Seven manifests, one version: the #2528 close-out
Issue #2528 asked whether the committed plugins/ mirror should go. Decided 2026-09-06: it stays (every harness installs from committed files and never builds). What landed instead is below: one version source for every harness manifest, and one measurement that decides whether a spec-clean frontmatter sweep can happen.
Before and after: every manifest a host reads, at origin/main edf0ff9df
| file | read by | before | after | who writes it now |
|---|---|---|---|---|
manifests/codex/ork-codex.json | build-codex-plugin.sh | 9.5.4 | 10.0.0-alpha.84 | release-please extra-file + build restamp |
src/codex/ork-codex/.codex-plugin/plugin.json | copied into the Codex plugin | 9.5.4 | 10.0.0-alpha.84 | release-please extra-file + build restamp |
plugins/ork-codex/.codex-plugin/plugin.json | Codex CLI | 10.0.0-alpha.84 | 10.0.0-alpha.84 | build (already), now restamped by sync_versions too |
plugins/ork/.claude-plugin/plugin.json | Claude Code | 10.0.0-alpha.84 | 10.0.0-alpha.84 | release-please extra-file + build |
plugins/ork/.cursor-plugin/plugin.json | Cursor | 10.0.0-alpha.84 | 10.0.0-alpha.84 | build, now restamped by sync_versions too |
plugins/ork/plugin.json | Agent Plugins 1.0 clients | 10.0.0-alpha.84 | 10.0.0-alpha.84 | release-please extra-file + build |
plugin.json (repo root) | ecosystem scanners (#3675) | 10.0.0-alpha.84 | 10.0.0-alpha.84 | release-please extra-file + build |
The two red cells had no writer at all: build-codex-plugin.sh read package.json only for the built copy, and sync_versions() never listed the sources. Forty releases went by. The fix stamps all seven from package.json inside npm run build, never by hand.
The gate, with its fault arm
Pick what the tree looks like; the meter shows what tests/unit/test-sync-versions.sh --live-only and the pre-push bin/validate-counts.sh return. These are the measured exit codes from tests/ci/fault-arms/sync-versions.sh (control=0 fault=1 fault2=1 fault3=1), not a simulation.
The measurement: metadata.* behaviour keys on CC 2.1.263
Agent Skills allows six frontmatter fields; ork skills carry about twenty. Three of them change Claude Code behaviour. A throwaway plugin with a top-level control and a metadata.* variant per key, three nonces, claude -p from $TMPDIR plus a pty for the / menu. Full commands and outputs: docs/audits/skill-metadata-keys-probe-2026-09-06.md.
| key | top-level | under metadata.* | evidence |
|---|---|---|---|
argument-hint | honoured | ignored | Tab-completing /probemd:top-arg rendered <hint-c96632da>; /probemd:md-arg rendered nothing |
disable-model-invocation | honoured | ignored | Skill tool on top-dmi answered UNAVAILABLE and the skill was absent from the model's list; md-dmi returned its token |
user-invocable | honoured | ignored | /top-ui ran zero turns with an empty result and is absent from the menu; /md-ui expanded and is listed |
A spec-clean sweep that moves these keys is not possible today. At HEAD it would strip 39 argument hints, expose 29 model-hidden skills and put 71 hidden skills in the menu. Re-run the probe on the next CC release that touches skill loading.
Decision and reopen condition
Keep the committed mirror. Option B (built artifact or built branch) is deferred. Wrapper triplication is already gone (#3807), the autobuild heals contribution friction, and the mirror is what every harness installs.
Reopen when: a second external-contributor drift-gate failure lands (the first was #2527), or a harness appears that cannot install from committed files.