release: publish Socket 9.32.0

AGENTS.md

@@ -29,6 +29,7 @@ Use this file for durable repo-local guidance that Codex should follow before ch
 - Work directly on local `main` only when Gale explicitly asks for a direct-main workflow, when the task is a read-only investigation, or when a repo-owned release helper explicitly owns the direct-main release operation.
 - Before editing from a detached Codex GUI checkout, create or switch to a named branch in that worktree so the branch/worktree owner is explicit.
 - When a commit is made in `socket`, push the current branch as the normal checkpoint unless Gale asks for local-only work or the branch is intentionally incomplete. Pushing the branch does not imply opening a PR, waiting on CI, tagging, or releasing.
+- On Gale-managed machines, expect `fetch.prune=true`, `pull.ff=only`, and `branch.autoSetupRebase=always` as global Git defaults. Inspect effective configuration before depending on them, surface any repository-specific override, and never install these machine preferences as repository-local configuration from a template, bootstrap, or sync workflow.
 - When an agent reaches a remote CI, review, release, deployment, or provider gate that will not resolve in the current command, it must schedule a host-native continuation at least five minutes later instead of holding a shell open or polling. Before creating one, find a live continuation for the same gate and reuse that same scheduler item while the gate remains pending and healthy; do not delete and recreate it after each unchanged snapshot. Pause or delete it only when the gate clears, fails, is cancelled, or its identity changes. Use a same-thread heartbeat in Codex desktop/ChatGPT when available; in Hermes, create or update the same self-contained `cronjob` delivered to the origin with `attach_to_session=true` after confirming its scheduler is active. A single sub-minute re-read is allowed only as a bounded part of the mutation that caused it, never as repeated polling. Use `maintain-project-repo` for the detailed release continuation contract.
 - Prefer small, focused commits over broad mixed changes.
 - For ordinary fixes in monorepo-owned child directories, edit the relevant copy under `plugins/` directly in `socket`.

README.md

@@ -176,7 +176,7 @@ Current Socket catalog shape:
 - `network-protocol-skills`: modern networking and application-protocol workflows for transport selection, HTTP/3 and QUIC planning, Media over QUIC draft-aware guidance, WebRTC signaling/media/data-channel work, and protocol diagnostics with stack-plugin handoffs
 - `professional-skills`: career and professional workflow guidance, starting with Dice job search and its bundled read-only remote MCP configuration
 - `python-skills`: Python runtime and tooling workflows, including local-first agent services, FastAPI and FastMCP service maintenance, and pytest-based testing; see the [Python skills expansion plan](./docs/maintainers/python-skills-plugin-plan.md) for maintainer details
-- `repository-skills`: GitHub repository maintenance, release operations, and Codex GUI worktree workflow guidance
+- `repository-skills`: routed Git and GitHub collaboration, repository settings, protected-main release, and Codex GUI worktree workflow guidance; its portable Git, GitHub, settings, release, and coordination workflows are available from the Hermes skill tap
 - `reverse-engineering-skills`: artifact triage, preservation, exact-build comparison, decompiler review, Apple Mach-O/runtime/signing/Apple Silicon/dyld/dynamic/kernel research, Cutter/Rizin, Malimite, Ghidra, Hopper, .NET, Unity and IL2CPP, and reproducible security evidence workflows
 - `server-side-jvm`: server-side JVM, Java, Scala, Google ADK agent-service, Gradle, Maven, SBT, and testing workflow guidance, with future Clojure support planned
 - `server-side-swift`: server-side Swift bootstrap and guidance sync, Vapor, Leaf-rendered websites and HTML email, Hummingbird, persistence, OpenAPI/RPC, SwiftNIO, observability, auth, app sync, Docker, Apple `container` 1.x, persistent `container machine` environments, exact-version Containerization APIs, and Fly.io support plus the source-bundled `server-swift-steward` custom-agent definition

