MarshalFleet 0.2.0__tar.gz

marshalfleet-0.2.0/.claude-plugin/marketplace.json

@@ -0,0 +1,25 @@
+{
+  "name": "marshal",
+  "description": "Marshal: run a fleet of headless coding agents in parallel, each isolated in its own git worktree, with per-provider cost tracking and measured routing benchmarks.",
+  "owner": {
+    "name": "chiruu12",
+    "url": "https://github.com/chiruu12"
+  },
+  "plugins": [
+    {
+      "name": "marshal",
+      "source": "./",
+      "description": "Drive a fleet of headless coding agents (Cursor, OpenCode, Codex, Antigravity, Claude Code, Command Code, Goose) from one driver: parallel git-worktree isolation, per-provider cost tracking, and measured routing benchmarks. Bundles the marshal-orchestrate, marshal-benchmark, marshal-workflow, marshal-review-gate, marshal-plan-consensus, and marshal-adversarial-review skills and the Marshal MCP server (see docs/mcp-tools.md; multi-workspace).",
+      "version": "0.2.0",
+      "license": "MIT",
+      "homepage": "https://github.com/chiruu12/marshal",
+      "keywords": [
+        "ai",
+        "coding-agents",
+        "orchestration",
+        "mcp",
+        "cost-tracking"
+      ]
+    }
+  ]
+}

marshalfleet-0.2.0/.claude-plugin/plugin.json

@@ -0,0 +1,39 @@
+{
+  "name": "marshal",
+  "version": "0.2.0",
+  "description": "The control plane for AI coding agents. Drive a fleet of headless workers (Cursor, OpenCode, Codex, Antigravity, Claude Code, Command Code, Goose) from one driver: each task runs isolated in its own git worktree, in parallel, with per-provider cost tracking and measured routing benchmarks. Bundles the marshal-orchestrate, marshal-benchmark, marshal-workflow, marshal-review-gate, marshal-plan-consensus, and marshal-adversarial-review skills plus the Marshal MCP server (see docs/mcp-tools.md; multi-workspace: one server drives several repos, registered in ~/.marshal/workspaces.yaml).",
+  "author": {
+    "name": "chiruu12",
+    "url": "https://github.com/chiruu12"
+  },
+  "homepage": "https://github.com/chiruu12/marshal",
+  "repository": "https://github.com/chiruu12/marshal",
+  "license": "MIT",
+  "keywords": [
+    "ai",
+    "coding-agents",
+    "orchestration",
+    "mcp",
+    "fleet",
+    "cost-tracking",
+    "cursor",
+    "opencode",
+    "codex",
+    "antigravity",
+    "claude-code"
+  ],
+  "mcpServers": {
+    "marshal": {
+      "command": "uv",
+      "args": [
+        "run",
+        "--project",
+        "${CLAUDE_PLUGIN_ROOT}",
+        "--extra",
+        "mcp",
+        "marshal",
+        "mcp"
+      ]
+    }
+  }
+}

marshalfleet-0.2.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,71 @@
+name: Bug report
+description: Report a problem with Marshal
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for filing a bug. Please do **not** report security vulnerabilities here - see SECURITY.md.
+  - type: input
+    id: version
+    attributes:
+      label: Marshal version / commit
+      description: Output of `uv run marshal --version` or the git commit SHA.
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: OS and Python version
+      placeholder: "e.g. macOS 14.5, Python 3.12.11"
+    validations:
+      required: true
+  - type: dropdown
+    id: backend
+    attributes:
+      label: Which backend(s)?
+      multiple: true
+      options:
+        - cursor
+        - opencode
+        - codex
+        - antigravity
+        - claude-code
+        - not backend-specific
+    validations:
+      required: true
+  - type: input
+    id: auth
+    attributes:
+      label: How is that backend authenticated?
+      placeholder: "e.g. opencode auth login / codex login / OPENAI_API_KEY env"
+  - type: textarea
+    id: doctor
+    attributes:
+      label: Output of `uv run marshal doctor`
+      render: text
+  - type: textarea
+    id: config
+    attributes:
+      label: fleet.config.yaml (redact any secrets / client names you don't want public)
+      render: yaml
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. ...
+        2. ...
+    validations:
+      required: true
+  - type: textarea
+    id: expected_actual
+    attributes:
+      label: Expected vs actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs / error output
+      render: text

marshalfleet-0.2.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/chiruu12/marshal/security/advisories/new
+    about: Report security issues privately. Do not open a public issue. See SECURITY.md.

marshalfleet-0.2.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,40 @@
+name: Feature request
+description: Suggest an improvement or new capability
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What are you trying to do, and what's getting in the way?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - new backend adapter
+        - MCP tool surface
+        - usage / cost tracking
+        - benchmark / report
+        - worktree / integrate
+        - CLI
+        - docs
+        - other
+    validations:
+      required: true
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context

marshalfleet-0.2.0/.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  # GitHub Actions used by the CI/release workflows.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "ci"
+    groups:
+      actions:
+        patterns: ["*"]
+
+  # Python dependencies, resolved from pyproject.toml + uv.lock.
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "deps"
+    groups:
+      python:
+        patterns: ["*"]

marshalfleet-0.2.0/.github/pull_request_template.md

@@ -0,0 +1,16 @@
+## Summary
+
+<!-- One line describing WHAT this change ships (not how, not iteration history). -->
+
+## Details
+
+<!-- What changed and why, if not obvious from the summary. -->
+
+## Checklist
+
+- [ ] Ran the gate locally: `uv run pytest -q && uv run ruff check src tests && uv run mypy`
+- [ ] Updated docs (`README.md` / `docs/` / `CLAUDE.md`) if behavior changed
+- [ ] Added a `## [Unreleased]` entry to `CHANGELOG.md`
+- [ ] No internal process / planning notes / cost figures in commits, PR text, or docs
+- [ ] **New backend?** Added contract tests for `build_invocation` and `map_permission`, and
+      registered the factory in `registry.py`

marshalfleet-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  gate:
+    name: gate (${{ matrix.os }} py${{ matrix.python-version }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ["ubuntu-latest"]
+        python-version: ["3.11", "3.12", "3.13"]
+        # Also exercise the POSIX process-group logic (killpg / start_new_session / worktrees) on
+        # macOS, the platform Marshal is developed on, for one Python version.
+        include:
+          - os: "macos-latest"
+            python-version: "3.12"
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v9.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+
+      - name: Sync dependencies
+        run: uv sync --frozen --extra mcp --extra dev
+
+      - name: Tests (with coverage gate)
+        run: uv run pytest -q --cov=marshal_engine --cov-report=term-missing --cov-fail-under=90
+
+      - name: Lint (ruff)
+        run: uv run ruff check src tests
+
+      - name: Type-check (mypy strict)
+        run: uv run mypy

