agtmls 0.0.3__tar.gz

agtmls-0.0.3/.agents/plugins/marketplace.json

@@ -0,0 +1,16 @@
+{
+  "interface": {
+    "displayName": "AgtMLS"
+  },
+  "name": "agtmls",
+  "plugins": [
+    {
+      "category": "Developer Tools",
+      "name": "agtmls",
+      "source": {
+        "source": "url",
+        "url": "./"
+      }
+    }
+  ]
+}

agtmls-0.0.3/.claude-plugin/marketplace.json

@@ -0,0 +1,35 @@
+{
+  "description": "The universal agent skills registry — polyglot engineering skills, system prompts, and commands for Claude Code and compatible agents.",
+  "name": "agtmls",
+  "owner": {
+    "name": "Sebastien Rousseau",
+    "url": "https://github.com/sebastienrousseau"
+  },
+  "plugins": [
+    {
+      "author": {
+        "name": "Sebastien Rousseau"
+      },
+      "category": "engineering",
+      "commands": "./commands",
+      "description": "The universal agent skills registry — polyglot engineering skills and system prompts, symlinked or installed into consumer repos.",
+      "displayName": "AgtMLS",
+      "homepage": "https://github.com/sebastienrousseau/agtmls",
+      "keywords": [
+        "skills",
+        "registry",
+        "polyglot",
+        "porting",
+        "security",
+        "release"
+      ],
+      "license": "MIT",
+      "name": "agtmls",
+      "repository": "https://github.com/sebastienrousseau/agtmls",
+      "skills": "./skills",
+      "source": "./",
+      "version": "0.0.3"
+    }
+  ],
+  "version": "0.0.3"
+}

agtmls-0.0.3/.claude-plugin/plugin.json

@@ -0,0 +1,12 @@
+{
+  "author": {
+    "name": "Sebastien Rousseau"
+  },
+  "commands": "./commands",
+  "description": "The universal agent skills registry — polyglot engineering skills and system prompts, symlinked or installed into consumer repos.",
+  "homepage": "https://github.com/sebastienrousseau/agtmls",
+  "license": "MIT",
+  "name": "agtmls",
+  "skills": "./skills",
+  "version": "0.0.3"
+}

agtmls-0.0.3/.codex-plugin/plugin.json

@@ -0,0 +1,34 @@
+{
+  "author": {
+    "name": "Sebastien Rousseau"
+  },
+  "commands": "./commands",
+  "description": "The universal agent skills registry — polyglot engineering skills and system prompts, symlinked or installed into consumer repos.",
+  "homepage": "https://github.com/sebastienrousseau/agtmls",
+  "interface": {
+    "capabilities": [
+      "Read",
+      "Write",
+      "Interactive"
+    ],
+    "developerName": "Sebastien Rousseau",
+    "displayName": "AgtMLS",
+    "shortDescription": "The universal agent skills registry",
+    "websiteURL": "https://github.com/sebastienrousseau/agtmls"
+  },
+  "keywords": [
+    "skills",
+    "registry",
+    "polyglot",
+    "porting",
+    "security",
+    "release"
+  ],
+  "license": "MIT",
+  "name": "agtmls",
+  "repository": "https://github.com/sebastienrousseau/agtmls",
+  "skills": [
+    "./skills"
+  ],
+  "version": "0.0.3"
+}

agtmls-0.0.3/.corral-state.json

@@ -0,0 +1,4 @@
+{
+  "last_synced_pushed_at": "2026-07-21T23:01:48Z",
+  "last_synced_at": "2026-08-04T13:27:59.212144Z"
+}

agtmls-0.0.3/.cursor-plugin/plugin.json

@@ -0,0 +1,23 @@
+{
+  "author": {
+    "name": "Sebastien Rousseau"
+  },
+  "description": "The universal agent skills registry — polyglot engineering skills and system prompts, symlinked or installed into consumer repos.",
+  "displayName": "AgtMLS",
+  "homepage": "https://github.com/sebastienrousseau/agtmls",
+  "keywords": [
+    "skills",
+    "registry",
+    "polyglot",
+    "porting",
+    "security",
+    "release"
+  ],
+  "license": "MIT",
+  "name": "agtmls",
+  "repository": "https://github.com/sebastienrousseau/agtmls",
+  "skills": [
+    "./skills"
+  ],
+  "version": "0.0.3"
+}

