create-agdf 0.13.6 → 0.13.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/generated/plugins/agdf/.claude-plugin/plugin.json +1 -1
- package/generated/plugins/agdf/.codex-plugin/plugin.json +1 -1
- package/generated/plugins/agdf/meta/agdf-plugin.definition.json +1 -1
- package/generated/plugins/agdf/runtime/create-agdf/generated/plugins/agdf/meta/agdf-plugin.definition.json +1 -1
- package/generated/plugins/agdf/runtime/create-agdf/package.json +1 -1
- package/generated/plugins/agdf/runtime/runtime-manifest.json +2 -2
- package/generated/plugins/agdf/submission/openai/availability.md +1 -1
- package/generated/plugins/agdf/submission/openai/capability-matrix.json +1 -1
- package/generated/plugins/agdf/submission/openai/release-notes.md +1 -1
- package/generated/plugins/agdf/submission/openai/reviewer-cases.json +1 -1
- package/generated/submissions/openai/agdf/.codex-plugin/plugin.json +1 -1
- package/generated/submissions/openai/agdf/meta/agdf-plugin.definition.json +1 -1
- package/generated/submissions/openai/agdf/submission/openai/availability.md +1 -1
- package/generated/submissions/openai/agdf/submission/openai/capability-matrix.json +1 -1
- package/generated/submissions/openai/agdf/submission/openai/inventory.json +9 -9
- package/generated/submissions/openai/agdf/submission/openai/listing.json +1 -1
- package/generated/submissions/openai/agdf/submission/openai/readiness.json +2 -2
- package/generated/submissions/openai/agdf/submission/openai/readiness.md +2 -2
- package/generated/submissions/openai/agdf/submission/openai/release-notes.md +1 -1
- package/generated/submissions/openai/agdf/submission/openai/reviewer-cases.json +1 -1
- package/lib/installers/local-marketplace.js +83 -21
- package/lib/installers/plugin-installers.js +2 -0
- package/package.json +1 -1
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "agdf",
|
|
3
|
-
"version": "0.13.
|
|
3
|
+
"version": "0.13.7",
|
|
4
4
|
"description": "AI Governance & Delivery Framework (AGDF) is a governance framework for agentic work. Its first implementation provides a control layer for governed AI-assisted software delivery. It combines workflow skills, explicit gates, control templates and machine-readable repository checks to keep work aligned with approved scope and make evidence a prerequisite for consequential gate transitions. Supported workflows include brownfield analysis, task-plan review, QA decisions, durable run state and auditable delivery closeout. AGDF is an independent open-source project, not a security sandbox, compliance certification or autonomous release system.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"agentic",
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"schema_version": "1",
|
|
3
3
|
"generated": true,
|
|
4
4
|
"source": "create-agdf/cli",
|
|
5
|
-
"version": "0.13.
|
|
5
|
+
"version": "0.13.7",
|
|
6
6
|
"entrypoint": "create-agdf/bin/agdf-validator.js",
|
|
7
|
-
"digest": "
|
|
7
|
+
"digest": "05afaf9ec478d50900a79cbdda8fcd7c61fa5627f4770ba093b19908fa6df91b"
|
|
8
8
|
}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
# AGDF 0.13.
|
|
1
|
+
# AGDF 0.13.7 — Initial OpenAI Public Plugin Candidate
|
|
2
2
|
|
|
3
3
|
This candidate packages the canonical AGDF workflow skills for public discovery in ChatGPT and
|
|
4
4
|
Codex. It helps users assess delivery fit, preserve explicit human approvals, inspect existing-system
|
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 1,
|
|
3
|
-
"releaseVersion": "0.13.
