create-agdf 0.14.1 → 0.14.2

package/generated/plugins/copilot/agdf/meta/agdf-plugin.definition.json

@@ -0,0 +1,331 @@
+{
+  "schemaVersion": 1,
+  "id": "agdf",
+  "version": "0.14.2",
+  "displayName": "AI Governance & Delivery Framework",
+  "developerName": "Arndt Gold",
+  "description": "Control layer for governed AI-assisted delivery.",
+  "longDescription": "AI Governance & Delivery Framework (AGDF) is a governance framework for agentic work. Its first implementation provides a control layer for governed AI-assisted software delivery. It combines workflow skills, explicit gates, control templates and machine-readable repository checks to keep work aligned with approved scope and make evidence a prerequisite for consequential gate transitions. Supported workflows include brownfield analysis, task-plan review, QA decisions, durable run state and auditable delivery closeout. AGDF is an independent open-source project, not a security sandbox, compliance certification or autonomous release system.",
+  "homepage": "https://agdf.iself.eu",
+  "repository": "https://github.com/arndtgold/ai-native-governance-delivery-framework",
+  "license": "Apache-2.0",
+  "keywords": [
+    "agentic",
+    "governance",
+    "delivery",
+    "ai-native",
+    "brownfield"
+  ],
+  "category": "Productivity",
+  "brandColor": "#14B8A6",
+  "author": {
+    "name": "Arndt Gold",
+    "url": "https://agdf.iself.eu"
+  },
+  "codex": {
+    "skills": "./skills/",
+    "skillPrefix": "",
+    "agentRouter": "meta/agdf-agent-router.md",
+    "composerIcon": "./assets/agdf-icon.svg",
+    "logo": "./assets/agdf-logo.svg",
+    "capabilities": [
+      "Read",
+      "Write"
+    ],
+    "defaultPrompt": [
+      "Assess whether AGDF fits this request and recommend the lightest safe path before proposing implementation.",
+      "Start this request under AGDF governance.",
+      "Close this delivery run with an auditable AGDF report."
+    ],
+    "hooks": "hooks/hooks.json"
+  },
+  "claude": {
+    "skillPrefix": "",
+    "agentRouter": "meta/agdf-agent-router.md",
+    "defaultPrompt": [
+      "Assess whether AGDF fits this request and recommend the lightest safe path before proposing implementation.",
+      "Start this request under AGDF governance.",
+      "Close this delivery run with an auditable AGDF report."
+    ]
+  },
+  "copilot": {
+    "skillPrefix": "agdf-",
+    "runtimeContractFileName": "agdf-runtime-contract.md",
+    "pluginManifest": "plugin.json",
+    "skills": "copilot-skills/",
+    "hooks": "hooks/copilot-hooks.json"
+  },
+  "opencode": {
+    "skillPrefix": "agdf-",
+    "globalSkillPrefix": "agdf-global-",
+    "evaluatorAgentName": "agdf-evaluator",
+    "runtimeContractFileName": "agdf-runtime-contract.md",
+    "instructionsFileName": "AGDF.md",
+    "npmPackage": "create-agdf",
+    "permissions": {
+      "question": "allow",
+      "edit": "ask",
+      "bash": "ask",
+      "skill": {
+        "agdf-*": "allow"
+      }
+    }
+  },
+  "automaticRuntimeChecks": {
+    "schemaVersion": 1,
+    "capabilityId": "automatic-runtime-checks",
+    "adapterContractVersion": 1,
+    "entrypoint": "runtime/agdf-session-check.js",
+    "operations": [
+      "resolve-local-runtime",
+      "inspect-control-state",
+      "render-bounded-orientation"
+    ],
+    "constraints": {
+      "arguments": "forbidden",
+      "filesystemWrites": "forbidden",
+      "network": "forbidden",
+      "gateAuthority": "none"
+    },
+    "surfaces": {
+      "codex": "native-hook-review",
+      "claude": "exact-command-rule",
+      "copilot": "plugin-hook-review",
+      "opencode": "plugin-internal",
+      "portable-skills": "manual-external-required"
+    }
+  },
+  "interactions": {
+    "fallback": "exact_text",
+    "localeRegistry": "meta/agdf-interaction-locales.json",
+    "fallbackLocale": "en",
+    "optionOrder": [
+      "approve",
+      "revise",
+      "decline",
+      "cancel"
+    ],
