fix(marketplace): close the pin-verification gap that let dangling versions ship silently

.claude-plugin/marketplace.json

@@ -62,10 +62,11 @@
       "source": {
         "source": "github",
         "repo": "cdeust/cortex-viz",
-        "sha": "1c1940e278979f35cdecea6146d7fb5f749907e9"
+        "ref": "v3.1.0",
+        "sha": "052e4a40d3e6bddaeb1cec6662e23b451575c481"
       },
       "description": "Canonical Claude Code publication for the standalone Hypermnesia MCP Viz server — a live neural-graph galaxy of every project, file, symbol, memory, discussion and wiki page, plus a per-session execution trace, a consolidation kanban, and a curated knowledge/wiki browser. Read-only bridge over Cortex's shared PostgreSQL store and the ~/.claude artifacts; it renders, it never remembers. Restores the open_visualization and get_methodology_graph tools removed from Cortex; launch with /cortex-visualize.",
-      "version": "3.0.0",
+      "version": "3.1.0",
       "author": {
         "name": "Clement Deust",
         "email": "admin@ai-architect.tools"
@@ -86,7 +87,7 @@
     {
       "name": "cortex-viz",
       "source": "./plugins/cortex-viz-deprecated",
-      "description": "DEPRECATED — renamed to hypermnesia-mcp-viz in v3.0.0. This frozen, nonfunctional migration shim has no MCP server or tools; it only announces the replacement at session start. Uninstall cortex-viz@cortex-plugins, refresh this marketplace, then install hypermnesia-mcp-viz@cortex-plugins. The repository remains cdeust/cortex-viz; only the marketplace plugin identity changed.",
+      "description": "DEPRECATED — renamed to hypermnesia-mcp-viz, first published in cortex-viz v3.1.0 (the rename itself was never tagged v3.0.0 — that version number sat unpublished in this marketplace's pin for six days). This frozen, nonfunctional migration shim has no MCP server or tools; it only announces the replacement at session start. Uninstall cortex-viz@cortex-plugins, refresh this marketplace, then install hypermnesia-mcp-viz@cortex-plugins. The repository remains cdeust/cortex-viz; only the marketplace plugin identity changed.",
       "version": "2.8.0",
       "author": {
         "name": "Clement Deust",
@@ -105,10 +106,12 @@
       "name": "zetetic-team-subagents",
       "source": {
         "source": "github",
-        "repo": "cdeust/zetetic-team-subagents"
+        "repo": "cdeust/zetetic-team-subagents",
+        "ref": "v2.37.0",
+        "sha": "57a5723df4262c014f5b2a1992cbace0efa4429f"
       },
       "description": "Zetetic agent team for Cortex — 97 genius reasoning patterns from history's greatest minds + 23 team specialists (architect, engineer, code-reviewer, refactorer, …), 78 skills, 26 commands, 42 tools, 20 hooks, under one epistemic standard none of them can bypass. Composes with Cortex memory: every agent recalls/remembers through the Cortex MCP and routes via /genius, /agent, /zetetic, /quality, /research commands.",
-      "version": "2.36.0",
+      "version": "2.37.0",
       "author": {
         "name": "Clement Deust",
         "email": "admin@ai-architect.tools"

.craftsmanship-baseline.json

@@ -5587,16 +5587,6 @@
       "kind": "unsourced-constant",
       "detail": "_SIDE_PADDING"
     },
-    {
-      "file": "scripts/check_marketplace_pins.py",
-      "kind": "file-size",
-      "detail": "exceeds 300-line cap"
-    },
-    {
-      "file": "scripts/check_marketplace_pins.py",
-      "kind": "method-size",
-      "detail": "main"
-    },
     {
       "file": "scripts/groomer.py",
       "kind": "file-size",

