test(codex): lock in marketplace + hooks-free manifest invariants (5.6.0)

.agents/plugins/marketplace.json

@@ -12,7 +12,7 @@
     {
       "name": "srepowers-core",
       "description": "SRE workflow spine, mandatory gates, and incident response",
-      "version": "5.5.0",
+      "version": "5.6.0",
       "source": {
         "source": "local",
         "path": "./plugins/srepowers-core"
@@ -30,7 +30,7 @@
     {
       "name": "srepowers-domain",
       "description": "Software engineering domain expertise for infrastructure engineers",
-      "version": "5.5.0",
+      "version": "5.6.0",
       "source": {
         "source": "local",
         "path": "./plugins/srepowers-domain"
@@ -48,7 +48,7 @@
     {
       "name": "srepowers-infra",
       "description": "Portable Proxmox, Puppet analysis, DNS, TLS, backup, and GitLab CI/CD administration",
-      "version": "5.5.0",
+      "version": "5.6.0",
       "source": {
         "source": "local",
         "path": "./plugins/srepowers-infra"
@@ -66,7 +66,7 @@
     {
       "name": "srepowers-private",
       "description": "Site-specific Puppet, Hiera, and Ansible operational workflow skills (sanitized templates)",
-      "version": "5.5.0",
+      "version": "5.6.0",
       "source": {
         "source": "local",
         "path": "./plugins/srepowers-private"

.claude-plugin/marketplace.json

@@ -5,13 +5,13 @@
     "email": "yg-codes@users.noreply.github.com"
   },
   "metadata": {
-    "version": "5.5.0",
+    "version": "5.6.0",
     "description": "SRE infrastructure skills marketplace — workflow, domain expertise, and infrastructure administration plugins"
   },
   "plugins": [
     {
       "name": "srepowers-core",
-      "version": "5.5.0",
+      "version": "5.6.0",
       "description": "SRE workflow spine, mandatory gates, and incident response — verification-first operations with TDO and SDO",
       "source": "./plugins/srepowers-core",
       "author": {
@@ -23,7 +23,7 @@
     },
     {
       "name": "srepowers-domain",
-      "version": "5.5.0",
+      "version": "5.6.0",
       "description": "Software engineering domain expertise — Go, Python, Rust, Kubernetes, Terraform, containers, networking, security, testing, and more",
       "source": "./plugins/srepowers-domain",
       "author": {
@@ -35,7 +35,7 @@
     },
     {
       "name": "srepowers-infra",
-      "version": "5.5.0",
+      "version": "5.6.0",
       "description": "Portable infrastructure administration — Proxmox VE, Puppet code analysis, DNS, TLS/PKI, backup, change management, and GitLab CI/CD pipelines",
       "source": "./plugins/srepowers-infra",
       "author": {
@@ -47,7 +47,7 @@
     },
     {
       "name": "srepowers-private",
-      "version": "5.5.0",
+      "version": "5.6.0",
       "description": "Site-specific operational workflows (sanitized templates) — Puppet deploy/release/MR lifecycle, Hiera debugging, and Ansible operations",
       "source": "./plugins/srepowers-private",
       "author": {

.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "srepowers",
   "description": "SRE infrastructure skills marketplace with 3 plugins: core (workflow + gates + incident), domain (Go, Python, Rust, K8s, Terraform, security, etc.), infra (Proxmox, Puppet, GitLab CI/CD)",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "author": {
     "name": "yg-codes",
     "email": "yg-codes@users.noreply.github.com"

plugins/srepowers-core/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "srepowers-core",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "SRE workflow spine, mandatory gates, and incident response — verification-first operations with Test-Driven Operation and Subagent-Driven Operation",
   "author": {
     "name": "yg-codes",

plugins/srepowers-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "srepowers-core",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "SRE workflow spine, mandatory gates, and incident response — verification-first operations with Test-Driven Operation and Subagent-Driven Operation",
   "author": {
     "name": "yg-codes",