+    "outcomes": [
+      "approve",
+      "revise",
+      "decline",
+      "cancel",
+      "no_response",
+      "timeout",
+      "empty",
+      "invalid",
+      "stale"
+    ],
+    "surfaces": {
+      "codex": {
+        "questionAdapter": "request_user_input",
+        "availability": "when_callable",
+        "gateSafety": "omit_auto_resolution",
+        "explicitOutcomes": [
+          "approve",
+          "revise",
+          "decline"
+        ],
+        "dismissOutcome": "cancel",
+        "approvalValueTransport": "exact_option_value",
+        "waitSafety": "deliberate_no_auto_resolution",
+        "authorizationPath": "exact_text",
+        "technicalPermissionOwner": "codex_host"
+      },
+      "claude": {
+        "questionAdapter": "AskUserQuestion",
+        "availability": "when_no_auto_continue_timeout",
+        "gateSafety": "no_timeout_or_hook_supplied_answer",
+        "explicitOutcomes": [
+          "approve",
+          "revise",
+          "decline"
+        ],
+        "dismissOutcome": "cancel",
+        "approvalValueTransport": "exact_option_value",
+        "waitSafety": "deliberate_no_auto_resolution",
+        "authorizationPath": "exact_text",
+        "technicalPermissionOwner": "claude_host"
+      },
+      "copilot": {
+        "questionAdapter": "exact_text",
+        "availability": "always",
+        "gateSafety": "wait_for_deliberate_user_input",
+        "explicitOutcomes": [
+          "approve",
+          "revise",
+          "decline",
+          "cancel"
+        ],
+        "approvalValueTransport": "exact_option_value",
+        "waitSafety": "deliberate_no_auto_resolution",
+        "authorizationPath": "exact_text",
+        "technicalPermissionOwner": "copilot_host"
+      },
+      "opencode": {
+        "questionAdapter": "question",
+        "availability": "when_permission_question_allows",
+        "gateSafety": "preserve_explicit_deny",
+        "explicitOutcomes": [
+          "approve",
+          "revise",
+          "decline"
+        ],
+        "dismissOutcome": "cancel",
+        "approvalValueTransport": "exact_option_value",
+        "waitSafety": "deliberate_no_auto_resolution",
+        "authorizationPath": "exact_text",
+        "technicalPermissionOwner": "opencode_host"
+      },
+      "fallback": {
+        "questionAdapter": "exact_text",
+        "availability": "always",
+        "gateSafety": "wait_for_deliberate_user_input",
+        "explicitOutcomes": [
+          "approve",
+          "revise",
+          "decline",
+          "cancel"
+        ],
+        "approvalValueTransport": "exact_option_value",
+        "waitSafety": "deliberate_no_auto_resolution",
+        "authorizationPath": "exact_text",
+        "technicalPermissionOwner": "host_specific"
+      }
+    }
+  },
+  "publicDistribution": {
+    "schemaVersion": 1,
+    "submissionType": "skills",
+    "technicalId": "agdf",
+    "publicDisplayName": "AGDF",
+    "fullDisplayName": "AI Governance & Delivery Framework (AGDF)",
+    "shortDescription": "Governed AI delivery controls",
+    "developerName": "Arndt Gold",
+    "publisher": {
+      "target": "Arndt Gold",
+      "verificationState": "unverified"
+    },
+    "category": "Productivity",
+    "urls": {
+      "website": "https://agdf.iself.eu",
+      "privacy": "https://agdf.iself.eu/privacy",
+      "terms": "https://agdf.iself.eu/terms",
+      "support": "https://agdf.iself.eu/support"
+    },
+    "defaultPrompt": [
+      "Assess whether AGDF fits this work and recommend the lightest safe delivery path.",
+      "Start this request under AGDF governance.",
+      "Review the active AGDF run and explain the next allowed step."
+    ],
+    "availability": {
+      "decisionState": "pending",
+      "countries": [],
+      "regions": [],
+      "workspaceContexts": [],
+      "decisionOwner": "verified publisher"
+    },
+    "submissionSources": {
+      "capabilityMatrix": "submission/openai/capability-matrix.json",
