Import engineering-workflow 0.9.7

PLANS.md

@@ -4,6 +4,109 @@ plan_schema_version: 2
 
 Use this file for active, blocked, ready-for-closure, or recently completed execution work. The canonical lifecycle is the installed `engineering-workflow` planning reference.
 
+## Active Plan: Marketplace Repository Audit Fix 1.0.7
+
+Status: active
+Owner: root
+Last Updated: 2026-09-20
+
+### Goal
+
+Import the immutable engineering-workflow 0.9.7 release that fixes repository audit discovery/output, publish xeonvs-engineering 1.0.7, and refresh managed Codex and Claude installations.
+
+### Plan Origin
+
+direct_execution
+
+### Requested Scope
+
+- Complete the authorized end-to-end publication after source release v0.9.7, including marketplace artifacts and local updates.
+
+### Requirement Traceability
+
+| Requirement | Complete outcome | Source | Work queue | Acceptance or validation | Status |
+| --- | --- | --- | --- | --- | --- |
+| REQ-001 | Catalog imports engineering-workflow 0.9.7 from its stable annotated tag with exact provenance and source-byte parity. | User authorization | WQ-01 | Synchronizer, provenance diff, recorded-byte verification. | done |
+| REQ-002 | Existing tgrep-search 1.0.3 and catalog policy/identity remain unchanged. | User authorization | WQ-01 | Focused diff and catalog tests. | done |
+| REQ-003 | Marketplace 1.0.7 passes local validation and is merged, tagged, and released with checksummed artifacts. | User authorization | WQ-02 | Tests, validators, security scans, exact-head merge, tag/release readback. | pending |
+| REQ-004 | Managed Codex and Claude installations resolve engineering-workflow 0.9.7 and tgrep-search 1.0.3. | User authorization | WQ-03 | Native marketplace/plugin refresh and version readback. | pending |
+
+### Explicit Non-Goals
+
+- Modify upstream runtime source, change tgrep-search, rewrite history, edit plugin caches directly, or alter marketplace policy and branding.
+
+### Constraints
+
+- Import only immutable stable annotated tags accepted by the repository synchronizer.
+- Preserve exact upstream bundle bytes and recorded commit/digest provenance.
+- Publish only after catalog, tests, byte verification, plugin validation, and redacted secret scans pass.
+
+### Inputs And Sources
+
+- https://github.com/xeonvs/codex-engineering-workflow/releases/tag/v0.9.7
+- Current catalog main at `f2da25fb1ada0213ead3e40296a21828eb9fd502` and repository-owned synchronization/release workflows.
+
+### User Decisions And Answers
+
+- 2026-09-20: Finish all remaining work, including marketplace updates.
+
+### Completed Baseline State
+
+- [x] WQ-00 — Fresh catalog main is clean at marketplace 1.0.6 with engineering-workflow 0.9.6 and tgrep-search 1.0.3; source v0.9.7 is published.
+
+### Current Work Queue
+
+- [x] WQ-01 — Synchronize and verify REQ-001/REQ-002. `done`
+- [ ] WQ-02 — Review, validate, publish, and read back REQ-003. `in_progress`
+- [ ] WQ-03 — Refresh and verify managed installations for REQ-004. `pending`
+
+### Locked Decisions
+
+- Publish marketplace patch version 1.0.7.
+- Retain current marketplace ownership: exact upstream snapshot only, no source development files.
+
+### Verification
+
+- `scripts/validate_catalog.py`, all unit tests, `sync_upstreams.py --verify-recorded`, source/package provenance review, Codex/Claude plugin validation where supported, and redacted Gitleaks tree/history scans.
+- One bounded readback of merge, annotated tag, release artifacts, and active managed versions.
+
+### Latest Validation Results
+
+- 2026-09-20: Upstream 0.9.7 source release exists at merged commit `2ceeba7e92497040b99a3bc1d302e4e26bf2a853` after its 12/12 release gate.
+- 2026-09-20: Synchronizer imported engineering-workflow 0.9.7 from annotated `v0.9.7` with bundle digest `09dcce2e3b3cd7ab9f017e6eedce1e5b0f76d4507c6a1a1c852566ae011c1d67`; tgrep-search remained 1.0.3. Catalog validation, all 16 tests, exact recorded-byte verification, both plugin/skill validators, and Claude plugin validation passed.
+
+### Risks And Recovery
+
+- Risk: synchronizer selects an unintended release or mismatched bytes. Recovery: stable annotated-tag policy and recorded-byte verification fail closed before publication.
+- Risk: release archive contains drift or stale catalog metadata. Recovery: release workflow and artifact readback must expose a matching checksummed 1.0.7 archive.
+- Risk: installed clients retain stale marketplace data. Recovery: update marketplace natively, reinstall/update both plugins, and read back active versions.
+
+### Resume Point
+
+- Continue WQ-02 by committing the reviewed catalog import, running post-commit redacted secret scans, and publishing the exact-head marketplace PR/tag/release.
+
+### Plan Fidelity Check
+
+- [x] Import, preserved plugin, release, installation refresh, exclusions, provenance, and validation are represented.
+- [x] Requirements map to ordered work and terminal evidence.
+
+### Reconciliation Check
+
+- [ ] Changed results and plan entries agree.
+
+### Closure Gate
+
+- [ ] Requirements and queue are terminal; release and installation evidence are recorded.
+
+### Post-Close Delivery
+
+- Marketplace commit/push/PR/merge/tag/release and managed installation refresh are explicitly authorized and included.
+
+### Handoff Notes
+
+- None.
+
+
 ## Recently Completed
 
