join-the-team v0.2.3 — conformance gate hardened by cross-model review

join-the-team is compliant with Agent Plugins 1.0.0 — the packaging standard announced by Google, stewarded by Amazon, Cursor, Google, Microsoft, OpenAI and Vercel. Skills comply with Agent Skills.

This release fixes the gate itself.

Why

Every PR from v0.1.7 to v0.2.2 was authored and self-merged with reviews=0 — against this project's own doctrine that neither author both writes and approves. An independent cross-model review of the cumulative diff found defects the gate had been passing.

Fixed

Round 1–3 — defects affecting the gate today:

• MCP transport fields were presence-checked, not type-checked. {"type":"stdio","command":null} validated clean: the required-key check saw the key, then isinstance guards skipped everything after it.
• cwd accepted traversal outside the plugin root. The published schema anchors only the prefix and defers containment to the client; the containment half was missing, so ./../outside passed.
• A malformed version shipped silently. "banana" across all six manifests passed both gates. Now a local SemVer rule, marked as stricter than the standard.

Rounds 4–11 — symlink-assisted escape, closed by generalising:

Broken links, Windows separators, drive-qualified and UNC targets, relative Windows traversal, unverifiable ${PLUGIN_DATA}, ancestor symlinks inflating depth. Each round produced one more variant, so the approach changed: a cwd that both crosses a symlink and climbs is refused as not provably contained. .. without a symlink still passes; a symlink without .. still passes.

Round twelve returned no actionable findings.

Evidence

make lint / typecheck / test / spec-conformance → all pass
negative fixtures 22 → 51
review rounds: 3 2 1 1 1 2 1 1 1 1 1 0

Every finding was reproduced before being accepted — cross-model verdicts are input, not authority — and every one has a fixture that fails without its fix.

The lesson, in ADR-002

The gate that checks the work needs checking too, and it cannot check itself. A validator's author is the worst reviewer of that validator.

And a stopping rule, earned rather than assumed: stop when fixes stop generalising. Chasing platform-specific compositions produced one finding per round indefinitely; refusing the unprovable combination ended it in a single move. When a reviewer keeps finding variants, the defect is usually the approach, not the variant.

Scope note

cwd containment is defence-in-depth for a root mcp.json this package does not ship. If one is ever added, ADR-002 says to re-run this review from round one rather than assume twelve rounds already covered it.