Prepare public community onboarding and release checks

.agents/plugins/marketplace.json

@@ -15,7 +15,7 @@
         "authentication": "ON_INSTALL"
       },
       "category": "Productivity",
-      "version": "0.2.0"
+      "version": "0.2.1"
     }
   ]
 }

.github/workflows/validate.yml

@@ -23,5 +23,7 @@ jobs:
         run: python3 -B -m unittest discover -s plugins/codex-orchestration/test -p 'test_*.py'
       - name: Check standalone catalog
         run: python3 -B plugins/codex-orchestration/test/check_catalog.py
+      - name: Check documentation
+        run: python3 -B plugins/codex-orchestration/test/check_docs.py
       - name: Check whitespace
         run: git show --format= --check HEAD

CONTRIBUTING.md

@@ -1,6 +1,8 @@
 # Contributing
 
-This repository maintains one plugin: `plugins/codex-orchestration/`. Keep changes focused on its existing project setup, delegation, documentation and validation responsibilities. The repository is initially private; collaboration requires access. A distribution license must be selected before the planned public release.
+This public repository maintains one plugin: `plugins/codex-orchestration/`. Keep changes focused on its existing project setup, delegation, documentation and validation responsibilities. Distribution terms remain under review; see [licensing status](README.md#licensing-status).
+
+The owner, `Number531`, is currently the only user with repository write/admin access. Community members can report issues and propose changes through pull requests; the owner decides what to accept and merge. A proposed contribution does not grant write access. Repository permissions and the license governing copies are separate.
 
 ## Local development
 
@@ -9,12 +11,13 @@ Use Python 3.11+ and Git. No Python packages are needed for the deterministic te
 ```sh
 python3 -B -m unittest discover -s plugins/codex-orchestration/test -p 'test_*.py'
 python3 -B plugins/codex-orchestration/test/check_catalog.py
+python3 -B plugins/codex-orchestration/test/check_docs.py
 git diff --check
 ```
 
 Read [validation and compatibility](plugins/codex-orchestration/docs/validation.md) before running native or live checks. Do not automatically invoke paid services, change global trust, install the plugin for someone else, or update their real project as part of a test.
 
-GitHub Actions runs the deterministic unit and catalog checks on pushes and pull requests using Python 3.11. Its token has read-only repository access, checkout does not persist credentials, and action dependencies are pinned. Native/live checks remain opt-in; a green CI run does not qualify a desktop client.
+GitHub Actions runs the deterministic unit, catalog and documentation checks on pushes and pull requests using Python 3.11. The offline documentation check covers tracked Markdown inline local links, ATX heading anchors, and JSON/TOML fenced examples; external URLs and shell commands require separate review. Its token has read-only repository access, checkout does not persist credentials, and action dependencies are pinned. Native/live checks remain opt-in; a green CI run does not qualify a desktop client.
 
 ## Changes and pull requests
 
@@ -28,13 +31,15 @@ Avoid adding a workflow framework, automatic updater, account-wide control claim
 
 ## Report a problem
 
-Use an issue in this repository for a non-sensitive bug or documentation problem. Include OS, package/client versions, the failing command, expected/observed behavior and a minimal sanitized reproduction. Do not attach full user configuration, prompts or logs containing secrets. Security-sensitive details belong in a private report.
+Use [GitHub Issues](https://github.com/Number531/Codex-Orchestration/issues) for a non-sensitive bug, feature request or documentation problem. Sign in to GitHub to submit an issue; no repository invitation is required. Include OS, package/client versions, the failing command, expected/observed behavior and a minimal sanitized reproduction. Do not attach full user configuration, prompts or logs containing secrets. Security-sensitive details belong in the [private reporting channel](SECURITY.md#report-a-vulnerability).
 
