making-things

A production-grade Electron full-stack AI coding workflow plugin for Codex, ZCode, and Claude Code. Install once, immediately usable — no separate setup or deployment step required.

What it does

Every activated requirement becomes a durable work package under docs/making-things/<ID>/ in your project, not ephemeral chat history. The $making-things orchestrator routes through ten specialist Skills, each owning one lifecycle stage:

DRAFT → PRD_APPROVED → ARCHITECTURE_APPROVED → PLANNED → IN_DEVELOPMENT
  → TESTED → IN_REVIEW → [DEBUGGING] → ACCEPTED → RELEASE_READY
  → PACKAGED → DELIVERED → POST_RELEASE_RECORDED → CLOSED

Each transition requires fresh command output or recorded evidence. "Passed," "complete," and "releasable" always mean verified, not claimed.

Install

Claude Code / ZCode

# From a marketplace
/plugin marketplace add SuShuHeng/making-things
/plugin install making-things@making-things

# Or direct
/plugin install https://github.com/SuShuHeng/making-things

Codex (OpenAI)

# Codex CLI
/plugins
# Search: making-things → Install

# Or add marketplace in ~/.codex/config.toml
# [marketplaces.making-things]
# source_type = "git"
# source = "https://github.com/SuShuHeng/making-things"

Zero configuration

After install, the SessionStart hook injects a lightweight notice that $making-things is available. To start a lifecycle, the user explicitly invokes $making-things — the orchestrator creates docs/making-things/ automatically if it doesn't exist.

Usage

Start or resume a work item

$making-things

The orchestrator will:

1. Validate the workflow
2. Read docs/making-things/CURRENT.md
3. Initialize a new work item or resume the active one
4. Route to the specialist Skill for the current stage
5. Require evidence before each state transition

Bundled scripts (self-contained)

Scripts live inside the plugin at skills/making-things/scripts/ and self-locate templates via import.meta.url. Run them from your project root:

node skills/making-things/scripts/validate-workflow.mjs --root .
node skills/making-things/scripts/init-work-item.mjs --root . FEATURE-123 "Short title"
node skills/making-things/scripts/check-work-item.mjs --root . FEATURE-123
node skills/making-things/scripts/check-electron-security.mjs --root .
node skills/making-things/scripts/release-readiness.mjs --root . FEATURE-123
node --test skills/making-things/scripts/tests/workflow.test.mjs

Skills

Skill	Trigger	Owns
making-things	$making-things (explicit only)	Orchestration, planning, and stage routing
product-prd	Auto / $product-prd	Requirements and acceptance criteria
solution-architecture	Auto / $solution-architecture	Architecture and IPC contracts
electron-implementation	Auto / $electron-implementation	Feature implementation
electron-ipc-security	Auto / $electron-ipc-security	Privilege boundary audits
electron-test-e2e	Auto / $electron-test-e2e	Test strategy and E2E
electron-review	Auto / $electron-review	Independent review and verdict
electron-debug	Auto / $electron-debug	Root-cause and minimal fixes
electron-release	Auto / $electron-release	Packaging and release matrix
github-delivery	Auto / $github-delivery	Git branch/commit/push/PR

Architecture

making-things/
├── .claude-plugin/
│   ├── plugin.json              # Claude/ZCode manifest
│   └── marketplace.json         # Claude marketplace catalog
├── .codex-plugin/
│   └── plugin.json              # Codex manifest (strict interface block)
├── .agents/plugins/
│   └── marketplace.json         # Codex/agents marketplace catalog
├── hooks/
│   ├── hooks.json               # SessionStart hook config
│   ├── run-hook.cmd             # Cross-platform polyglot launcher
│   └── session-start            # Bootstrap notice injection
├── skills/                      # 10 self-contained Skills
│   ├── making-things/
│   │   ├── SKILL.md             # Orchestrator (explicit invocation)
│   │   ├── scripts/             # Bundled validation scripts
│   │   ├── templates/           # 12 work-item templates
│   │   └── references/          # lifecycle, stage-gates, artifact-contract
│   ├── electron-ipc-security/
│   │   └── references/          # security-checklist + security-standard
│   ├── electron-review/
│   │   └── references/          # review-checklist + code-review-standard
│   └── ...                      # 7 more specialist Skills
├── AGENTS.md                    # Tool-independent repo rules
├── PLANS.md                     # Implementation plan standard
└── docs/making-things/          # Runtime work-item output (per-project)

Dual-agent model

• Codex owns discovery, PRD, architecture, planning, implementation, tests, self-review, and handoff.
• ZCode independently owns review, reproduction, Debug closeout, regression verification, and the release verdict.
• Neither agent may treat the other's unverified claim as evidence.
• STATE.md tracks active_agent through each handoff boundary.

Security model

• Renderer code is browser-only — no direct Node.js or Electron privileged APIs.
• Preload exposes narrow capabilities via contextBridge; never raw ipcRenderer, require, fs, shell, or process.
• nodeIntegration: false, contextIsolation: true, sandbox: true, webSecurity: true unless a documented exception exists.
• Release checks print secret variable names only (PRESENT/MISSING), never values.

License

MIT © SuShuHeng