From 1a4546e43002c562cc0bad15a5ab26fd10274e67 Mon Sep 17 00:00:00 2001 From: xeonvs <11463419+xeonvs@users.noreply.github.com> Date: Sun, 20 Sep 2026 12:37:29 +0200 Subject: [PATCH] Close marketplace 1.0.7 release plan --- PLANS.md | 104 +------------------------------------------------------ 1 file changed, 1 insertion(+), 103 deletions(-) diff --git a/PLANS.md b/PLANS.md index b78b5b5..696725e 100644 --- a/PLANS.md +++ b/PLANS.md @@ -4,111 +4,9 @@ plan_schema_version: 2 Use this file for active, blocked, ready-for-closure, or recently completed execution work. The canonical lifecycle is the installed `engineering-workflow` planning reference. -## Active Plan: Marketplace Repository Audit Fix 1.0.7 - -Status: active -Owner: root -Last Updated: 2026-09-20 - -### Goal - -Import the immutable engineering-workflow 0.9.7 release that fixes repository audit discovery/output, publish xeonvs-engineering 1.0.7, and refresh managed Codex and Claude installations. - -### Plan Origin - -direct_execution - -### Requested Scope - -- Complete the authorized end-to-end publication after source release v0.9.7, including marketplace artifacts and local updates. - -### Requirement Traceability - -| Requirement | Complete outcome | Source | Work queue | Acceptance or validation | Status | -| --- | --- | --- | --- | --- | --- | -| REQ-001 | Catalog imports engineering-workflow 0.9.7 from its stable annotated tag with exact provenance and source-byte parity. | User authorization | WQ-01 | Synchronizer, provenance diff, recorded-byte verification. | done | -| REQ-002 | Existing tgrep-search 1.0.3 and catalog policy/identity remain unchanged. | User authorization | WQ-01 | Focused diff and catalog tests. | done | -| REQ-003 | Marketplace 1.0.7 passes local validation and is merged, tagged, and released with checksummed artifacts. | User authorization | WQ-02 | Tests, validators, security scans, exact-head merge, tag/release readback. | pending | -| REQ-004 | Managed Codex and Claude installations resolve engineering-workflow 0.9.7 and tgrep-search 1.0.3. | User authorization | WQ-03 | Native marketplace/plugin refresh and version readback. | pending | - -### Explicit Non-Goals - -- Modify upstream runtime source, change tgrep-search, rewrite history, edit plugin caches directly, or alter marketplace policy and branding. - -### Constraints - -- Import only immutable stable annotated tags accepted by the repository synchronizer. -- Preserve exact upstream bundle bytes and recorded commit/digest provenance. -- Publish only after catalog, tests, byte verification, plugin validation, and redacted secret scans pass. - -### Inputs And Sources - -- https://github.com/xeonvs/codex-engineering-workflow/releases/tag/v0.9.7 -- Current catalog main at `f2da25fb1ada0213ead3e40296a21828eb9fd502` and repository-owned synchronization/release workflows. - -### User Decisions And Answers - -- 2026-09-20: Finish all remaining work, including marketplace updates. - -### Completed Baseline State - -- [x] WQ-00 — Fresh catalog main is clean at marketplace 1.0.6 with engineering-workflow 0.9.6 and tgrep-search 1.0.3; source v0.9.7 is published. - -### Current Work Queue - -- [x] WQ-01 — Synchronize and verify REQ-001/REQ-002. `done` -- [ ] WQ-02 — Review, validate, publish, and read back REQ-003. `in_progress` -- [ ] WQ-03 — Refresh and verify managed installations for REQ-004. `pending` - -### Locked Decisions - -- Publish marketplace patch version 1.0.7. -- Retain current marketplace ownership: exact upstream snapshot only, no source development files. - -### Verification - -- `scripts/validate_catalog.py`, all unit tests, `sync_upstreams.py --verify-recorded`, source/package provenance review, Codex/Claude plugin validation where supported, and redacted Gitleaks tree/history scans. -- One bounded readback of merge, annotated tag, release artifacts, and active managed versions. - -### Latest Validation Results - -- 2026-09-20: Upstream 0.9.7 source release exists at merged commit `2ceeba7e92497040b99a3bc1d302e4e26bf2a853` after its 12/12 release gate. -- 2026-09-20: Synchronizer imported engineering-workflow 0.9.7 from annotated `v0.9.7` with bundle digest `09dcce2e3b3cd7ab9f017e6eedce1e5b0f76d4507c6a1a1c852566ae011c1d67`; tgrep-search remained 1.0.3. Catalog validation, all 16 tests, exact recorded-byte verification, both plugin/skill validators, and Claude plugin validation passed. - -### Risks And Recovery - -- Risk: synchronizer selects an unintended release or mismatched bytes. Recovery: stable annotated-tag policy and recorded-byte verification fail closed before publication. -- Risk: release archive contains drift or stale catalog metadata. Recovery: release workflow and artifact readback must expose a matching checksummed 1.0.7 archive. -- Risk: installed clients retain stale marketplace data. Recovery: update marketplace natively, reinstall/update both plugins, and read back active versions. - -### Resume Point - -- Continue WQ-02 by committing the reviewed catalog import, running post-commit redacted secret scans, and publishing the exact-head marketplace PR/tag/release. - -### Plan Fidelity Check - -- [x] Import, preserved plugin, release, installation refresh, exclusions, provenance, and validation are represented. -- [x] Requirements map to ordered work and terminal evidence. - -### Reconciliation Check - -- [ ] Changed results and plan entries agree. - -### Closure Gate - -- [ ] Requirements and queue are terminal; release and installation evidence are recorded. - -### Post-Close Delivery - -- Marketplace commit/push/PR/merge/tag/release and managed installation refresh are explicitly authorized and included. - -### Handoff Notes - -- None. - - ## Recently Completed +- [x] 2026-09-20: Completed Marketplace Repository Audit Fix 1.0.7. - [x] 2026-09-15: Completed Marketplace Context Discipline 1.0.6. - [x] 2026-09-13: Completed Marketplace 1.0.5 Source Refresh. - [x] 2026-09-13: Completed Proportional Marketplace Maintenance.