diff --git a/PRIVACY.md b/PRIVACY.md index 2cddb9d..8845ddd 100644 --- a/PRIVACY.md +++ b/PRIVACY.md @@ -9,4 +9,4 @@ When Codex uses a plugin, Codex can read repository or GitHub settings and run t only under the user's request, the target repository's instructions, and the active Codex environment. ACG Box does not receive that content through these plugins. -Report a privacy concern through the `acg-box/exp` repository issue tracker. +Report a privacy concern through the `acg-box/agentry` repository issue tracker. diff --git a/README.md b/README.md index fee0c2f..b66e395 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,10 @@
-# exp +# Agentry -Small, reusable ACG Box engineering standards. +Skills, standards, and workflows for agents. + +Agentry publishes ACG Box engineering practices as small, reusable Codex plugins. [![License](https://img.shields.io/badge/License-GPLv3%20only-blue.svg)](LICENSE) [![Status](https://img.shields.io/badge/Status-experimental-f59e0b.svg)](VERSION) @@ -32,7 +34,7 @@ or invoke `$acg-release:macos` after installation. Add this Git marketplace, then install the optional plugins: ```sh -codex plugin marketplace add acg-box/exp --ref main +codex plugin marketplace add acg-box/agentry --ref main codex plugin add gh-settings@acg-box codex plugin add acg-release@acg-box ``` diff --git a/VERSION b/VERSION index 6e8bf73..17e51c3 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.1.0 +0.1.1 diff --git a/openwiki/.claims/gh-settings.json b/openwiki/.claims/gh-settings.json new file mode 100644 index 0000000..cf0ea40 --- /dev/null +++ b/openwiki/.claims/gh-settings.json @@ -0,0 +1,30 @@ +{ + "schemaVersion": 1, + "pageVersion": "sha256:2c8accd0c37249f841240d4e19f9c1f2a0dbf5dee2e6263ce39079f2851d2d82", + "claims": [ + { + "id": "claim_539d8e3ba46a4d7b8177ab3d04ec280d", + "statement": "The gh-settings skill audits or reconciles GitHub organization and repository governance; repository-scoped work keeps organization state read-only.", + "evidence": [ + { + "resource": "repo://plugins/gh-settings/skills/sync/SKILL.md#L1-L19", + "version": "repo-lines-v1:sha256:01225e6e9d51dbb09eb454d45a7eba8b3efe95955855c18eac9900b8832e4e6d:eyJzZWxlY3RlZExpbmVDb3VudCI6MTksImZpcnN0U2VsZWN0ZWRMaW5lSGFzaCI6ImY1MmQ3MTExMDNkNTBhNDM3ODMwYzZmYmNkMDRmYjRiYWI0OWEwZjgyZjZkMjZkMWM3OTFjNmU4NDg4ZGQwOTAiLCJsYXN0U2VsZWN0ZWRMaW5lSGFzaCI6ImE0YWQ1MGIyNzRhOTcxMjlmZDZmODc1NWQ1YmJhODRhYjMwNDllNmYwODk5YjFkOWZjZGM2NDk5NmNjMWZiMDMiLCJwcmVjZWRpbmdDb250ZXh0TGluZUNvdW50IjowLCJwcmVjZWRpbmdDb250ZXh0SGFzaCI6ImUzYjBjNDQyOThmYzFjMTQ5YWZiZjRjODk5NmZiOTI0MjdhZTQxZTQ2NDliOTM0Y2E0OTU5OTFiNzg1MmI4NTUiLCJmb2xsb3dpbmdDb250ZXh0TGluZUNvdW50IjozLCJmb2xsb3dpbmdDb250ZXh0SGFzaCI6IjI2ODIyNDNlNzMyYjQ4NDA4ZDU0Yjc4MDE0YWNjOGY0MjA1ODA5ZDdkZWQ0OTZkNDMxNGI4MjVmN2MyZTMzNTcifQ" + } + ] + }, + { + "id": "claim_f28a39a6a881491b85ed7f7ddcdef862", + "statement": "The governance standard defines cost control requirements without granting authority to remove people or repository access.", + "evidence": [ + { + "resource": "repo://plugins/gh-settings/skills/sync/references/standard.md#L51-L80", + "version": "repo-lines-v1:sha256:71edfd3e859791b12e9706f966914fa94fb6d3a44f87651dbd8d14a8b03c59d9:eyJzZWxlY3RlZExpbmVDb3VudCI6MzAsImZpcnN0U2VsZWN0ZWRMaW5lSGFzaCI6IjAxYmE0NzE5YzgwYjZmZTkxMWIwOTFhN2MwNTEyNGI2NGVlZWNlOTY0ZTA5YzA1OGVmOGY5ODA1ZGFjYTU0NmIiLCJsYXN0U2VsZWN0ZWRMaW5lSGFzaCI6IjBhMzQ0MmZlM2IyOWZmZTE4M2QzOGE5YzNjZGQxYmUyMDkyMzRlYzhjZmU1MGRmNzhjMGUzODQ1N2U3OWMyYjUiLCJwcmVjZWRpbmdDb250ZXh0TGluZUNvdW50IjozLCJwcmVjZWRpbmdDb250ZXh0SGFzaCI6IjI5YWNkMjUzMmNhOTRlYWEzZGIwZjJmMDI5NDgxY2Y1ZDMxY2ZkNzkwOWI5MmUwMzAxMDdkZjU4ZTI2ZTM2NmQiLCJmb2xsb3dpbmdDb250ZXh0TGluZUNvdW50IjozLCJmb2xsb3dpbmdDb250ZXh0SGFzaCI6IjkwM2FjYWQ0OGYyZDYxNjc2MGE5ZWIxMWM0YjFmODliZDVlNTI4YWRlMzUxOTNmNTEwZGI0OTZmZWRjNTE4MmMifQ" + } + ] + } + ], + "verification": { + "by": "openwiki/0.7.2", + "at": "2026-10-10T13:00:35.168Z" + } +} diff --git