agtmls-0.0.3/.gitignore

@@ -0,0 +1,9 @@
+.DS_Store
+*.swp
+*.swo
+*~
+.ruff_cache/
+__pycache__/
+.agtmls/
+dist/
+*.egg-info/

agtmls-0.0.3/.kimi-plugin/plugin.json

@@ -0,0 +1,24 @@
+{
+  "author": {
+    "name": "Sebastien Rousseau"
+  },
+  "description": "The universal agent skills registry — polyglot engineering skills and system prompts, symlinked or installed into consumer repos.",
+  "homepage": "https://github.com/sebastienrousseau/agtmls",
+  "keywords": [
+    "skills",
+    "registry",
+    "polyglot",
+    "porting",
+    "security",
+    "release"
+  ],
+  "license": "MIT",
+  "name": "agtmls",
+  "sessionStart": {
+    "skill": "using-agtmls"
+  },
+  "skills": [
+    "./skills"
+  ],
+  "version": "0.0.3"
+}

agtmls-0.0.3/.opencode/INSTALL.md

@@ -0,0 +1,33 @@
+<!-- SPDX-FileCopyrightText: 2026 Sebastien Rousseau -->
+<!-- SPDX-License-Identifier: MIT -->
+<!-- Generated by scripts/generate-plugin-manifests.py; do not edit by hand. -->
+
+# Installing AgtMLS for OpenCode
+
+OpenCode has no plugin manifest for skill bundles. It loads Markdown
+guidance through the `instructions` array in `opencode.json`, which takes
+paths and glob patterns.
+
+Clone the hub, then add it to your global or project `opencode.json`:
+
+```json
+{
+  "instructions": [
+    "~/dev/agtmls/system-prompts/_base.md",
+    "~/dev/agtmls/skills/*/SKILL.md"
+  ]
+}
+```
+
+One glob covers the catalog: the skill tree is flat, so every skill is
+exactly one level under `skills/`.
+
+This loads every skill body eagerly, which spends context that a native
+progressive-disclosure install would not. Prefer a narrower glob, or
+export a profile and point `instructions` at that instead:
+
+```sh
+python3 scripts/agtmls.py export --provider generic --profile minimal --out-dir dist
+```
+
+Verify by asking OpenCode: "which AgtMLS skill applies here?"

