[aaronpowell]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

The Azure update in #6176 fails manifest compliance even though its pinned source contains a valid Agent Plugins v1.0.0 root plugin.json. Quality gates currently prefer .github/plugin/plugin.json and .plugin/plugin.json, selecting a legacy manifest instead.

Make the root manifest authoritative for compliance, lint-target selection, version matching, and installed-manifest lookup. Retain nested locations as legacy fallbacks only when the root is absent; an invalid root must still fail rather than falling back. This also aligns selection order with the external-plugin metadata validator.

Add regression coverage for mixed modern/legacy manifests, malformed legacy JSON, invalid roots, lint-target selection, and matching/mismatching root versions under a nested source path. Document the precedence in the contribution guidance.

Relates to #6176.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify): Fix external-plugin quality-gate manifest selection and related documentation.

---

Additional Notes

Validation:

• node --test eng\external-plugin-quality-gates.test.mjs eng\external-plugin-validation.test.mjs: passed, 64 tests.
• npm run build: passed; generated files remained unchanged. Existing non-SPDX license warnings were emitted.
• bash eng/fix-line-endings.sh: passed.
• git diff --check: passed.
• The root manifest at Azure's pinned commit bd001a39dc9d4fea4f4e488284a9cfbb05d4bf78 passed the shared schema validator with no errors.

The full Azure install smoke test was not rerun locally; #6176's existing run already passed lint, installation, and version matching. Its failing compliance gate needs rerunning after this fix lands. Resource-specific checklist items are not applicable; npm run build was used instead of the equivalent npm start alias.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• eng/external-plugin-quality-gates.mjs is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• eng/external-plugin-quality-gates.test.mjs is a high-risk path (automation, scripts, MCP config, hooks, or review policy)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	✅ Passed	Passed · logs

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s); an approval from a maintainer with admin or maintain permission
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for 3bd5c7e · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the root-manifest precedence change.

No open issues 🎉

What changed in this PR

Fixes external-plugin quality gates selecting legacy manifests over a modern root plugin.json, addressing the compliance failure reported for Azure’s update in #6176.

Changes:

• Makes the root manifest authoritative, retaining nested manifests as fallbacks only when the root is absent.
• Adds regression tests for manifest precedence, invalid JSON, lint-target selection, and version matching under nested source paths.
• Documents that legacy manifests cannot override or bypass an invalid root manifest.

File	Description
eng/​external-plugin-quality-gates.test.mjs	Adds regression coverage for root-manifest precedence across quality gates.
eng/​external-plugin-quality-gates.mjs	Places root plugin.json first in the shared manifest search order.
CONTRIBUTING.md	Clarifies root-manifest authority when legacy manifests coexist.

_{Review effort: Balanced (auto)}