.github/workflows/release.yml

@@ -430,3 +430,83 @@ jobs:
           # is a no-op instead of a hard failure — this was the exact
           # failure mode that motivated removing PyPI in a2dc7e3.
           skip-existing: true
+
+  # Public MCP registry (registry.modelcontextprotocol.io) compatibility
+  # channel — a THIRD version surface alongside the marketplace pin and
+  # PyPI, previously updated by hand and, like the other two, drifting
+  # silently: `io.github.cdeust/hypermnesia-mcp` sat published at 4.17.1
+  # while this repo's tag, server.json, and PyPI were already at 4.17.2 —
+  # one release short, invisible until queried directly (no CI gate read
+  # this surface until scripts/check_marketplace_pins.py's
+  # REGISTRY_VERSION_STALE check, added alongside this job). Same failure
+  # shape as issue #179 (marketplace pin) and the cortex-viz CHANGELOG
+  # incident: a mandatory per-release step that lived only in prose.
+  #
+  # Auth: GitHub OIDC (`mcp-publisher login github-oidc`), NOT a
+  # PyPI-Trusted-Publishing equivalent — a distinct mechanism documented at
+  # modelcontextprotocol/registry docs/reference/cli/commands.md and
+  # docs/modelcontextprotocol-io/github-actions.mdx (checked 2026-08-10,
+  # not assumed). `io.github.cdeust/*` namespace authentication comes free
+  # from the workflow's own OIDC token (bound to this repo + workflow +
+  # ref by Sigstore) once `id-token: write` is granted — no stored secret,
+  # unlike the PAT or DNS auth alternatives the docs also describe.
+  publish-mcp-registry:
+    name: Publish to the MCP registry (best-effort compatibility)
+    # `needs: publish-pypi`, NOT `build` — the registry's package-ownership
+    # verification (see server.json's `packages[].registryType: pypi`)
+    # resolves the version this job's `server.json` declares against what
+    # PyPI actually serves. `build` only builds the sdist/wheel; the PyPI
+    # publish itself happens in `publish-pypi`, a job that runs in
+    # parallel with this one when both only `need: build` — so a fast
+    # registry publish could name a version PyPI had not yet received,
+    # the exact "dangling pin, in reverse" shape this PR's own
+    # REGISTRY_VERSION_STALE check exists to catch (cortex-viz's own
+    # Release.yaml gates its registry job on `needs: [test, release]` for
+    # the identical reason — verified against that workflow, not assumed).
+    needs: publish-pypi
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write   # OIDC — mcp-publisher login github-oidc
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Verify server.json matches the tag (same guard as mcpb-bundle)
+        run: |
+          set -euxo pipefail
+          VERSION="$(python3 -c "import json;print(json.load(open('server.json'))['version'])")"
+          if [ "v${VERSION}" != "${GITHUB_REF_NAME}" ]; then
+            echo "server.json version ${VERSION} does not match tag ${GITHUB_REF_NAME}" >&2
+            exit 1
+          fi
+
+      # Checksum-verified, not just version-pinned (issue #178 supply-chain
+      # posture applied to a third-party tool this workflow now trusts).
+      # source: sha256 measured 2026-08-10 by downloading this exact asset
+      # from https://github.com/modelcontextprotocol/registry/releases/tag/v1.8.1
+      - name: Install mcp-publisher (pinned release, checksum-verified)
+        run: |
+          set -euxo pipefail
+          curl -fsSL -o mcp-publisher.tar.gz \
+            "https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}/mcp-publisher_linux_amd64.tar.gz"
+          echo "${MCP_PUBLISHER_SHA256}  mcp-publisher.tar.gz" | sha256sum -c -
+          tar xzf mcp-publisher.tar.gz mcp-publisher
+        env:
+          MCP_PUBLISHER_VERSION: v1.8.1
+          MCP_PUBLISHER_SHA256: a06c9096dcb9727c13555b6be26c7effa707b01f06a4c561ba7a3635443cf2cc
+
+      - name: Authenticate to the MCP registry (OIDC)
+        run: ./mcp-publisher login github-oidc
+
+      - name: Publish server.json to the MCP registry (best-effort — must not fail primary release)
+        # Same rationale as publish-pypi: this is a secondary compatibility
+        # channel (ADR-0050 names the marketplace primary) — a registry
+        # outage or a stricter future validation rule must not red-X the
+        # GitHub Release / marketplace propagation this workflow exists to
+        # ship. A silenced failure is exactly what let this surface drift
+        # in the first place, so it is not swallowed: the step still shows
+        # red in the Actions UI, `continue-on-error` only stops it from
+        # failing the *job*/workflow.
+        continue-on-error: true
+        run: ./mcp-publisher publish

