Repository navigation
0.7.0 invalidated the three published plugin distributions; they need republishing #79
Description
What
The five-axis migration in #73 changed the compiled guard runtime. The three distribution repositories were published by framework v0.6.0 and have not been republished, so each one's Generated-only check now fails against chock's current main:
| Repository | Last published as | Generated-only |
|---|---|---|
| chock-claude-plugins | generated: catalog 3e01994… (framework v0.6.0) |
red |
| chock-cursor-plugins | v0.6.0-era | red |
| chock-codex-plugins | v0.6.0-era | red |
Those workflows check out open-coder-ai/chock at current main and regenerate, so the failure appeared the moment 0.7.0 merged — no push to the distribution repos was involved. Run #21 of Generated-only on chock-claude-plugins' main was green on 2026-08-29 under 0.6.0; the same run today fails on the guard runtime diff (the Cursor permission: deny JSON and Codex exit-code block).
Why this is worth fixing promptly rather than at the next publish
Generated-only is not a lint — its own workflow comment calls it "the security argument": it proves that what a user installs is exactly what the catalog published. While it is red:
- that proof is unavailable for all three published distributions, which is the strongest claim those repos make;
- a genuine tampering diff would be indistinguishable from this standing failure;
- the shipped plugins still carry the 0.6.0 runtime, so adopters installing today get the pre-migration behaviour while the catalog and framework have moved on.
What done looks like
- Run
publish.ymlon each of the three repositories against chock 0.7.0. - Confirm
Generated-onlygoes green onmainin all three. - Diff the regenerated runtime deliberately rather than rubber-stamping it: the migration re-graded 16 coverage cells, so if any plugin's stated enforcement tier moved, that belongs in the publish notes.
Related: chock-catalog#45 is the same 0.6→0.7 staleness in the catalog's own compiled artifacts. Both come from the same migration; neither is a defect in it.
Found while adding badges to the three distribution READMEs (chock-claude-plugins#2, chock-cursor-plugins#1, chock-codex-plugins#1) — those PRs touch only README.md, which is deliberately exempt from generation, and are blocked behind this.
Activity