a/openwiki/.claims/operations.json b/openwiki/.claims/operations.json new file mode 100644 index 0000000..08e5629 --- /dev/null +++ b/openwiki/.claims/operations.json @@ -0,0 +1,42 @@ +{ + "schemaVersion": 1, + "pageVersion": "sha256:f71434f89e38c9b5d53f746e255ca086acd4ebd9400ceb7877bf535ec1ba232a", + "claims": [ + { + "id": "claim_454347a1c1d947dc881f0d35b896d30e", + "statement": "Agentry's Git marketplace is installed from acg-box/agentry; its plugins retain the acg-box marketplace namespace.", + "evidence": [ + { + "resource": "repo://.agents/plugins/marketplace.json", + "version": "repo-file-v1:sha256:a65bf8b183782875ca01408d8828862cb63e6f1ea5b903ec17940209f776fa98" + }, + { + "resource": "repo://README.md#L32-L40", + "version": "repo-lines-v1:sha256:241a26549d6c91e45168ffaf86607f40b8a04c84cba943148236740a8d974921:eyJzZWxlY3RlZExpbmVDb3VudCI6OSwiZmlyc3RTZWxlY3RlZExpbmVIYXNoIjoiZWM2ZGU5MDgyYjc4Mjg0MDI4ZWY1MGRmNmY1OTRjOTVhOTE2NzY4N2YwNzgyZmI2OGE5ZjI1MDI1YjIwN2JlNiIsImxhc3RTZWxlY3RlZExpbmVIYXNoIjoiNDdjMDZjNTYxZDVjMzI3MzQzNjg1MjY4YTQ2YjMzOTFmMzk5OGVlZTg5MGQyYmU1MWYwZDIxY2M0YTUzYWU2ZCIsInByZWNlZGluZ0NvbnRleHRMaW5lQ291bnQiOjMsInByZWNlZGluZ0NvbnRleHRIYXNoIjoiOTNlZDdlMmVjOTI5ZDFhYjA1Mjc4Y2UxMzY4ZDNmZDFjZjRhMTcyNTIyZDg3NWRhNGNiZmQ1Y2E4NmFkNGQ3MyIsImZvbGxvd2luZ0NvbnRleHRMaW5lQ291bnQiOjMsImZvbGxvd2luZ0NvbnRleHRIYXNoIjoiOTkwZDM2MTgwOWJlYzE5YWNiZGMzMjQ0YTg1M2RlNmZiZTZkYjE4ZTRlYzE3OTBjYTBlOWM0MTg5ZWVhYTFiZSJ9" + } + ] + }, + { + "id": "claim_eb90f247a36145659e168f8426b668ce", + "statement": "The repository VERSION and both plugin manifests use release version 0.1.1.", + "evidence": [ + { + "resource": "repo://VERSION", + "version": "repo-file-v1:sha256:80447316529fc62014fbaa047fb67c51ac30e32830cda370405349d8d66d196c" + }, + { + "resource": "repo://plugins/acg-release/.codex-plugin/plugin.json#L1-L4", + "version": "repo-lines-v1:sha256:b29dfd9034e64e0384adef17356fb78f5883cba9b2b601c4a8ae0040e76cbcad:eyJzZWxlY3RlZExpbmVDb3VudCI6NCwiZmlyc3RTZWxlY3RlZExpbmVIYXNoIjoiYTZmYjA4ZmRhMWFjYjk1N2I2MTE2YmQzNzgxMWExZmU0MWEwMTYxMWMwNjMxZWRiZjc4NmQ2ODg5YTI3YTU1YyIsImxhc3RTZWxlY3RlZExpbmVIYXNoIjoiODI5NjIyYjE3ZjlmNGRkZmQxYzU4ZGYwNTVjMThhOWQ3NGM1MzU4ZWFkZjU3NjlhMDk1NDYxNzVkNTJlNmM4OSIsInByZWNlZGluZ0NvbnRleHRMaW5lQ291bnQiOjAsInByZWNlZGluZ0NvbnRleHRIYXNoIjoiZTNiMGM0NDI5OGZjMWMxNDlhZmJmNGM4OTk2ZmI5MjQyN2FlNDFlNDY0OWI5MzRjYTQ5NTk5MWI3ODUyYjg1NSIsImZvbGxvd2luZ0NvbnRleHRMaW5lQ291bnQiOjMsImZvbGxvd2luZ0NvbnRleHRIYXNoIjoiNjBkMjBhMjg3MWMyODVhZDJhMmUzYzdkNjMzNDc3NGQ1NmM0ZDc0NzdmM2Y5N2MxOTljZTIwMzExZWI1OTQ2NSJ9" + }, + { + "resource": "repo://plugins/gh-settings/.codex-plugin/plugin.json#L1-L4", + "version": "repo-lines-v1:sha256:c5eb24d0dac0f7a70da1f11cd8ee90108f1acfab66c774c58c03c090b9033209:eyJzZWxlY3RlZExpbmVDb3VudCI6NCwiZmlyc3RTZWxlY3RlZExpbmVIYXNoIjoiYTZmYjA4ZmRhMWFjYjk1N2I2MTE2YmQzNzgxMWExZmU0MWEwMTYxMWMwNjMxZWRiZjc4NmQ2ODg5YTI3YTU1YyIsImxhc3RTZWxlY3RlZExpbmVIYXNoIjoiN2Q5OGEwZjNlOTNiOGFjMzU4ZGQxNGIyZTE5MDMzYjBiZWQ1YTI5YzgzYzMxMDY1NDMxZmVmZDBlZWI4YjMyMCIsInByZWNlZGluZ0NvbnRleHRMaW5lQ291bnQiOjAsInByZWNlZGluZ0NvbnRleHRIYXNoIjoiZTNiMGM0NDI5OGZjMWMxNDlhZmJmNGM4OTk2ZmI5MjQyN2FlNDFlNDY0OWI5MzRjYTQ5NTk5MWI3ODUyYjg1NSIsImZvbGxvd2luZ0NvbnRleHRMaW5lQ291bnQiOjMsImZvbGxvd2luZ0NvbnRleHRIYXNoIjoiNjBkMjBhMjg3MWMyODVhZDJhMmUzYzdkNjMzNDc3NGQ1NmM0ZDc0NzdmM2Y5N2MxOTljZTIwMzExZWI1OTQ2NSJ9" + } + ] + } + ], + "verification": { + "by": "openwiki/0.7.2", + "at": "2026-10-10T13:08:34.012Z" + } +} diff --git a/openwiki/.claims/quickstart.json b/openwiki/.claims/quickstart.json new file mode 100644 index 0000000..c193645 --- /dev/null +++ b/openwiki/.claims/quickstart.json @@ -0,0 +1,24 @@ +{ + "schemaVersion": 1, + "pageVersion": "sha256:ce2ede14eb354d6a1df2891164ed15fd8ea5686bf6a972ca8d6bdf2103cf7b44", + "claims": [ + { + "id": "claim_fa6907a5e9da4f7fba94258ef9c13755", + "statement": "Agentry publishes ACG Box engineering practices as small Codex plugins, with gh-settings and acg-release as