Release hardened Co-Engineer and Cursor control planes

.agents/plugins/marketplace.json

@@ -0,0 +1,32 @@
+{
+  "name": "codex-co-engineer",
+  "interface": {
+    "displayName": "Codex-Co-Engineer"
+  },
+  "plugins": [
+    {
+      "name": "plumbob-harness-control",
+      "source": {
+        "source": "local",
+        "path": "./plugins/plumbob-harness-control"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Developer Tools"
+    },
+    {
+      "name": "cursor-cloud-control",
+      "source": {
+        "source": "local",
+        "path": "./plugins/cursor-cloud-control"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Developer Tools"
+    }
+  ]
+}

.gitignore

@@ -6,6 +6,9 @@ docs/research/
 .codex/*
 !.codex/release-gate.toml
 .agents/
+!.agents/
+!.agents/plugins/
+!.agents/plugins/marketplace.json
 .serena/
 .claude/
 .cursor/

CHANGELOG.md

@@ -2,26 +2,38 @@
 
 All notable public changes to Codex-Co-Engineer are recorded here.
 
-## [1.0.0] - 2026-08-16
+## [Unreleased]
+
+No unreleased changes.
+
+## [2.2.0] - 2026-08-19
 
 ### Added
 
-- Public Codex-Co-Engineer release surface centered on DeepSeek Harness.
-- Stable `plumbob-harness-control` compatibility identifier retained.
-- Target, configuration-digest, fingerprint, MCP Inspector, lifecycle, and
-  data-handling release contracts.
-- Public configuration and preflight examples without credentials or personal
-  filesystem paths.
-- Release inventory validation and GitHub CI guidance.
+- Control-plane target binding can resolve and attest the selected local or
+  staged target while preserving the strict path, Git identity, and postflight
+  contract.
+- Terminal Co-Engineer jobs expose a bounded final response alongside their
+  lifecycle receipt, so callers do not need to parse the complete provider log
+  to retrieve the result.
+- Cursor Cloud Control `0.4.0` adds explicit reconciliation for uncertain
+  creates and keeps provider-assigned IDs distinct from local reservations.
+- Cursor Local Control is exposed as wire identity `0.2.0` with an explicit
+  administrator opt-in for host-trusted direct-CLI runs; status remains the
+  default catalog surface and Cloud/local state stays separate.
 
 ### Changed
 
-- User-facing plugin branding is now Codex-Co-Engineer.
-- Package metadata is public and versioned `1.0.0`.
-- Personal Prime Lab, generated runtime, state, and credential paths are
-  explicitly outside the public release boundary.
+- Co-Engineer runtime and final-response handling now fail closed when target
+  binding or durable completion cannot be confirmed.
+- Cursor Cloud reconciliation retries only bounded provider-absence checks and
+  never resubmits an uncertain mutation; definitive conflicts and rate limits
+  remain failed provider responses.
+- Release validation, activation fixtures, Inspector examples, and package
+  inventories identify the current Co-Engineer `2.2.0` and Cursor `0.4.0`
+  surfaces without changing the independently pinned ACPX runtime.
 
-## [Unreleased]
+## [2.1.2] - 2026-08-18
 
 ### Added
 
@@ -38,14 +50,12 @@ All notable public changes to Codex-Co-Engineer are recorded here.
   deliberate ACP, worktree, prompt-file, and system-prompt-override omissions.
 - Cursor Cloud Control plugin with typed Cursor Cloud Agents API v1 lifecycle,
   bounded SSE/polling, usage, artifact, and archive/delete operations.
-- Packaged (but not production-exposed) Cursor Local Control foundation for the
-  locally installed Cursor Agent CLI, with separate owner-only state and
-  receipts, explicit read-only and isolated-worktree policies, bounded NDJSON
-  logs, and owned cancellation for later host acceptance. Only local
-  status/auth/permissions diagnostics are ready for use; run dispatch remains
-  fail-closed and unwired pending real Cursor plus Bubblewrap acceptance. The
-  adapter never accepts Cloud IDs or shares Cloud credentials, state, or
-  receipts.
+- Cursor Local Control with an administrator-activated,
+  `execution_profile: "host_trusted"` direct Cursor CLI surface. The public
+  default remains status/auth/permissions only; host-trusted reads use Ask
+  mode, explicit implement calls use `--force` and an isolated worktree, and
+  receipts identify process-user authority with no outer sandbox claim. Local
+  state, credentials, IDs, and receipts remain separate from Cursor Cloud.
 - Owner-only credential handling, durable mutation ledger, redacted receipts,
   and artifact path/overwrite protections.
 - Cursor MCP preflight, plugin validation, unit coverage, and package inventory
@@ -82,13 +92,14 @@ All notable public changes to Codex-Co-Engineer are recorded here.
   Grok's kind-specific HOME guard. It uses Grok's noninteractive `auto`
   permission mode for implement jobs and fails closed when an implement run
   exits without an allowed workspace change.
-- Cursor Cloud Control `0.3.0` packages the distinct local Cursor CLI
-  foundation but keeps it unwired and not exposed in the production catalog;
-  only status/auth/permissions diagnostics are ready pending real Cursor plus
-  Bubblewrap host acceptance. Its cloud half gives repository discovery and
-  repository-backed creation one bounded 60-second attempt, never retries the strictly
-  rate-limited inventory endpoint, and degrades discovery timeouts into an
-  explicit unavailable result.
+- Cursor Cloud Control `0.3.0` packages the distinct local Cursor CLI surface;
+  its public default catalog remains status/auth/permissions only, while an
+  administrator may explicitly activate the host-trusted direct-CLI profile.
+  The retained Bubblewrap foundation remains separate and unwired, and each
+  host-trusted installation still requires real Cursor process acceptance.
+  Its cloud half gives repository discovery and repository-backed creation one
+  bounded 60-second attempt, never retries the strictly rate-limited inventory
+  endpoint, and degrades discovery timeouts into an explicit unavailable result.
 - DeepSeek Harness is invoked directly in the attested target checkout and is
   validated independently through its own CLI version.
 - DeepSeek headless and web jobs use a managed absolute DSH profile/state root,
@@ -101,19 +112,39 @@ All notable public changes to Codex-Co-Engineer are recorded here.
   are explicit, selector-aware, compactly cached, and stale-on-refresh-failure.
 - Grok ACP is limited to read-only capacity telemetry; coding dispatch remains
   on the direct headless CLI interface.
-- Configured provider credentials are standing authorization for task-scoped
-  calls; no per-job egress prompt is added. Grok and DSH harness-internal
-  subagents can be requested, while receipts keep actual effectiveness
-  `unknown` unless provider evidence proves delegation occurred.
+- Configured provider credentials or sessions are reused as standing
+  authorization for task-scoped calls; normal provider expiry or revocation
+  can still require reauthentication, and no per-job egress prompt is added.
+  Grok and DSH harness-internal subagents can be requested, while receipts keep
+  actual effectiveness `unknown` unless provider evidence proves delegation
+  occurred.
 - Cursor model discovery is dynamic, custom subagents remain typed and
   bounded, identity responses omit personal fields, and write-mode repository
   dispatch requires an immutable starting commit.
 
