From 3bbbb8d933efd6400b9c59fa2734780d4a93671a Mon Sep 17 00:00:00 2001 From: xeonvs <11463419+xeonvs@users.noreply.github.com> Date: Sun, 13 Sep 2026 14:32:13 +0200 Subject: [PATCH] docs: clarify proportional marketplace maintenance --- AGENTS.md | 20 ++++++++++++++++++++ PLANS.md | 1 + README.md | 7 +++++++ 3 files changed, 28 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index eda9cf6..ca28e87 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -3,3 +3,23 @@ This repository is a public catalog only. It contains self-contained, immutable plugin bundles released by their own repositories; it does not own their runtime source. Use `PLANS.md` as active execution state. Keep the catalog limited to metadata, documented provenance, and byte-verified copies of released plugin bundles. Do not add credentials, local paths, private repository references, generated indexes, automatic installation behavior, hooks, MCP servers, or unrelated code. + +## Maintainer workflow + +- For sync-policy or validator changes, inspect the matching script and tests; + for catalog imports, inspect provenance and the exact generated bundle diff; + for documentation-only changes, inspect affected instructions and links. + Do not load every maintainer source for a narrow question. +- Known local fixture tests are authorized when the request includes + implementation. Select an affected suite while iterating. For final catalog + or code changes, run `PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover + -s tests -v`, `python3 scripts/validate_catalog.py`, and + `python3 scripts/sync_upstreams.py --verify-recorded`. The last check fetches + recorded public upstream revisions. Do not run the full suite again solely + for a documentation-only update; preserve applicable package evidence. +- Reuse current evidence when inputs are unchanged. Do not repeat expensive + checks merely because a later step or handoff occurred. +- A PR-only task ends after local validation, diff review, PR creation, and + readback of its URL, base, and head. It does + not imply CI polling, approval, merge, release, or local skill installation; + those are separate explicitly authorized actions. diff --git a/PLANS.md b/PLANS.md index da85707..bd8f927 100644 --- a/PLANS.md +++ b/PLANS.md @@ -6,6 +6,7 @@ Use this file for active, blocked, ready-for-closure, or recently completed exec ## Recently Completed +- [x] 2026-09-13: Completed Proportional Marketplace Maintenance. - [x] 2026-09-12: Completed Xeonvs Engineering 1.0.4 Brand And Plugin Icons. - [x] 2026-09-12: Completed Refresh Marketplace Actions For Node 24. - [x] 2026-09-12: Completed Repair Marketplace Sync Authentication For Engineering Workflow 0.9.2. diff --git a/README.md b/README.md index 0a7a371..d598ac3 100644 --- a/README.md +++ b/README.md @@ -50,6 +50,13 @@ stable annotated SemVer tag of an allowlisted source. The installed catalog bundle is pinned to that tag's resolved immutable commit; installation never follows a branch or floating tag. +Upstream source changes must first be merged and released as an annotated tag; +catalog synchronization imports only that released tag. Do not invent future +provenance or hand-edit vendored bundles. After source releases exist, the +scheduled or explicitly requested synchronizer produces the byte-verified +update and its review-required PR. Preparing a source PR does not require +waiting for its release or starting a synchronization run. + `python3 scripts/validate_catalog.py` validates catalog identity, plugin manifests, local bundle checksums, and public-content hygiene. CI also runs `python3 scripts/sync_upstreams.py --verify-recorded` to prove that the