its current plugins.", + "evidence": [ + { + "resource": "repo://.agents/plugins/marketplace.json", + "version": "repo-file-v1:sha256:a65bf8b183782875ca01408d8828862cb63e6f1ea5b903ec17940209f776fa98" + }, + { + "resource": "repo://README.md#L1-L29", + "version": "repo-lines-v1:sha256:bb31a47294e588a06280824d65a2f2b0960bbcd42027d3690bf79d849ea87658:eyJzZWxlY3RlZExpbmVDb3VudCI6MjksImZpcnN0U2VsZWN0ZWRMaW5lSGFzaCI6ImVjOTk2NjBkYWMyZGNmN2E2MGNhMDIyZWUwNjM2MDU3ZjJiZmU1NTE0Yjg1YmJkZDQ2M2U0ZTMzZGI3NDdlNGYiLCJsYXN0U2VsZWN0ZWRMaW5lSGFzaCI6IjIxOGUxY2JmYTgzZmRjNTE3OWQ1MjQ2ZWY0NzNkMjdhY2Q3MmNhZDUwZjQzMzk5MDMzNzQyMWFiZmYyZmQwMjUiLCJwcmVjZWRpbmdDb250ZXh0TGluZUNvdW50IjowLCJwcmVjZWRpbmdDb250ZXh0SGFzaCI6ImUzYjBjNDQyOThmYzFjMTQ5YWZiZjRjODk5NmZiOTI0MjdhZTQxZTQ2NDliOTM0Y2E0OTU5OTFiNzg1MmI4NTUiLCJmb2xsb3dpbmdDb250ZXh0TGluZUNvdW50IjozLCJmb2xsb3dpbmdDb250ZXh0SGFzaCI6ImYwMThjYWM4MGNiZjUwMTNkOTk4NDE1MjFlZTQ2YzI0NjgyZTA3NTFlNTM3YTZmOTc4MWRlMzQ4MWE1OGZiMGUifQ" + } + ] + } + ], + "verification": { + "by": "openwiki/0.7.2", + "at": "2026-10-10T13:08:34.012Z" + } +} diff --git a/openwiki/.last-update.json b/openwiki/.last-update.json new file mode 100644 index 0000000..127752a --- /dev/null +++ b/openwiki/.last-update.json @@ -0,0 +1,8 @@ +{ + "updatedAt": "2026-10-10T13:08:56.776Z", + "command": "update", + "gitHead": "6cc1321108f2d6eb6aee5fea114671be612508e6", + "model": "host-agent/codex", + "status": "complete", + "language": "en" +} diff --git a/openwiki/.page-manifest.json b/openwiki/.page-manifest.json new file mode 100644 index 0000000..5feef31 --- /dev/null +++ b/openwiki/.page-manifest.json @@ -0,0 +1,26 @@ +{ + "schemaVersion": 1, + "pages": { + "/openwiki/gh-settings.md": { + "gitHead": "6cc1321108f2d6eb6aee5fea114671be612508e6", + "sourceFingerprint": "sha256:152d864d581feba9369d1121aac7c2cae1477f7cc26c4cb0d3a20f7ca90b8a00", + "pageVersion": "sha256:2c8accd0c37249f841240d4e19f9c1f2a0dbf5dee2e6263ce39079f2851d2d82", + "completedBy": "codex", + "completedRunId": "75e0ceea-f336-4a7b-9623-d8ec92ba7ce7" + }, + "/openwiki/operations.md": { + "pageVersion": "sha256:f71434f89e38c9b5d53f746e255ca086acd4ebd9400ceb7877bf535ec1ba232a", + "completedBy": "codex", + "completedRunId": "aaabce8b-09ff-44c8-9264-b3553aafe2c3", + "gitHead": "6cc1321108f2d6eb6aee5fea114671be612508e6", + "sourceFingerprint": "sha256:b108b8c9330de78051b392e1b90717dfc1af3a2f3b0c615cdf068f69df1522a9" + }, + "/openwiki/quickstart.md": { + "pageVersion": "sha256:ce2ede14eb354d6a1df2891164ed15fd8ea5686bf6a972ca8d6bdf2103cf7b44", + "completedBy": "codex", + "completedRunId": "aaabce8b-09ff-44c8-9264-b3553aafe2c3", + "gitHead": "6cc1321108f2d6eb6aee5fea114671be612508e6", + "sourceFingerprint": "sha256:b108b8c9330de78051b392e1b90717dfc1af3a2f3b0c615cdf068f69df1522a9" + } + } +} diff --git a/openwiki/gh-settings.md b/openwiki/gh-settings.md index 34bbe74..a10eeac 100644 --- a/openwiki/gh-settings.md +++ b/openwiki/gh-settings.md @@ -1,7 +1,7 @@ --- type: Architecture Reference title: GitHub Settings -description: Runtime ownership, central-first and repository-scoped modes, safety boundaries, public surfaces, and validation for the instruction-only GitHub settings plugin. +description: Runtime ownership, organization and repository scope, safety boundaries, public surfaces, and validation for the instruction-only GitHub settings plugin. tags: [architecture, plugins, github, settings, security] openwiki: roles: [architecture, repository, workflow, security] @@ -9,14 +9,23 @@ openwiki: source_paths: [plugins/gh-settings/.codex-plugin/plugin.json, plugins/gh-settings/skills/sync/SKILL.md, plugins/gh-settings/skills/sync/references/standard.md, plugins/gh-settings/skills/sync/agents/openai.yaml, .agents/plugins/marketplace.json] symbols: [gh-settings, sync, central-first authority, repository-scoped mode, merge-commit-only baseline, zero repository-owned rulesets, exact drift preview, free security