|
|
4
|
-
"digest": "
|
|
3
|
+
"releaseVersion": "0.13.7",
|
|
4
|
+
"digest": "66e5c26d1673393afd09b24ff17306497f958414ab24f2e1e3b55fb7cd3ad18e",
|
|
5
5
|
"files": [
|
|
6
6
|
{
|
|
7
7
|
"path": ".codex-plugin/plugin.json",
|
|
8
|
-
"sha256": "
|
|
8
|
+
"sha256": "be5e69d2c1c1a1ac8e1da3b4770003b027ddbf32b7dd7eeab2519aa6316a7b32"
|
|
9
9
|
},
|
|
10
10
|
{
|
|
11
11
|
"path": "assets/agdf-icon.svg",
|
|
@@ -29,7 +29,7 @@
|
|
|
29
29
|
},
|
|
30
30
|
{
|
|
31
31
|
"path": "meta/agdf-plugin.definition.json",
|
|
32
|
-
"sha256": "
|
|
32
|
+
"sha256": "ce61ec6a7210c34616e4eda529029629c3e3b74756921c437bc2aa51387dc56a"
|
|
33
33
|
},
|
|
34
34
|
{
|
|
35
35
|
"path": "meta/agdf-runtime-contract.md",
|
|
@@ -157,23 +157,23 @@
|
|
|
157
157
|
},
|
|
158
158
|
{
|
|
159
159
|
"path": "submission/openai/availability.md",
|
|
160
|
-
"sha256": "
|
|
160
|
+
"sha256": "940be7ccc82c41be6c2a53e58e7fac6e1d580d1c622ee8457134ddb9d502b2ba"
|
|
161
161
|
},
|
|
162
162
|
{
|
|
163
163
|
"path": "submission/openai/capability-matrix.json",
|
|
164
|
-
"sha256": "
|
|
164
|
+
"sha256": "108c87450f6c234dec7c371df21a80a31647fb158eaae9768af14095f3dbc448"
|
|
165
165
|
},
|
|
166
166
|
{
|
|
167
167
|
"path": "submission/openai/listing.json",
|
|
168
|
-
"sha256": "
|
|
168
|
+
"sha256": "daeaad9b36df9f37b07c505ef081297e67bc171b3a58bca5e2b022f3658c36f3"
|
|
169
169
|
},
|
|
170
170
|
{
|
|
171
171
|
"path": "submission/openai/release-notes.md",
|
|
172
|
-
"sha256": "
|
|
172
|
+
"sha256": "69fb2e3dfd2af90de40c07019f4dac960d950871dfdf5819be59613688286b7b"
|
|
173
173
|
},
|
|
174
174
|
{
|
|
175
175
|
"path": "submission/openai/reviewer-cases.json",
|
|
176
|
-
"sha256": "
|
|
176
|
+
"sha256": "dc3b27cd47fb390e105c386c3e842f9da0ea554d357d42a4d99a8a13655431b1"
|
|
177
177
|
}
|
|
178
178
|
]
|
|
179
179
|
}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 1,
|
|
3
|
-
"releaseVersion": "0.13.
|
|
3
|
+
"releaseVersion": "0.13.7",
|
|
4
4
|
"candidateState": "repository_ready",
|
|
5
5
|
"submissionReady": false,
|
|
6
6
|
"submissionBlockers": [
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
},
|
|
17
17
|
"bundle": {
|
|
18
18
|
"state": "pass",
|
|
19
|
-
"detail": "43 inventoried files; inventory digest
|
|
19
|
+
"detail": "43 inventoried files; inventory digest 66e5c26d1673393afd09b24ff17306497f958414ab24f2e1e3b55fb7cd3ad18e"
|
|
20
20
|
},
|
|
21
21
|
"installed_host": {
|
|
22
22
|
"state": "unverified",
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# AGDF Public Plugin Readiness
|
|
2
2
|
|
|
3
|
-
- release: `0.13.
|
|
3
|
+
- release: `0.13.7`
|
|
4
4
|
- candidate_state: `repository_ready`
|
|
5
5
|
- submission_ready: `false`
|
|
6
6
|
|
|
@@ -9,7 +9,7 @@
|
|
|
9
9
|
| Class | State | Detail |
|
|
10
10
|
|---|---|---|
|
|
11
11
|
| repository | pass | canonical contract and deterministic source checks |
|
|
12
|
-
| bundle | pass | 43 inventoried files; inventory digest
|
|
12
|
+
| bundle | pass | 43 inventoried files; inventory digest 66e5c26d1673393afd09b24ff17306497f958414ab24f2e1e3b55fb7cd3ad18e |