 ## Release preparation
 
-Before a public launch:
+Follow the [versioned release and rollback procedure](docs/releasing.md). Changes to `main` require a pull request, the passing `contracts` check and resolved review conversations. Force-pushes and branch deletion are blocked. Zero required GitHub approvals accommodates a solo maintainer; retain an independent review before merging.
+
+Before a versioned release:
 
-1. Confirm the intended license and ownership/branding permissions, add the selected license, and align manifest metadata and documentation. No license is selected by this initial extraction.
+1. Confirm the intended license and ownership/branding permissions, add the selected license, and align manifest metadata and documentation. Public repository visibility does not settle these terms.
 2. Review the complete candidate tree and reachable history for credentials, customer data, internal material and third-party content. This repository starts from selected package files rather than importing the original repository's history.
 3. Pass deterministic checks, review the final diff independently, and record native/client validation honestly. Resolve or explicitly disclose compatibility assumptions.
 4. Trial the documented install, setup, trust, toggle, update and removal procedures in a disposable project with a separate authorized account. Confirm that the configured models are available there.

README.md

@@ -4,7 +4,7 @@ Cost-aware delegation for Codex, with named specialist agents and an optional mo
 
 An orchestrating agent can choose tasks dynamically while delegating through registered roles with fixed model and reasoning settings. The optional guard rejects covered spawn requests that violate the project policy. **Enforcement starts off.**
 
-This repository is initially private. GitHub read access is required until the owner changes its visibility. It is a repository-hosted Codex catalog, not a public directory listing or an OpenAI endorsement. No license has been selected for public distribution yet.
+This repository is public and accepts community issue reports. It is a repository-hosted Codex catalog; an OpenAI public-directory listing and endorsement have not been granted. Distribution terms remain under review; see [licensing status](#licensing-status).
 
 ## Start here
 
@@ -16,6 +16,7 @@ This repository is initially private. GitHub read access is required until the o
 | Understand what has actually been tested | [Validation and compatibility](plugins/codex-orchestration/docs/validation.md) |
 | Contribute a change | [Contributing](CONTRIBUTING.md) |
 | Report a security concern | [Security](SECURITY.md) |
+| Report a bug or request an improvement | [GitHub Issues](https://github.com/Number531/Codex-Orchestration/issues) |
 
 ## Install the plugin
 
@@ -27,7 +28,7 @@ codex plugin list --available --json --marketplace codex-orchestration
 codex plugin add codex-orchestration@codex-orchestration
 ```
 
-For a private repository, use Git credentials with read access. SSH is also supported:
+The HTTPS catalog is publicly readable and requires no repository invitation. SSH is also supported for users with GitHub SSH authentication:
 
 ```sh
 codex plugin marketplace add git@github.com:Number531/Codex-Orchestration.git
@@ -45,7 +46,11 @@ Choose one catalog source. If that catalog is already registered, inspect `codex
 | Package directory | `plugins/codex-orchestration/` |
 | Native catalog | `.agents/plugins/marketplace.json` |
 
-Version `0.2.0` aligns the plugin, skills and project markers with this repository's community branding. Existing `0.1.0` installations need the [manual migration steps](plugins/codex-orchestration/docs/operations.md#migrate-from-010). The generic role names, model pins and default-off behavior are unchanged. This repository contains no sibling plugins from the original multi-plugin repository.
+Version `0.2.0` aligned the plugin, skills and project markers with this repository's community branding. Existing `0.1.0` installations need the [manual migration steps](plugins/codex-orchestration/docs/operations.md#migrate-from-010). The generic role names, model pins and default-off behavior are unchanged. This repository contains no sibling plugins from the original multi-plugin repository.
+
+## Reviewed versions
+
+For a reproducible install, add `--ref <reviewed-ref>` to the marketplace-add command above. Replace the placeholder with a reviewed commit SHA or a published tag from [Releases](https://github.com/Number531/Codex-Orchestration/releases); use one catalog source. No tagged release has been published yet. Review the [upgrade and rollback procedure](plugins/codex-orchestration/docs/operations.md#upgrade-a-project) before changing an existing installation. Maintainers use the [release procedure](docs/releasing.md).
 