baselines] test_paths: [Makefile.toml] - invariants: [Audits are read-only by default, organization-wide mode places each control at the highest sufficient GitHub scope, repository-scoped mode keeps parent state read-only, selected zero-local-ruleset profiles require a count of zero on every repository, and only attached or enforced parent configurations determine effective state.] + invariants: [Audits are read-only by default, organization-wide mode uses supported organization controls, repository-scoped mode keeps organization state read-only, selected zero-local-ruleset profiles require a count of zero on every repository, and only attached or enforced parent configurations determine effective state.] validation_commands: [cargo make check] +verified: + - by: openwiki/0.7.2 + at: 2026-10-10T13:00:35.168Z +sources: + - id: openwiki-source-814cee67e5419784bb2251c3 + resource: repo://plugins/gh-settings/skills/sync/references/standard.md + - id: openwiki-source-f2a9bda4df7b989ef8b9ce83 + resource: repo://plugins/gh-settings/skills/sync/SKILL.md --- # GitHub Settings `plugins/gh-settings/` contains the installed manifest, `sync` skill, invocation -metadata, and canonical governance standard. It has no executable runtime. +metadata, and canonical governance standard for GitHub organizations and +repositories. It has no executable runtime. Use the [skill](../plugins/gh-settings/skills/sync/SKILL.md) for task scope and the [standard](../plugins/gh-settings/skills/sync/references/standard.md) for team diff --git a/openwiki/index.md b/openwiki/index.md new file mode 100644 index 0000000..fe58954 --- /dev/null +++ b/openwiki/index.md @@ -0,0 +1,10 @@ +--- +okf_version: "0.2" +--- + +# Files + +- [ACG Release: macOS](acg-release.md) - Ownership, applicability, release flow, authorization boundaries, and validation for the instruction-only acg-release plugin and its current macOS skill. +- [GitHub Settings](gh-settings.md) - Runtime ownership, organization and repository scope, safety boundaries, public surfaces, and validation for the instruction-only GitHub settings plugin. +- [Install And Validation](operations.md) - Installation, repository checks, plugin validation, CI behavior, and release boundaries for repository plugins. +- [Repository Quickstart](quickstart.md) - Navigation for the ACG Box repository that publishes small Codex engineering-standard plugins and their validation rules. diff --git a/openwiki/operations.md b/openwiki/operations.md index 6e9cc09..28876af 100644 --- a/openwiki/operations.md +++ b/openwiki/operations.md @@ -11,6 +11,21 @@ openwiki: test_paths: [Makefile.toml, .github/workflows/check.yml] invariants: [The Check workflow runs the same cargo make check command as local validation.] validation_commands: [cargo make check] +verified: + - by: openwiki/0.7.2 + at: 2026-10-10T13:08:34.012Z +sources: + - id: openwiki-source-8e7150eb410f39fb723ea62d + resource: repo://.agents/plugins/marketplace.json + - id: openwiki-source-af1b995411f58f4a90794b96 + resource: repo://plugins/acg-release/.codex-plugin/plugin.json + - id: openwiki-source-76d8051b07974472959e6838 + resource: repo://plugins/gh-settings/.codex-plugin/plugin.json + - id: openwiki-source-23775c3de52f3ab95a13cb8b + resource: repo://README.md + - id: openwiki-source-94e7bca26bc3525581ff6cdf + resource: repo://VERSION +generated: { by: "codex", at: "2026-10-10T13:08:34.012Z" } --- # Install And Validation @@ -20,7 +35,7 @@ openwiki: Add the Git marketplace and install the optional plugins: ```sh -codex plugin marketplace add acg-box/exp --ref main +codex plugin marketplace add acg-box/agentry --ref main codex plugin add gh-settings@acg-box codex plugin add acg-release@acg-box ``` @@ -83,7 +98,7 @@ Ubuntu job with a five-minute timeout, installs pinned `cargo-make` and Taplo, a runs `cargo make check`. Pull-request runs may be canceled when superseded; `main` runs are