+      "reviewerCases": "submission/openai/reviewer-cases.json",
+      "releaseNotes": "submission/openai/release-notes.md",
+      "availabilityDecision": "submission/openai/availability.md"
+    }
+  },
+  "skillSet": [
+    {
+      "slug": "delivery-path-search",
+      "discovery": "optional",
+      "useFor": "high-impact planning decisions with several plausible next delivery steps before implementation",
+      "boundary": "read-only advisory search; never grants gate permission or replaces gate-check"
+    },
+    {
+      "slug": "brownfield-analysis",
+      "discovery": "automatic",
+      "useFor": "after gate-check permits Brownfield Review or implementation preparation, before non-trivial changes in existing systems",
+      "boundary": "clarifies reuse, owners, risks and Mode/Slice Decision; never bypasses gate-check; Brownfield Review is not implementation permission"
+    },
+    {
+      "slug": "ux-intent-definition",
+      "discovery": "automatic",
+      "useFor": "after approved UR and post-UR routing for medium/high UI/UX impact or ambiguous low-impact product semantics before PRD readiness",
+      "boundary": "non-authorizing analytical PRD input; never creates product intent, gate permission, technical design or a parallel product source of truth"
+    },
+    {
+      "slug": "clean-implementation-review",
+      "discovery": "automatic",
+      "useFor": "evidence dimension: inspect whether the solution is structurally clean",
+      "boundary": "supports Quality Readiness; not a TP or QA substitute"
+    },
+    {
+      "slug": "code-review",
+      "discovery": "automatic",
+      "useFor": "evidence dimension: review the actual diff for defects, regression and security findings",
+      "boundary": "supports Quality Readiness; does not replace QA"
+    },
+    {
+      "slug": "delivery-closeout",
+      "discovery": "automatic",
+      "useFor": "commit/PR-near handoff after QA/OR/UAT",
+      "boundary": "never performs VCS actions automatically"
+    },
+    {
+      "slug": "gate-check",
+      "discovery": "start_here",
+      "useFor": "new build/change intent, unclear approval, Structured Delivery, later-gate artefact requested",
+      "boundary": "does not create later artefacts or skip Mode/Slice Decision after Brownfield Review"
+    },
+    {
+      "slug": "qa-gate",
+      "discovery": "automatic",
+      "useFor": "sole final Quality Readiness decision",
+      "boundary": "only instance for `pass | revise | block`"
+    },
+    {
+      "slug": "release-or",
+      "discovery": "automatic",
+      "useFor": "auditable closeout for every relevant run",
+      "boundary": "not a QA substitute"
+    },
+    {
+      "slug": "task-plan-review",
+      "discovery": "automatic",
+      "useFor": "evidence dimension: verify whether the approved Task Plan was fulfilled",
+      "boundary": "supports Quality Readiness; no final QA decision"
+    }
+  ],
+  "distributionProfiles": {
+    "schemaVersion": 1,
+    "marketplaceIdentities": {
+      "durable": "agdf",
+      "generatedRepository": "agdf-repo"
+    },
+    "profiles": {
+      "source-development": {
+        "runtime": "absent",
+        "installable": false,
+        "machineValidation": "unavailable"
+      },
+      "runtime-plugin": {
+        "runtime": "required",
+        "installable": true,
+        "machineValidation": "local_exact_version_digest"
+      },
+      "copilot-runtime-plugin": {
+        "runtime": "required",
+        "installable": true,
+        "machineValidation": "local_exact_version_digest_inventory"
+      },
+      "opencode-config-local": {
+        "runtime": "config_local_package",
+        "installable": true,
+        "machineValidation": "local_exact_version"
+      },
+      "portable-skills": {
+        "runtime": "absent",
+        "installable": true,
+        "machineValidation": "unavailable_or_external_required"
+      }
+    }
+  }
+}

