join-the-team v0.2.3 — conformance gate hardened by cross-model review

join-the-team is compliant with Agent Plugins 1.0.0 — the packaging standard announced by Google, stewarded by Amazon, Cursor, Google, Microsoft, OpenAI and Vercel. Skills comply with Agent Skills.

This release fixes the gate itself.

Why

Every PR from v0.1.7 to v0.2.2 was authored and self-merged with reviews=0 — against this project's own doctrine that neither author both writes and approves. An independent cross-model review of the cumulative diff found defects the gate had been passing.

Fixed

Round 1–3 — defects affecting the gate today:

• MCP transport fields were presence-checked, not type-checked. {"type":"stdio","command":null} validated clean: the required-key check saw the key, then isinstance guards skipped everything after it.
• cwd accepted traversal outside the plugin root. The published schema anchors only the prefix and defers containment to the client; the containment half was missing, so ./../outside passed.
• A malformed version shipped silently. "banana" across all six manifests passed both gates. Now a local SemVer rule, marked as stricter than the standard.

Rounds 4–11 — symlink-assisted escape, closed by generalising:

Broken links, Windows separators, drive-qualified and UNC targets, relative Windows traversal, unverifiable ${PLUGIN_DATA}, ancestor symlinks inflating depth. Each round produced one more variant, so the approach changed: a cwd that both crosses a symlink and climbs is refused as not provably contained. .. without a symlink still passes; a symlink without .. still passes.

Round twelve returned no actionable findings.

Evidence

make lint / typecheck / test / spec-conformance → all pass
negative fixtures 22 → 51
review rounds: 3 2 1 1 1 2 1 1 1 1 1 0

Every finding was reproduced before being accepted — cross-model verdicts are input, not authority — and every one has a fixture that fails without its fix.

The lesson, in ADR-002

The gate that checks the work needs checking too, and it cannot check itself. A validator's author is the worst reviewer of that validator.

And a stopping rule, earned rather than assumed: stop when fixes stop generalising. Chasing platform-specific compositions produced one finding per round indefinitely; refusing the unprovable combination ended it in a single move. When a reviewer keeps finding variants, the defect is usually the approach, not the variant.

Scope note

cwd containment is defence-in-depth for a root mcp.json this package does not ship. If one is ever added, ADR-002 says to re-run this review from round one rather than assume twelve rounds already covered it.

join-the-team v0.2.2 — README audit, Agent Plugins 1.0.0 compliance

join-the-team is compliant with Agent Plugins 1.0.0 — the open, vendor-neutral packaging standard announced by Google, stewarded by a Technical Steering Committee spanning Amazon, Cursor, Google, Microsoft, OpenAI and Vercel. Its skills comply with Agent Skills.

Verify it yourself: make spec-conformance.

Fixed

Three README links returned 404 on public GitHub. Inverting the skill layout in 0.2.1 made .agents/skills/ a symlink, and GitHub's web UI does not traverse symlinked directories — so the skills library, plugin-submission and operating-model-bootstrap links all broke. They now point at the real skills/ directory, verified against the public API.

Install instructions referenced the symlink. README.md, BOOTSTRAP.md and docs/install/codex.md said to copy or vendor .agents/skills/; docs/install/claude.md still described the pre-inversion direction. All corrected. A coherence bug went with them: the README said copy skills/, then told Codex users it reads .agents/skills/ — follow both and Codex found nothing.

Added

The README now documents installation, configuration, usage examples and troubleshooting — the four things the Claude Plugin Hub creator guide asks for:

• Usage — an intent-to-skill routing table and a worked risk-tiered example
• Configuration — the three seams: operating contract, project profile, data seams
• Troubleshooting — six failure modes, every one observed during live installs
• Verify the install — what to ask, and what PASS looks like

Scope of compliance, stated precisely

The standard defines exactly two component types — skills (skills/) and MCP servers (mcp.json). Commands, hooks, agents, rules and LSP servers are explicitly outside v1 (§7), so this plugin's slash commands and session-start hooks are client-specific concerns rather than conformance surface, declared as manifest extensions (§8.1).

This package does not claim .claude-plugin/ or .kimi-plugin/ as §8.2 directory extensions — those must be named after the reverse-domain namespace. Ours are ordinary top-level directories, which the standard treats as non-errors. The conformance table in the README marks each rule as spec-required or local hygiene.

