Prepare agent plugins for reviewed directories

.agents/plugins/marketplace.json

@@ -12,7 +12,8 @@
       },
       "policy": {
         "installation": "AVAILABLE",
-        "authentication": "ON_INSTALL"
+        "authentication": "ON_INSTALL",
+        "products": ["CODEX"]
       },
       "category": "Developer Tools"
     }

.claude-plugin/marketplace.json

@@ -1,11 +1,8 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-marketplace.json",
   "name": "codetruss",
-  "description": "Catch scope drift and AI slop before commit with local acceptance receipts",
-  "metadata": {
-    "description": "Catch scope drift and AI slop before commit with local acceptance receipts",
-    "version": "0.1.1"
-  },
+  "description": "Verify the acceptance contract for coding-agent changes locally",
+  "version": "0.1.2",
   "owner": {
     "name": "CodeTruss",
     "email": "zack@codetruss.com"
@@ -14,10 +11,9 @@
     {
       "name": "codetruss",
       "source": "./plugins/codetruss-claude",
-      "description": "Bind agent changes to the task and produce a verifiable local receipt before commit",
-      "version": "0.1.1",
+      "description": "Enforce approved scope and checks with the separately installed free CodeTruss CLI",
       "category": "development",
-      "tags": ["scope-drift", "verification", "local-first", "coding-agents"]
+      "tags": ["acceptance-gate", "scope-drift", "verification", "local-first", "coding-agents"]
     }
   ]
 }

.github/workflows/release.yml

@@ -0,0 +1,38 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  attestations: write
+  contents: write
+  id-token: write
+
+jobs:
+  release:
+    name: Publish deterministic plugin archives
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - run: npm test
+      - run: npm run release:verify
+      - name: Attest plugin archives
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: dist/*.zip
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: >-
+          gh release create "$GITHUB_REF_NAME" dist/*
+          --verify-tag
+          --generate-notes
+          --title "CodeTruss agent plugins $GITHUB_REF_NAME"

.github/workflows/validate.yml

@@ -25,3 +25,5 @@ jobs:
         with:
           node-version: 24
       - run: npm test
+      - run: npm run fixtures:verify
+      - run: npm run release:verify

.gitignore

@@ -1,2 +1,3 @@
 .DS_Store
 node_modules/
+dist/

README.md

@@ -26,8 +26,10 @@ claude plugin marketplace add DeliriumPulse/codetruss-plugins
 claude plugin install codetruss@codetruss
 ```
 
-The same validated plugin is ready for Anthropic's reviewed marketplace. The
-owned marketplace is live now; official listing remains pending review.
+The owned marketplace is live now. The same validated plugin is prepared for
+Anthropic's reviewed community marketplace but has not been submitted. The
+automatically available official marketplace is separately curated at
+Anthropic's discretion.
 
 ## Codex
 
@@ -36,9 +38,9 @@ codex plugin marketplace add DeliriumPulse/codetruss-plugins
 codex plugin add codetruss@codetruss
 ```
 
-The validated skills-only bundle is ready for OpenAI's universal Plugin
-Directory. The owned marketplace is live now; official listing remains pending
-verified publisher submission and review.
+The validated skills-only bundle is ready for OpenAI's Plugin Directory. The
+owned marketplace is live now; public-directory submission has not occurred and
+still requires a verified publisher with Apps Management write access.
 
