugin", "marketplace.json") : null;
 const codexPluginPath = join(pluginRoot, ".codex-plugin", "plugin.json");
 const claudePluginPath = join(pluginRoot, ".claude-plugin", "plugin.json");
+const installationProvenancePath = join(pluginRoot, ".agdf-installation.json");
+const legacyLocalInstallMarkerPath = join(pluginRoot, ".agdf-local-install.json");
 const pluginDefinitionPath = join(pluginRoot, "meta", "agdf-plugin.definition.json");
 const agentRouterPath = join(pluginRoot, "meta", "agdf-agent-router.md");
 const runtimeContractPath = join(pluginRoot, "meta", "agdf-runtime-contract.md");
@@ -203,6 +206,32 @@ function readJson(path, label) {
   }
 }
 
+function digestPluginSource(root, canonicalVersion) {
+  const files = [];
+  function visit(directory) {
+    for (const name of readdirSync(directory).sort()) {
+      const path = join(directory, name);
+      const stats = statSync(path);
+      if (stats.isDirectory()) visit(path);
+      else if (stats.isFile()) files.push(path);
+    }
+  }
+  visit(root);
+  const hash = createHash("sha256");
+  for (const path of files) {
+    const normalizedPath = relative(root, path).replaceAll("\\", "/");
+    if ([".agdf-installation.json", ".agdf-local-install.json"].includes(normalizedPath)) continue;
+    const content = normalizedPath === ".codex-plugin/plugin.json"
+      ? `${JSON.stringify({ ...readJson(path, "Codex plugin manifest"), version: canonicalVersion }, null, 2)}\n`
+      : readFileSync(path);
+    hash.update(normalizedPath);
+    hash.update("\0");
+    hash.update(content);
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+
 function stripAllowedGerman(content) {
   let next = content;
   for (const fragment of allowedGermanFragments) {
@@ -300,7 +329,8 @@ assertFile(join(controlRoot, "README.md"), "AGDF control scaffold README");
 assertFile(pluginLicensePath, "plugin LICENSE");
 