Verified on four clients

Claude Code, Antigravity (agy), Codex and Kimi Code — all installing 21 skills at the standard's fixed location, from clean installs.

make lint / typecheck / test / spec-conformance → all pass
README relative links → all resolve, none via symlink

join-the-team v0.2.1 — Agent Plugins 1.0.0 conformance

This release makes join-the-team conform to the Agent Plugins 1.0.0 specification, with skills conforming to Agent Skills — and, unlike a README badge, proves it with a CI gate and a live install into every supported client.

Scope of adherence

Validated against the published schemas:

• https://agent-plugins.org/schemas/1.0.0/plugin.schema.json
• https://agent-plugins.org/schemas/1.0.0/mcp.schema.json

Surface	What the standard requires	What ships
Root manifest	plugin.json with $schema + name, closed schema	Present; only the ten permitted keys
Fixed skill location	skills/ discoverable	Real directory, 21 skills — survives installers that drop symlinks
Skill format	Agent Skills frontmatter	Name pattern, 64-char cap, dirname match, non-empty description ≤1024 chars — all gated
Client extensions	Reverse-domain namespaces	com.anthropic.claude-code, com.google.gemini-cli, ai.moonshot.kimi; every declared path resolved on disk
mcp.json	Optional; closed transport union	None shipped — the bundled config is a template, not live servers
Path safety	No escape from plugin root	Enforced on the .agents/skills alias

Verify it yourself:

make spec-conformance

Standard-library Python, runs offline, reports as its own CI job, backed by 22 negative fixtures — because a validator that only ever passes is decoration.

Proven on four clients

Every client was installed from a clean install of this tree:

Client	Version	Skills at fixed location	Session-start hook
Claude Code	0.2.1	21 (+3 commands)	registered
Antigravity (agy)	0.2.1	21 (+3 commands)	hooks: 1 processed
Codex	0.2.1	21	native discovery
Kimi Code	0.2.1	21 — confirmed in a live session	sessionStart

Fixed since 0.2.0

0.2.0 was merged to main but never tagged. 0.2.1 supersedes it and fixes two defects that only live installs could surface:

1. A regression the conformance work itself caused. Adding a root plugin.json switches agy into Agent Plugins mode, where it reads hooks.json at the package root only — silently disabling Antigravity's session-start hook, which worked in 0.1.7. Both manifests now ship, kept byte-identical by the validator.
2. A conformant client could install and find zero skills. skills/ was a symlink, and Codex's install cache drops symlinks. The layout is inverted: skills/ is now the real directory, .agents/skills/ the alias. Existing .agents/skills/... references keep working.

Upgrade notes

• Existing .agents/skills/... paths still resolve — nothing adopter-facing breaks.
• A codex plugin add install contains no .agents/skills/ alias (Codex flattens symlinks); all 21 skills are at skills/.
• Restart your client after updating.

Full detail and the decision record — including a written correction of two claims the first draft got wrong — in ADR-002 and the CHANGELOG.

join-the-team v0.1.7 — existing-repo requirement backfill

Adopting the harness into a repo that already has code no longer starts from a blank form.

Added

• Existing-repo requirement backfill. A read-only inspection pass (inspect_repo.py) reads manifests, tool configs, CI, CODEOWNERS, and docs and emits inferred findings — each a machine guess with an evidence pointer and a ready-to-paste inferred — source: <evidence>; confirm: <role> marker. Strictly read-only, vendor-neutral, and it never infers authority (roles and accountability stay human-owned). init runs it for existing repos and confirms each field one at a time.
• Provenance-aware operating profiles. Fields carry verified / inferred / unknown provenance (✅ / 🤖 / ⬜). The validator blocks promotion to active while any field is unconfirmed inference — so machine-backfilled values can never masquerade as owned facts.

Shipped through the harness's own gates: spec-first (ADR-approved design), built in bounded slices, and audited with the Adversarial Gate + PR review before merge.

Install: Claude Plugin Hub · README

join-the-team v0.1.6 — clearer ADR guidance + a look at the harness

Added

• README "What it looks like" section with a live session screenshot — the plugin explaining coherence and auditability over speed, with risk-gate routing.

Changed

• the-architect and operating-model-bootstrap now teach a single, coherent ADR convention for adopting teams: ADRs live in ADR/, with a decision's lifecycle visible in both the filename postfix (-DRAFT / -approved) and an in-file status: field. Replaces the prior architecture/decisions/ + inline-Status guidance.