 - [x] 2026-09-15: Completed Marketplace Context Discipline 1.0.6.

PROVENANCE.json

@@ -4,13 +4,13 @@
   "bundles": [
     {
       "name": "engineering-workflow",
-      "version": "0.9.6",
+      "version": "0.9.7",
       "source_repository": "https://github.com/xeonvs/codex-engineering-workflow",
       "source_policy": "latest-tag",
-      "source_ref": "v0.9.6",
-      "source_commit": "f94bdef31622daa3c4ec89aeab7fce317d41a4c9",
+      "source_ref": "v0.9.7",
+      "source_commit": "2ceeba7e92497040b99a3bc1d302e4e26bf2a853",
       "source_path": "plugins/engineering-workflow",
-      "bundle_sha256": "8570254060c53de724678ef887d4c088780fdc2db27a9be3c3a32885b1d22c1f"
+      "bundle_sha256": "09dcce2e3b3cd7ab9f017e6eedce1e5b0f76d4507c6a1a1c852566ae011c1d67"
     },
     {
       "name": "tgrep-search",

README.md

@@ -14,7 +14,7 @@ reviewed local bundle held in this repository.
 <!-- BEGIN GENERATED PLUGIN VERSIONS -->
 | Plugin | Version | Purpose | Canonical source |
 | --- | --- | --- | --- |
-| [`engineering-workflow`](plugins/engineering-workflow/) | 0.9.6 | Audit, plan, migrate, validate, and maintain repository engineering workflows. | [`xeonvs/codex-engineering-workflow`](https://github.com/xeonvs/codex-engineering-workflow) |
+| [`engineering-workflow`](plugins/engineering-workflow/) | 0.9.7 | Audit, plan, migrate, validate, and maintain repository engineering workflows. | [`xeonvs/codex-engineering-workflow`](https://github.com/xeonvs/codex-engineering-workflow) |
 | [`tgrep-search`](plugins/tgrep-search/) | 1.0.3 | Search local source trees efficiently with the tgrep trigram index. | [`xeonvs/tgrep-search`](https://github.com/xeonvs/tgrep-search) |
 <!-- END GENERATED PLUGIN VERSIONS -->
 

plugins/engineering-workflow/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-workflow",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "description": "Audit, plan, migrate, validate, and maintain repository engineering workflows.",
   "author": {
     "name": "xeonvs",

plugins/engineering-workflow/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-workflow",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "description": "Audit, plan, migrate, validate, and maintain repository engineering workflows.",
   "author": {
     "name": "xeonvs",

plugins/engineering-workflow/skills/engineering-workflow/SKILL.md

@@ -2,7 +2,7 @@
 name: engineering-workflow
 description: Set up, audit, or upgrade repository workflow instructions and planning. Use for workflow changes or explicit skill refresh/update; ordinary repository work does not invoke migration.
 metadata:
-  version: 0.9.6
+  version: 0.9.7
 ---
 
 # Engineering Workflow
@@ -47,7 +47,7 @@ Use this skill for the workflow layer around a repository. Keep product, domain,
 ## Core Workflow
 