 if (sourceMode) {
-  assertFile(marketplacePath, "plugin marketplace");
+  if (isFile(codexSourceMarketplacePath)) failures.push("source checkout must not expose a runtime-free Codex marketplace");
+  if (isFile(claudeSourceMarketplacePath)) failures.push("source checkout must not expose a runtime-free Claude marketplace");
   assertFile(agdfPackagePath, "agdf CLI package manifest");
   assertFile(createAgdfPackagePath, "create-agdf package manifest");
   assertFile(pagesPackagePath, "Pages package manifest");
@@ -328,6 +358,7 @@ for (const forbiddenRuntimeDirectory of ["installers", "lifecycle", "scaffold"])
 }
 for (const requiredRuntimeFile of sourceMode ? [] : [
   "runtime/create-agdf/lib/runtime/validator-application.js",
+  "runtime/create-agdf/lib/runtime/plugin-provenance.js",
   "runtime/create-agdf/lib/cli/validation-handlers.js",
 ]) assertFile(join(pluginRoot, requiredRuntimeFile), `focused surface-local runtime module ${requiredRuntimeFile}`);
 if (!sourceMode && isFile(localRuntimeEntrypointPath)) {
@@ -401,6 +432,8 @@ for (const required of [
 }
 const codexPlugin = isFile(codexPluginPath) ? readJson(codexPluginPath, "Codex plugin manifest") : null;
 const claudePlugin = isFile(claudePluginPath) ? readJson(claudePluginPath, "Claude plugin manifest") : null;
+const installationProvenance = isFile(installationProvenancePath) ? readJson(installationProvenancePath, "AGDF installation provenance") : null;
+const legacyLocalInstallMarker = isFile(legacyLocalInstallMarkerPath) ? readJson(legacyLocalInstallMarkerPath, "legacy AGDF local install marker") : null;
 const agdfPackage = isFile(agdfPackagePath) ? readJson(agdfPackagePath, "agdf CLI package manifest") : null;
 const createAgdfPackage = isFile(createAgdfPackagePath) ? readJson(createAgdfPackagePath, "create-agdf package manifest") : null;
 const pagesPackage = isFile(pagesPackagePath) ? readJson(pagesPackagePath, "Pages package manifest") : null;
@@ -637,8 +670,18 @@ if (pluginDefinition) {
       if (!skill?.boundary) failures.push(`canonical AGDF plugin definition skill ${skill?.slug ?? "<unknown>"} must declare boundary`);
     }
   }
-  if (pluginDefinition.marketplaces?.repository?.name !== "agdf-repo") failures.push("canonical AGDF plugin definition repository marketplace name must be agdf-repo");
-  if (pluginDefinition.marketplaces?.repository?.displayName !== "This repository") failures.push("canonical AGDF plugin definition repository marketplace display name must be This repository");
+  const expectedProfiles = {
+    "source-development": { runtime: "absent", installable: false, machineValidation: "unavailable" },
+    "runtime-plugin": { runtime: "required", installable: true, machineValidation: "local_exact_version_digest" },
+    "opencode-config-local": { runtime: "config_local_package", installable: true, machineValidation: "local_exact_version" },
+    "portable-skills": { runtime: "absent", installable: true, machineValidation: "unavailable_or_external_required" },
+  };
+  if (pluginDefinition.distributionProfiles?.schemaVersion !== 1
+      || pluginDefinition.distributionProfiles?.marketplaceIdentities?.durable !== "agdf"
+      || pluginDefinition.distributionProfiles?.marketplaceIdentities?.generatedRepository !== "agdf-repo"
+      || JSON.stringify(pluginDefinition.distributionProfiles?.profiles) !== JSON.stringify(expectedProfiles)) {
+    failures.push("canonical AGDF plugin definition distribution profiles must match the runtime integrity contract");
+  }
   expectedSkills = (pluginDefinition.skillSet ?? [])
     .map((skill) => `${pluginDefinition.codex?.skillPrefix ?? ""}${skill?.slug ?? ""}`)
     .sort();
@@ -709,7 +752,21 @@ if (isFile(pagesSiteDataPath)) {
 
 if (codexPlugin && pluginDefinition) {
   if (codexPlugin.name !== pluginDefinition.id) failures.push("Codex plugin manifest name must match canonical AGDF plugin definition");
-  if (codexPlugin.version !== pluginDefinition.version) failures.push("Codex plugin manifest version must match canonical AGDF plugin definition");
+  const expectedInstallVersion = installationProvenance?.codex_install_version ?? pluginDefinition.version;
+  const validInstalledProjection = !sourceMode
+    && installationProvenance?.schema_version === 1
+    && installationProvenance?.owner === "create-agdf"
+    && installationProvenance?.profile_id === "runtime-plugin"
+    && installationProvenance?.marketplace_id === "agdf"
+    && installationProvenance?.canonical_version === pluginDefinition.version
+    && /^[a-f0-9]{64}$/.test(installationProvenance?.source_digest ?? "")
+    && installationProvenance?.source_digest === digestPluginSource(pluginRoot, pluginDefinition.version)
+    && installationProvenance?.runtime_digest === localRuntimeManifest?.digest
+    && codexPlugin.version === expectedInstallVersion;
+  if (codexPlugin.version !== pluginDefinition.version && !validInstalledProjection) failures.push("Codex plugin manifest version must match canonical AGDF plugin definition or one owned installed projection");
+  if (installationProvenance && !validInstalledProjection) failures.push("AGDF installation provenance must match plugin, runtime and normalized source digests");
+  if (sourceMode && (installationProvenance || legacyLocalInstallMarker)) failures.push("source plugin must not contain AGDF installation provenance");
+  if (!sourceMode && legacyLocalInstallMarker) failures.push("installed plugin must not retain the legacy AGDF local install marker");
   if (codexPlugin.description !== pluginDefinition.description) failures.push("Codex plugin manifest description must match canonical AGDF plugin definition");
   if (codexPlugin.homepage !== pluginDefinition.homepage) failures.push("Codex plugin manifest homepage must match canonical AGDF plugin definition");
   if (codexPlugin.repository !== pluginDefinition.repository) failures.push("Codex plugin manifest repository must match canonical AGDF plugin definition");
@@ -962,18 +1019,6 @@ if (isFile(runtimeContractPath)) {
   }
 }
 