plugins/srepowers-domain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "srepowers-domain",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "Software engineering domain expertise — Go, Python, Rust, Kubernetes, Terraform, containers, networking, security, testing, and more",
   "author": {
     "name": "yg-codes",

plugins/srepowers-domain/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "srepowers-domain",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "Software engineering domain expertise — Go, Python, Rust, Kubernetes, Terraform, containers, networking, security, testing, and more",
   "author": {
     "name": "yg-codes",

plugins/srepowers-infra/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "srepowers-infra",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "Portable infrastructure administration — Proxmox VE, Puppet code analysis, PuppetDB queries, DNS, TLS/PKI, backup, change management, and GitLab CI/CD pipelines",
   "author": {
     "name": "yg-codes",

plugins/srepowers-infra/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "srepowers-infra",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "Portable infrastructure administration — Proxmox VE, Puppet code analysis, DNS, TLS/PKI, backup, change management, and GitLab CI/CD pipelines",
   "author": {
     "name": "yg-codes",

plugins/srepowers-private/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "srepowers-private",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "Site-specific operational workflows — Puppet deploy/release/MR lifecycle, Hiera debugging, and Ansible operations. Sanitized templates: replace placeholders with your environment's values.",
   "author": {
     "name": "yg-codes",

plugins/srepowers-private/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "srepowers-private",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "Site-specific operational workflows — Puppet deploy/release/MR lifecycle, Hiera debugging, and Ansible operations. Sanitized templates: replace placeholders with your environment's values.",
   "author": {
     "name": "yg-codes",

tests/codex/run-skill-tests.sh

@@ -49,6 +49,17 @@ plugins = (
 )
 
 marketplace = json.loads(Path(".agents/plugins/marketplace.json").read_text())
+
+# v5.6.0 invariant (superpowers v6.1.0 parity): the Codex marketplace manifest
+# must be installable — it needs a name, an interface.displayName, and a list
+# of plugin entries, each pointing at a packaged plugin under ./plugins/.
+if not isinstance(marketplace.get("plugins"), list):
+    raise SystemExit(".agents/plugins/marketplace.json plugins must be a list")
+if not marketplace.get("name"):
+    raise SystemExit(".agents/plugins/marketplace.json missing name")
+if not marketplace.get("interface", {}).get("displayName"):
+    raise SystemExit(".agents/plugins/marketplace.json missing interface.displayName")
+
 entries = {entry["name"]: entry for entry in marketplace["plugins"]}
 root_manifest = json.loads(Path(".codex-plugin/plugin.json").read_text())
 versions = {root_manifest["version"]}
@@ -82,6 +93,12 @@ for plugin in plugins:
         raise SystemExit(f"{codex_manifest} name mismatch")
     if manifest.get("skills") != "./skills/":
         raise SystemExit(f"{codex_manifest} skills path must be ./skills/")
+    # v5.6.0 invariant (superpowers v6.1.0 parity): packaged Codex plugins ship
+    # no SessionStart hook. The bootstrap hook lives at repo-root .codex/hooks.json
+    # for repo-dev convenience only — it must not appear in a packaged plugin
+    # manifest, where it would fire on every install.
+    if manifest.get("hooks") is not None:
+        raise SystemExit(f"{codex_manifest} must not declare a hooks field")
 
     skills = sorted(path.parent.name for path in skills_dir.glob("*/SKILL.md"))
     commands = sorted(path.stem for path in commands_dir.glob("*.md"))
@@ -105,6 +122,9 @@ for plugin in plugins:
         raise SystemExit(f"{plugin} marketplace source.path mismatch")
     if entry.get("category") != "Engineering":
         raise SystemExit(f"{plugin} marketplace category must be Engineering")
+    policy = entry.get("policy")
+    if policy != {"installation": "AVAILABLE", "authentication": "ON_INSTALL"}:
+        raise SystemExit(f"{plugin} marketplace policy must be installation=AVAILABLE, authentication=ON_INSTALL")
 
 if len(versions) != 1:
     raise SystemExit(f"Codex marketplace and plugin versions differ: {sorted(versions)}")