chore: migrate repository URLs from tonythethompson to numan-cli

.github/workflows/roadmap-drift.yml

@@ -23,7 +23,7 @@ jobs:
       # Roadmap contract v1 pin. CONTRACT_TAG is the human-readable handle;
       # CONTRACT_SHA is the immutable fetch target. The verify step fails
       # closed if the tag moves away from this SHA. See scripts/bump-contract.sh
-      # in tonythethompson/numan — never edit this in isolation.
+      # in numan-cli/numan — never edit this in isolation.
       CONTRACT_TAG: numan-roadmap-contract/v1
       CONTRACT_SHA: 2cd6f5a4d5e831d1248d3fe3fd924944823510a1
     steps:
@@ -39,7 +39,7 @@ jobs:
             -H "Authorization: Bearer ${GITHUB_TOKEN}" \
             -H "Accept: application/vnd.github+json" \
             -H "User-Agent: numan-plugins-ci" \
-            "https://api.github.com/repos/tonythethompson/numan/git/refs/tags/${CONTRACT_TAG}")
+            "https://api.github.com/repos/numan-cli/numan/git/refs/tags/${CONTRACT_TAG}")
           if [ "$status" = "404" ]; then
             echo "::warning::Tag $CONTRACT_TAG does not exist yet; skipping SHA resolution check."
             exit 0
@@ -69,7 +69,7 @@ jobs:
         run: |
           mkdir -p docs/plans
           curl --fail-with-body --silent --show-error --location \
-            "https://raw.githubusercontent.com/tonythethompson/numan/${CONTRACT_SHA}/docs/plans/consolidated-multi-repo-roadmap.md" \
+            "https://raw.githubusercontent.com/numan-cli/numan/${CONTRACT_SHA}/docs/plans/consolidated-multi-repo-roadmap.md" \
             -o docs/plans/consolidated-multi-repo-roadmap.md
           # Sanity check: the file must not be empty AND must mention this
           # repo by path so we know we didn't grab a placeholder document.
@@ -79,7 +79,7 @@ jobs:
         run: |
           mkdir -p scripts
           curl --fail-with-body --silent --show-error --location \
-            "https://raw.githubusercontent.com/tonythethompson/numan/${CONTRACT_SHA}/scripts/check-roadmap-drift.py" \
+            "https://raw.githubusercontent.com/numan-cli/numan/${CONTRACT_SHA}/scripts/check-roadmap-drift.py" \
             -o scripts/check-roadmap-drift.py
           chmod +x scripts/check-roadmap-drift.py
       - name: Run drift check

README.md

@@ -1,8 +1,8 @@
 # numan-plugins
 
-CI build pipeline feeder for the [numan](https://github.com/tonythethompson/numan)
+CI build pipeline feeder for the [numan](https://github.com/numan-cli/numan)
 official registry — implements the binary-delivery half of
-[numan #30](https://github.com/tonythethompson/numan/issues/30).
+[numan #30](https://github.com/numan-cli/numan/issues/30).
 
 **Default branch:** `main` (aligned with `numan-registry`; client stays on `master`).
 
@@ -16,13 +16,13 @@ toolchain to install them.
 This repo closes that gap for selected plugins: it cross-compiles from immutable
 upstream commits (with tags retained for human-facing provenance), packages one
 archive per target, and publishes them as GitHub release assets.
-[`numan-registry`](https://github.com/tonythethompson/numan-registry)
+[`numan-registry`](https://github.com/numan-cli/numan-registry)
 then pins those URLs and signs the index with the official trust root.
 
 Plugins that already publish compliant upstream release assets can be ingested
 directly into `numan-registry` without a stop here. For the live catalog × Nu
 matrix, see
-[`docs/catalog-compat.md`](https://github.com/tonythethompson/numan-registry/blob/main/docs/catalog-compat.md)
+[`docs/catalog-compat.md`](https://github.com/numan-cli/numan-registry/blob/main/docs/catalog-compat.md)
 in the registry. For demand-ranked candidates **not yet** built, see
 [`docs/backlog.json`](docs/backlog.json) here.
 
@@ -48,7 +48,7 @@ Vulnerability reporting and scope: [SECURITY.md](SECURITY.md).
 | `manifest.json` | `active[]` = plugins built now; build matrix + target→runner map |
 | `docs/backlog.json` | Demand-ranked plugin candidates (statuses, Nu deps per tag) |
 | `docs/roadmap.md` | Repo-local build/handoff plan (points at consolidated 1.0 roadmap) |
-| Registry [`catalog-compat.md`](https://github.com/tonythethompson/numan-registry/blob/main/docs/catalog-compat.md) | Master list of **live** official packages × Nu constraints |
+| Registry [`catalog-compat.md`](https://github.com/numan-cli/numan-registry/blob/main/docs/catalog-compat.md) | Master list of **live** official packages × Nu constraints |
 | `.github/workflows/build.yml` | manual matrix build → package → release → emit spec |
 | `.github/workflows/repo-safety.yml` | required manifest, test, archive, spec, and workflow checks |
 | `.pre-commit-config.yaml` | local JSON format + README/backlog consistency hooks |
@@ -140,5 +140,5 @@ invariants, and the review checklist.
 
 See [SECURITY.md](SECURITY.md) for how to report issues in this build pipeline.
 Signed-index and client issues go to
-[numan-registry](https://github.com/tonythethompson/numan-registry/blob/main/SECURITY.md)
-and [numan](https://github.com/tonythethompson/numan/blob/main/SECURITY.md).
+[numan-registry](https://github.com/numan-cli/numan-registry/blob/main/SECURITY.md)
+and [numan](https://github.com/numan-cli/numan/blob/main/SECURITY.md).

SECURITY.md

@@ -7,17 +7,17 @@ hosts artifacts only. It never holds registry signing keys.
 Companion policies:
 
 - Signed index, yanks, and key incidents:
-  [tonythethompson/numan-registry SECURITY.md](https://github.com/tonythethompson/numan-registry/blob/main/SECURITY.md)
+  [numan-cli/numan-registry SECURITY.md](https://github.com/numan-cli/numan-registry/blob/main/SECURITY.md)
 - Numan CLI verification and install/activate behavior:
-  [tonythethompson/numan SECURITY.md](https://github.com/tonythethompson/numan/blob/main/SECURITY.md)
+  [numan-cli/numan SECURITY.md](https://github.com/numan-cli/numan/blob/main/SECURITY.md)
 
 ## Report a vulnerability
 
 Do not publish exploit details, credentials, or unverified malware samples in a
 public issue.
 
 Preferred: open a private GitHub security advisory at
-<https://github.com/tonythethompson/numan-plugins/security/advisories/new>.
+<https://github.com/numan-cli/numan-plugins/security/advisories/new>.
 
 Fallback: open a public issue titled **Security contact request** with no
 technical details. The maintainer will establish a private channel before
@@ -45,9 +45,9 @@ Helpful report contents:
 
 - A bad artifact that is already pinned and signed in the official index
   (including yank / user remediation):
-  [numan-registry](https://github.com/tonythethompson/numan-registry)
+  [numan-registry](https://github.com/numan-cli/numan-registry)
 - Client-side verification, path, or activation bugs:
-  [numan](https://github.com/tonythethompson/numan)
+  [numan](https://github.com/numan-cli/numan)
 - Security bugs in upstream plugin source (report upstream; open an issue here
   only if our pinned commit or rebuild process needs to change)
 - Registry private-key or signature issues (this repo does not sign indexes)
@@ -79,4 +79,4 @@ intake or yank as appropriate.
 - Trust boundary overview: [README.md](README.md#trust-boundary)
 - Reviewer trust checklist: [REVIEW.md](REVIEW.md)
 - Registry incident procedures:
-  [numan-registry incident-response](https://github.com/tonythethompson/numan-registry/blob/main/docs/incident-response.md)
+  [numan-registry incident-response](https://github.com/numan-cli/numan-registry/blob/main/docs/incident-response.md)

docs/roadmap.md

@@ -8,10 +8,10 @@ catalog intake, signing, plugin backfills, client compat, lifecycle
 evidence, and the active-plugin gate — lives in the consolidated
 cross-repo plan:
 