 ## Development checks
 
@@ -54,10 +59,13 @@ From the repository root, with Python 3.11+ and Git:
 ```sh
 python3 -B -m unittest discover -s plugins/codex-orchestration/test -p 'test_*.py'
 python3 -B plugins/codex-orchestration/test/check_catalog.py
+python3 -B plugins/codex-orchestration/test/check_docs.py
 ```
 
 These checks use synthetic local fixtures and run in [GitHub Actions](.github/workflows/validate.yml). CI does not run paid models or native Codex sessions. Native engine checks, Desktop installation/trust, and live model access are separate validation surfaces; see the [compatibility guide](plugins/codex-orchestration/docs/validation.md).
 
-## Before a public release
+## Licensing status
+
+A distribution license reflecting the owner's intended free-use and enterprise restrictions is still being selected. No project license has been adopted. Public visibility does not itself grant general reuse or redistribution rights; GitHub explains the [default licensing position and platform fork rights](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/licensing-a-repository).
 
-Choose a license and update the package metadata, confirm branding and source ownership, test onboarding with a separate account, and review the repository contents and history before changing visibility. Publishing to GitHub and submitting to OpenAI's public plugin directory are separate decisions. See [maintainer release guidance](CONTRIBUTING.md#release-preparation).
+Before a versioned release, finalize the license and package metadata, confirm source ownership, and record supported-client validation. Desktop UI and live-account qualification remain open. See [maintainer release guidance](CONTRIBUTING.md#release-preparation). Publishing a GitHub release and submitting to OpenAI's public plugin directory are separate decisions.

SECURITY.md

@@ -10,6 +10,8 @@ The shipped installer and guard make no network calls and load no credentials. C
 
 ## Report a vulnerability
 
-Use GitHub's private vulnerability reporting for this repository if that option is enabled. While the repository is private, an authorized collaborator can contact the owner through their established private channel. If no private reporting channel is available, open only a minimal, non-sensitive issue requesting one; do not include exploit details, credentials or customer data.
+As of 2026-09-13, this repository is public and GitHub private vulnerability reporting, secret scanning and repository push protection are enabled and verified through GitHub's API. These controls do not guarantee that every secret or vulnerability will be detected. Maintainers should recheck the settings before releases; see the [release procedure](docs/releasing.md#repository-security-settings).
+
+Use [Report a vulnerability](https://github.com/Number531/Codex-Orchestration/security/advisories/new) for security-sensitive findings. Sign in to GitHub and use the private advisory form. If that channel is unavailable, open only a minimal, non-sensitive issue requesting a private contact route; do not include exploit details, credentials or customer data.
 
 Provide the affected package/client versions, a sanitized reproduction, the violated boundary and observed impact through the private channel. Do not publish a working exploit or sensitive logs in a public issue. This initial project makes no response-time or long-term support commitment.

