diff --git a/README.md b/README.md index 9d737f0..ffd5017 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ Three small, open-source skills bring Terraphim's local code search, operational learning, and agent memory workflows to Cursor, Kimi Code, AutoClaw, ZCode, -Hermes Agent, skills.sh, and Claude Code. +Hermes Agent, skills.sh, Claude Code, and Grok Build. | Skill | Command family | Purpose | |---|---|---| @@ -42,6 +42,7 @@ never install dependencies automatically. | Hermes Agent | Add `terraphim/terraphim-cursor-plugin` as a tap, then inspect and install the three skills. | | skills.sh | Run `npx skills add terraphim/terraphim-cursor-plugin`; use `DISABLE_TELEMETRY=1` to opt out of anonymous telemetry. | | Claude Code | Add the repository as a marketplace, then install the plugin as shown below. | +| Grok Build | The [xAI marketplace submission](https://github.com/xai-org/plugin-marketplace/pull/730) pins the signed v0.2.2 commit and is awaiting maintainer review. | Claude Code commands: diff --git a/docs/distribution.md b/docs/distribution.md index 9ef5270..0e16fd6 100644 --- a/docs/distribution.md +++ b/docs/distribution.md @@ -10,6 +10,9 @@ exactly three skills and deterministic AutoClaw archives. - **Curated marketplace listing** is controlled by each marketplace maintainer and remains pending until that marketplace confirms indexing or approval. - Cursor is already submitted and is a regression target, not a new submission. +- The Grok Build submission is open at + and pins the exact + signed `v0.2.2` commit; public listing remains under maintainer review. - AutoClaw local ZIP import is supported. ZhipuAI Skills Center inclusion is a separate external review; ClawHub is not treated as proof of that inclusion. @@ -46,9 +49,9 @@ Open ZCode's **Discover** view and add `https://raw.githubusercontent.com/terraphim/terraphim-cursor-plugin/v0.2.2/marketplaces/zcode.json` as a personal marketplace source, install `terraphim-skills-intro`, then confirm the Plugin Skills view shows exactly three skills. Curated discovery requires a separate -pull request to `zai-org/zcode-plugins`; this repository does not claim that -acceptance before the maintainers merge it. Update or remove the installed -plugin through ZCode's plugin manager. +[pull request to `zai-org/zcode-plugins`](https://github.com/zai-org/zcode-plugins/pull/13); +this repository does not claim acceptance before the maintainers merge it. +Update or remove the installed plugin through ZCode's plugin manager. ## Hermes Agent @@ -77,6 +80,15 @@ skills are offered and that their files match tag `v0.2.2`. Update by repeating command for the new tag; remove the installed skill directories through the target agent's documented skill manager. +## Grok Build (xAI) + +The [xAI marketplace submission](https://github.com/xai-org/plugin-marketplace/pull/730) +uses a full commit SHA for the signed `v0.2.2` source. Its catalogue validation, +and component-index checks pass when reproduced locally against the submitted +head. GitHub-hosted Actions await maintainer approval; the hosted Socket security +and Semgrep checks are green. The listing becomes generally available only after +xAI maintainers merge the pull request. + ## Claude Code ```text diff --git a/docs/marketplace-submission-pack.md b/docs/marketplace-submission-pack.md index b1dd09e..baf751a 100644 --- a/docs/marketplace-submission-pack.md +++ b/docs/marketplace-submission-pack.md @@ -98,6 +98,7 @@ The repository includes Terraphim-owned V-model artwork in both formats: | Hermes Agent | `skills/*/SKILL.md` | Repository/local skills directory | | skills.sh | `skills/*/SKILL.md` | Repository URL discovery/install | | Claude Code | `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json` | Direct install and publisher-owned marketplace | +| Grok Build (xAI) | `.grok-plugin/marketplace.json` entry in xAI's catalogue | [Submission PR #730](https://github.com/xai-org/plugin-marketplace/pull/730), pinned to the signed v0.2.2 commit | An artefact being present does not imply that a third-party catalogue has accepted or featured the plugin. Record curated acceptance only after the host diff --git a/docs/uat/evidence-v0.2.2.md b/docs/uat/evidence-v0.2.2.md index b21602e..c608eb1 100644 --- a/docs/uat/evidence-v0.2.2.md +++ b/docs/uat/evidence-v0.2.2.md @@ -1,5 +1,7 @@ # Validation evidence — v0.2.2 +Date: 2026-09-16 + ## Purpose Patch release `v0.2.2` preserves the reviewed Community pack and makes release @@ -30,3 +32,59 @@ control. - the active `v*` tag ruleset restricts updates and deletions; - GitHub release validation verifies the private tag ref and publishes the six expected assets. + +## Observed release evidence + +- The active [Immutable release tags ruleset](https://github.com/terraphim/terraphim-cursor-plugin/rules/23531392) + targets `refs/tags/v*`, enforces update, deletion, and non-fast-forward + restrictions, has no bypass actors, and reports that the current user can + never bypass it. +- Pull request [#4](https://github.com/terraphim/terraphim-cursor-plugin/pull/4) + merged