|
|
13
13
|
| installed_host | unverified | PPD-L02 and PPD-L03 not performed |
|
|
14
14
|
| portal | unverified | unverified |
|
|
15
15
|
| post_publication | unverified | not published |
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
# AGDF 0.13.
|
|
1
|
+
# AGDF 0.13.7 — Initial OpenAI Public Plugin Candidate
|
|
2
2
|
|
|
3
3
|
This candidate packages the canonical AGDF workflow skills for public discovery in ChatGPT and
|
|
4
4
|
Codex. It helps users assess delivery fit, preserve explicit human approvals, inspect existing-system
|
|
@@ -7,7 +7,7 @@ import {
|
|
|
7
7
|
writeFileSync,
|
|
8
8
|
} from "node:fs";
|
|
9
9
|
import { homedir } from "node:os";
|
|
10
|
-
import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
|
|
10
|
+
import { dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
|
|
11
11
|
import process from "node:process";
|
|
12
12
|
import { generatedRoot, packageRoot, pluginDefinition } from "../cli/runtime-context.js";
|
|
13
13
|
import { renameSyncWithRetry } from "../fs-swap.js";
|
|
@@ -40,6 +40,11 @@ function semverBase(version) {
|
|
|
40
40
|
return version.split("+")[0];
|
|
41
41
|
}
|
|
42
42
|
|
|
43
|
+
function isSemanticVersion(version) {
|
|
44
|
+
return typeof version === "string"
|
|
45
|
+
&& /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(version);
|
|
46
|
+
}
|
|
47
|
+
|
|
43
48
|
export function codexLocalInstallVersion(version, sourceDigest) {
|
|
44
49
|
if (!/^[a-f0-9]{64}$/.test(sourceDigest)) throw new Error("AGDF local source digest must be a deterministic SHA-256 value.");
|
|
45
50
|
return `${semverBase(version)}+codex.local-${sourceDigest.slice(0, 12)}`;
|
|
@@ -60,15 +65,20 @@ function readJson(path, label) {
|
|
|
60
65
|
}
|
|
61
66
|
}
|
|
62
67
|
|
|
68
|
+
function pathForPlatform(platform = process.platform) {
|
|
69
|
+
return platform === "win32" ? win32 : posix;
|
|
70
|
+
}
|
|
71
|
+
|
|
63
72
|
export function defaultAgdfDataRoot({ env = process.env, platform = process.platform, home = homedir() } = {}) {
|
|
64
|
-
|
|
65
|
-
if (
|
|
66
|
-
if (platform === "
|
|
67
|
-
return join(env.
|
|
73
|
+
const targetPath = pathForPlatform(platform);
|
|
74
|
+
if (env.AGDF_DATA_DIR) return targetPath.resolve(env.AGDF_DATA_DIR);
|
|
75
|
+
if (platform === "darwin") return targetPath.join(home, "Library", "Application Support", "agdf");
|
|
76
|
+
if (platform === "win32") return targetPath.join(env.LOCALAPPDATA || env.APPDATA || targetPath.join(home, "AppData", "Local"), "agdf");
|
|
77
|
+
return targetPath.join(env.XDG_DATA_HOME || targetPath.join(home, ".local", "share"), "agdf");
|
|
68
78
|
}
|
|
69
79
|
|
|
70
80
|
export function localMarketplaceRoot(options = {}) {
|
|
71
|
-
return join(defaultAgdfDataRoot(options), "marketplaces", MARKETPLACE_ID);
|
|
81
|
+
return pathForPlatform(options.platform).join(defaultAgdfDataRoot(options), "marketplaces", MARKETPLACE_ID);
|
|
72
82
|
}
|
|
73
83
|
|
|
74
84
|
function ownership(root, { allowBuilding = false } = {}) {
|
|
@@ -134,6 +144,7 @@ function claudeMarketplace(definition = pluginDefinition) {
|
|
|
134
144
|
function validateBuiltPlugin(pluginRoot, expectedVersion, expectedCodexInstallVersion = expectedVersion, sourceDigest = "", {
|
|
135
145
|
requireInstallationProvenance = false,
|
|
136
146
|
allowLegacyProvenanceForMigration = false,
|
|
147
|
+
allowPreProvenanceShape = false,
|
|
137
148
|
} = {}) {
|
|
138
149
|
const definition = readJson(join(pluginRoot, "meta", "agdf-plugin.definition.json"), "built plugin definition");
|
|
139
150
|
const runtime = readJson(join(pluginRoot, "runtime", "runtime-manifest.json"), "built runtime manifest");
|
|
@@ -150,8 +161,11 @@ function validateBuiltPlugin(pluginRoot, expectedVersion, expectedCodexInstallVe
|
|
|
150
161
|
