docs: record v0.2.2 release and marketplace evidence

README.md

@@ -2,7 +2,7 @@
 
 Three small, open-source skills bring Terraphim's local code search, operational
 learning, and agent memory workflows to Cursor, Kimi Code, AutoClaw, ZCode,
-Hermes Agent, skills.sh, and Claude Code.
+Hermes Agent, skills.sh, Claude Code, and Grok Build.
 
 | Skill | Command family | Purpose |
 |---|---|---|
@@ -42,6 +42,7 @@ never install dependencies automatically.
 | Hermes Agent | Add `terraphim/terraphim-cursor-plugin` as a tap, then inspect and install the three skills. |
 | skills.sh | Run `npx skills add terraphim/terraphim-cursor-plugin`; use `DISABLE_TELEMETRY=1` to opt out of anonymous telemetry. |
 | Claude Code | Add the repository as a marketplace, then install the plugin as shown below. |
+| Grok Build | The [xAI marketplace submission](https://github.com/xai-org/plugin-marketplace/pull/730) pins the signed v0.2.2 commit and is awaiting maintainer review. |
 
 Claude Code commands:
 

docs/distribution.md

@@ -10,6 +10,9 @@ exactly three skills and deterministic AutoClaw archives.
 - **Curated marketplace listing** is controlled by each marketplace maintainer and
   remains pending until that marketplace confirms indexing or approval.
 - Cursor is already submitted and is a regression target, not a new submission.
+- The Grok Build submission is open at
+  <https://github.com/xai-org/plugin-marketplace/pull/730> and pins the exact
+  signed `v0.2.2` commit; public listing remains under maintainer review.
 - AutoClaw local ZIP import is supported. ZhipuAI Skills Center inclusion is a
   separate external review; ClawHub is not treated as proof of that inclusion.
 
@@ -46,9 +49,9 @@ Open ZCode's **Discover** view and add
 `https://raw.githubusercontent.com/terraphim/terraphim-cursor-plugin/v0.2.2/marketplaces/zcode.json`
 as a personal marketplace source, install `terraphim-skills-intro`, then confirm the Plugin
 Skills view shows exactly three skills. Curated discovery requires a separate
-pull request to `zai-org/zcode-plugins`; this repository does not claim that
-acceptance before the maintainers merge it. Update or remove the installed
-plugin through ZCode's plugin manager.
+[pull request to `zai-org/zcode-plugins`](https://github.com/zai-org/zcode-plugins/pull/13);
+this repository does not claim acceptance before the maintainers merge it.
+Update or remove the installed plugin through ZCode's plugin manager.
 
 ## Hermes Agent
 
@@ -77,6 +80,15 @@ skills are offered and that their files match tag `v0.2.2`. Update by repeating
 command for the new tag; remove the installed skill directories through the target
 agent's documented skill manager.
 