docs/releasing.md

@@ -0,0 +1,39 @@
+# Releasing Codex-Orchestration
+
+Release only a reviewed commit of this single plugin. A tag selects a repository snapshot; the plugin version, both manifests, catalog entry and changelog must agree on the release version.
+
+## Prepare and validate
+
+1. Confirm the license, attribution and intended distribution audience. Review the candidate tree and reachable history for sensitive material; a pattern scan does not establish ownership or prove that every secret is absent.
+2. Update both package manifests, the catalog version, changelog and affected onboarding/compatibility documentation. Keep delegation enforcement off by default.
+3. Run the deterministic checks from the repository root:
+
+```sh
+python3 -B -m unittest discover -s plugins/codex-orchestration/test -p 'test_*.py'
+python3 -B plugins/codex-orchestration/test/check_catalog.py
+python3 -B plugins/codex-orchestration/test/check_docs.py
+git diff --check
+```
+
+4. Trial discovery, installation, project setup and default-off status in an isolated configuration/cache and disposable Git project. Confirm that the installed cache matches the reviewed package. Record exact client/OS versions and distinguish CLI, Desktop engine and Desktop UI results. Native and live checks remain opt-in; keep credentials and session records out of release artifacts.
+5. Obtain independent review, open a pull request and require passing CI before merging. Confirm the merged tree is the reviewed tree. Keep main protected and do not bypass failing required checks.
+
+## Publish a reviewed version
+
+After the owner authorizes publication, create a version tag such as `vX.Y.Z` at the exact validated merge commit and publish a GitHub release using that tag. Replace placeholders with the reviewed version and commit. Do not move or force-update a published tag; ship a new version for corrections.
+
+The release notes should state the change, migration requirements, tested client/OS versions, known limitations, license and default-off behavior. Verify the release and tag resolve to the intended commit, then trial catalog discovery from that tag. GitHub's generated source archives are sufficient for this package; no custom binary build pipeline is required.
+
+Users can add `--ref <release-tag>` to the documented marketplace-add command to select a reviewed version. A pinned catalog remains on that ref when refreshed; moving to another release requires reviewing and updating the catalog source/ref through the client's supported marketplace flow. Plugin-cache updates and project-asset updates are separate.
+
+## Repository security settings
+
+Maintain pull-request-only changes to main, the required `contracts` check from GitHub Actions, resolved review conversations, and blocked force-pushes/deletions. A solo maintainer may use zero required approvals while retaining independent review in the contribution process; require an additional reviewer when one is available.
+
+This repository is public. GitHub private vulnerability reporting, secret scanning and repository push protection were enabled and verified on 2026-09-13. Before a release, recheck those settings and the private reporting link in [SECURITY.md](../SECURITY.md#report-a-vulnerability). Do not infer current settings from this dated record or enroll in a paid product unintentionally.
+
+Changing repository visibility, publishing a release and submitting to OpenAI's public plugin directory are separate owner-authorized actions. A repository catalog is not an OpenAI directory listing.
+
+## Roll back an adoption
+
+Review the [project upgrade and recovery guide](../plugins/codex-orchestration/docs/operations.md#upgrade-a-project). Select the prior reviewed package version for the plugin cache and separately reconcile its project files, preserving custom roles, policy and toggle values. Disabling the plugin does not remove project assets. If reverting enforcement, explicitly set the project's guard off before removing its script/hook. Never use blanket cleanup or history rewriting to discard unrelated work.

plugins/codex-orchestration/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-orchestration",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Team delegation, focused delivery and explicit Codex project setup with an optional model guard.",
   "author": {
     "name": "Codex-Orchestration contributors"

plugins/codex-orchestration/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.2.1 — Unreleased
+
+Separated installed-plugin and checkout setup instructions, documented project and hook trust separately, and stated the Unix prerequisite and default-off activation guidance. Added offline documentation checks and maintainer release/rollback instructions. The installer, hook, role profiles, model pins and project guidance are unchanged.
+
+Disposable local-catalog and pinned GitHub-commit installation passed on CLI `0.154.0` and Desktop engine `0.154.0-alpha.6.2` on macOS: three cached skills, matching package files, repeatable setup and guard off. Desktop UI trust and live model access remain unqualified.
+
+The repository became public on 2026-09-13 with Issues available, private vulnerability reporting enabled, and secret scanning/push protection verified. Updated public access, owner-controlled contribution and security-reporting guidance. Distribution license and tagged release remain pending; public visibility does not grant a project license.
+
 ## 0.2.0 — 2026-09-12
 
 Renamed the plugin/package to `codex-orchestration` and its skills to `orchestration-setup`, `orchestration-delivery` and `orchestration-review`. Updated neutral author/display metadata, project guidance, installer markers, documentation, CI paths and catalog contracts. Global configuration and other repositories are outside this change.