Prairie-Server · JonahMMay · Sep 28, 2026 · Aug 31, 2026 · Sep 14, 2026 · Sep 14, 2026
diff --git a/.github/workflows/update-catalog.yml b/.github/workflows/update-catalog.yml
@@ -36,7 +36,7 @@ jobs:
 
       - name: Update catalog manifest
         env:
-          GITHUB_TOKEN: ${{ secrets.CATALOG_SOURCE_TOKEN || github.token }}
+          GITHUB_TOKEN: ${{ github.token }}
           PLUGIN_REPO: ${{ inputs.repo || github.event.client_payload.repo }}
           PLUGIN_TAG: ${{ inputs.tag || github.event.client_payload.tag }}
         run: |

diff --git a/.github/workflows/update-manifest.yml b/.github/workflows/update-manifest.yml
@@ -40,7 +40,7 @@ jobs:
 
       - name: Update catalog manifest
         env:
-          GITHUB_TOKEN: ${{ secrets.CATALOG_SOURCE_TOKEN || github.token }}
+          GITHUB_TOKEN: ${{ github.token }}
           PLUGIN: ${{ inputs.plugin }}
           VERSION: ${{ inputs.version }}
         run: |

diff --git a/.gitignore b/.gitignore
@@ -5,7 +5,9 @@ logs/
 .env.*
 !.env.example
 .DS_Store
-.claude/
+# Local agent/tooling state
+/.agents/
+/.claude/
 .codex/
 .cursor/
 .worktrees/

diff --git a/AGENTS.md b/AGENTS.md
@@ -0,0 +1,15 @@
+# Agent instructions
+
+Read [README.md](README.md) and [CONTRIBUTING.md](CONTRIBUTING.md) before working here; they define this repository's ownership, build, and validation rules.
+
+## Writing
+
+Give human-facing prose a final readability pass. Lead with the outcome, use concrete plain language and active voice, and cut filler, stock framing, repetition, and promotional claims. Preserve meaning, evidence, citations, uncertainty, and established terminology. Never rewrite exact quotations, commands, logs, identifiers, API names, or contractual language. Match the audience and use restrained formatting.
+
+## Pull requests
+
+- Never create a pull request unless the developer explicitly asks.
+- Use a plain-language Conventional Commit title. In the body, explain the problem before the solution and end with the required AI disclosure, naming the exact model, harness, and tooling used.
+- For UI changes, include before-and-after evidence and a video for motion or timing behavior. Upload pull-request evidence to GitHub; never commit PR-only assets such as `.github/pr-assets`.
+- Keep one concern per pull request. If the description needs the word "also" for another change, split it.
+- When babysitting a pull request, poll for checks and comments newer than the last push. Verify bot findings against the source, fix real issues, and dismiss false positives with a written reason. Stay quiet when nothing is new, and stop when the latest commit is green.
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -0,0 +1 @@
+AGENTS.md
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -0,0 +1,49 @@
+# Contributing to the Prairie Plugin Catalog
+
+The [Prairie contribution guide](https://github.com/prairie-server/prairie-server/blob/main/CONTRIBUTING.md)
+covers project-wide coordination, focused changes, evidence, AI disclosure, and
+pull request expectations. Those requirements apply here; this guide adds the
+catalog-specific workflow.
+
+## Before you start
+
+Open an [issue](https://github.com/prairie-server/prairie-plugins/issues) before
+changing catalog schema, provenance rules, release ingestion, or automation.
+Plugin implementation changes belong in the individual plugin repository;
+plugin contract changes belong in
+[`prairie-plugin-sdk`](https://github.com/prairie-server/prairie-plugin-sdk).
+
+Release entries are normally generated from a plugin's published GitHub release
+by the catalog workflows. Do not hand-edit checksums or release metadata to work
+around a missing or incorrect upstream artifact.
+
+## Development setup
+
+Use the Go version declared in `go.mod`. The update command reads release assets
+from GitHub, so use a real tagged release when testing ingestion and never place
+tokens in command arguments, committed files, or logs.
+
+## Validate your change
+
+```sh
+go test ./...
+go vet ./...
+go build ./...
+gofmt -l .
+```
+
+`gofmt -l .` should print nothing. If it reports unrelated pre-existing drift,
+none of the Go files touched by your change may appear in the output; do not add
+to the output, and report what remains. For catalog output changes, inspect the
+complete `manifest.json` diff and verify repository URLs, versions, platforms,
+the checksum URL, capabilities, and presentation metadata against the source
+release. The catalog stores a URL for `checksums.txt`, not the checksum values
+themselves, so also confirm that the release asset exists and covers every
+published binary.
+
+## Open the pull request
+
+Use a Conventional Commit title, explain the catalog or automation impact, and
+paste the actual validation results. Read the
+[AI-assisted contribution policy](https://github.com/prairie-server/prairie-server/blob/main/docs/ai-contributions.md)
+and include its disclosure block.
diff --git a/README.md b/README.md
@@ -2,15 +2,48 @@
 
 Catalog metadata and helpers for first-party Prairie plugins.
 