CHANGELOG.md

@@ -100,13 +100,19 @@ adheres to [Semantic Versioning](https://semver.org/).
   visualization-plugin migration described below.
 - **Breaking visualization-plugin publication rename, with migration shim.**
   The canonical Claude Code publication is
-  `hypermnesia-mcp-viz@cortex-plugins` 3.0.0, sourced from the unchanged
-  `cdeust/cortex-viz` repository at exact commit
-  `1c1940e278979f35cdecea6146d7fb5f749907e9`. Existing installs must uninstall
-  `cortex-viz@cortex-plugins`, refresh `cortex-plugins`, and install
-  `hypermnesia-mcp-viz@cortex-plugins`. The former identity remains as a
-  frozen 2.8.0 migration shim that only prints those instructions; it
-  registers no MCP server or tools. Claude's composed tool names also change:
+  `hypermnesia-mcp-viz@cortex-plugins` 3.1.0, sourced from the unchanged
+  `cdeust/cortex-viz` repository at tag `v3.1.0` (commit
+  `052e4a40d3e6bddaeb1cec6662e23b451575c481`, cdeust/cortex-viz#130).
+  (Corrected: the rename commit itself, `1c1940e2789...`, was originally
+  pinned here at a claimed "3.0.0" — cortex-viz never actually tagged a
+  v3.0.0, so that pin was dangling for six days, detected and fixed by
+  `scripts/check_marketplace_pins.py`'s new `PIN_VERSION_UNPUBLISHED`
+  check; see that script's module docstring for the incident.) Existing
+  installs must uninstall `cortex-viz@cortex-plugins`, refresh
+  `cortex-plugins`, and install `hypermnesia-mcp-viz@cortex-plugins`. The
+  former identity remains as a frozen 2.8.0 migration shim that only
+  prints those instructions; it registers no MCP server or tools. Claude's
+  composed tool names also change:
   `mcp__plugin_cortex-viz_cortex-viz__open_visualization` becomes
   `mcp__plugin_hypermnesia-mcp-viz_hypermnesia-mcp-viz__open_visualization`,
   and `mcp__plugin_cortex-viz_cortex-viz__get_methodology_graph` becomes

CLAUDE.md

@@ -55,6 +55,16 @@ ENDS with: bump the marketplace pin(s) and `server.json`, and confirm
 the 2026-07-25 incident where six zetetic-team-subagents releases and two
 cortex-viz releases shipped to zero installs (#179).
 
+The public MCP registry (`io.github.cdeust/hypermnesia-mcp`) is a third
+version surface alongside the marketplace pin and PyPI — auto-published on
+every `v*` tag by `release.yml`'s `publish-mcp-registry` job (GitHub OIDC,
+no stored secret) and cross-checked by `check_marketplace_pins.py` against
+`server.json`'s own declared version (`REGISTRY_VERSION_STALE`). Source:
+2026-08-10, `io.github.cdeust/hypermnesia-mcp` sat published at 4.17.1
+while the tag/server.json/PyPI were already at 4.17.2 — the publish step
+had lived only in prose, with nothing committed to run it or verify it
+happened.
+
 ## Architecture
 
