Seven manifests, one version: the #2528 close-out

Issue #2528 asked whether the committed plugins/ mirror should go. Decided 2026-09-06: it stays (every harness installs from committed files and never builds). What landed instead is below: one version source for every harness manifest, and one measurement that decides whether a spec-clean frontmatter sweep can happen.

Before and after: every manifest a host reads, at origin/main edf0ff9df

fileread bybeforeafterwho writes it now
manifests/codex/ork-codex.jsonbuild-codex-plugin.sh9.5.410.0.0-alpha.84release-please extra-file + build restamp
src/codex/ork-codex/.codex-plugin/plugin.jsoncopied into the Codex plugin9.5.410.0.0-alpha.84release-please extra-file + build restamp
plugins/ork-codex/.codex-plugin/plugin.jsonCodex CLI10.0.0-alpha.8410.0.0-alpha.84build (already), now restamped by sync_versions too
plugins/ork/.claude-plugin/plugin.jsonClaude Code10.0.0-alpha.8410.0.0-alpha.84release-please extra-file + build
plugins/ork/.cursor-plugin/plugin.jsonCursor10.0.0-alpha.8410.0.0-alpha.84build, now restamped by sync_versions too
plugins/ork/plugin.jsonAgent Plugins 1.0 clients10.0.0-alpha.8410.0.0-alpha.84release-please extra-file + build
plugin.json (repo root)ecosystem scanners (#3675)10.0.0-alpha.8410.0.0-alpha.84release-please extra-file + build

The two red cells had no writer at all: build-codex-plugin.sh read package.json only for the built copy, and sync_versions() never listed the sources. Forty releases went by. The fix stamps all seven from package.json inside npm run build, never by hand.

The gate, with its fault arm

Pick what the tree looks like; the meter shows what tests/unit/test-sync-versions.sh --live-only and the pre-push bin/validate-counts.sh return. These are the measured exit codes from tests/ci/fault-arms/sync-versions.sh (control=0 fault=1 fault2=1 fault3=1), not a simulation.


The measurement: metadata.* behaviour keys on CC 2.1.263

Agent Skills allows six frontmatter fields; ork skills carry about twenty. Three of them change Claude Code behaviour. A throwaway plugin with a top-level control and a metadata.* variant per key, three nonces, claude -p from $TMPDIR plus a pty for the / menu. Full commands and outputs: docs/audits/skill-metadata-keys-probe-2026-09-06.md.

keytop-levelunder metadata.*evidence
argument-hinthonouredignoredTab-completing /probemd:top-arg rendered <hint-c96632da>; /probemd:md-arg rendered nothing
disable-model-invocationhonouredignoredSkill tool on top-dmi answered UNAVAILABLE and the skill was absent from the model's list; md-dmi returned its token
user-invocablehonouredignored/top-ui ran zero turns with an empty result and is absent from the menu; /md-ui expanded and is listed

A spec-clean sweep that moves these keys is not possible today. At HEAD it would strip 39 argument hints, expose 29 model-hidden skills and put 71 hidden skills in the menu. Re-run the probe on the next CC release that touches skill loading.

Decision and reopen condition

Keep the committed mirror. Option B (built artifact or built branch) is deferred. Wrapper triplication is already gone (#3807), the autobuild heals contribution friction, and the mirror is what every harness installs.

Reopen when: a second external-contributor drift-gate failure lands (the first was #2527), or a harness appears that cannot install from committed files.