agtmls-0.0.3/CATALOG.md

@@ -0,0 +1,46 @@
+<!-- SPDX-FileCopyrightText: 2026 Sebastien Rousseau -->
+<!-- SPDX-License-Identifier: MIT -->
+<!-- Generated by scripts/generate-catalog.py; do not edit by hand. -->
+
+# AgtMLS Catalog
+
+Registry version: `0.0.3`
+Skills: `26`
+Commands: `1`
+
+## Skills
+
+| Name | Bundle | Tags | Path |
+|---|---|---|---|
+| `agent-loop-design` | `loops` | loops, validation | `skills/agent-loop-design` |
+| `ai-supply-chain-security` | `security` | release, security, validation | `skills/ai-supply-chain-security` |
+| `cross-language-port` | `general` | porting | `skills/cross-language-port` |
+| `handoff` | `general` | validation | `skills/handoff` |
+| `noyalib-architecture-contract` | `noyalib` | architecture, ci, noyalib | `skills/noyalib-architecture-contract` |
+| `noyalib-build-and-env` | `noyalib` | coverage, diagnostics, noyalib, qa | `skills/noyalib-build-and-env` |
+| `noyalib-change-control` | `noyalib` | ci, noyalib, release, security | `skills/noyalib-change-control` |
+| `noyalib-ci-and-release` | `noyalib` | ci, noyalib, release | `skills/noyalib-ci-and-release` |
+| `noyalib-config-and-flags` | `noyalib` | config, noyalib | `skills/noyalib-config-and-flags` |
+| `noyalib-coverage-campaign` | `noyalib` | coverage, debugging, noyalib | `skills/noyalib-coverage-campaign` |
+| `noyalib-debugging-playbook` | `noyalib` | debugging, noyalib, qa | `skills/noyalib-debugging-playbook` |
+| `noyalib-diagnostics-and-tooling` | `noyalib` | coverage, diagnostics, noyalib, validation | `skills/noyalib-diagnostics-and-tooling` |
+| `noyalib-docs-and-writing` | `noyalib` | architecture, ci, docs, noyalib, qa, release | `skills/noyalib-docs-and-writing` |
+| `noyalib-external-positioning` | `noyalib` | docs, noyalib, release, yaml | `skills/noyalib-external-positioning` |
+| `noyalib-failure-archaeology` | `noyalib` | ci, noyalib, validation | `skills/noyalib-failure-archaeology` |
+| `noyalib-research-frontier` | `noyalib` | noyalib, research, validation | `skills/noyalib-research-frontier` |
+| `noyalib-validation-and-qa` | `noyalib` | diagnostics, noyalib, qa, validation | `skills/noyalib-validation-and-qa` |
+| `pr-review-and-release` | `engineering` | ci, docs, engineering, release | `skills/pr-review-and-release` |
+| `receiving-code-review` | `general` | ci | `skills/receiving-code-review` |
+| `systematic-debugging` | `general` | debugging, qa | `skills/systematic-debugging` |
+| `test-driven-development` | `general` | qa | `skills/test-driven-development` |
+| `using-agtmls` | `general` | noyalib, porting, routing | `skills/using-agtmls` |
+| `verification-before-completion` | `general` | porting, qa, validation | `skills/verification-before-completion` |
+| `web-research-and-source-triage` | `web-reach` | ci, debugging, docs, research, validation, web-reach | `skills/web-research-and-source-triage` |
+| `writing-plans` | `general` | docs | `skills/writing-plans` |
+| `yaml-domain-reference` | `noyalib` | config, noyalib, yaml | `skills/yaml-domain-reference` |
+
+## Commands
+
+| Name | Description | Path |
+|---|---|---|
+| `agtmls` | Run the local AgtMLS registry health check. | `commands/agtmls.md` |