not canceled. -`VERSION` is `0.1.0`. Change it and every plugin manifest together only for an explicit +`VERSION` is `0.1.1`. Change it and every plugin manifest together only for an explicit release. This repository has no publication workflow. Full verification or plugin installation does not authorize publishing, deploying, or changing CI policy. diff --git a/openwiki/quickstart.md b/openwiki/quickstart.md index 48bff68..e7a321c 100644 --- a/openwiki/quickstart.md +++ b/openwiki/quickstart.md @@ -11,13 +11,22 @@ openwiki: test_paths: [.github/workflows/check.yml, Makefile.toml] invariants: [The plugin manifest, marketplace entry, and repository VERSION must describe the same installable release.] validation_commands: [cargo make check] +sources: + - id: openwiki-source-8e7150eb410f39fb723ea62d + resource: repo://.agents/plugins/marketplace.json + - id: openwiki-source-23775c3de52f3ab95a13cb8b + resource: repo://README.md +generated: { by: "codex", at: "2026-10-10T13:08:34.012Z" } +verified: + - by: openwiki/0.7.2 + at: 2026-10-10T13:08:34.012Z --- # Repository Quickstart ## What This Repository Is -`acg-box/exp` publishes small ACG Box engineering standards as Codex plugins. Both +Agentry (`acg-box/agentry`) publishes small ACG Box engineering standards as Codex plugins. Both current plugins are instruction-only: - [`gh-settings`](gh-settings.md) owns GitHub governance profiles. @@ -42,7 +51,7 @@ context belongs under `openwiki/`. | --- | --- | --- | --- | --- | --- | | Change GitHub settings guidance | [GitHub Settings](gh-settings.md) | `plugins/gh-settings/skills/sync/SKILL.md`, `plugins/gh-settings/skills/sync/references/standard.md` | `sync`, central-first authority, exact drift preview, automatic dependency submission, free Dependabot baseline | Skill Creator `quick_validate.py` | `python3 .../quick_validate.py plugins/gh-settings/skills/sync` | | Change the ACG Box macOS release standard | [ACG Release: macOS](acg-release.md) | `plugins/acg-release/skills/macos/SKILL.md`, `plugins/acg-release/skills/macos/references/standard.md` | `acg-release`, `macos`, canonical owner `acg-box`, Developer ID, notarization, final Sparkle ZIP, draft-first publication | Skill Creator `quick_validate.py` | `python3 .../quick_validate.py plugins/acg-release/skills/macos` | -| Change plugin metadata or installability | [Install And Validation](operations.md) | `plugins/*/.codex-plugin/plugin.json`, `.agents/plugins/marketplace.json`, `VERSION` | `gh-settings`, `acg-release`, `acg-box`, `0.1.0` | Plugin Creator `validate_plugin.py` | Run the validator for each changed plugin | +| Change plugin metadata or installability | [Install And Validation](operations.md) | `plugins/*/.codex-plugin/plugin.json`, `.agents/plugins/marketplace.json`, `VERSION` | `gh-settings`, `acg-release`, `acg-box`, `0.1.1` | Plugin Creator `validate_plugin.py` | Run the validator for each changed plugin | | Change repository checks or formatting | [Install And Validation](operations.md) | `Makefile.toml`, `.taplo.toml` | `check`, `check-json`, `fmt-check` | `cargo make check` | `cargo make check` | | Change CI triggers or release boundaries | [Install And Validation](operations.md) | `.github/workflows/check.yml`, `PRIVACY.md` | `Check`, `contents: read` | GitHub `Check` workflow | `cargo make check` | | Update repository navigation | this page and linked concepts | `README.md`, `AGENTS.md`, `openwiki/` | repository ownership statements | Markdown link review | `cargo make check` | diff --git a/plugins/acg-release/.codex-plugin/plugin.json b/plugins/acg-release/.codex-plugin/plugin.json index 3253230..b45387d 100644 --- a/plugins/acg-release/.codex-plugin/plugin.json +++ b/plugins/acg-release/.codex-plugin/plugin.json @@ -1,13 +1,13 @@ { "name": "acg-release", - "version": "0.1.0", + "version": "0.1.1", "description": "Apply ACG Box release standards only to repositories