as `6ea3bf47fd7585d8bc518d782b371f281e20e12b` after its validation check passed. +- The annotated `v0.2.2` tag peels to that exact merge commit and verifies as a + good SSH signature for `alex@metacortex.engineer` with trusted ED25519 key + fingerprint `SHA256:sfUIepNnrxdFgZDGWa9u8Kjzrdqh8pxvoovhGgBvJoQ`. +- [Release workflow run 35069801681](https://github.com/terraphim/terraphim-cursor-plugin/actions/runs/35069801681) + completed successfully. +- [GitHub release v0.2.2](https://github.com/terraphim/terraphim-cursor-plugin/releases/tag/v0.2.2) + is public, non-draft, and non-prerelease with the three deterministic skill + ZIPs, `SHA256SUMS`, and the SVG and PNG V-model artwork. +- A fresh download passed `shasum -a 256 -c SHA256SUMS` and `unzip -t` for all + three archives. + +## Host validation + +- **Kimi Code 1.44.0:** installed the immutable v0.2.2 checkout in an isolated + `KIMI_SHARE_DIR`; `plugin info` reported v0.2.2 and exactly the three intended + `SKILL.md` files were present. +- **Claude Code 2.1.270:** strict validation passed; an isolated configuration + added the publisher marketplace and installed + `terraphim-skills-intro@terraphim-skills` v0.2.2 with exactly three skills. +- **skills.sh:** live repository discovery with telemetry disabled reported + `Found 3 skills` and listed only the three Community skills. +- **Hermes Agent v1.0.0:** an isolated `HERMES_HOME` added the GitHub tap, + inspected all skills, classified each as `SAFE`, installed all three, and + listed exactly three hub-installed Community skills. +- **AutoClaw:** all three release ZIPs pass their checksums, archive integrity, + and deterministic rebuild checks. Real desktop import remains outstanding + because the validation Mac was locked; archive proof is not represented as + desktop UAT. +- **ZCode:** the official validator accepts 22 plugins including Terraphim and + `build_dist.py` creates an integrity-tested v0.2.2 package containing the + canonical Apache-2.0 `LICENSE` and `NOTICE`. In an isolated ZCode 0.15.2 + profile, the app-server added the public GitHub repository as a marketplace, + discovered `terraphim-skills-intro` v0.2.2, installed it enabled at user scope, + validated the plugin with no diagnostics, and described exactly the three + intended skills. Submission [PR #13](https://github.com/zai-org/zcode-plugins/pull/13) + is open; its Actions require maintainer approval and real GUI UAT remains + transparently outstanding. +- **Grok Build (xAI):** submission + [PR #730](https://github.com/xai-org/plugin-marketplace/pull/730) pins the exact + v0.2.2 commit. Catalogue validation and component-index checks pass when + reproduced locally against the submitted head. GitHub-hosted Actions await + maintainer approval; the hosted Socket security and Semgrep checks are green. + Maintainer merge remains external. + +The package contains Community skill instructions only. Curated marketplace +acceptance remains a third-party decision and is never inferred from direct +installation or a successful submission check. diff --git a/docs/uat/multi-marketplace.md b/docs/uat/multi-marketplace.md index d5dd722..1ea7308 100644 --- a/docs/uat/multi-marketplace.md +++ b/docs/uat/multi-marketplace.md @@ -71,6 +71,7 @@ content as bundled. | Hermes Agent | Add the repository's `skills/` entries to the configured skills directory | Three discovered skills and UAT-1 through UAT-5 | | skills.sh | Install/discover from the public repository URL | Three discovered skills and UAT-1 through UAT-5 | | Claude Code | Add the local/publisher marketplace, then install `terraphim-skills-intro` | Strict plugin validation, installed listing, UAT-1 through UAT-5 | +| Grok Build (xAI) | Install from the curated catalogue after submission approval | Full commit pin, generated component index, security checks, and UAT-1 through UAT-5 | Capture the host and version, plugin version, command transcript or screenshots, and the final pass/fail result. Redact local paths or memory content that is not diff --git a/tests/test_distribution.py b/tests/test_distribution.py index 9fad5bb..96f699c 100644 --- a/tests/test_distribution.py +++ b/tests/test_distribution.py @@ -158,12 +158,20 @@ def test_docs_cover_hosts_and_dependency_probes(self) -> None: "hermes", "skills.sh", "claude", + "grok", ): self.assertIn(host, readme) self.assertIn(host, uat) for probe in self.metadata["runtime"]["verify"]: self.assertIn(probe, (ROOT / "docs/install-dependencies.md").read_text()) + def test_release_evidence_records_live_publication_and_submissions(self) -> None: + evidence = (ROOT / "docs/uat/evidence-v0.2.2.md").read_text() + self.assertIn("actions/runs/35069801681", evidence) + self.assertIn("releases/tag/v0.2.2", evidence) + self.assertIn("zai-org/zcode-plugins/pull/13", evidence) + self.assertIn("xai-org/plugin-marketplace/pull/730", evidence) + def test_skills_hint_dependencies_without_installing_them(self) -> None: for name in GENERATOR.ALLOWED_SKILLS: text = (ROOT / "skills" / name / "SKILL.md").read_text().lower()