Install: Claude Plugin Hub · README

join-the-team v0.1.5 — governance, release-manager, project awareness

Added

• governance-guardrail — checks proposed stack, data flows, and cloud choices against declared enterprise policies, compliance frameworks, and security controls. Never invents a policy position; surfaces gaps as explicitly owned unknowns. Triggered by delivery-orchestrator at R2/R3, feeds adversarial-gate.
• release-manager — governs the SemVer release process: versioning discipline, tag-based GitHub releases, changelog hygiene, and the ADR that confirms the strategy. Distinct from release-readiness (deployment gate) and github-manager (CI infra).

Changed

• operating-model-bootstrap — new Project awareness section formalising the seven areas established or explicitly owned at init (product vision, team roster, technical stack, tooling, cloud/governance, automation, delivery controls). The bootstrap workflow now records init decisions as a baseline ADR and a first docs/STATUS.md entry, alongside the initializer-seeded docs/VISION.md and docs/ROADMAP.md.
• Routing tables (using-the-harness, delivery-orchestrator) extended with the new skills.
• Skill count updated to 21 across all docs.

Brings the skill count to 21.

Full detail: CHANGELOG.md

join-the-team v0.1.4 — github-manager skill

Added

• github-manager — a new skill for cost-effective, consistent GitHub operations: CI trigger rightsizing, Actions billing guardrails (macOS ×10 runner cost), issue and label discipline, branch-protection policy, and release-workflow governance. Wired into the using-the-harness and delivery-orchestrator routing tables, with an operating-model-context section binding each procedure to a harness invariant.

Brings the skill count to 19.

Full detail: CHANGELOG.md

join-the-team v0.1.3 — planning starts at init

Planning becomes part of the installed operating system

join-the-team now gives a human–AI delivery team more than a governance contract on day one. Bootstrap and init seed the minimum durable records needed to turn accepted intent into coordinated delivery: a product vision, shared delivery workflow, roadmap, current status, and project changelog.

The value is practical: Product Owners have an explicit acceptance boundary, planners preserve intent and interfaces, workers receive bounded tasks, and repository records no longer compete silently with the active work tracker. Better planning reduces duplicated discovery, context churn, merge conflict, rework, and avoidable agent spend.

What is new

• Planning seed at init: project-neutral VISION.md, DELIVERY-WORKFLOW.md, ROADMAP.md, STATUS.md, and CHANGELOG.md templates are installed alongside the operating model.
• One workflow above the skills: the generated workflow connects Product Owner validation, delivery orchestration, planner/worker separation, integration, independent review, release, observation, and learning.
• Safe adoption for existing projects: existing planning records are preserved; only missing records are seeded. Conflicting operating contracts or surface adapters still stop before writes begin.
• Approved dual-record architecture: repository documents own durable intent and decisions; GitHub or another tracker owns active milestones, epics, tasks, assignments, and queue state. Deterministic reconciliation is the design boundary.
• Clearer init experience: /join-the-team:init, bootstrap guidance, and the day-one example now explain how planning records and human authority are established together.
• Public privacy policy: the repository now documents local behavior, optional external connections, data handling, and user controls for plugin and marketplace review.

Why this improves delivery value

Agent throughput is only valuable when the plan prevents many workers from multiplying the same ambiguity. This release makes product intent, decisions, ownership, evidence, and re-planning triggers durable before fan-out. The direction is informed by Cursor research on agent-swarm economics, while the plugin makes no claim that external experimental savings automatically reproduce in every project.

Research: https://cursor.com/blog/agent-swarm-model-economics

Upgrade and compatibility

This is a backward-compatible 0.1.x enhancement. Existing adopters can rerun init safely: matching operating files remain unchanged, existing project planning records are reported and preserved, and missing planning files are added. Start with the dry-run documented in BOOTSTRAP.md.

Validation

• 79 Markdown files linted with zero errors
• 16 unit tests passed
• clean-init, dry-run/no-write, preservation, idempotency, conflict-atomicity, drift, binding, and evidence cases covered
• operating-model template validation passed
• cross-harness plugin packaging and manifest validation passed

Scope boundary

This release delivers the bootstrap planning-seed slice of approved DPS-001. Cross-skill lifecycle enforcement, issue templates, and deterministic live-tracker reconciliation remain explicit follow-up work rather than being presented as complete.

Full change: #6

join-the-team v0.1.2

Normalizes the LICENSE file to the canonical Apache License 2.0 text so GitHub and plugin directories reliably detect Apache-2.0.

join-the-team v0.1.1

Adds plugin-submission, a governed cross-harness workflow for directory and marketplace listings: current-policy review, artifact eligibility, exact final confirmation, and submission receipts.