ROADMAP.md

@@ -1118,6 +1118,10 @@ Planned
 - [x] Audit and update the default and recommended GitHub repository settings in relevant repo-maintenance, skill-repo, and Apple bootstrap/sync workflows.
 - [x] Add `repository-skills:maintain-github-repository` as the dedicated owner for GitHub repository settings audits and requested alignment, while keeping release and publish choreography in `maintain-project-repo`.
 - [x] GitHub #81: Strengthen `maintain-project-repo` release, publish, tag, protected-main, cleanup, and branch-accounting triggers while routing settings-only requests to `maintain-github-repository` ([#81](https://github.com/gaelic-ghost/socket/issues/81)).
+- [x] Add the `xcode-workspace` `maintain-project-repo` profile for modular Apple roots with workspace-shape validation and serial component-maintenance dispatch.
+- [x] Add the `repository-operations-workflow` router plus focused Git and GitHub collaboration workflows, and export their portable guidance with the host-neutral coordination contracts to Hermes.
+- [x] Record Gale's expected machine-level Git defaults in the portable Git workflow: prune stale fetch refs, refuse pull-created merge commits, and configure new tracking branches to rebase; inspect overrides and never write these defaults as repository-local template configuration.
+- [ ] Design a read-first native Hermes `git-steward` only after repeated use proves that a registered runtime role, slash command, or dedicated tool surface is needed. Keep pushes, merges, tags, deletion, settings changes, and publication explicitly authority-gated.
 - [x] Migrated the remaining root `TODO.md` backlog into canonical `ROADMAP.md` milestones, Small Tickets, or Backlog Candidates, then removed `TODO.md` in a reviewed documentation pass.
 - [ ] Investigate `uv audit` as a Socket validation and release-evidence input. Decide whether the first adoption belongs in root validation, Python-backed child plugin validation, release evidence capture, or reusable Python project-maintenance guidance, and test the `--locked`, `--frozen`, JSON output, ignore, and OSV service options before making it a required gate.
 - [ ] Explore an `ErrorHandles` Swift helper package for consistent, concise error construction, diagnostic context, typed wrapping, and recovery helpers. Use [`docs/maintainers/errorhandles-package-plan.md`](./docs/maintainers/errorhandles-package-plan.md) to keep the Swift package source outside Socket while keeping skills and adoption guidance in `plugins/swift-lang`.