+## Grok Build (xAI)
+
+The [xAI marketplace submission](https://github.com/xai-org/plugin-marketplace/pull/730)
+uses a full commit SHA for the signed `v0.2.2` source. Its catalogue validation,
+and component-index checks pass when reproduced locally against the submitted
+head. GitHub-hosted Actions await maintainer approval; the hosted Socket security
+and Semgrep checks are green. The listing becomes generally available only after
+xAI maintainers merge the pull request.
+
 ## Claude Code
 
 ```text

docs/marketplace-submission-pack.md

@@ -98,6 +98,7 @@ The repository includes Terraphim-owned V-model artwork in both formats:
 | Hermes Agent | `skills/*/SKILL.md` | Repository/local skills directory |
 | skills.sh | `skills/*/SKILL.md` | Repository URL discovery/install |
 | Claude Code | `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json` | Direct install and publisher-owned marketplace |
+| Grok Build (xAI) | `.grok-plugin/marketplace.json` entry in xAI's catalogue | [Submission PR #730](https://github.com/xai-org/plugin-marketplace/pull/730), pinned to the signed v0.2.2 commit |
 
 An artefact being present does not imply that a third-party catalogue has
 accepted or featured the plugin. Record curated acceptance only after the host

docs/uat/evidence-v0.2.2.md

@@ -1,5 +1,7 @@
 # Validation evidence — v0.2.2
 
+Date: 2026-09-16
+
 ## Purpose
 
 Patch release `v0.2.2` preserves the reviewed Community pack and makes release
@@ -30,3 +32,59 @@ control.
 - the active `v*` tag ruleset restricts updates and deletions;
 - GitHub release validation verifies the private tag ref and publishes the six
   expected assets.
+
+## Observed release evidence
+
+- The active [Immutable release tags ruleset](https://github.com/terraphim/terraphim-cursor-plugin/rules/23531392)
+  targets `refs/tags/v*`, enforces update, deletion, and non-fast-forward
+  restrictions, has no bypass actors, and reports that the current user can
+  never bypass it.
+- Pull request [#4](https://github.com/terraphim/terraphim-cursor-plugin/pull/4)
+  merged as `6ea3bf47fd7585d8bc518d782b371f281e20e12b` after its validation check passed.
+- The annotated `v0.2.2` tag peels to that exact merge commit and verifies as a
+  good SSH signature for `alex@metacortex.engineer` with trusted ED25519 key
+  fingerprint `SHA256:sfUIepNnrxdFgZDGWa9u8Kjzrdqh8pxvoovhGgBvJoQ`.
+- [Release workflow run 35069801681](https://github.com/terraphim/terraphim-cursor-plugin/actions/runs/35069801681)
+  completed successfully.
+- [GitHub release v0.2.2](https://github.com/terraphim/terraphim-cursor-plugin/releases/tag/v0.2.2)
+  is public, non-draft, and non-prerelease with the three deterministic skill
+  ZIPs, `SHA256SUMS`, and the SVG and PNG V-model artwork.
+- A fresh download passed `shasum -a 256 -c SHA256SUMS` and `unzip -t` for all
+  three archives.
+
+## Host validation
+
+- **Kimi Code 1.44.0:** installed the immutable v0.2.2 checkout in an isolated
+  `KIMI_SHARE_DIR`; `plugin info` reported v0.2.2 and exactly the three intended
+  `SKILL.md` files were present.
+- **Claude Code 2.1.270:** strict validation passed; an isolated configuration
+  added the publisher marketplace and installed
+  `terraphim-skills-intro@terraphim-skills` v0.2.2 with exactly three skills.
+- **skills.sh:** live repository discovery with telemetry disabled reported
+  `Found 3 skills` and listed only the three Community skills.
+- **Hermes Agent v1.0.0:** an isolated `HERMES_HOME` added the GitHub tap,
+  inspected all skills, classified each as `SAFE`, installed all three, and
+  listed exactly three hub-installed Community skills.
+- **AutoClaw:** all three release ZIPs pass their checksums, archive integrity,
+  and deterministic rebuild checks. Real desktop import remains outstanding
+  because the validation Mac was locked; archive proof is not represented as
+  desktop UAT.
+- **ZCode:** the official validator accepts 22 plugins including Terraphim and
+  `build_dist.py` creates an integrity-tested v0.2.2 package containing the
+  canonical Apache-2.0 `LICENSE` and `NOTICE`. In an isolated ZCode 0.15.2
+  profile, the app-server added the public GitHub repository as a marketplace,
+  discovered `terraphim-skills-intro` v0.2.2, installed it enabled at user scope,
+  validated the plugin with no diagnostics, and described exactly the three
+  intended skills. Submission [PR #13](https://github.com/zai-org/zcode-plugins/pull/13)
+  is open; its Actions require maintainer approval and real GUI UAT remains
+  transparently outstanding.
+- **Grok Build (xAI):** submission
+  [PR #730](https://github.com/xai-org/plugin-marketplace/pull/730) pins the exact
+  v0.2.2 commit. Catalogue validation and component-index checks pass when
+  reproduced locally against the submitted head. GitHub-hosted Actions await
+  maintainer approval; the hosted Socket security and Semgrep checks are green.
+  Maintainer merge remains external.
+
+The package contains Community skill instructions only. Curated marketplace
+acceptance remains a third-party decision and is never inferred from direct
+installation or a successful submission check.

docs/uat/multi-marketplace.md

@@ -71,6 +71,7 @@ content as bundled.
 | Hermes Agent | Add the repository's `skills/` entries to the configured skills directory | Three discovered skills and UAT-1 through UAT-5 |
 | skills.sh | Install/discover from the public repository URL | Three discovered skills and UAT-1 through UAT-5 |
 | Claude Code | Add the local/publisher marketplace, then install `terraphim-skills-intro` | Strict plugin validation, installed listing, UAT-1 through UAT-5 |
+| Grok Build (xAI) | Install from the curated catalogue after submission approval | Full commit pin, generated component index, security checks, and UAT-1 through UAT-5 |
 
 Capture the host and version, plugin version, command transcript or screenshots,
 and the final pass/fail result. Redact local paths or memory content that is not

tests/test_distribution.py

@@ -158,12 +158,20 @@ def test_docs_cover_hosts_and_dependency_probes(self) -> None:
             "hermes",
             "skills.sh",
             "claude",
+            "grok",
         ):
             self.assertIn(host, readme)
             self.assertIn(host, uat)
         for probe in self.metadata["runtime"]["verify"]:
             self.assertIn(probe, (ROOT / "docs/install-dependencies.md").read_text())
 
+    def test_release_evidence_records_live_publication_and_submissions(self) -> None:
+        evidence = (ROOT / "docs/uat/evidence-v0.2.2.md").read_text()
+        self.assertIn("actions/runs/35069801681", evidence)
+        self.assertIn("releases/tag/v0.2.2", evidence)
+        self.assertIn("zai-org/zcode-plugins/pull/13", evidence)
+        self.assertIn("xai-org/plugin-marketplace/pull/730", evidence)
+
     def test_skills_hint_dependencies_without_installing_them(self) -> None:
         for name in GENERATOR.ALLOWED_SKILLS:
             text = (ROOT / "skills" / name / "SKILL.md").read_text().lower()