whose canonical GitHub owner is acg-box; the current macOS skill manages Developer ID-notarized Sparkle ZIP releases.", "author": { "name": "ACG Box", "url": "https://github.com/acg-box" }, - "homepage": "https://github.com/acg-box/exp", - "repository": "https://github.com/acg-box/exp", + "homepage": "https://github.com/acg-box/agentry", + "repository": "https://github.com/acg-box/agentry", "license": "GPL-3.0-only", "keywords": [ "acg-box", @@ -33,9 +33,9 @@ "Read", "Write" ], - "websiteURL": "https://github.com/acg-box/exp", - "privacyPolicyURL": "https://github.com/acg-box/exp/blob/main/PRIVACY.md", - "termsOfServiceURL": "https://github.com/acg-box/exp/blob/main/LICENSE", + "websiteURL": "https://github.com/acg-box/agentry", + "privacyPolicyURL": "https://github.com/acg-box/agentry/blob/main/PRIVACY.md", + "termsOfServiceURL": "https://github.com/acg-box/agentry/blob/main/LICENSE", "defaultPrompt": [ "Audit this acg-box macOS Sparkle ZIP workflow against the Developer ID standard.", "Migrate this acg-box macOS ZIP workflow to Developer ID signing and notarization.", diff --git a/plugins/gh-settings/.codex-plugin/plugin.json b/plugins/gh-settings/.codex-plugin/plugin.json index 640beeb..5890dc6 100644 --- a/plugins/gh-settings/.codex-plugin/plugin.json +++ b/plugins/gh-settings/.codex-plugin/plugin.json @@ -1,13 +1,13 @@ { "name": "gh-settings", - "version": "0.1.0", + "version": "0.1.1", "description": "Centralize GitHub governance, preview exact drift, and reconcile only explicitly approved controls.", "author": { "name": "ACG Box", "url": "https://github.com/acg-box" }, - "homepage": "https://github.com/acg-box/exp", - "repository": "https://github.com/acg-box/exp", + "homepage": "https://github.com/acg-box/agentry", + "repository": "https://github.com/acg-box/agentry", "license": "GPL-3.0-only", "keywords": [ "github", @@ -21,7 +21,7 @@ "interface": { "displayName": "GitHub Settings", "shortDescription": "Centralize governance and reconcile approved drift.", - "longDescription": "Audit GitHub Enterprise, organization, and repository controls without changing them. Put enforceable controls at the highest supported scope, preserve paid-product boundaries, show exact drift, then reconcile and read back only changes that the user explicitly approved.", + "longDescription": "Audit GitHub organization and repository controls without changing them. Put enforceable controls at the highest supported scope, preserve paid-product boundaries, show exact drift, then reconcile and read back only changes that the user explicitly approved.", "developerName": "ACG Box", "category": "Development", "capabilities": [ @@ -29,12 +29,12 @@ "Read", "Write" ], - "websiteURL": "https://github.com/acg-box/exp", - "privacyPolicyURL": "https://github.com/acg-box/exp/blob/main/PRIVACY.md", - "termsOfServiceURL": "https://github.com/acg-box/exp/blob/main/LICENSE", + "websiteURL": "https://github.com/acg-box/agentry", + "privacyPolicyURL": "https://github.com/acg-box/agentry/blob/main/PRIVACY.md", + "termsOfServiceURL": "https://github.com/acg-box/agentry/blob/main/LICENSE", "defaultPrompt": [ "Audit organization-wide GitHub governance, centralize every supported control, and show an exact drift preview.", - "Audit one repository without changing its Enterprise or organization parent controls.", + "Audit one repository without changing its organization controls.", "Reconcile a merge-commit-only, zero-repository-ruleset profile without enabling unapproved paid products." ], "brandColor": "#24292F" diff --git a/plugins/gh-settings/skills/sync/SKILL.md b/plugins/gh-settings/skills/sync/SKILL.md index a59e071..e05dc92 100644 --- a/plugins/gh-settings/skills/sync/SKILL.md +++ b/plugins/gh-settings/skills/sync/SKILL.md @@ -1,6 +1,6 @@ --- name: sync -description: Use when auditing or reconciling GitHub Enterprise, organization, and repository governance against an