feat: make the gate usable — request builder and Claude Code plugin packaging - #6
Merged
Conversation
Creating a v2 request by hand meant writing four correlated sha256 values, so the gate was correct but unusable. tools/devops_plan.py computes the canonical command digest, the registered policy digest, and the validated target-profile digest, derives the minimum risk class the policy implies and refuses to understate it, requires acceptance criteria at R2 and above, and prints every remaining human obligation. Planning grants no authority: approval slots, required change locks, and required recovery evidence are emitted structurally incomplete, so the gate refuses a generated request until a real approver fills it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
.claude-plugin/plugin.json exposes the repository root as the skills container and .claude-plugin/marketplace.json publishes it, so install becomes '/plugin marketplace add Manacost-Labs/devops-skill' instead of a clone and a profile decision. The plugin ships skills only: the PreToolUse gate denies mutating commands session-wide, which must stay an explicit operator choice, so it is documented rather than enabled. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two adoption blockers, both outside ROADMAP-10.
1.
tools/devops_plan.py— the gate was correct but unusable. Producing a v2 operation request by hand meant writing four correlated sha256 values (policy, target profile, plan digest of the exact argv, duplicated into every approval). The builder computes all of them, derives the minimum risk class the policy implies and refuses to understate it, enforces acceptance criteria at R2+, and prints the remaining human obligations (approval count, separation of duties, change lock, recovery evidence).Crucially it never manufactures authorization: approval slots, required locks, and required recovery fields are emitted structurally incomplete, so the gate refuses a freshly generated request until a real approver fills it.
test_generated_request_is_not_authorized_until_a_human_fills_approvalspins that property;test_planned_request_executes_after_approvalproves the full plan → approve → execute path works.2.
.claude-plugin/— installation is now one command.The plugin declares the repository root as its skills container (
"skills": "."), so all 22 modules load without relayout. It ships skills only: the PreToolUse gate denies mutating shell commands session-wide, which would be a hostile surprise for someone who installed the plugin for the skills, so enforcement stays opt-in viadocs/hooks-setup.md. A test assertsplugin.jsondeclares no hooks, so that decision cannot regress silently.Both files were written against the current published plugin and marketplace schemas;
devops_plan.pyis registered as a read-only script with the command gate and added to the release, public-source, and verifier allowlists.Testing
python devops-platform-contracts/scripts/validate_platform.py→ OK, 22/22 compatible installed skillspython -m unittest discover -s tests→ 60 tests OK (was 53)python tools/build_public_source.py→.claude-plugin/andtools/devops_plan.pypresent in the manifest🤖 Generated with Claude Code