-if (sourceMode) {
-  const marketplace = isFile(marketplacePath) ? readJson(marketplacePath, "plugin marketplace") : null;
-  const agdfMarketplaceEntry = marketplace?.plugins?.find((plugin) => plugin?.name === "agdf");
-  if (!agdfMarketplaceEntry) {
-    failures.push("plugin marketplace must expose agdf");
-  } else {
-    if (agdfMarketplaceEntry.source !== "./plugin/") failures.push("plugin marketplace agdf source must point to ./plugin/");
-    if (Object.hasOwn(agdfMarketplaceEntry, "policy")) failures.push("Claude plugin marketplace agdf entry must not use unsupported policy field");
-    if (agdfMarketplaceEntry.category !== "Productivity") failures.push("plugin marketplace agdf category must be Productivity");
-  }
-}
-
 const actualSkills = readdirSync(skillRoot)
   .filter((entry) => statSync(join(skillRoot, entry)).isDirectory())
   .sort();

package/generated/plugins/agdf/submission/openai/availability.md

@@ -1,6 +1,6 @@
 # Availability Decision Record
 
-- release: `0.13.5`
+- release: `0.13.7`
 - decision_state: `pending`
 - decision_owner: verified publisher
 - countries: not selected

package/generated/plugins/agdf/submission/openai/capability-matrix.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.13.5",
+  "releaseVersion": "0.13.7",
   "evidenceStates": [
     "common",
     "codex-specific",

package/generated/plugins/agdf/submission/openai/release-notes.md

@@ -1,4 +1,4 @@
-# AGDF 0.13.5 — Initial OpenAI Public Plugin Candidate
+# AGDF 0.13.7 — Initial OpenAI Public Plugin Candidate
 
 This candidate packages the canonical AGDF workflow skills for public discovery in ChatGPT and
 Codex. It helps users assess delivery fit, preserve explicit human approvals, inspect existing-system

package/generated/plugins/agdf/submission/openai/reviewer-cases.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.13.5",
+  "releaseVersion": "0.13.7",
   "cases": [
     {
       "id": "positive-proportional-fit",

package/generated/submissions/openai/agdf/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agdf",
-  "version": "0.13.5",
+  "version": "0.13.7",
   "description": "Control layer for governed AI-assisted delivery.",
   "author": {
     "name": "Arndt Gold",