 ### Removed
 
-- All Prime Intellect integrations, including Prime Agent, Prime Eval, Prime
-  CLI compatibility probes, lab diagnostics, environment variables, schemas,
-  runner parsing, tests, and runtime patch generation.
+- Legacy provider integrations and compatibility surfaces that are not part of
+  the public control-plane release, including their private runtime hooks.
+
+## [1.0.0] - 2026-08-16
+
+### Added
+
+- Public Codex-Co-Engineer release surface centered on DeepSeek Harness.
+- Stable `plumbob-harness-control` compatibility identifier retained.
+- Target, configuration-digest, fingerprint, MCP Inspector, lifecycle, and
+  data-handling release contracts.
+- Public configuration and preflight examples without credentials or personal
+  filesystem paths.
+- Release inventory validation and GitHub CI guidance.
+
+### Changed
+
+- User-facing plugin branding is now Codex-Co-Engineer.
+- Package metadata is public and versioned `1.0.0`.
+- Generated runtime, state, and credential paths remain outside the public
+  release boundary.
 
 Future changes should document protocol, target-contract, lifecycle, and
 compatibility effects before implementation details.

CONTRIBUTING.md

@@ -6,10 +6,9 @@ focused on the Codex control plane and the DeepSeek Harness integration.
 ## Before opening a pull request
 
 ```bash
-node --version                 # Node 24 or newer
-cd plugins/plumbob-harness-control
-npm test
-cd ../..
+node --version                                      # Node 24.x for the local gate
+npm --prefix plugins/plumbob-harness-control test
+npm --prefix plugins/cursor-cloud-control test
 node scripts/validate-release.mjs
 git diff --check
 ```
@@ -19,14 +18,34 @@ processes, temporary Git repositories, and redacted test data. A change that
 requires an external model should document the manual, opt-in verification
 separately.
 
+The GitHub Actions workflow runs both plugin suites and the portable fixture,
+Inspector, reproducible-build, provenance, and package-inventory checks. It is
+a diagnostic mirror, not release authority: GitHub CI does not install the
+`release-gate` CLI or prove this host's attested Bubblewrap/cgroup boundary.
+
+The authoritative gate is `local-exact-tree`. Run it from a dedicated clean
+worktree containing exactly the candidate files on Linux with Node major 24,
+the pinned MCP Inspector `2.2.0`, executable Bubblewrap, and static BusyBox:
+
+```bash
+release-gate plan --repo "$PWD"
+release-gate run --repo "$PWD"
+```
+
+Review the resulting receipt and package inventories. A green GitHub check
+cannot replace that local receipt. The gate is provider-free except for its
+bounded ACPX provenance/signature metadata checks; never add provider
+credentials to CI.
+
 ## Code and contract expectations
 
 - Preserve `plumbob-harness-control` as the stable MCP compatibility ID.
 - Validate configuration before resolving a target or starting a process.
 - Require exactly one target for every dispatch; never infer it from prompt
   prose or silently fall back after an explicit-target error.
 - Canonicalize target/configuration input before hashing and compare the
-  caller-supplied fingerprint.
+  caller-supplied fingerprint, unless the caller explicitly opts into the
+  control-plane binding path.
 - Keep absolute deadlines independent from progress heartbeats.
 - Emit one terminal state and distinguish client, transport, protocol,
   process-startup, tool, timeout, and cancellation failures.