if (definition.version !== expectedVersion || runtime.version !== expectedVersion) {
|
|
151
162
|
throw new Error(`Built plugin version mismatch: expected ${expectedVersion}, definition ${definition.version}, runtime ${runtime.version}`);
|
|
152
163
|
}
|
|
164
|
+
const profile = validateDistributionProfiles(definition);
|
|
165
|
+
const isPreProvenanceShape = allowPreProvenanceShape
|
|
166
|
+
&& !Object.hasOwn(definition, "distributionProfiles");
|
|
153
167
|
let provenance = null;
|
|
154
|
-
if (
|
|
168
|
+
if (profile.status !== "matched"
|
|
155
169
|
&& requireInstallationProvenance
|
|
156
170
|
&& allowLegacyProvenanceForMigration) {
|
|
157
171
|
provenance = inspectInstallationProvenance(pluginRoot, {
|
|
@@ -161,7 +175,7 @@ function validateBuiltPlugin(pluginRoot, expectedVersion, expectedCodexInstallVe
|
|
|
161
175
|
allowLegacy: true,
|
|
162
176
|
});
|
|
163
177
|
}
|
|
164
|
-
if (
|
|
178
|
+
if (profile.status !== "matched" && provenance?.status !== "legacy" && !isPreProvenanceShape) {
|
|
165
179
|
throw new Error("Built plugin distribution profile contract is invalid.");
|
|
166
180
|
}
|
|
167
181
|
if (codex.version !== expectedCodexInstallVersion) {
|
|
@@ -212,6 +226,49 @@ function validateMarketplaceRoot(root, definition = pluginDefinition) {
|
|
|
212
226
|
return Object.freeze({ codexShape });
|
|
213
227
|
}
|
|
214
228
|
|
|
229
|
+
function classifyExistingMarketplace(stableRoot, marker) {
|
|
230
|
+
const existingPluginRoot = join(stableRoot, "plugins", MARKETPLACE_ID);
|
|
231
|
+
const existingCodexInstallVersion = marker.codex_install_version ?? marker.version;
|
|
232
|
+
if (!isSemanticVersion(marker.version)
|
|
233
|
+
|| !/^[a-f0-9]{64}$/.test(marker.plugin_digest ?? "")) {
|
|
234
|
+
throw new Error(`Refusing invalid AGDF marketplace ownership evidence: ${stableRoot}`);
|
|
235
|
+
}
|
|
236
|
+
const definition = readJson(
|
|
237
|
+
join(existingPluginRoot, "meta", "agdf-plugin.definition.json"),
|
|
238
|
+
"built plugin definition",
|
|
239
|
+
);
|
|
240
|
+
const hasCurrentProvenance = existsSync(join(existingPluginRoot, INSTALLATION_PROVENANCE_FILE));
|
|
241
|
+
const hasLegacyProvenance = existsSync(join(existingPluginRoot, LEGACY_LOCAL_INSTALL_FILE));
|
|
242
|
+
const preProvenanceCandidate = !hasCurrentProvenance
|
|
243
|
+
&& !hasLegacyProvenance
|
|
244
|
+
&& !Object.hasOwn(definition, "distributionProfiles");
|
|
245
|
+
const existingDefinition = validateBuiltPlugin(
|
|
246
|
+
existingPluginRoot,
|
|
247
|
+
marker.version,
|
|
248
|
+
existingCodexInstallVersion,
|
|
249
|
+
marker.source_digest ?? "",
|
|
250
|
+
preProvenanceCandidate
|
|
251
|
+
? { allowPreProvenanceShape: true }
|
|
252
|
+
: { requireInstallationProvenance: true, allowLegacyProvenanceForMigration: true },
|
|
253
|
+
);
|
|
254
|
+
const marketplace = validateMarketplaceRoot(stableRoot, existingDefinition);
|
|
255
|
+
if (digestDirectory(existingPluginRoot) !== marker.plugin_digest) {
|
|
256
|
+
throw new Error(`Refusing tampered AGDF marketplace root: ${stableRoot}`);
|
|
257
|
+
}
|
|
258
|
+
return Object.freeze({
|
|
259
|
+
classification: preProvenanceCandidate
|
|
260
|
+
? "owned_pre_provenance_rebuild"
|
|
261
|
+
: "current_or_marker_migration",
|
|
262
|
+
definition: existingDefinition,
|
|
263
|
+
marketplace,
|
|
264
|
+
});
|
|
265
|
+
}
|
|
266
|
+
|
|
267
|
+
function invalidExistingMarketplace(error) {
|
|
268
|
+
error.existingClassification = "invalid_or_unowned";
|
|
269
|
+
return error;
|
|
270
|
+
}
|
|
271
|
+
|
|
215
272
|
function recoverInterruptedTransaction(stableRoot, stageRoot, backupRoot, failedRoot) {
|
|
216
273
|
const parent = dirname(stableRoot);
|
|
217
274
|
if (existsSync(backupRoot)) {
|
|
@@ -252,25 +309,28 @@ export function prepareLocalMarketplace({
|
|
|
252
309
|
mkdirSync(parent, { recursive: true });