package/generated/plugins/copilot/agdf/meta/agdf-runtime-contract.md

@@ -0,0 +1,16 @@
+# AGDF Runtime Contract
+
+This manifest indexes the thematic runtime-contract modules used by AGDF skills and runtime validation.
+
+| Module | Path | Coverage |
+|---|---|---|
+| Task target resolution | `contracts/task-target-resolution.md` | Primary target authority, evidence/mutation separation, governance derivation, continuation and fail-closed target states |
+| Gate transitions | `contracts/gate-transition.md` | Source precedence, scope ambiguity, gate rules, Brownfield routing and transition model |
+| Interaction | `contracts/interaction.md` | Run Status Card, approval orientation, native interaction and locale contracts |
+| Modes | `contracts/modes.md` | Mode selection, Quick Task, Verified Change, trivial and bug boundaries |
+| Quality | `contracts/quality.md` | Quality readiness, chat discipline and quality output contracts |
+| Context Graph | `contracts/context-graph.md` | Knowledge persistence and Context Graph reconciliation |
+| Control scaffold | `contracts/control-scaffold.md` | Delivery Path Search, run state, CLI verification and Delivery Map |
+| Closeout | `contracts/closeout.md` | Support bridge, relevant-run boundary and non-duplication |
+
+The explanatory framework lives in `docs/`, the operating philosophy in `plugin/meta/agdf-constitution.md`, and the principles in `plugin/meta/agdf-tenets.md`.

package/generated/plugins/{agdf → copilot/agdf}/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agdf",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "description": "Control layer for governed AI-assisted delivery.",
   "author": {
     "name": "Arndt Gold",

package/generated/plugins/copilot/agdf/runtime/agdf-local.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+
+// Generated by create-agdf/scripts/sync-plugin-runtime.js; do not edit.
+import { readFileSync } from "node:fs";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { runLocalValidator } from "./create-agdf/lib/runtime/local-validator.js";
+
+const runtimeRoot = fileURLToPath(new URL(".", import.meta.url));
+const pluginRoot = fileURLToPath(new URL("../", import.meta.url));
+const manifest = JSON.parse(readFileSync(new URL("./runtime-manifest.json", import.meta.url), "utf8"));
+process.exitCode = runLocalValidator({
+  runtimeRoot,
+  pluginRoot,
+  expectedPluginRoot: process.env.CLAUDE_PLUGIN_ROOT || process.env.PLUGIN_ROOT || undefined,
+  expectedVersion: manifest.version,
+  surface: process.env.AGDF_SURFACE || "plugin",
+}, process.argv.slice(2));