 1. Reuse the established invoking host. Read `references/platform_compatibility.md` when host or capability behavior is uncertain; select a Codex or Claude Code branch only when the actual host establishes it, otherwise use the shared agent-neutral fallback. In Claude Code, explicitly read the applicable target `AGENTS.md` files rather than assuming automatic discovery.
-2. For scaffold, merge, or workflow-structure verification, run `scripts/repo_audit.py` to establish missing maturity, ownership, compatibility, history, injection, and validation facts. Reuse an applicable audit already available. For target upgrade, follow `references/target_workflow_upgrade.md`, including its customized-owner adoption review before prompt apply; the upgrader owns the report-first audit, so do not add a duplicate standalone audit. Installed-skill refresh/update follows `references/skill_update.md` without auditing or migrating the target repository. A narrow explanation uses only the relevant owners.
+2. For scaffold, merge, or workflow-structure verification, run `scripts/repo_audit.py` with `<repo> --summary --full-report <protected-task-path>` so the model receives bounded status and counts while complete evidence remains available at the reported path. Reuse an applicable audit already available; use the compatible default full-JSON form only when a non-agent consumer requires it. Git-backed discovery includes tracked and non-ignored untracked files; non-Git discovery is explicitly bounded and reports omissions under `references/repo_maturity_matrix.md`. For target upgrade, follow `references/target_workflow_upgrade.md`, including its customized-owner adoption review before prompt apply; the upgrader owns the report-first audit, so do not add a duplicate standalone audit. Installed-skill refresh/update follows `references/skill_update.md` without auditing or migrating the target repository. A narrow explanation uses only the relevant owners.
 3. For repository-changing work, read `references/planning_and_backlog.md`, create or update the full active plan as the first write, and pass its fidelity gate.
 4. For instruction changes, read `references/instruction_lifecycle.md`; preserve one canonical owner per invariant, keep target `AGENTS.md` route-only, and keep pitfalls non-normative.
 5. Use exact canonical paths, the state manifest, or managed-section markers as ownership evidence. Treat unknown files as protected until evidence or user direction resolves ownership.
@@ -75,7 +75,7 @@ Use this skill for the workflow layer around a repository. Keep product, domain,
 
 ## Scripts
 
-- `scripts/repo_audit.py`: structured read-only workflow audit.
+- `scripts/repo_audit.py`: structured read-only workflow audit with compatible full JSON and opt-in compact output backed by a complete report file.
 - `scripts/assess_programmatic_stage.py`: validate model-established stage facts and render bounded Programmatic Tool Calling instructions.
 - `scripts/plan_bootstrap.py`: plan and artifact-action proposal; read-only mode emits no plan requirement.
 - `scripts/instruction_contract.py`: validate invariant owners, routes, incident links, and guards.

plugins/engineering-workflow/skills/engineering-workflow/references/repo_maturity_matrix.md

@@ -1,5 +1,11 @@
 # Repo Maturity Matrix
 
+## Discovery Boundary
+
+For a Git repository root, audit discovery uses the repository inventory: every tracked path plus non-ignored untracked paths, decoded from NUL-delimited Git output. A tracked document remains visible even when its name or parent resembles an ignored cache or dependency directory. Ignored untracked diagnostics, dependencies, and build products do not enter ownership or context classification.
+
+For a non-Git directory or unavailable Git inventory, discovery uses a bounded filesystem fallback. It checks canonical exact owners independently, prunes known generated/cache/dependency directories before descent, does not follow directory symlinks, and stops after 20,000 entries or 32 directory levels. The complete audit and compact summary identify the inventory mode, limits, truncation, and omission reasons; truncated discovery is attention-required evidence rather than a complete audit.
+
 ## `empty_directory`
 
 Signals:

plugins/engineering-workflow/skills/engineering-workflow/references/target_workflow_upgrade.md

@@ -24,7 +24,7 @@ Use this canonical reference for `upgrade_target_workflow`, which migrates the w
 Treat `Upgrade A Target Workflow` plus a target repository as an authorized repo-changing prompt, not as a request for CLI instructions.
 
 1. Resolve the target path and requested version from context; default to the installed skill version.
-2. Before prompt apply, review target-local owners affected by the requested release's changed semantics when adoption has not already been established. For customized owners, preserve equivalent rules or make the narrow requested correction under the full planning and privacy gates; ask only for a real ownership conflict. A same-version stamp or `already_current` result proves structural state, not semantic adoption. For the 0.9.6 changes, inspect the task-handoff route and efficient-execution owner for root working state, self-contained worker context, transient-versus-durable evidence, and artifact-based recovery. Use already-current evidence, and do not sweep unrelated owners. Then invoke `scripts/upgrade_target_workflow.py --prompt` yourself.
+2. Before prompt apply, review target-local owners affected by the requested release's changed semantics when adoption has not already been established. For customized owners, preserve equivalent rules or make the narrow requested correction under the full planning and privacy gates; ask only for a real ownership conflict. A same-version stamp or `already_current` result proves structural state, not semantic adoption. Version 0.9.7 changes audit discovery and output only, so it requires no target-local instruction rewrite. For the 0.9.6 changes, inspect the task-handoff route and efficient-execution owner for root working state, self-contained worker context, transient-versus-durable evidence, and artifact-based recovery. Use already-current evidence, and do not sweep unrelated owners. Then invoke `scripts/upgrade_target_workflow.py --prompt` yourself.
 3. Prompt mode builds and reviews the read-only migration report first.
 4. If ownership, conflicts, privacy, and approvals are resolved, it proceeds through guarded apply and validation automatically.
 5. If the result returns `agent_action: ask_targeted_question`, ask only `question_to_ask`; keep any later questions deferred and do not write target files.