agtmls-0.0.3/CHANGELOG.md

@@ -0,0 +1,145 @@
+<!-- SPDX-FileCopyrightText: 2026 Sebastien Rousseau -->
+<!-- SPDX-License-Identifier: MIT -->
+
+# Changelog
+
+All notable changes to AgtMLS are recorded here.
+
+## Unreleased
+
+### Added
+
+- **A real unit-test suite for the tooling** — 65 tests across 12 cases
+  covering the spec validator, collision maths, frontmatter derivation,
+  packaging layout, manifest generation, index parsing, and the packaged CLI.
+  The 57-check gate validates repository *data*; these validate the
+  validators, which is the failure mode the gate cannot see.
+- `validate-spec-conformance.py`, running the Agent Skills **reference**
+  implementation (`skills-ref`) over every skill. Skips cleanly when the
+  optional dependency is absent; CI installs it, so it always runs on a PR.
+- `validate-licence-headers.py`, enforcing an SPDX header on every file that
+  can carry one and `license:` frontmatter on the two classes that cannot
+  (`SKILL.md`, `commands/*.md` must start with `---` at byte 0).
+- `docs/adr/` with the first four architecture decision records, applying to
+  AgtMLS the ADR discipline it already requires of the projects it serves.
+- `.github/CODEOWNERS`, `docs/cli.md`, `docs/checks.md`.
+- Signed build provenance on releases via `actions/attest-build-provenance`,
+  plus a post-build step that installs the wheel and asserts it reports the
+  released version.
+- **Six discipline skills**, general (`"bundle": null`) so they install in
+  every repo: `writing-plans`, `test-driven-development`,
+  `systematic-debugging`, `verification-before-completion`,
+  `receiving-code-review`, and `handoff`. They are
+  language- and project-agnostic, compose in phase order, and defer to a
+  project bundle's own rules on specifics. Adds a `discipline` install/export
+  profile; the `polyglot`, `noyalib`, `security`, and `research` profiles now
+  carry them too.
+- **PyPI packaging**: `uvx agtmls ...` / `pipx install agtmls`, with the whole
+  registry bundled in the wheel under `agtmls/_registry/` and no runtime
+  dependencies. `scripts/validate-packaging.py` gates the force-include list
+  so a wheel cannot ship a registry the CLI can't find.
+- `--copy` on `setup-workspace.sh` and `agtmls install`, materialising real
+  files instead of symlinks. Package installs default to it, because a wheel
+  in an ephemeral uvx cache cannot be the target of a durable symlink.
+- `.claude-plugin/marketplace.json`, so the registry is installable with
+  `/plugin marketplace add sebastienrousseau/agtmls`.
+- `scripts/sync-skill-frontmatter.py`, which mirrors `metadata.json` into the
+  spec's `compatibility`, `metadata`, and `allowed-tools` frontmatter fields.
+  Runs `--check` in CI so the sidecar and the frontmatter cannot drift.
+- `allowed_tools` in `index.json`, derived from each skill's `safety_policy`.
+- A `plugin_targets` section in `providers.json` for runtimes that consume a
+  plugin manifest rather than a symlink install or a Markdown export:
+  Antigravity, Codex, Cursor, Gemini CLI, Kimi Code, and OpenCode.
+- `scripts/generate-plugin-manifests.py` (and `agtmls.py plugin-manifests`),
+  which generates all eight manifests from `.claude-plugin/plugin.json` and
+  the skill tree so no runtime drifts behind a version bump or a new bundle.
+  Runs `--check` in CI.
+
+### Changed
+
+- CI runs a matrix of Python 3.10-3.13 across Linux and macOS. It previously
+  tested one interpreter on one OS while declaring `requires-python >=3.10`,
+  so the 3.10 code path had never executed.
+- README split: the command reference and the check list moved to
+  `docs/cli.md` and `docs/checks.md`; CONTRIBUTING rewritten around the gate,
+  the skill lifecycle, and what a good skill looks like.