-[**`numan/docs/plans/consolidated-multi-repo-roadmap.md`**](https://github.com/tonythethompson/numan/blob/master/docs/plans/consolidated-multi-repo-roadmap.md)
+[**`numan/docs/plans/consolidated-multi-repo-roadmap.md`**](https://github.com/numan-cli/numan/blob/master/docs/plans/consolidated-multi-repo-roadmap.md)
 
 Repo-local roadmaps keep operational detail. The cross-repo drill is enforced by
-[`scripts/check-roadmap-drift.py`](https://github.com/tonythethompson/numan/blob/master/scripts/check-roadmap-drift.py),
+[`scripts/check-roadmap-drift.py`](https://github.com/numan-cli/numan/blob/master/scripts/check-roadmap-drift.py),
 which CI runs at `.github/workflows/roadmap-drift.yml` and which fails the
 workflow run if this page drifts from the consolidated truth.
 
@@ -44,7 +44,7 @@ contract pins in this repo alone.
 - `docs/backlog.json` (schema v1) is the comprehensive **plugin candidate** list
   (not the live catalog). It tracks release versions per plugin with Nu minor
   compatibility via `versions[]` / `backfill_targets`. Live catalog × Nu overview:
-  [`numan-registry/docs/catalog-compat.md`](https://github.com/tonythethompson/numan-registry/blob/main/docs/catalog-compat.md).
+  [`numan-registry/docs/catalog-compat.md`](https://github.com/numan-cli/numan-registry/blob/main/docs/catalog-compat.md).
   Source: awesome-nu + manual discovery.
 - Wave 1 and Wave 2 CI-built plugins are on **`main`**, published, and intaken
   into the official registry. Wave 2 targets Nu 0.114; Wave 1 includes Nu
@@ -111,9 +111,9 @@ occurred during the Wave 1 Nu 0.114 intake).
 - [x] `lizclipse/nu_plugin_ulid@0.23.0`
 - [x] `rhino-linux/nu_plugin_nutext@0.6.2`
 
-Assets published ([build 30985049217](https://github.com/tonythethompson/numan-plugins/actions/runs/30985049217));
+Assets published ([build 30985049217](https://github.com/numan-cli/numan-plugins/actions/runs/30985049217));
 registry intake complete;
-production [30996546918](https://github.com/tonythethompson/numan-registry/actions/runs/30996546918);
+production [30996546918](https://github.com/numan-cli/numan-registry/actions/runs/30996546918);
 lifecycle-prove OK Linux x86_64 and Windows x64 / Nu 0.114.1.
 
 ### Wave 2 Research

manifest.json

@@ -3,7 +3,7 @@
   "note": "Build matrix for the numan#30 CI build+sign pipeline. Each active plugin is cross-compiled from its immutable upstream source_commit after its human-facing tag is verified to resolve to that commit, packaged per target (.tar.gz on Unix, .zip on Windows), and published once as a GitHub release asset on THIS repo. numan-registry then pins those asset URLs via scripts/add-package.py and signs the index with the trust root. This repo never holds signing keys.",
   "schema_notes": {
     "intake_mode": "Optional per-entry field, 'tagged' (default) or 'commit-snapshot'. 'tagged' entries must provide a non-empty 'tag' field and the tag is verified via git ls-remote against source_commit. 'commit-snapshot' entries may omit 'tag' or set it to null; the tag-to-commit ls-remote check is skipped and source_commit is confirmed fetchable upstream via a scoped shallow fetch and verified to be a commit object, not a tree/blob/tag. The workflow derives the version for commit-snapshot entries as 0.0.0-snapshot.<YYYYMMDD>.<7-char-sha> once per run (date = intake date) and uses it consistently for packaging, the release tag, and the generated spec, instead of the manifest 'version' field. gen_spec.py emits 'provenance': 'commit-snapshot' at the top level of the generated spec.",
-    "upstream_repo": "Optional per-entry field, 'owner/name' of the ORIGINAL upstream repo. Only set on numan-maintained fork entries: 'repo'/'owner'/'source_commit' point at the fork (owner must be exactly 'numan-maintained'), 'upstream_repo' preserves the original author's identity. gen_spec.py emits it as source.upstream in the generated spec and appends a fork-attribution note to the description. See https://github.com/tonythethompson/numan/blob/master/docs/adr/0001-ecosystem-trust-upstream-contribution-fork-stewardship.md for the full fork-eligibility and stewardship requirements that must be satisfied before an entry like this is added -- this field only records identity, it doesn't grant eligibility."
+    "upstream_repo": "Optional per-entry field, 'owner/name' of the ORIGINAL upstream repo. Only set on numan-maintained fork entries: 'repo'/'owner'/'source_commit' point at the fork (owner must be exactly 'numan-maintained'), 'upstream_repo' preserves the original author's identity. gen_spec.py emits it as source.upstream in the generated spec and appends a fork-attribution note to the description. See https://github.com/numan-cli/numan/blob/master/docs/adr/0001-ecosystem-trust-upstream-contribution-fork-stewardship.md for the full fork-eligibility and stewardship requirements that must be satisfied before an entry like this is added -- this field only records identity, it doesn't grant eligibility."
   },
   "default_targets": [
     "x86_64-unknown-linux-gnu",