docs/maintainers/hermes-compatibility.md

@@ -75,6 +75,14 @@ Socket tap. The curated set is:
 - `fastapi-service-workflow`
 - `fastmcp-service-workflow`
 - `python-testing-workflow`
+- `coordinate-external-agents`
+- `coordinate-worktrees-and-threads`
+- `orchestrate-agent-work`
+- `repository-operations-workflow`
+- `git-workflow`
+- `github-collaboration-workflow`
+- `maintain-github-repository`
+- `maintain-project-repo`
 
 ```bash
 hermes skills tap add gaelic-ghost/socket
@@ -150,6 +158,21 @@ agent services, FastAPI services, FastMCP services, and tests while relying on
 operator-installed Python tooling and project dependencies. They package no
 MCP server, credentials, hook, app, or native Hermes runtime surface.
 
+The exported repository workflows are portable guidance. They use the
+operator's `git` and, for GitHub work, authenticated `gh` CLI. They distinguish
+read-only inspection from pushing, merging, tagging, deletion, settings
+changes, publishing, and release actions; those mutations still need explicit
+authority or a repository-owned release contract. The host-neutral coordinator
+workflows accompany them so a Hermes agent can record worktree, branch, write,
+validation, and handoff ownership. `codex-gui-worktree-workflow` remains
+Codex-specific because its thread association and managed-worktree state have
+no Hermes equivalent.
+
+A named autonomous `git-steward` remains a future native Hermes-plugin
+decision. The current tap provides reusable workflow instructions, not a
+registered runtime role, slash command, credential store, or additional GitHub
+authority.
+
 The exported macOS platform-security workflows are portable instruction contracts. Public app permission, sandbox file-access, and entitlement diagnosis remain in Apple Dev Skills; exact-build private-control research remains in Reverse Engineering Skills; defensive host investigation remains in Cybersecurity Skills. Hermes does not receive a TCC database tool, permission grant service, privileged helper, protection bypass, or native runtime plugin from this work.
 
 ## Maintainer Workflow

plugins/agent-engineering-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-engineering-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Agent-system design, orchestration, scheduling, external-agent, and evaluation workflow skills.",
   "author": {
     "name": "Gale",

plugins/agent-engineering-skills/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agent-engineering-skills-maintenance"
-version = "9.31.2"
+version = "9.32.0"
 description = "Maintainer-only Python tooling baseline for agent-engineering-skills."
 requires-python = ">=3.11"
 dependencies = []

plugins/agent-engineering-skills/skills/coordinate-worktrees-and-threads/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: coordinate-worktrees-and-threads
-description: Assign worktree, branch, thread, artifact, write, validation, integration, and cleanup ownership before parallel repository work. Use when launching or resuming a worker that will inspect or modify repository state outside the coordinator's single worktree.
+description: Assign worktree, branch, write, validation, integration, and cleanup ownership before parallel repository work. Use when a worker will inspect or modify repository state outside the coordinator's worktree.
 ---
 
 # Coordinate Worktrees And Threads
@@ -18,6 +18,10 @@ cleanup decision.
 ## Rules
 
 - Give parallel writers disjoint files or directories and separate worktrees.
+- When a Codex-managed worktree versus a plain Git worktree is itself a
+  decision, hand that host-specific choice to
+  `repository-skills:codex-gui-worktree-workflow`; retain this skill's
+  host-neutral ownership record in either case.
 - Serialize Git operations that change shared repository state. A worker must
   not assume it owns tags, merges, release branches, deletion, or cleanup.
 - Serialize heavy build and test lanes unless the environment explicitly proves

plugins/agent-engineering-skills/skills/orchestrate-agent-work/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: orchestrate-agent-work
-description: Coordinate bounded work across in-run subagents or worker tasks. Use before spawning, resuming, steering, cancelling, or closing workers when the coordinator needs a structured launch envelope, required report-back, escalation, and synthesis contract.
+description: Coordinate bounded worker tasks with a launch envelope, report-back, escalation, and synthesis contract. Use before spawning, resuming, steering, cancelling, or closing subagents.
 ---
 
 # Orchestrate Agent Work
@@ -46,3 +46,7 @@ authority, ownership, evidence, or acceptance criteria change.
 - Use `coordinate-external-agents` when work crosses a host, session, or
   durable ownership boundary.
 - Use `coordinate-worktrees-and-threads` when workers need repository state.
+  When the selected host is Codex and the worktree mode, local environment, or
+  app-owned thread association needs a decision, compose it with
+  `repository-skills:codex-gui-worktree-workflow`. On Hermes or another host,
+  keep the ownership contract host-neutral and use ordinary Git worktrees.

plugins/agent-portability-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-portability-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Skills for agent portability, ACP, A2A, Zed, Hermes, Codex plugin surfaces, and host adapter guidance.",
   "author": {
     "name": "Gale",

plugins/agent-portability-skills/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agent-portability-skills-maintenance"
-version = "9.31.2"
+version = "9.32.0"
 description = "Maintainer-only Python tooling baseline for Agent Portability Skills."
 requires-python = ">=3.11"
 dependencies = []

plugins/agentdeck/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentdeck",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Local Codex runtime utilities for thread, hook, and app-server workflows.",
   "author": {
     "name": "Gale",

plugins/android-dev-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "android-dev-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Android, Kotlin, Java, Gradle, Android Gradle Plugin, testing, lint, UI implementation, and release-readiness workflow skills.",
   "author": {
     "name": "Gale",

plugins/apple-creator-studio-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-creator-studio-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Human-facing and Computer Use-aware Apple Creator Studio workflows for Final Cut Pro editing, Motion templates, Compressor delivery, Logic Pro production, MainStage concert preparation, and GarageBand projects.",
   "author": {
     "name": "Gale",

plugins/apple-dev-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-dev-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Apple development workflows for Codex, including macOS privacy permissions, sandbox file access, entitlement diagnosis, virtualization, SwiftPM, Xcode, app extensions, media, provisioning, SwiftUI, AppKit, Safari, security, OpenAPI, and DocC.",