|
|
253
310
|
recoverInterruptedTransaction(stableRoot, stageRoot, backupRoot, failedRoot);
|
|
254
311
|
|
|
255
|
-
|
|
312
|
+
let existing = null;
|
|
313
|
+
if (existsSync(stableRoot)) {
|
|
314
|
+
try {
|
|
315
|
+
existing = ownership(stableRoot);
|
|
316
|
+
} catch (error) {
|
|
317
|
+
throw invalidExistingMarketplace(error);
|
|
318
|
+
}
|
|
319
|
+
}
|
|
256
320
|
const targetCodexRegistrationRevision = codexRegistrationRevision
|
|
257
321
|
?? existing?.codex_registration_revision
|
|
258
322
|
?? 0;
|
|
259
323
|
let existingMarketplace = null;
|
|
324
|
+
let existingClassification = "none";
|
|
260
325
|
if (existing) {
|
|
261
|
-
|
|
262
|
-
|
|
263
|
-
|
|
264
|
-
|
|
265
|
-
|
|
266
|
-
existingCodexInstallVersion,
|
|
267
|
-
existing.source_digest ?? "",
|
|
268
|
-
{ requireInstallationProvenance: true, allowLegacyProvenanceForMigration: true },
|
|
269
|
-
);
|
|
270
|
-
existingMarketplace = validateMarketplaceRoot(stableRoot, existingDefinition);
|
|
271
|
-
if (digestDirectory(existingPluginRoot) !== existing.plugin_digest) {
|
|
272
|
-
throw new Error(`Refusing tampered AGDF marketplace root: ${stableRoot}`);
|
|
326
|
+
let classified;
|
|
327
|
+
try {
|
|
328
|
+
classified = classifyExistingMarketplace(stableRoot, existing);
|
|
329
|
+
} catch (error) {
|
|
330
|
+
throw invalidExistingMarketplace(error);
|
|
273
331
|
}
|
|
332
|
+
existingClassification = classified.classification;
|
|
333
|
+
existingMarketplace = classified.marketplace;
|
|
274
334
|
}
|
|
275
335
|
mkdirSync(stageRoot, { recursive: false });
|
|
276
336
|
try {
|
|
@@ -338,6 +398,7 @@ export function prepareLocalMarketplace({
|
|
|
338
398
|
codexInstallVersion,
|
|
339
399
|
sourceDigest,
|
|
340
400
|
digest: pluginDigest,
|
|
401
|
+
existingClassification,
|
|
341
402
|
changed: false,
|
|
342
403
|
commit() {},
|
|
343
404
|
rollback() {},
|
|
@@ -359,6 +420,7 @@ export function prepareLocalMarketplace({
|
|
|
359
420
|
codexInstallVersion,
|
|
360
421
|
sourceDigest,
|
|
361
422
|
digest: pluginDigest,
|
|
423
|
+
existingClassification,
|
|
362
424
|
changed: true,
|
|
363
425
|
commit() {
|
|
364
426
|
if (closed) return;
|
|
@@ -27,6 +27,7 @@ export function installCodexGlobalPlugin({ exec = execFileSync, prepare = prepar
|
|
|
27
27
|
...(transaction.pluginRoot ? [`staged_plugin_root:${transaction.pluginRoot}`, "staged_installation_provenance:matched"] : []),
|
|
28
28
|
...(transaction.sourceDigest ? [`source_digest:${transaction.sourceDigest}`] : []),
|
|
29
29
|
...(transaction.digest ? [`plugin_digest:${transaction.digest}`] : []),
|
|
30
|
+
...(transaction.existingClassification === "owned_pre_provenance_rebuild" ? ["marketplace_recovery:owned_pre_provenance_rebuild", "loaded_session:restart_required"] : []),
|
|
30
31
|
...(expectedInstallVersion === expectedVersion ? [] : [`canonical_version:${expectedVersion}`, `local_install_version:${expectedInstallVersion}`]),
|
|
31
32
|
],
|
|
32
33
|
nativeOutput: nativeOutput.filter(Boolean).map(String),
|
|
@@ -73,6 +74,7 @@ export function installClaudeGlobalPlugin({ exec = execFileSync, prepare = prepa
|
|
|
73
74
|
...(transaction.pluginRoot ? [`staged_plugin_root:${transaction.pluginRoot}`, "staged_installation_provenance:matched"] : []),
|
|
74
75
|
...(transaction.sourceDigest ? [`source_digest:${transaction.sourceDigest}`] : []),
|
|
75
76
|
...(transaction.digest ? [`plugin_digest:${transaction.digest}`] : []),
|
|
77
|
+
...(transaction.existingClassification === "owned_pre_provenance_rebuild" ? ["marketplace_recovery:owned_pre_provenance_rebuild", "loaded_session:restart_required"] : []),
|
|
76
78
|
...(installedVersion ? [] : ["host_did_not_expose_version"]),
|
|
77
79
|
],
|
|
78
80
|
nativeOutput: nativeOutput.filter(Boolean).map(String),
|
package/package.json
CHANGED