 ## What the skill does
 
@@ -60,10 +62,21 @@ self-contained.
 npm test
 claude plugin validate ./plugins/codetruss-claude
 python3 /path/to/plugin-creator/scripts/validate_plugin.py ./plugins/codetruss
+npm run release:verify
 ```
 
 `npm test` uses only Node.js built-ins and verifies manifests, marketplace
 entries, skill parity, privacy guardrails, and submission-case counts.
+`npm run release:verify` builds the OpenAI and Claude submission archives twice
+from the committed Git tree and proves their bytes are reproducible.
+
+## Security and support
+
+Read [SECURITY.md](SECURITY.md) before reporting a vulnerability. General
+wrapper issues belong in this repository; CLI issues belong in the
+[CodeTruss CLI tracker](https://github.com/DeliriumPulse/codetruss-cli/issues).
+Never attach third-party source, credentials, or unredacted receipts to a public
+issue.
 
 ## Licensing boundary
 

SECURITY.md

@@ -0,0 +1,18 @@
+# Security policy
+
+Please report suspected vulnerabilities privately to `zack@codetruss.com` with
+the subject `CodeTruss security report`. Include the affected wrapper or CLI
+version, reproduction steps, impact, and whether public disclosure is already
+planned. Do not include third-party source code, credentials, or unredacted
+receipts unless requested through a mutually agreed secure channel.
+
+We will acknowledge a report within two business days, provide a preliminary
+triage within five business days when reproducible, and coordinate disclosure
+after a fix or mitigation is available. Availability and timelines may change
+for reports that cannot be reproduced or concern unsupported versions.
+
+The MIT wrapper repository contains skill instructions and manifests only. CLI
+implementation reports belong in the public CLI issue tracker unless they are
+security-sensitive. Deterministic CLI operation is local; optional provider
+review sends the reviewed diff directly to the selected provider, and explicit
+sync sends a privacy-minimized receipt to CodeTruss but never the patch.

package.json

@@ -1,11 +1,14 @@
 {
   "name": "codetruss-agent-plugins",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "private": true,
   "description": "Open Claude Code, Codex, and Agent Skills wrappers for the CodeTruss CLI",
   "license": "MIT",
   "scripts": {
-    "test": "node scripts/validate.mjs"
+    "test": "node scripts/validate.mjs",
+    "fixtures:verify": "node submission/fixtures/setup.mjs /tmp/codetruss-plugin-fixtures",
+    "release:build": "node scripts/build-release.mjs",
+    "release:verify": "node scripts/verify-release.mjs"
   },
   "engines": {
     "node": ">=20.9"

plugins/codetruss-claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "codetruss",
-  "version": "0.1.1",
-  "description": "Catch scope drift and AI slop before commit with local acceptance receipts.",
+  "version": "0.1.2",
+  "description": "Verify coding-agent changes locally with the separately installed free CodeTruss CLI.",
   "author": {
     "name": "CodeTruss",
     "email": "zack@codetruss.com",
@@ -10,6 +10,6 @@
   "homepage": "https://codetruss.com/cli",
   "repository": "https://github.com/DeliriumPulse/codetruss-plugins",
   "license": "MIT",
-  "keywords": ["coding-agents", "scope-drift", "local-first", "verification", "receipts"],
+  "keywords": ["acceptance-gate", "coding-agents", "scope-drift", "local-first", "verification", "receipts"],
   "skills": "./skills/"
 }

plugins/codetruss-claude/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CodeTruss
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

plugins/codetruss-claude/README.md

@@ -0,0 +1,32 @@
+# CodeTruss for Claude Code
+
+This plugin teaches Claude Code to operate the separately installed free
+CodeTruss CLI as a local acceptance gate for coding-agent changes.
+
+Prerequisites:
+
+- Git
+- Node.js 20.9 or newer
+- CodeTruss CLI v0.2.14 or newer from <https://codetruss.com/cli>
+
+The plugin contains no analyzer, bundled hook, MCP server, background service,
+or upload path. It delegates hook installation to the tested CLI after developer
+confirmation. Deterministic checks stay local. Provider-backed review,
+authentication, and receipt sync require separate explicit developer actions.
+
+Troubleshooting:
+
+- Run `codetruss --version`; install or upgrade from the CLI page when it is
+  missing or older than v0.2.14.
+- Run `codetruss hooks status claude` and `codetruss hooks doctor claude`
+  before changing or reinstalling Claude settings.
+- Exit 1 means `REVIEW_REQUIRED`, exit 2 means `FAILED`, and both still produce
+  a receipt. Exit 3 is a usage or environment failure.
+- Report wrapper problems at <https://github.com/DeliriumPulse/codetruss-plugins/issues>
+  and CLI/security problems at <https://github.com/DeliriumPulse/codetruss-cli/issues>.
+- Follow <https://codetruss.com/security> for private vulnerability reporting
+  and the current product security boundary.
+
+The wrapper files in this package are MIT licensed. The separately installed
+CLI is source-visible and free to use under the CodeTruss CLI Proprietary
+License and CodeTruss Terms of Service.

plugins/codetruss-claude/skills/codetruss/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: codetruss
-description: Catch scope drift and AI slop by setting up and operating CodeTruss local acceptance gates for AI-generated code. Use when a developer asks to bind an agent task to allowed or denied files, configure repository verification, install or diagnose Claude Code or Codex hooks, review a working-tree or staged diff before commit, interpret or verify a signed CodeTruss receipt, repair a failed verdict, or explicitly opt into provider-backed review or receipt sync.