+Prairie servers consume the generated `manifest.json` to discover approved plugin
+releases, supported platforms, checksums, capabilities, and presentation
+metadata. Source plugin repositories remain the authority for implementation
+and release artifacts.
+
 ## Catalog updates
 
 Plugin repositories should dispatch `plugin_release_published` after publishing
 a release. Set `PRAIRIE_PLUGINS_DISPATCH_TOKEN` in the plugin repository so it can
 call `repository_dispatch` on `prairie-server/prairie-plugins`.
 
-`prairie-plugins` uses `CATALOG_PUSH_TOKEN` to push catalog updates. If plugin
-repositories are private, also set `CATALOG_SOURCE_TOKEN` in `prairie-plugins` so
-the updater can read release metadata and the tagged `manifest.json`.
+`prairie-plugins` uses `CATALOG_PUSH_TOKEN` to push catalog updates. Reading a
+plugin's release metadata and its tagged `manifest.json` needs no extra
+credential: every catalogued plugin repository is public, so the workflow's own
+`github.token` is enough. A plugin has to be public before it dispatches.
+
+To exercise ingestion locally against an existing tagged release, pass the
+repository in `owner/name` form and the exact release tag:
+
+```sh
+go run ./cmd/update-catalog \
+  -repo Prairie-Server/prairie-plugin-metadata-tmdb \
+  -tag v1.2.21
+```
+
+For a private source repository, provide `GITHUB_TOKEN` through your normal
+secret-injection workflow. The command rewrites `manifest.json`; review or
+discard that diff after the check.
+
+## Development
+
+```sh
+go test ./...
+go vet ./...
+go build ./...
+```
+
+## Contributing
+
+Read [CONTRIBUTING.md](CONTRIBUTING.md) before opening a pull request. Plugin
+implementation changes belong in the source plugin repository; catalog schema
+and automation changes belong here.
 
 ## License
 

diff --git a/go.mod b/go.mod
@@ -3,14 +3,14 @@ module github.com/prairie-server/prairie-plugins
 go 1.26.0
 
 require (
-	github.com/prairie-server/prairie-plugin-sdk v0.12.1-0.20260828014014-de2fc8135237
+	github.com/prairie-server/prairie-plugin-sdk v0.12.1-0.20260928142658-1b20b2f74c42
 	google.golang.org/protobuf v1.36.11
 )
 
 require (
-	golang.org/x/net v0.48.0 // indirect
-	golang.org/x/sys v0.39.0 // indirect
-	golang.org/x/text v0.32.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
-	google.golang.org/grpc v1.75.1 // indirect
+	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/grpc v1.82.1 // indirect
 )
diff --git a/go.sum b/go.sum
@@ -1,3 +1,5 @@
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
@@ -8,31 +10,31 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/prairie-server/prairie-plugin-sdk v0.12.1-0.20260828014014-de2fc8135237 h1:4TEsc0cDlWqNu1pOfJmuthiCxiQf9U0LmdSh86sejhY=
-github.com/prairie-server/prairie-plugin-sdk v0.12.1-0.20260828014014-de2fc8135237/go.mod h1:G+brXLx+euqAiLHkiPX/IvnDVVfH3Z+LpTjIsiqJV/A=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
-go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
-go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
-go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
-go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
-go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
-go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
-go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
-go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
-go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
-golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
-golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
-golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
-golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
-google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
-google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+github.com/prairie-server/prairie-plugin-sdk v0.12.1-0.20260928142658-1b20b2f74c42 h1:wFdWr2eon0QfL9HmQGM9vLxRvvn6tyGX31o3q4uXrZE=
+github.com/prairie-server/prairie-plugin-sdk v0.12.1-0.20260928142658-1b20b2f74c42/go.mod h1:P4QeyZ1jFOPjGcPHJ/kMH47QKgeLOCy4z2A6g1CYgkE=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
+go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
+go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=