package/generated/submissions/openai/agdf/meta/agdf-plugin.definition.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "id": "agdf",
-  "version": "0.13.5",
+  "version": "0.13.7",
   "displayName": "AI Governance & Delivery Framework",
   "developerName": "Arndt Gold",
   "description": "Control layer for governed AI-assisted delivery.",
@@ -33,9 +33,8 @@
       "Write"
     ],
     "defaultPrompt": [
-      "Assess whether AGDF is proportionate for this repository and request before proposing any implementation. Explain AGDF's purpose and practical benefits, weigh governance overhead against the project's delivery risk, and recommend the lightest suitable path — or explicitly advise against AGDF where it would add more process than value.",
+      "Assess whether AGDF fits this request and recommend the lightest safe path before proposing implementation.",
       "Start this request under AGDF governance.",
-      "Create durable AGDF control state for this repository.",
       "Close this delivery run with an auditable AGDF report."
     ],
     "hooks": "hooks/hooks.json"
@@ -44,9 +43,8 @@
     "skillPrefix": "",
     "agentRouter": "meta/agdf-agent-router.md",
     "defaultPrompt": [
-      "Assess whether AGDF is proportionate for this repository and request before proposing any implementation. Explain AGDF's purpose and practical benefits, weigh governance overhead against the project's delivery risk, and recommend the lightest suitable path — or explicitly advise against AGDF where it would add more process than value.",
+      "Assess whether AGDF fits this request and recommend the lightest safe path before proposing implementation.",
       "Start this request under AGDF governance.",
-      "Create durable AGDF control state for this repository.",
       "Close this delivery run with an auditable AGDF report."
     ]
   },
@@ -254,10 +252,33 @@
       "boundary": "supports Quality Readiness; no final QA decision"
     }
   ],
-  "marketplaces": {
-    "repository": {
-      "name": "agdf-repo",
-      "displayName": "This repository"
+  "distributionProfiles": {
+    "schemaVersion": 1,
+    "marketplaceIdentities": {
+      "durable": "agdf",
+      "generatedRepository": "agdf-repo"
+    },
+    "profiles": {
+      "source-development": {
+        "runtime": "absent",
+        "installable": false,
+        "machineValidation": "unavailable"
+      },
+      "runtime-plugin": {
+        "runtime": "required",
+        "installable": true,
+        "machineValidation": "local_exact_version_digest"
+      },
+      "opencode-config-local": {
+        "runtime": "config_local_package",
+        "installable": true,
+        "machineValidation": "local_exact_version"
+      },
+      "portable-skills": {
+        "runtime": "absent",
+        "installable": true,
+        "machineValidation": "unavailable_or_external_required"
+      }
     }
   }
 }

package/generated/submissions/openai/agdf/submission/openai/availability.md

@@ -1,6 +1,6 @@
 # Availability Decision Record
 
-- release: `0.13.5`
+- release: `0.13.7`
 - decision_state: `pending`
 - decision_owner: verified publisher
 - countries: not selected

package/generated/submissions/openai/agdf/submission/openai/capability-matrix.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.13.5",
+  "releaseVersion": "0.13.7",
   "evidenceStates": [
     "common",
     "codex-specific",

package/generated/submissions/openai/agdf/submission/openai/inventory.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.13.5",
-  "digest": "5e93c979972386a5b255c67bcbc491e13a21b7a6a046c292bd0fd4cfd60a72e0",
+  "releaseVersion": "0.13.7",
+  "digest": "66e5c26d1673393afd09b24ff17306497f958414ab24f2e1e3b55fb7cd3ad18e",
   "files": [
     {
       "path": ".codex-plugin/plugin.json",
-      "sha256": "50cfbd46d2b9584ce53fd58ef30d78560dff54f086f138bacb4e882ce558d06f"
+      "sha256": "be5e69d2c1c1a1ac8e1da3b4770003b027ddbf32b7dd7eeab2519aa6316a7b32"
     },
     {
       "path": "assets/agdf-icon.svg",
@@ -29,7 +29,7 @@
     },
     {
       "path": "meta/agdf-plugin.definition.json",
-      "sha256": "65918917ec5a640a093b26638fca4151de2863d659280e97cb88a10722951312"
+      "sha256": "ce61ec6a7210c34616e4eda529029629c3e3b74756921c437bc2aa51387dc56a"
     },
     {
       "path": "meta/agdf-runtime-contract.md",
@@ -157,23 +157,23 @@
     },
     {
       "path": "submission/openai/availability.md",
-      "sha256": "65cb1697e3d7a9cd096e8adee1aa5670f3a075f3ff000d1c8d0e4dcc4a2f65a9"
+      "sha256": "940be7ccc82c41be6c2a53e58e7fac6e1d580d1c622ee8457134ddb9d502b2ba"
     },
     {
       "path": "submission/openai/capability-matrix.json",
-      "sha256": "0509483fd59a74e924fb1339bbe71f68bc00dd70c948dfda99f77c6b74edc8ac"
+      "sha256": "108c87450f6c234dec7c371df21a80a31647fb158eaae9768af14095f3dbc448"
     },
     {
       "path": "submission/openai/listing.json",
-      "sha256": "55d09444fcbc0b8f4d953d1ede9e930647f6551236e6fac54f759f127c2ccf6a"
+      "sha256": "daeaad9b36df9f37b07c505ef081297e67bc171b3a58bca5e2b022f3658c36f3"
     },
     {
       "path": "submission/openai/release-notes.md",
-      "sha256": "dfca2f38093336d508e341ce9ddd79fefa76db59aac9a9bed7b513ab39a21bf3"
+      "sha256": "69fb2e3dfd2af90de40c07019f4dac960d950871dfdf5819be59613688286b7b"
     },
     {
       "path": "submission/openai/reviewer-cases.json",
-      "sha256": "6e242aaf7b381353ffd5924f91cc257bc65c14b1f8960612ec33db9558ee0c35"
+      "sha256": "dc3b27cd47fb390e105c386c3e842f9da0ea554d357d42a4d99a8a13655431b1"
     }
   ]
 }

