feat(agentic-engineering): bundle workspace skills, Codex app connectors and platform service servers

.claude-plugin/marketplace.json

@@ -19,8 +19,8 @@
   "plugins": [
     {
       "name": "agentic-engineering",
-      "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments and engineering-practice skills; and the MCP servers they use; configured by the consumer AGENTS.md",
-      "version": "7.0.0",
+      "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use; configured by the consumer AGENTS.md",
+      "version": "7.1.0",
       "source": "./plugins/agentic-engineering"
     },
     {

.github/plugin/marketplace.json

@@ -19,8 +19,8 @@
   "plugins": [
     {
       "name": "agentic-engineering",
-      "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments and engineering-practice skills; and the MCP servers they use; configured by the consumer AGENTS.md",
-      "version": "7.0.0",
+      "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use; configured by the consumer AGENTS.md",
+      "version": "7.1.0",
       "source": "./plugins/agentic-engineering"
     },
     {

.github/workflows/ci.yaml

@@ -138,6 +138,9 @@ jobs:
       - name: 🧪 Guard consolidated skill-spec validation
         run: bash scripts/ci-skill-validation-workflow.test.sh
 
+      - name: 🧪 Self-test the skill spec view
+        run: bash scripts/skill-spec-view.test.sh
+
       - name: 🧪 Guard complete script-test sharding
         run: bash scripts/ci-script-test-sharding-workflow.test.sh
 
@@ -531,8 +534,21 @@ jobs:
           fi
 
           printf 'Validating %s skill(s).\n' "${#skills[@]}"
-          for skill in "${skills[@]}"; do
-            echo "::group::Validate $skill"
+          # Each skill is judged through a copy without the `argument-hint` and `user-invocable`
+          # fields Claude Code and VS Code read, which the spec does not define; every other field is still
+          # checked (scripts/skill-spec-view.sh, maintainer decision 2026-11-04).
+          views="$RUNNER_TEMP/skill-spec-views"
+          for skill_path in "${skills[@]}"; do
+            echo "::group::Validate $skill_path"
+            skill=$(bash scripts/skill-spec-view.sh "$skill_path" "$views/${skill_path//\//_}")
+            # The view must read as exactly the skill's own properties, so dropping the two
+            # fields can never hand the validator frontmatter the skill does not have.
+            skills-ref read-properties "$skill_path" > "$views/original.json"
+            skills-ref read-properties "$skill" > "$views/view.json"
+            if ! cmp -s "$views/original.json" "$views/view.json"; then
+              echo "::error file=$skill_path/SKILL.md::its spec view reads differently from the skill itself"
+              exit 1
+            fi
             skills-ref validate "$skill"
             echo "::endgroup::"
           done

.github/workflows/update-agent-skills.yaml

@@ -143,7 +143,8 @@ jobs:
           # The publisher independently rejects anything outside this skill's plugin metadata.
           git add -- '*.desired-state.json'
           git add -- .claude-plugin/marketplace.json .github/plugin/marketplace.json \
-            'plugins/*/plugin.json' 'plugins/*/.claude-plugin/plugin.json' 'plugins/*/CHANGELOG.md'
+            'plugins/*/plugin.json' 'plugins/*/.claude-plugin/plugin.json' \
+            'plugins/*/.codex-plugin/plugin.json' 'plugins/*/CHANGELOG.md'
 
       - name: ✍️ Publish one App-signed metadata commit
         id: publish-metadata

docs/adr/0018-agentic-engineering-covers-the-agents-workspace.md

@@ -0,0 +1,49 @@
+# 0018. The agentic-engineering plugin covers the agents' whole workspace
+
+## Context
+
+[ADR 0017](0017-agentic-engineering-bundles-the-agents-toolbox.md) made `agentic-engineering` the one
+plugin carrying the agents' engineering toolbox. On 2026-11-04 the maintainer asked for Anthropic's
+Engineering, Design, Product Management, Marketing, Finance and Productivity skills, iCloud Mail and
+Calendar, LinkedIn and Codex Security as well. They considered a separate productivity plugin, then
+chose to keep one plugin and split it later only if that proves troublesome.
+
+Three facts shaped how. Most of Anthropic's skills use the `argument-hint` and `user-invocable`
+frontmatter fields that Claude Code and VS Code read, which the Agent Skills specification this
+marketplace enforces does not define. The Productivity skills keep their state in `CLAUDE.md`, a `memory/` folder,
+`TASKS.md` and a dashboard file in the working folder. Mail, calendar, LinkedIn and Codex Security
+reach the agents through the providers' own connectors, which need the user's sign-in and which a
+Claude Code plugin manifest cannot declare.
+
+## Decision
+
+- **One plugin.** `agentic-engineering` also carries the design, product-management, marketing,
+  finance and productivity skills, installed unmodified with `gh skill install`. Their connectors
+  are not bundled.
+- **Two runtime fields are accepted.** The spec check judges each skill through a copy without
+  `argument-hint` and `user-invocable`, and still rejects every other unknown field. Upstream skills
+  are still never rewritten.
+- **The plugin steers, it does not rewrite.** A maintained `workspace-conventions` skill sends the
+  Productivity skills' state to `AGENTS.md`, the agent's native memory and the project's issue
+  tracker. The dashboard template is not bundled.
+- **Official connectors are requested, never improvised.** A maintained `connector-setup` skill
+  names the official connector for each need, and how to ask the user to enable it: in Claude
+  through the connector directory, in Codex as a plugin from OpenAI's catalogue. It says plainly
+  when none exists, as for iCloud in Claude, and forbids unofficial servers, scraping and passwords.
+- **Name clashes keep the first owner.** CodeRabbit's `code-review` and Product Management's
+  `competitive-brief` keep their names; Anthropic's Engineering `code-review` and Marketing's
+  `competitive-brief` are not bundled.
+
+## Consequences
+
+- The plugin is no longer engineering-only. Its description, README and catalogue say so, and
+  `vibe-coding` and `ksail` stay separate as before.
+- This plugin grows to 87 skills, so a session lists many more skill descriptions. If that crowds
+  out the engineering ones, splitting off a productivity plugin is the planned next step.
+- Mail, calendar and LinkedIn need one sign-in each by the user, and unattended runs never wait
+  for one. Codex can install the iCloud and Codex Security plugins; Claude has no iCloud connector
+  yet.
+- The two accepted fields are not Claude-only. VS Code documents both for Copilot agent skills, and
+  Codex's skill parser reads only `name`, `description` and `metadata.short-description`, ignoring
+  any other field. Each field only adds an input hint or a menu switch, so a runtime that ignores
+  them still runs the skill.