marshalfleet-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,108 @@
+name: Release
+
+# Publish to PyPI only when a GitHub Release is published, or via manual
+# workflow_dispatch. Never on push to a branch / tag.
+#
+# Maintainer setup (one-time) for PyPI Trusted Publishing (OIDC) — no API token:
+# 1. Create a GitHub Environment named `PYPI` on this repo AND configure protection
+#    rules (required reviewers, deployment branches limited to `v*` tags).
+#    Treat this as REQUIRED, not optional. `workflow_dispatch` runs the workflow
+#    file as it exists ON THE SELECTED REF, so the tag/version guard below — and
+#    the gate above it — can be edited away on an attacker-controlled branch. PyPI
+#    validates the workflow *filename* and environment, never the step contents.
+#    Environment protection is the only gate that lives outside the ref being built.
+# 2. On https://pypi.org/manage/account/publishing/ (or the project’s Publishing
+#    settings once it exists), add a Trusted Publisher:
+#      PyPI project name: MarshalFleet   # must equal [project].name in pyproject.toml
+#      Owner:             chiruu12
+#      Repository:        marshal
+#      Workflow:          release.yml
+#      Environment:       PYPI
+# 3. First upload can create the project if you registered a *pending* publisher
+#    before the name exists. Confirm the name is still free (or switch
+#    pyproject `[project].name` to the fallback) before cutting the first release.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write  # required for PyPI Trusted Publishing (OIDC)
+
+# A PyPI version can never be replaced, so two runs racing the same upload is not a retry - it is
+# one confusing partial failure. Never cancel in progress: killing a run mid-upload is worse.
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment:
+      # MUST match the GitHub Environment name EXACTLY - they are case-sensitive, and a mismatch
+      # silently resolves to a different (non-existent) environment, so its protection rules would
+      # not apply and its secrets would not be in scope. The configured environment is `PYPI`.
+      name: PYPI
+      url: https://pypi.org/p/MarshalFleet
+    steps:
+      # Every action in this job is pinned by commit SHA. The job holds `id-token: write`, so any
+      # step in it can reach the publishing credential - a mutable tag anywhere here is a way in.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
+        with:
+          python-version: "3.12"
+          enable-cache: true
+
+      - name: Gate
+        run: |
+          uv sync --frozen --extra mcp --extra dev
+          uv run pytest -q --cov=marshal_engine --cov-fail-under=90 && uv run ruff check src tests && uv run mypy
+
+      - name: Build sdist + wheel
+        run: uv build
+
+      # A publish is irreversible: PyPI never lets a version be replaced. `workflow_dispatch` lets
+      # a maintainer pick ANY ref, so without this a mis-selected branch publishes whatever it
+      # happens to contain under whatever version it happens to declare. Refuse unless the ref is a
+      # tag and the built version is exactly that tag - which also catches the far likelier mistake
+      # of cutting a release without bumping `[project].version`.
+      - name: Refuse to publish a ref whose version is not the tag
+        # A git tag may legally contain shell metacharacters, so `github.ref_name` reaches the
+        # script through `env` and is only ever read as "$TAG". Interpolating it into the script
+        # body would let a crafted tag run commands here - in a job holding `id-token: write`,
+        # before this very check.
+        env:
+          TAG: ${{ github.ref_name }}
+          REF_TYPE: ${{ github.ref_type }}
+        run: |
+          set -euo pipefail
+          if [ "$REF_TYPE" != "tag" ]; then
+            echo "::error::refusing to publish from $REF_TYPE '$TAG' - release from a tag"
+            exit 1
+          fi
+          # Read the version off the BUILT WHEEL, not the source tree. hatchling builds from
+          # `[project].version` in pyproject.toml, so checking `marshal_engine.__version__` would
+          # verify a value the artifact does not necessarily carry: if the two drift, the guard
+          # passes while PyPI receives a different version than the tag claims.
+          wheel="$(ls dist/*.whl)"
+          version="$(basename "$wheel" | cut -d- -f2)"
+          if [ -z "$version" ]; then
+            echo "::error::could not read a version from the built wheel '$wheel'"
+            exit 1
+          fi
+          if [ "$TAG" != "v$version" ] && [ "$TAG" != "$version" ]; then
+            echo "::error::tag '$TAG' does not match built version '$version' - bump [project].version or retag"
+            exit 1
+          fi
+          echo "publishing $version from tag $TAG"
+
+      - name: Publish to PyPI
+        # OIDC trusted publishing — do not add password / API-token secrets.
+        # Pinned to a commit SHA, not the `v1.14.0` tag: a tag is mutable, and this step runs in a
+        # job holding `id-token: write`, so whatever it resolves to can publish as us. Bump the SHA
+        # and the trailing version comment together.
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247  # v1.14.1

marshalfleet-0.2.0/.gitignore

@@ -0,0 +1,58 @@
+# OS
+.DS_Store
+
+# Dependencies
+node_modules/
+.venv/
+__pycache__/
+*.pyc
+
+# Build
+dist/
+build/
+.next/
+.turbo/
+
+# Environment
+.env
+.env.local
+.env.*.local
+
+# IDE
+.idea/
+.vscode/settings.json
+*.swp
+*.swo
+
+# Claude Code (local tooling - the public driver Skills live in skills/, not here)
+.context/
+.claude/
+.commandcode/
+tmp/
+
+# Internal notes - strategy / decisions / plans, kept local, not part of the public docs set
+docs/internal/
+
+# Python
+.ruff_cache/
+.pytest_cache/
+.mypy_cache/
+.coverage
+*.egg-info/
+
+# A user's real fleet config (copied from fleet.config.example.yaml) - never commit it
+fleet.config.yaml
+
+# A user's own workflow recipes (they reference local client names). Templates ship in
+# examples/workflows/; user recipes live in the repo-root workflows/, local-only.
+/workflows/
+
+# Marshal runtime state (worktrees, fleet.json, usage)
+.marshal/
+
+# Live agent-run artifacts + playground (review locally, don't commit)
+marshal-runs/
+
+# Local dogfood review panels (they reference clients from the gitignored fleet.config.yaml).
+# Shareable starters live in examples/teams/.
+teams/

marshalfleet-0.2.0/.python-version

@@ -0,0 +1 @@
+3.12