package/generated/submissions/openai/agdf/submission/openai/listing.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.13.5",
+  "releaseVersion": "0.13.7",
   "submissionType": "skills",
   "identity": {
     "technicalId": "agdf",

package/generated/submissions/openai/agdf/submission/openai/readiness.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.13.5",
+  "releaseVersion": "0.13.7",
   "candidateState": "repository_ready",
   "submissionReady": false,
   "submissionBlockers": [
@@ -16,7 +16,7 @@
     },
     "bundle": {
       "state": "pass",
-      "detail": "43 inventoried files; inventory digest 5e93c979972386a5b255c67bcbc491e13a21b7a6a046c292bd0fd4cfd60a72e0"
+      "detail": "43 inventoried files; inventory digest 66e5c26d1673393afd09b24ff17306497f958414ab24f2e1e3b55fb7cd3ad18e"
     },
     "installed_host": {
       "state": "unverified",

package/generated/submissions/openai/agdf/submission/openai/readiness.md

@@ -1,6 +1,6 @@
 # AGDF Public Plugin Readiness
 
-- release: `0.13.5`
+- release: `0.13.7`
 - candidate_state: `repository_ready`
 - submission_ready: `false`
 
@@ -9,7 +9,7 @@
 | Class | State | Detail |
 |---|---|---|
 | repository | pass | canonical contract and deterministic source checks |
-| bundle | pass | 43 inventoried files; inventory digest 5e93c979972386a5b255c67bcbc491e13a21b7a6a046c292bd0fd4cfd60a72e0 |
+| bundle | pass | 43 inventoried files; inventory digest 66e5c26d1673393afd09b24ff17306497f958414ab24f2e1e3b55fb7cd3ad18e |
 | installed_host | unverified | PPD-L02 and PPD-L03 not performed |
 | portal | unverified | unverified |
 | post_publication | unverified | not published |

package/generated/submissions/openai/agdf/submission/openai/release-notes.md

@@ -1,4 +1,4 @@
-# AGDF 0.13.5 — Initial OpenAI Public Plugin Candidate
+# AGDF 0.13.7 — Initial OpenAI Public Plugin Candidate
 
 This candidate packages the canonical AGDF workflow skills for public discovery in ChatGPT and
 Codex. It helps users assess delivery fit, preserve explicit human approvals, inspect existing-system

package/generated/submissions/openai/agdf/submission/openai/reviewer-cases.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.13.5",
+  "releaseVersion": "0.13.7",
   "cases": [
     {
       "id": "positive-proportional-fit",