authorized settings profile, with central-first organization controls and repository-scoped changes. +description: Use when auditing or reconciling GitHub organization and repository governance against an authorized settings profile, with central-first organization controls and repository-scoped changes. --- # GitHub Governance @@ -14,9 +14,9 @@ For free-feature or cost-control requests, also read the standard's `Prevent Additional Charges` section. Preventing unapproved charges is an acceptance condition, not a conclusion from feature toggles alone. -Organization-wide work puts controls at the highest sufficient authorized scope. -Repository-scoped work keeps parent state read-only. Preserve the distinction -between enforced parent policy and repository-overridable defaults. +Organization-wide work uses supported organization controls within the authorized scope. +Repository-scoped work keeps organization state read-only. Preserve the distinction +between enforced organization policy and repository-overridable defaults. Default to a read-only audit unless the request authorizes reconciliation. Show exact drift before live writes; existing authority remains valid for that drift. diff --git a/plugins/gh-settings/skills/sync/references/standard.md b/plugins/gh-settings/skills/sync/references/standard.md index dabd9d8..7698ab6 100644 --- a/plugins/gh-settings/skills/sync/references/standard.md +++ b/plugins/gh-settings/skills/sync/references/standard.md @@ -4,12 +4,12 @@ Audit or reconcile the requested profile against the exact authorized GitHub host, accounts, repositories, and mutation scopes. Use the complete in-scope -repository inventory, including private, internal, archived, and template +repository inventory, including private, archived, and template repositories. Establish identity, permissions, plan, and billing where they affect the requested controls. -Organization-wide work uses the highest sufficient authorized scope: Enterprise -enforcement, organization enforcement, parent defaults, then repository settings. +Organization-wide work uses supported organization enforcement and defaults, then +repository settings, within the authorized scope. Repository-scoped work keeps parent state read-only while accounting for inherited controls. Neither mode grants authority to modify a higher scope. @@ -35,7 +35,7 @@ Preserve active advanced CodeQL setup or select the supported advanced-setup allowance when attaching a parent configuration. Do not remove working advanced setup merely to make the attachment succeed. -For a free private or internal baseline, enable only features supported without +For a free private baseline, enable only features supported without charge by the current plan, including dependency graph and Dependabot alerts and security updates. Disable Code Security, Secret Protection, CodeQL, secret scanning, push protection, and paid dependent features unless separately authorized. Keep @@ -43,19 +43,17 @@ malware alerts within their supported ecosystems and delegated dismissal disable when it requires a paid product. Code Quality is separate from CodeQL and Code Security. For a no-extra-cost -profile, keep it disabled on public and private repositories. At Enterprise scope, -verify organization access is unavailable and repository administrators cannot -enable it. Where organization controls remain available, require `No repositories` +profile, keep it disabled on public and private repositories. Where organization +controls are available, require `No repositories` with `Enforce access`; the default alone does not disable repository opt-ins. Read back effective repository analysis as off. Never enable the product to expose a hidden control or complete verification. ### Prevent Additional Charges -Preserve the authorized base subscription and seat allowance. The acg-box baseline -allows one GHEC seat and no additional paid