docs/adr/0019-codex-manifest-offers-optional-apps.md

@@ -0,0 +1,35 @@
+# 0019. A Codex manifest offers the official apps the agents use
+
+## Context
+
+The maintainer wants the agents' mail, calendar, LinkedIn and Codex Security connections enabled
+automatically wherever possible ([ADR 0018](0018-agentic-engineering-covers-the-agents-workspace.md)).
+A Claude Code plugin manifest cannot declare a claude.ai connector, so in Claude the plugin can
+only tell the agents what to ask for. Codex plugins can: a `.codex-plugin/plugin.json` names an
+`.app.json` whose apps Codex offers with the plugin. Codex already loaded this marketplace's
+plugins through their `.claude-plugin/plugin.json`.
+
+Codex's own source settles how the files interact. It reads `.codex-plugin/plugin.json` before
+`.claude-plugin/plugin.json`, and resolves skills, MCP servers and apps only from the paths that
+manifest declares. Installing a branch build into a throwaway `CODEX_HOME` showed Codex loading the
+plugin's skills and every bundled MCP server through the new manifest. The connector ids were read
+from the official iCloud Mail, iCloud Calendar and LinkedIn plugins after installing them; the Codex
+Security Cloud id comes from OpenAI's published `codex-security` plugin.
+
+## Decision
+
+- `agentic-engineering` ships a `.codex-plugin/plugin.json` and an `.app.json`. The manifest
+  repeats the portable `plugin.json` exactly and adds only `skills`, `mcpServers`, `apps` and an
+  `interface` listing.
+- Every app is optional (`"required": false`): installing the plugin never forces a connector the
+  user has not chosen.
+- `validate-manifests.sh` enforces that shape and refuses an `.app.json` no Codex manifest
+  declares. `bump-plugin-version.sh` moves the Codex manifest's version with the other four.
+
+## Consequences
+
+- Codex users see the four apps offered with the plugin and still sign in to each themselves.
+- A new bundled resource directory or file must also be named in the Codex manifest, or Codex will
+  not load it; the validator catches a missing `skills` or `mcpServers` path.
+- Connector ids are Codex's internal identifiers. If OpenAI changes one, the app silently stops
+  being offered until the id is updated, so re-read it from the installed plugin when in doubt.

docs/installation.md

@@ -41,6 +41,23 @@ Browse everything on offer with `/plugin` (**Discover** tab) or list it with `/p
 
 Claude Desktop can add the same GitHub repository from **Plugins → Personal**. That path validates the marketplace remotely in strict mode; every plugin therefore includes the canonical `.claude-plugin/plugin.json` manifest it requires.
 
+## Codex
+
+Add the marketplace, then install a plugin, from a terminal:
+
+```bash
+codex plugin marketplace add https://github.com/devantler-tech/agent-plugins.git
+codex plugin add agentic-engineering@devantler-plugins
+```
+
+Codex reads a plugin's `.codex-plugin/plugin.json` before its `.claude-plugin/plugin.json`. The
+`agentic-engineering` plugin ships one so that it can also offer the official Codex apps its agents
+use: iCloud Mail, iCloud Calendar, LinkedIn and Codex Security Cloud, all optional, listed in its
+[`.app.json`](../plugins/agentic-engineering/.app.json). Each still needs your own sign-in.
+`scripts/validate-manifests.sh` keeps that manifest identical to the portable one apart from its
+component paths, app list and listing, and `scripts/bump-plugin-version.sh` moves its version
+with the others.
+
 ## Any other agent — skills only, via `npx skills`
 
 [`npx skills`](https://github.com/vercel-labs/skills) reads this repo's [`.claude-plugin/marketplace.json`](../.claude-plugin/marketplace.json) and installs the bundled **skills** into its supported agents — useful when your agent isn't one of the three above: