diff --git a/.agents/plugins/marketplace.json b/.agents/plugins/marketplace.json index 54c884e..f3692ba 100644 --- a/.agents/plugins/marketplace.json +++ b/.agents/plugins/marketplace.json @@ -15,7 +15,7 @@ "authentication": "ON_INSTALL" }, "category": "Productivity", - "version": "0.2.1" + "version": "0.2.2" } ] } diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 51f3513..ccd7ece 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,6 +1,6 @@ # Contributing -This public repository maintains one plugin: `plugins/codex-orchestration/`. Keep changes focused on its existing project setup, delegation, documentation and validation responsibilities. Distribution terms remain under review; see [licensing status](README.md#licensing-status). +This public repository maintains one plugin: `plugins/codex-orchestration/`. Keep changes focused on its existing project setup, delegation, documentation and validation responsibilities. The project uses the [MIT License](LICENSE); preserve its copyright and permission notices in distributed copies. The owner, `Number531`, is currently the only user with repository write/admin access. Community members can report issues and propose changes through pull requests; the owner decides what to accept and merge. A proposed contribution does not grant write access. Repository permissions and the license governing copies are separate. @@ -39,7 +39,7 @@ Follow the [versioned release and rollback procedure](docs/releasing.md). Change Before a versioned release: -1. Confirm the intended license and ownership/branding permissions, add the selected license, and align manifest metadata and documentation. Public repository visibility does not settle these terms. +1. Confirm ownership/branding permissions, preserve the MIT license notices, keep the root and package license copies identical, and align manifest metadata and documentation. Public repository visibility does not settle third-party rights. 2. Review the complete candidate tree and reachable history for credentials, customer data, internal material and third-party content. This repository starts from selected package files rather than importing the original repository's history. 3. Pass deterministic checks, review the final diff independently, and record native/client validation honestly. Resolve or explicitly disclose compatibility assumptions. 4. Trial the documented install, setup, trust, toggle, update and removal procedures in a disposable project with a separate authorized account. Confirm that the configured models are available there. diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..0eeb0f5 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Number531 + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index 1a87350..ca042dd 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ Cost-aware delegation for Codex, with named specialist agents and an optional mo An orchestrating agent can choose tasks dynamically while delegating through registered roles with fixed model and reasoning settings. The optional guard rejects covered spawn requests that violate the project policy. **Enforcement starts off.** -This repository is public and accepts community issue reports. It is a repository-hosted Codex catalog; an OpenAI public-directory listing and endorsement have not been granted. Distribution terms remain under review; see [licensing status](#licensing-status). +This public repository is [MIT licensed](#licensing-status) and accepts community issue reports. It is a repository-hosted Codex catalog; an OpenAI public-directory listing and endorsement have not been granted. ## Start here @@ -66,6 +66,8 @@ These checks use synthetic local fixtures and run in [GitHub Actions](.github/wo ## Licensing status -A distribution license reflecting the owner's intended free-use and enterprise restrictions is still being selected. No project license has been adopted. Public visibility does not itself grant general reuse or redistribution rights; GitHub explains the [default licensing position and platform fork rights](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/licensing-a-repository). +The repository and plugin use the [MIT License](LICENSE). Individuals and organizations, including enterprises, may use, modify and redistribute the software commercially or noncommercially under those terms. Copies or substantial portions must retain the copyright and permission notices. The software is provided without warranty. -Before a versioned release, finalize the license and package metadata, confirm source ownership, and record supported-client validation. Desktop UI and live-account qualification remain open. See [maintainer release guidance](CONTRIBUTING.md#release-preparation). Publishing a GitHub release and submitting to OpenAI's public plugin directory are separate decisions. +The installed plugin contains its own [license copy](plugins/codex-orchestration/LICENSE), matching the repository license. GitHub write permissions remain controlled by the owner; the license governs reuse of copies. + +Before a versioned release, verify license notices, source ownership and supported-client validation. Desktop UI and live-account qualification remain open. See [maintainer release guidance](CONTRIBUTING.md#release-preparation). Publishing a GitHub release and submitting to OpenAI's public plugin directory are separate decisions. diff --git a/docs/releasing.md b/docs/releasing.md index bfc690f..e859b6b 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -4,7 +4,7 @@ Release only a reviewed commit of this single plugin. A tag selects a repository ## Prepare and validate -1. Confirm the license, attribution and intended distribution audience. Review the candidate tree and reachable history for sensitive material; a pattern scan does not establish ownership or prove that every secret is absent. +1. Confirm MIT license notices, attribution and intended distribution audience. Keep `LICENSE` and `plugins/codex-orchestration/LICENSE` identical and both manifest license fields set to `MIT`. Review the candidate tree and reachable history for sensitive material; a pattern scan does not establish ownership or prove that every secret is absent. 2. Update both package manifests, the catalog version, changelog and affected onboarding/compatibility documentation. Keep delegation enforcement off by default. 3. Run the deterministic checks from the repository root: diff --git a/plugins/codex-orchestration/.codex-plugin/plugin.json b/plugins/codex-orchestration/.codex-plugin/plugin.json index a64b346..3391e75 100644 --- a/plugins/codex-orchestration/.codex-plugin/plugin.json +++ b/plugins/codex-orchestration/.codex-plugin/plugin.json @@ -1,6 +1,7 @@ { "name": "codex-orchestration", - "version": "0.2.1", + "version": "0.2.2", + "license": "MIT", "description": "Team delegation, focused delivery and explicit Codex project setup with an optional model guard.", "author": { "name": "Codex-Orchestration contributors" diff --git a/plugins/codex-orchestration/CHANGELOG.md b/plugins/codex-orchestration/CHANGELOG.md index 9c03854..f9a5f0d 100644 --- a/plugins/codex-orchestration/CHANGELOG.md +++ b/plugins/codex-orchestration/CHANGELOG.md @@ -1,22 +1,26 @@ # Changelog -## 0.2.1 — Unreleased +## 0.2.2 — Unreleased + +Adopted the MIT License for the repository and standalone plugin, including commercial and enterprise use. Added matching license copies at both distribution roots and MIT metadata in both manifests. Updated licensing guidance and bumped the package/catalog version so cached installs can distinguish the licensed package. Installer, guard, profiles, model pins and new-install default-off behavior are unchanged. + +## 0.2.1 — 2026-09-13 (repository update) Separated installed-plugin and checkout setup instructions, documented project and hook trust separately, and stated the Unix prerequisite and default-off activation guidance. Added offline documentation checks and maintainer release/rollback instructions. The installer, hook, role profiles, model pins and project guidance are unchanged. Disposable local-catalog and pinned GitHub-commit installation passed on CLI `0.154.0` and Desktop engine `0.154.0-alpha.6.2` on macOS: three cached skills, matching package files, repeatable setup and guard off. Desktop UI trust and live model access remain unqualified. -The repository became public on 2026-09-13 with Issues available, private vulnerability reporting enabled, and secret scanning/push protection verified. Updated public access, owner-controlled contribution and security-reporting guidance. Distribution license and tagged release remain pending; public visibility does not grant a project license. +The repository became public on 2026-09-13 with Issues available, private vulnerability reporting enabled, and secret scanning/push protection verified. Updated public access, owner-controlled contribution and security-reporting guidance. Distribution license and tagged release were pending at this point; public visibility did not grant a project license. ## 0.2.0 — 2026-09-12 Renamed the plugin/package to `codex-orchestration` and its skills to `orchestration-setup`, `orchestration-delivery` and `orchestration-review`. Updated neutral author/display metadata, project guidance, installer markers, documentation, CI paths and catalog contracts. Global configuration and other repositories are outside this change. -Setup now refuses recognized `0.1.0` guidance or an existing legacy setup lock pending [manual migration](docs/operations.md#migrate-from-010). It holds both lock names during apply for cross-version exclusion. Existing policy/toggle values are preserved after migration. Generic agent names, model pins, guard logic and new-install default-off behavior are unchanged. No license has been selected. +Setup now refuses recognized `0.1.0` guidance or an existing legacy setup lock pending [manual migration](docs/operations.md#migrate-from-010). It holds both lock names during apply for cross-version exclusion. Existing policy/toggle values are preserved after migration. Generic agent names, model pins, guard logic and new-install default-off behavior are unchanged. No license had been selected at this point. ## Standalone repository — 2026-09-12 -Moved the selected package into the private Codex-Orchestration repository with its own single-plugin catalog. Updated repository metadata, installation instructions, configuration/customization, operations, validation and contributor/security guidance. Runtime assets, model pins, skills and the default-off guard remain unchanged at version 0.1.0. No distribution license has been selected. +Moved the selected package into the private Codex-Orchestration repository with its own single-plugin catalog. Updated repository metadata, installation instructions, configuration/customization, operations, validation and contributor/security guidance. Runtime assets, model pins, skills and the default-off guard remain unchanged at version 0.1.0. No distribution license had been selected at this point. ## 0.1.0 diff --git a/plugins/codex-orchestration/LICENSE b/plugins/codex-orchestration/LICENSE new file mode 100644 index 0000000..0eeb0f5 --- /dev/null +++ b/plugins/codex-orchestration/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Number531 + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/plugins/codex-orchestration/README.md b/plugins/codex-orchestration/README.md index d941359..53421a6 100644 --- a/plugins/codex-orchestration/README.md +++ b/plugins/codex-orchestration/README.md @@ -1,6 +1,6 @@ # Codex-Orchestration -**Version 0.2.1 · Plugin ID `codex-orchestration` · Guard off by default** +**Version 0.2.2 · Plugin ID `codex-orchestration` · MIT licensed · Guard off by default** A small Codex plugin for delegating dynamic tasks through named, model-pinned specialists. It provides three skills, six agent profiles, project guidance, a preview-first installer, and an optional synchronous spawn guard. @@ -25,7 +25,7 @@ codex plugin list --available --json --marketplace codex-orchestration codex plugin add codex-orchestration@codex-orchestration ``` -No repository invitation is required for HTTPS access. Use the SSH equivalent if that is how you authenticate. Plugin installation makes the skills available; project setup is a separate step. Review the repository's [licensing status](../../README.md#licensing-status) before adoption. +No repository invitation is required for HTTPS access. Use the SSH equivalent if that is how you authenticate. Plugin installation makes the skills available; project setup is a separate step. The package includes its [MIT License](LICENSE). ## Set up one project @@ -113,4 +113,4 @@ These skills do not authorize spending, remote writes, merges, or policy changes - [Validation and compatibility](docs/validation.md): reproducible checks, evidence and unverified surfaces. - [Changelog](CHANGELOG.md), [contribution guidance](../../CONTRIBUTING.md), and [security policy](../../SECURITY.md). -The repository is public, but a distribution license has not yet been adopted. See [licensing status](../../README.md#licensing-status) for the current position. +The package is available under the [MIT License](LICENSE), including commercial and enterprise use. Preserve its copyright and permission notices when redistributing copies or substantial portions, including setup-generated project assets. Setup does not change your project's own license; include this notice with any redistributed package assets. diff --git a/plugins/codex-orchestration/docs/validation.md b/plugins/codex-orchestration/docs/validation.md index bf2676b..194566f 100644 --- a/plugins/codex-orchestration/docs/validation.md +++ b/plugins/codex-orchestration/docs/validation.md @@ -6,10 +6,11 @@ | Surface | Evidence | Limit | |---|---|---| -| Setup, guard, profiles, package and documentation contracts | 54 deterministic unit tests passed for the `0.2.1` candidate, including legacy migration refusal, installer lock exclusion and documentation-check regressions. | Synthetic projects do not establish live account access or UI behavior. | +| Setup, guard, profiles, package and documentation contracts | 54 deterministic unit tests passed for the `0.2.2` candidate, including MIT metadata/license-copy consistency, legacy migration refusal, installer lock exclusion and documentation-check regressions. | Synthetic projects do not establish live account access or UI behavior. | | Native spawn behavior | 17 cases passed on CLI `0.154.0` and Desktop engine `0.154.0-alpha.6.2` on macOS, recorded 2026-09-12. | The harness supplies reviewed configuration/trust overrides and a loopback scripted provider. | | Local-catalog installation and setup | CLI `0.154.0` and Desktop engine `0.154.0-alpha.6.2` installed the `0.2.1` candidate on macOS, recorded 2026-09-12. | This is a local-catalog trial; it does not establish GitHub authentication or Desktop UI behavior. | | Pinned GitHub-commit installation | Both engines installed commit `1ea514efdacb8aa1077e4eb81a8f7d90d1255306` through the GitHub