+- **The skill tree is now flat**: every skill is `skills/<name>/SKILL.md`.
+  Bundle membership moved from a parent directory to a `bundle` field in each
+  skill's `metadata.json` (`null` for general skills). Agent runtimes scan
+  their skills path *non-recursively*, so nested skills were invisible to any
+  runtime without array-valued `skills` support — Codex, Cursor, Gemini CLI,
+  and Antigravity among them. Every manifest now points at a single
+  `./skills`. `--bundle` scoping in `setup-workspace.sh` is unchanged in
+  behaviour and now resolves through metadata.
+- `skills/noyalib/README.md` moved to `references/noyalib-bundle.md`.
+- `validate-version-policy.py` and `bump-version.py` derive their metadata
+  file lists from the skill tree instead of hardcoding them, so a new skill
+  cannot escape the version gate.
+- `validate-skills.py` now enforces the agentskills.io Agent Skills spec: the
+  closed six-key frontmatter set, the `name` length and hyphen rules, the
+  `compatibility` length cap, flat string `metadata`, and a 500-line
+  `SKILL.md` budget.
+- `validate-plugin-manifest.py` also validates the marketplace catalog, and
+  fails if a nested skill ever reappears — such a skill would be invisible to
+  every runtime. Before the tree was flattened, `plugin.json`'s single
+  `./skills` path exposed only the two top-level skills; the other 18 never
+  loaded for anyone installing as a plugin.
+
+### Fixed
+
+- `generate-skill-index.py` did not unquote the **last** frontmatter key —
+  only the mid-loop flush was patched. Invisible for skills (where `metadata`
+  is last) but wrong for `commands/*.md`, where `description` is the only key.
+  Found by the new unit tests.
+- Three checks (`validate-packaging.py`, `sync-skill-frontmatter.py`,
+  `generate-plugin-manifests.py`) were in `checks.json` and the local runner
+  but **absent from CI**, which enumerates steps by hand.
+  `validate-check-manifest.py` now enforces manifest/runner/CI parity.
+- `generate-skill-index.py` unquotes YAML scalars, so quoted descriptions no
+  longer carry their quotes into `index.json` and every downstream export.
+- `agtmls-doctor.py` handles array-valued `skills`/`commands` manifest paths.
+
+### Removed
+
+- Non-spec `date:` frontmatter keys from three noyalib skills, and the dead
+  `date` field from the `index.json` schema.
+
+## 0.0.3 - 2026-07-21
+
+### Changed
+
+- Bumped release metadata through the guarded patch-line release flow.
+
+
+## 0.0.2 - 2026-07-21
+
+### Changed
+
+- Bumped release metadata through the guarded patch-line release flow.
+
+
+## 0.0.1 - 2026-07-20
+
+### Added
+
+- Registry `index.json` generation and validation.
+- Full routing eval coverage for all current skills.
+- Behavioral smoke evals for all current skills.
+- Local `agtmls` dispatcher for registry checks, install flows, provider export,
+  evolution proposals, evidence recording, benchmarks, SBOM, provenance, MCP
+  resources, and agent-card generation.
+- Doctor checks for registry health and consumer-repo installs.
+- Skill metadata sidecars with bundle inheritance.
+- Lifecycle metadata and validation.
+- Command validation and plugin command-path consistency checks.
+- Security and contribution policy documents.
+- Provider export/install adapters for Claude, Codex, Aider, Cursor, GitHub
+  Copilot, Continue, Windsurf, Zed, OpenAI, Anthropic, and Google Gemini
+  style targets.
+- Generated `CATALOG.md`, docs site, `agent-card.json`, `mcp-resources.json`,
+  `SBOM.spdx.json`, and deterministic `provenance.json`.
+- Governance, release, smoke, behavioral, routing, and benchmark checks in the
+  release gate.
+- 2026-ready skill bundles for agent loop design, AI supply-chain security, web
+  research/source triage, PR/release workflow, and project-specific noyalib
+  operations.