+description: Operate CodeTruss local acceptance gates for coding-agent changes. Use when a developer asks to bind an agent task to allowed or denied files, configure repository verification, install or diagnose Claude Code or Codex hooks, review a working-tree or staged diff before commit, interpret or verify a signed CodeTruss receipt, repair a failed verdict, or explicitly opt into provider-backed review or receipt sync.
 ---
 
 # CodeTruss

plugins/codetruss-claude/skills/codetruss/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "CodeTruss"
-  short_description: "Catch scope drift and AI slop before commit"
+  short_description: "Local acceptance gate for coding-agent changes"
   default_prompt: "Use $codetruss to review my current agent changes and explain the receipt."

plugins/codetruss/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "codetruss",
-  "version": "0.1.1",
-  "description": "Catch scope drift and AI slop before commit with local acceptance receipts.",
+  "version": "0.1.2",
+  "description": "Verify the acceptance contract for coding-agent changes locally.",
   "author": {
     "name": "CodeTruss",
     "email": "zack@codetruss.com",
@@ -10,12 +10,12 @@
   "homepage": "https://codetruss.com/cli",
   "repository": "https://github.com/DeliriumPulse/codetruss-plugins",
   "license": "MIT",
-  "keywords": ["coding-agents", "scope-drift", "local-first", "verification", "receipts"],
+  "keywords": ["acceptance-gate", "coding-agents", "scope-drift", "local-first", "verification", "receipts"],
   "skills": "./skills/",
   "interface": {
     "displayName": "CodeTruss",
-    "shortDescription": "Catch scope drift and AI slop before commit",
-    "longDescription": "Bind agent changes to the task, run deterministic local checks, and produce a verifiable receipt before commit.",
+    "shortDescription": "Local acceptance gate for coding-agent changes",
+    "longDescription": "Declare approved scope and repository checks, evaluate the captured Git state locally, and produce a verifiable receipt before commit. Requires the separately installed free CodeTruss CLI; no CodeTruss account or upload is required.",
     "developerName": "CodeTruss",
     "category": "Developer Tools",
     "capabilities": ["Interactive", "Read", "Write"],
@@ -27,6 +27,9 @@
       "Review my current changes against the task",
       "Verify and explain my latest CodeTruss receipt"
     ],
-    "brandColor": "#B93A26"
+    "brandColor": "#B93A26",
+    "composerIcon": "./assets/codetruss-mark-512.png",
+    "logo": "./assets/codetruss-mark-512.png",
+    "logoDark": "./assets/codetruss-mark-512.png"
   }
 }

plugins/codetruss/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CodeTruss
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

plugins/codetruss/README.md

@@ -0,0 +1,32 @@
+# CodeTruss for Codex
+
+This skills-only plugin teaches Codex to operate the separately installed free
+CodeTruss CLI as a local acceptance gate for coding-agent changes.
+
+Prerequisites:
+
+- Git
+- Node.js 20.9 or newer
+- CodeTruss CLI v0.2.14 or newer from <https://codetruss.com/cli>
+
+The plugin contains no analyzer, MCP server, background service, or upload path.
+Deterministic checks stay local. Provider-backed review, authentication, and
+receipt sync require separate explicit developer actions.
+
+Troubleshooting:
+
+- Run `codetruss --version`; install or upgrade from the CLI page when it is
+  missing or older than v0.2.14.
+- Run `codetruss hooks status codex` and `codetruss hooks doctor codex` before
+  changing hook configuration. Codex may require approval of the exact hook in
+  `/hooks`.
+- Exit 1 means `REVIEW_REQUIRED`, exit 2 means `FAILED`, and both still produce
+  a receipt. Exit 3 is a usage or environment failure.
+- Report wrapper problems at <https://github.com/DeliriumPulse/codetruss-plugins/issues>
+  and CLI/security problems at <https://github.com/DeliriumPulse/codetruss-cli/issues>.
+- Follow <https://codetruss.com/security> for private vulnerability reporting
+  and the current product security boundary.
+
+The wrapper files in this package are MIT licensed. The separately installed
+CLI is source-visible and free to use under the CodeTruss CLI Proprietary
+License and CodeTruss Terms of Service.

plugins/codetruss/skills/codetruss/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: codetruss
-description: Catch scope drift and AI slop by setting up and operating CodeTruss local acceptance gates for AI-generated code. Use when a developer asks to bind an agent task to allowed or denied files, configure repository verification, install or diagnose Claude Code or Codex hooks, review a working-tree or staged diff before commit, interpret or verify a signed CodeTruss receipt, repair a failed verdict, or explicitly opt into provider-backed review or receipt sync.
+description: Operate CodeTruss local acceptance gates for coding-agent changes. Use when a developer asks to bind an agent task to allowed or denied files, configure repository verification, install or diagnose Claude Code or Codex hooks, review a working-tree or staged diff before commit, interpret or verify a signed CodeTruss receipt, repair a failed verdict, or explicitly opt into provider-backed review or receipt sync.
 ---
 
 # CodeTruss

plugins/codetruss/skills/codetruss/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "CodeTruss"
-  short_description: "Catch scope drift and AI slop before commit"
+  short_description: "Local acceptance gate for coding-agent changes"
   default_prompt: "Use $codetruss to review my current agent changes and explain the receipt."