catalog on 2026-09-13. | Used the maintainer's existing Git authentication while the repository was private; no separate community-account trial. | +| MIT package installation | Both engines installed `0.2.2` from a local catalog on 2026-09-13. The cache included the MIT notice and metadata; all 31 package files matched the trial checkout, setup was repeatable, and the guard stayed off. | Disposable configuration/cache and projects only; no trust grant, Desktop UI test or live-model call. | | Desktop UI install/trust and live models | Not established by those tests. | Requires a separately authorized onboarding trial. | | Windows, other clients or versions | Not qualified by the original native matrix. | The installer uses POSIX `fcntl`; the hook command assumes a compatible shell. | @@ -19,6 +20,8 @@ The `0.2.1` trial used a separate temporary Codex configuration/cache and Git pr The subsequent pinned GitHub-commit trial repeated those checks successfully on both engines against the exact commit above. Later public-state documentation edits did not change runtime assets. After the visibility change, unauthenticated HTTP requests separately confirmed public repository and Issues access. That access check did not invoke Codex or establish model availability. +The `0.2.2` licensing update preserves those runtime assets and adds the package's MIT notice. The separate local-catalog trial confirmed that the licensed package reached each cache and that real global configuration hashes were unchanged. Versioned-package installation and project-asset installation remain separate; see [operations](operations.md#upgrade-a-project). + The production Desktop app was not launched for the trial. A safe, documented separate UI profile was not established for that build; qualifying its graphical installation and normal trust flow requires a disposable OS user/VM or a supported isolated app environment. ## Local checks diff --git a/plugins/codex-orchestration/plugin.json b/plugins/codex-orchestration/plugin.json index a9c7561..8c25c55 100644 --- a/plugins/codex-orchestration/plugin.json +++ b/plugins/codex-orchestration/plugin.json @@ -1,7 +1,8 @@ { "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json", "name": "codex-orchestration", - "version": "0.2.1", + "version": "0.2.2", + "license": "MIT", "description": "Team delegation, focused delivery and explicit Codex project setup with an optional model guard.", "author": { "name": "Codex-Orchestration contributors" diff --git a/plugins/codex-orchestration/test/test_package.py b/plugins/codex-orchestration/test/test_package.py index 9e100fa..5620a33 100644 --- a/plugins/codex-orchestration/test/test_package.py +++ b/plugins/codex-orchestration/test/test_package.py @@ -27,8 +27,10 @@ def test_portable_manifest_and_compatibility_agree(self): self.assertEqual(manifest['name'], PACKAGE.name) self.assertFalse(set(manifest['author']) - {'name','email','url'}) compat = json.loads((PACKAGE / '.codex-plugin/plugin.json').read_text()) - for key in ['name','version','author','description']: + for key in ['name','version','author','description','license']: self.assertEqual(manifest[key], compat[key]) + self.assertEqual(manifest['license'], 'MIT') + self.assertEqual((PACKAGE / 'LICENSE').read_bytes(), (PACKAGE.parents[1] / 'LICENSE').read_bytes()) self.assertEqual(manifest['extensions']['com.openai']['interface'], compat['interface']) self.assertEqual(compat['interface']['displayName'], 'Codex-Orchestration') self.assertFalse((PACKAGE / 'hooks').exists(), 'No implicit plugin-hook loading contract') @@ -83,7 +85,7 @@ def test_catalog_checker_accepts_valid_and_rejects_broken_integration(self): root = Path(scratch) shutil.copytree(PACKAGE, root/'plugins/codex-orchestration', ignore=shutil.ignore_patterns('__pycache__')) file = root/'.agents/plugins/marketplace.json'; file.parent.mkdir(parents=True) - catalog = {'name':'codex-orchestration', 'plugins':[{'name':'codex-orchestration','source':{'source':'local','path':'./plugins/codex-orchestration'},'policy':{'installation':'AVAILABLE','authentication':'ON_INSTALL'},'category':'Productivity','version':'0.2.1'}]} + catalog = {'name':'codex-orchestration', 'plugins':[{'name':'codex-orchestration','source':{'source':'local','path':'./plugins/codex-orchestration'},'policy':{'installation':'AVAILABLE','authentication':'ON_INSTALL'},'category':'Productivity','version':'0.2.2'}]} file.write_text(json.dumps(catalog)); catalog_check.check(root) catalog['plugins'][0]['source']['path']='./missing' file.write_text(json.dumps(catalog)) @@ -92,7 +94,7 @@ def test_catalog_checker_accepts_valid_and_rejects_broken_integration(self): catalog['plugins'][0]['version']='9.9.9' file.write_text(json.dumps(catalog)) with self.assertRaises(AssertionError): catalog_check.check(root) - catalog['plugins'][0]['version']='0.2.1' + catalog['plugins'][0]['version']='0.2.2' catalog['plugins'].append(catalog['plugins'][0]) file.write_text(json.dumps(catalog)) with self.assertRaises(AssertionError): catalog_check.check(root)