scripts/test_check_repo_consistency.py

@@ -117,7 +117,7 @@ def test_pr_url_in_roadmap_fails(self):
             roadmap = root / "docs" / "roadmap.md"
             roadmap.parent.mkdir()
             roadmap.write_text(
-                "See [intake](https://github.com/tonythethompson/numan-registry/pull/45).\n",
+                "See [intake](https://github.com/numan-cli/numan-registry/pull/45).\n",
                 encoding="utf-8",
             )
             found = self.mod.check_no_pr_refs(roadmap)

scripts/test_gen_spec_source.py

@@ -53,7 +53,7 @@ def test_emits_source_from_manifest_entry(self):
         out = self.gs.build_spec(
             entry,
             rows,
-            "https://github.com/tonythethompson/numan-plugins/releases/download/nu_plugin_highlight-1.4.15",
+            "https://github.com/numan-cli/numan-plugins/releases/download/nu_plugin_highlight-1.4.15",
             ["x86_64-unknown-linux-gnu"],
         )
         self.assertEqual(
@@ -98,7 +98,7 @@ def test_commit_snapshot_entry_emits_derived_version_and_provenance(self):
         out = self.gs.build_spec(
             entry,
             rows,
-            "https://github.com/tonythethompson/numan-plugins/releases/download/nu_plugin_plot-snapshot",
+            "https://github.com/numan-cli/numan-plugins/releases/download/nu_plugin_plot-snapshot",
             ["x86_64-unknown-linux-gnu"],
             snapshot_date="20260809",
         )
@@ -150,7 +150,7 @@ def test_fork_entry_emits_source_upstream_and_description_note(self):
         out = self.gs.build_spec(
             entry,
             rows,
-            "https://github.com/tonythethompson/numan-plugins/releases/download/nu_plugin_clipboard-0.110.0",
+            "https://github.com/numan-cli/numan-plugins/releases/download/nu_plugin_clipboard-0.110.0",
             ["x86_64-unknown-linux-gnu"],
         )
         self.assertEqual(
@@ -184,7 +184,7 @@ def test_numan_maintained_requires_upstream_repo(self):
             self.gs.build_spec(
                 entry,
                 rows,
-                "https://github.com/tonythethompson/numan-plugins/releases/download/nu_plugin_clipboard-0.110.0",
+                "https://github.com/numan-cli/numan-plugins/releases/download/nu_plugin_clipboard-0.110.0",
                 ["x86_64-unknown-linux-gnu"],
             )
     def test_rejects_self_referential_upstream_repo(self):
@@ -214,7 +214,7 @@ def test_rejects_self_referential_upstream_repo(self):
             self.gs.build_spec(
                 entry,
                 rows,
-                "https://github.com/tonythethompson/numan-plugins/releases/download/nu_plugin_clipboard-0.110.0",
+                "https://github.com/numan-cli/numan-plugins/releases/download/nu_plugin_clipboard-0.110.0",
                 ["x86_64-unknown-linux-gnu"],
             )