agtmls-0.0.3/CONTRIBUTING.md

@@ -0,0 +1,124 @@
+<!-- SPDX-FileCopyrightText: 2026 Sebastien Rousseau -->
+<!-- SPDX-License-Identifier: MIT -->
+
+# Contributing to AgtMLS
+
+AgtMLS is a registry, so the bar is unusual: a bad skill does not crash, it
+quietly makes every agent that loads it worse. Most of the process below
+exists to catch that.
+
+## The one command
+
+```bash
+python3 scripts/agtmls.py check
+```
+
+57 checks. It is the same gate CI runs — `validate-check-manifest.py` fails
+if `checks.json`, `scripts/run-all-checks.py`, and
+`.github/workflows/validate.yml` ever disagree, so a green local run means a
+green CI run.
+
+Two checks need optional extras and skip cleanly without them:
+
+| Check | Extra | Install |
+| --- | --- | --- |
+| `validate-spec-conformance.py` | reference validator | `pip install skills-ref` |
+| `smoke-live-providers.py` | provider credentials | export the relevant `*_API_KEY` |
+
+CI installs `skills-ref`, so spec conformance is always enforced on a pull
+request even if you skipped it locally.
+
+## Adding a skill
+
+```bash
+python3 scripts/agtmls.py scaffold-skill my-skill            # general
+python3 scripts/agtmls.py scaffold-skill my-skill --bundle x # project-scoped
+```
+
+That writes `skills/my-skill/` with `SKILL.md`, `reference.md`,
+`metadata.json`, and both eval cases. Then:
+
+1. **Write the description first.** It is the whole routing surface — the
+   model decides whether to load your skill from it alone. Say what the skill
+   does *and when to load it*, using words a user would actually type.
+2. **Write the body.** Keep `SKILL.md` under 500 lines and put depth in
+   `reference.md`. The body is loaded in full on activation; the reference is
+   loaded only when the skill asks for it.
+3. **Fill in `metadata.json`**, especially `safety_policy`. It is generated
+   into portable frontmatter, so it is what a Cursor or Gemini user sees.
+   Never hand-edit `license`, `compatibility`, `allowed-tools`, or `metadata`
+   in `SKILL.md` — run `sync-skill-frontmatter.py --write`.
+4. **Write the eval cases.** Routing positives are prompts that *must* reach
+   your skill; negatives are prompts that must not. Behavioral cases assert
+   that load-bearing content stays present.
+5. **Regenerate and check:**
+
+   ```bash
+   python3 scripts/sync-skill-frontmatter.py --write
+   python3 scripts/generate-skill-index.py --write
+   python3 scripts/agtmls.py check
+   ```
+
+### What a good skill looks like
+
+- **One rule, stated once.** The best skills have a single load-bearing
+  sentence that the rest of the body serves.
+- **Triggers, not topics.** "Load when X happens" beats "about X".
+- **A `When not to use` section.** Skills that never decline get loaded
+  wrongly and dilute the router.
+- **Concrete over abstract.** Commands, tables, worked examples.
+- **Defers to project bundles.** A general skill states the floor; a project
+  skill overrides it on specifics.
+
+## Skill lifecycle
+
+Skills move through four stages (`lifecycle.json`), each with exit criteria:
+
+| Stage | Requires | Exit criteria |
+| --- | --- | --- |
+| proposal | `.agtmls/proposals/<skill>.md` | human-reviewed trigger and safety boundaries |
+| draft | `SKILL.md`, routing eval | validator, routing eval, collision check pass |
+| hardened | behavioral eval | behavioral eval passes, index regenerated |
+| published | `index.json` | doctor clean, CI green, docs updated |
+
+External skills enter as drafts via `agtmls.py import-skill`, never directly
+as hardened.
+
+## Architecture decisions
+
+Load-bearing or hard-to-reverse changes need an ADR in `docs/adr/` — the skill
+contract, the on-disk layout, distribution, or the permission posture. See
+`docs/adr/README.md` for when one is required and the template. Routine work
+does not need one.
+
+## Changing the tooling
+
+`scripts/` is covered by `scripts/run-unit-tests.py`. If you change a
+validator's logic, add a test that fails without your change: the gate checks
+repository *data*, so a checker that always returns 0 is invisible to it.
+Tests run on Python 3.10–3.13 across Linux and macOS in CI.
+
+## Style
+
+- **Python: stdlib only.** The zero-dependency guarantee is what makes
+  `uvx agtmls` a single fast download; `validate-packaging.py` enforces it.
+- **Shell:** `set -euo pipefail`, 2-space indent.
+- **Licence on every file.** Markdown gets an SPDX header — except `SKILL.md`
+  and `commands/*.md`, which must begin with `---` at byte 0 and declare
+  `license:` in frontmatter instead. `validate-licence-headers.py` enforces
+  whichever form applies.
+- **Conventional Commits.**
+
+## Never edit by hand
+
+These are generated and drift-checked:
+
+`index.json` · `CATALOG.md` · `site/index.html` · `agent-card.json` ·
+`mcp-resources.json` · `SBOM.spdx.json` · `provenance.json` ·
+`plugin.json` · `gemini-extension.json` · `GEMINI.md` ·
+`.codex-plugin/` · `.cursor-plugin/` · `.kimi-plugin/` · `.agents/` ·
+`.opencode/INSTALL.md` · the generated frontmatter fields in every `SKILL.md`
+
+## Reporting security issues
+
+See `SECURITY.md`. Do not open a public issue for a vulnerability.

agtmls-0.0.3/GEMINI.md

@@ -0,0 +1,4 @@
+<!-- SPDX-FileCopyrightText: 2026 Sebastien Rousseau -->
+<!-- SPDX-License-Identifier: MIT -->
+<!-- Generated by scripts/generate-plugin-manifests.py; do not edit by hand. -->
+@./skills/using-agtmls/SKILL.md

agtmls-0.0.3/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sebastien Rousseau
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.