package/generated/plugins/copilot/agdf/runtime/agdf-session-check.js

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+
+// Generated by create-agdf/scripts/sync-plugin-runtime.js; do not edit.
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { digestNormalizedPluginSource } from "./create-agdf/lib/runtime/plugin-provenance.js";
+import { fixedRuntimeCheckCommand, runtimeCheckCapabilityIdentity } from "./create-agdf/lib/runtime-check-consent/contract.js";
+
+if (process.argv.length !== 2) {
+  console.error("AGDF automatic runtime check accepts no arguments.");
+  process.exitCode = 2;
+} else {
+  const surface = process.env.AGDF_SURFACE
+    || (process.env.CLAUDE_PLUGIN_ROOT ? "claude" : process.env.COPILOT_PLUGIN_DATA ? "copilot" : process.env.PLUGIN_ROOT ? "codex" : "");
+  const dataRoot = process.env.AGDF_DATA_DIR
+    || (process.platform === "darwin"
+      ? join(homedir(), "Library", "Application Support", "agdf")
+      : process.platform === "win32"
+        ? join(process.env.LOCALAPPDATA || process.env.APPDATA || join(homedir(), "AppData", "Local"), "agdf")
+        : join(process.env.XDG_DATA_HOME || join(homedir(), ".local", "share"), "agdf"));
+  let consentEnabled = false;
+  if (["codex", "claude", "copilot", "opencode"].includes(surface)) {
+    try {
+      const receipt = JSON.parse(readFileSync(join(dataRoot, "runtime-checks", `${surface}.json`), "utf8"));
+      consentEnabled = receipt?.schema_version === 1
+        && receipt?.owner === "create-agdf"
+        && receipt?.capability_id === "automatic-runtime-checks"
+        && receipt?.surface === surface
+        && receipt?.requested_state === "enabled";
+      if (consentEnabled && ["codex", "claude", "copilot"].includes(surface)) {
+        const pluginRoot = fileURLToPath(new URL("../", import.meta.url));
+        const manifest = JSON.parse(readFileSync(new URL("./runtime-manifest.json", import.meta.url), "utf8"));
+        const definition = JSON.parse(readFileSync(new URL("../meta/agdf-plugin.definition.json", import.meta.url), "utf8"));
+        const currentIdentity = runtimeCheckCapabilityIdentity({
+          capability: definition.automaticRuntimeChecks,
+          surface,
+          runtimeDigest: manifest.digest,
+          sourceDigest: digestNormalizedPluginSource(pluginRoot, manifest.version),
+          command: fixedRuntimeCheckCommand(surface, pluginRoot, process.platform),
+        });
+        consentEnabled = receipt.capability_identity === currentIdentity;
+      }
+    } catch {}
+  }
+  if (!consentEnabled) process.exit(0);
+  const validator = fileURLToPath(new URL("./agdf-local.js", import.meta.url));
+  const pluginRoot = fileURLToPath(new URL("../", import.meta.url));
+  const child = spawnSync(process.execPath, [validator, "doctor", "--all-active", "--json"], {
+    cwd: process.cwd(),
+    env: { ...process.env, AGDF_SURFACE: process.env.AGDF_SURFACE || "plugin" },
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 10000,
+    maxBuffer: 1024 * 1024,
+  });
+  let message = "AGDF automatic runtime check: no governed control state was found; manual validation remains available.";
+  try {
+    const report = JSON.parse(child.stdout || "{}");
+    const status = report.status || "unknown";
+    const findings = report.summary?.findings ?? report.reports?.reduce((sum, item) => sum + (item.summary?.findings ?? 0), 0) ?? 0;
+    message = `AGDF automatic runtime check: status=${status} findings=${findings}. This is read-only technical evidence and never grants an AGDF approval.`;
+  } catch {}
+  const configPath = join(process.cwd(), ".agdf", "control", "config.json");
+  let configHint = "Project config: .agdf/control/config.json not found. Persist project language only when durable control is needed.";
+  if (existsSync(configPath)) {
+    try {
+      const config = JSON.parse(readFileSync(configPath, "utf8"));
+      configHint = `Project config: .agdf/control/config.json (artefacts=${config.artifact_language || "unset"}, chat=${config.chat_language || "unset"}, runtime=${config.runtime_language || "en"}).`;
+    } catch {
+      configHint = "Project config: .agdf/control/config.json is invalid. Run the surface-local doctor command manually.";
+    }
+  }
+  const additionalContext = [
+    "AGDF active.",
+    "",
+    message,
+    configHint,
+    "",
+    "Use the installed AGDF skills as workflow controls.",
+    "For a new build, change, extension, refactor, CLI, app, fix with product semantics, Structured Delivery request, unclear approval, or unclear next step, use gate-check before implementation or later-gate artefacts.",
+    "Do not print the full router or constitution unless the user asks for them.",
+    "Source of truth:",
+    `- ${join(pluginRoot, "meta", "agdf-agent-router.md")}`,
+    `- ${join(pluginRoot, "meta", "agdf-constitution.md")}`,
+    `- ${join(pluginRoot, "meta", "agdf-runtime-contract.md")}`,
+  ].join("\n");
+  if (surface === "copilot") {
+    console.log(JSON.stringify({ additionalContext }));
+  } else {
+    console.log(additionalContext);
+  }
+  process.exitCode = 0;
+}

package/generated/plugins/copilot/agdf/runtime/create-agdf/NOTICE

@@ -0,0 +1,10 @@
+AI Governance & Delivery Framework (AGDF)
+
+Copyright 2024-2026 Arndt Gold.
+
+The create-agdf package is licensed under the Apache License, Version 2.0.
+
+AGDF(TM) and AI Governance & Delivery Framework(TM) are marks of Arndt Gold.
+The package license does not grant permission to use project names, trademarks,
+service marks or logos except as required for reasonable and customary
+description of the origin of the project.

package/generated/plugins/copilot/agdf/runtime/create-agdf/bin/agdf-validator.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+
+import process from "node:process";
+import { runValidatorCli } from "../lib/runtime/validator-application.js";
+
+try {
+  process.exitCode = await runValidatorCli(process.argv.slice(2));
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+}