   "author": {
     "name": "Gale",

plugins/apple-dev-skills/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "apple-dev-skills-maintainer"
-version = "9.31.2"
+version = "9.32.0"
 description = "Maintainer tooling for the apple-dev-skills repository"
 requires-python = ">=3.10"
 dependencies = []

plugins/apple-dev-skills/skills/sync-xcode-workspace-guidance/SKILL.md

@@ -30,7 +30,12 @@ guidance section when needed.
 6. Route app-specific guidance to `sync-xcode-project-guidance`, package-specific
    guidance to `sync-swift-package-guidance`, and active execution to
    `xcode-build-run-workflow` or `xcode-testing-workflow`.
-7. Keep optional services under `Services/` as their own deployment and runtime
+7. When the workspace root needs shared validation, release, or GitHub Actions
+   maintenance, compose it with `repository-skills:maintain-project-repo` using
+   the `xcode-workspace` profile. Its root dispatcher validates workspace shape
+   and runs any component-owned maintenance entrypoints serially; it does not
+   replace app, package, or service-local build policy.
+8. Keep optional services under `Services/` as their own deployment and runtime
    boundary. Use the selected server skill for service-local policy.
 
 ## Audit Contract

plugins/apple-dev-skills/skills/sync-xcode-workspace-guidance/assets/append-section.md

@@ -15,3 +15,8 @@
 - Use `sync-xcode-project-guidance` for an app project,
   `sync-swift-package-guidance` for a package, and
   `xcode-build-run-workflow` or `xcode-testing-workflow` for active Xcode work.
+- Use `repository-skills:maintain-project-repo` with the `xcode-workspace`
+  profile when the workspace root needs shared validation, release, or GitHub
+  Actions maintenance. It validates the root composition and serially delegates
+  to component-owned maintenance entrypoints; it does not replace app, package,
+  or service-local build policy.

plugins/cardhop-app/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cardhop-app",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Cardhop.app workflow guidance plus a bundled local MCP server for contact capture and updates on macOS.",
   "author": {
     "name": "Gale",

plugins/cardhop-app/mcp/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cardhop-app-mcp"
-version = "9.31.2"
+version = "9.32.0"
 requires-python = ">=3.13"
 dependencies = [
     "fastmcp>=3.0.2",

plugins/cloud-deployment-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cloud-deployment-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Codex skills for routing cloud deployment work through official provider plugins, MCP servers, CLIs, and a reusable Dockerized-service release and deployment contract.",
   "author": {
     "name": "Gale",

plugins/cloud-inference-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cloud-inference-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Cloud AI inference workflow skills for routing model serving, training, conversion, and GPU infrastructure work across Runpod, Hugging Face, AWS, Vast.ai, CoreWeave, and similar providers.",
   "author": {
     "name": "Gale",

plugins/codebase-understanding-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codebase-understanding-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Code-path exploration, call-site tracing, and evidence-based codebase explanation skills.",
   "author": {
     "name": "Gale",

plugins/cybersecurity-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cybersecurity-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Defensive cybersecurity, isolated Linux and macOS analysis labs, suspicious-content and malware analysis, macOS defense, vulnerability testing, pentesting, and incident response workflows.",
   "skills": "./skills/",
   "author": {

plugins/documentation-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "documentation-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Documentation maintenance skills for README, contributor, agent, API, accessibility, architecture, and roadmap surfaces.",
   "author": {
     "name": "Gale",

plugins/documentation-skills/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "documentation-skills-maintenance"
-version = "9.31.2"
+version = "9.32.0"
 description = "Maintainer-only Python tooling baseline for documentation-skills."
 requires-python = ">=3.11"
 dependencies = []

plugins/dotnet-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dotnet-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Codex skills for choosing, bootstrapping, building, testing, packaging, diagnosing, and maintaining .NET projects, including F# web applications, with F# and C# as equal first-party languages.",
   "author": {
     "name": "Gale",

plugins/game-dev-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "game-dev-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Apple platform game development workflow skills for native Metal rendering, Game Porting Toolkit routing, MetalFX, GPU asset streaming, neural rendering, frameworks, input, haptics, and profiling.",
   "author": {
     "name": "Gale",

plugins/messaging-collaboration-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "messaging-collaboration-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Codex workflows for chat apps, bots, collaboration, iMessage, Apple notifications and Push to Talk, VoIP, and default communication-app planning.",
   "author": {
     "name": "Gale",

plugins/model-lab-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "model-lab-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Reproducible model training, evaluation, intervention, and runtime research workflows.",
   "author": {
     "name": "Gale"

plugins/network-protocol-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "network-protocol-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Codex skills for choosing, planning, implementing, and diagnosing modern application transports and real-time networking protocols, including QUIC, HTTP/3, WebRTC, Media over QUIC, WebTransport-adjacent handoffs, protocol maturity checks, and stack-specific implementation routing.",
   "author": {
     "name": "Gale",

plugins/professional-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "professional-skills",
-  "version": "9.31.2",
+  "version": "9.32.0",
   "description": "Professional workflow skills for job search, career materials, and external professional services.",
   "author": {
     "name": "Gale",

plugins/professional-skills/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "professional-skills-maintenance"
-version = "9.31.2"
+version = "9.32.0"
 description = "Maintainer-only Python tooling baseline for professional-skills."
 requires-python = ">=3.11"
 dependencies = []