 Clean Architecture, concentric layers: `server → handlers → core ← shared`,

README.md

@@ -63,7 +63,7 @@ claude plugin install hypermnesia-mcp
 ```
 > **Upgrading from the `cortex` plugin?** The plugin was renamed `hypermnesia-mcp` in v4.15.0 (a community-directory name collision with an unrelated `cortex` plugin): `claude plugin uninstall cortex && claude plugin install hypermnesia-mcp` — your memories and configuration are untouched, storage paths do not change.
 >
-> **Upgrading from `cortex-viz@cortex-plugins`?** Its Claude Code marketplace identity was renamed in v3.0.0. Run `claude plugin uninstall cortex-viz@cortex-plugins`, then `claude plugin marketplace update cortex-plugins`, then `claude plugin install hypermnesia-mcp-viz@cortex-plugins`. The retained `cortex-viz@cortex-plugins` item is a frozen, nonfunctional migration shim: it only prints this notice and exposes no MCP server or tools. The repository remains `cdeust/cortex-viz`; only its marketplace plugin identity changed.
+> **Upgrading from `cortex-viz@cortex-plugins`?** Its Claude Code marketplace identity was renamed to `hypermnesia-mcp-viz`, first published in cortex-viz v3.1.0 (the rename commit itself was never tagged as v3.0.0 — that version number was pinned here for six days without a matching release; see cortex-viz's CHANGELOG). Run `claude plugin uninstall cortex-viz@cortex-plugins`, then `claude plugin marketplace update cortex-plugins`, then `claude plugin install hypermnesia-mcp-viz@cortex-plugins`. The retained `cortex-viz@cortex-plugins` item is a frozen, nonfunctional migration shim: it only prints this notice and exposes no MCP server or tools. The repository remains `cdeust/cortex-viz`; only its marketplace plugin identity changed.
 >
 > Claude tool allowlists, hooks, skills, and agents must migrate both composed names: `mcp__plugin_cortex-viz_cortex-viz__open_visualization` becomes `mcp__plugin_hypermnesia-mcp-viz_hypermnesia-mcp-viz__open_visualization`, and `mcp__plugin_cortex-viz_cortex-viz__get_methodology_graph` becomes `mcp__plugin_hypermnesia-mcp-viz_hypermnesia-mcp-viz__get_methodology_graph`.
 
@@ -167,8 +167,8 @@ Or add it to `~/.gemini/settings.json` directly:
 repository now carries an isolated Codex marketplace and an exact 10-tool
 lean MCP surface. Claude Code remains the primary integration and retains its
 automatic hooks, custom agent, and full tool profile. Its shared marketplace
-catalog changes only for the pinned `hypermnesia-mcp-viz` 3.0.0 publication
-and the frozen `cortex-viz` migration shim.
+catalog changes only for the pinned `hypermnesia-mcp-viz` publication and
+the frozen `cortex-viz` migration shim.
 Pre-install the same published package once so the plugin's first `uvx`
 handshake can reuse the local uv cache instead of spending its startup budget
 downloading the Python environment. The bundled server also declares a

docs/codex-plugin.md

@@ -62,7 +62,7 @@ env CORTEX_RUNTIME=cowork \
 policy; it does not install or invoke the Cowork plugin. Claude Code remains
 the primary integration, and its primary plugin manifest, hooks, agents, and
 full tool profile are unchanged. The shared Claude marketplace catalog changes
-only to publish `hypermnesia-mcp-viz` 3.0.0 and retain `cortex-viz` as a frozen,
+only to publish `hypermnesia-mcp-viz` and retain `cortex-viz` as a frozen,
 nonfunctional migration shim.
 
 This is a local plugin. It does not make Cortex available to ChatGPT web and

plugins/cortex-viz-deprecated/hooks/hooks.json

@@ -8,7 +8,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo '[cortex-viz@cortex-plugins] DEPRECATED: the Claude Code plugin was renamed in v3.0.0. Run: claude plugin uninstall cortex-viz@cortex-plugins; claude plugin marketplace update cortex-plugins; claude plugin install hypermnesia-mcp-viz@cortex-plugins. The repository remains cdeust/cortex-viz; only the marketplace plugin identity changed.'",
+            "command": "echo '[cortex-viz@cortex-plugins] DEPRECATED: the Claude Code plugin was renamed to hypermnesia-mcp-viz. Run: claude plugin uninstall cortex-viz@cortex-plugins; claude plugin marketplace update cortex-plugins; claude plugin install hypermnesia-mcp-viz@cortex-plugins. The repository remains cdeust/cortex-viz; only the marketplace plugin identity changed.'",
             "timeout": 5
           }
         ]