products or metered charges unless the -user changes that profile. Keep confirmed free features. Trials, discounts, -included quotas, and public visibility do not prove that a feature and its +Preserve the authorized subscription. Do not enable additional paid products or +metered charges without user authority. Keep confirmed free features. Trials, +discounts, included quotas, and public visibility do not prove that a feature and its dependent Actions, storage, or AI workloads cannot incur charges. Within the authorized scope, disable unapproved paid products and use parent @@ -65,20 +63,17 @@ usage where supported. Report an uncovered cost risk instead of enabling a featu with uncertain billing to maximize security coverage. Budgets supplement product controls. Verify current product/SKU support, units, -scope, exclusions, and stop-usage enforcement. Alert-only budgets do not cap use; -GHEC license budgets cannot prevent additional seats. Do not assume Code Quality -supports a budget or that a GHAS budget disables existing paid enablement. Recheck +scope, exclusions, and stop-usage enforcement. Alert-only budgets do not cap use. +Do not assume Code Quality supports a budget or that a GHAS budget disables +existing paid enablement. Recheck provider capabilities instead of treating historical API limitations as permanent. -For account-wide cost audits, inspect consumed licenses and billable usage, -including outside collaborators and invitations that can add seats. Cost control -does not authorize removing people or repository access. Report excess seats and -the proposed access change unless that exact change is already authorized. +For account-wide cost audits, inspect billable usage. Cost control does not +authorize removing people or repository access. Verify effective product state, restrictions on re-enablement, and current-period -net charges separately. Account for reporting delay, usage before a budget existed, -and license charges that continue after disablement or user removal. Current -consumed seats do not establish the period's billable seats. Report remaining +net charges separately. Account for reporting delay and usage before a budget +existed or a product was disabled. Report remaining charges and gaps; do not promise a monthly total or zero future charges from current settings, absent usage records, or partial-period totals alone. @@ -89,7 +84,7 @@ dependency-graph, Actions, ecosystem, runner, and billing prerequisites. It is n controlled by the Dependabot runner setting. For a maximum-free public baseline, enable it with the standard runner after -confirming current free usage. For private or internal repositories, leave it +confirming current free usage. For private repositories, leave it disabled unless the user accepts Actions usage and possible charges. Prefer free Dependabot graph jobs where they take precedence. Report enablement with no current effect when the repository has no supported manifest. @@ -204,9 +199,7 @@ Use current official documentation for the controls involved: - [GraphQL](https://docs.github.com/en/graphql/reference). For cost controls, consult [budgets and alerts](https://docs.github.com/en/billing/concepts/budgets-and-alerts), -[Code Quality disablement](https://docs.github.com/en/code-security/how-tos/maintain-quality-code/disable-code-quality), -[Enterprise Code Quality policy](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/allow-github-code-quality-in-enterprise), -and [enterprise license billing](https://docs.github.com/en/enterprise-cloud@latest/billing/concepts/enterprise-billing/usage-based-licenses). +and [Code Quality disablement](https://docs.github.com/en/code-security/how-tos/maintain-quality-code/disable-code-quality). Consult the relevant product documentation for billing, default precedence, attachment compatibility, and automatic dependency submission prerequisites.