From bc572fa0377dadc21e809aafb58d6d5d8b3be3eb Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 19 Jul 2026 07:12:00 +0500 Subject: [PATCH] fix: correct stale probe-timeout and 13->16 component counts in docs The runtime CLI probe default timeout is 30s (version.sh DEFAULT_TIMEOUT, override-clamped 1-120s; a private test encodes the 30s cold-start tolerance), but build/manifest.json and SECURITY.md still advertised 3s -- 10x tighter than reality. The core toolkit ships 16 skills / 16 commands (the private marketplace-structure test asserts 16/16), but README.md, docs/architecture.md, and the core plugin README still said 13/13, omitting add-instructions, nddev-builder-orientation, and validate-components. Also couple marketplace.json's core-plugin version to build_version in the public contract validator (previously only plugin.json.version was checked). Docs/validator-only; no runtime behavior change; release-evidence rebound. Claude-Session: https://claude.ai/code/session_01Y29c9sJRhChvxDcUjab5Xo --- README.md | 2 +- SECURITY.md | 3 ++- build/manifest.json | 2 +- build/release-evidence.json | 8 ++++---- cli-tools/validate_public_contracts.py | 16 ++++++++++++++++ docs/architecture.md | 2 +- .../nddev-builder/plugins/core/README.md | 12 +++++++----- 7 files changed, 32 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 6021cd4..9b37920 100644 --- a/README.md +++ b/README.md @@ -69,7 +69,7 @@ restore, remove, and custom-target usage. Each directory under `zcode_tools/marketplaces/` is a complete setup: -- `nddev-builder` enables its reusable 13-skill, 13-command `core` toolkit for +- `nddev-builder` enables its reusable 16-skill, 16-command `core` toolkit for creating and managing ZCode marketplaces, plugins, and components. - `nddev-designer` is a deliberately lean product-design profile focused on design-system consistency, accessibility, responsive states, and diff --git a/SECURITY.md b/SECURITY.md index a2fe8e8..362775f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -94,7 +94,8 @@ accepted report within 30 business days. These targets are best-effort. dpkg-owned path/version and SHA-512 equality with that verified entry are required. - Runtime CLI probing resolves one canonical executable and limits execution to - 3 seconds and 64 KiB of output. Normal install treats probe failure as + a bounded timeout (30 seconds by default, clamped to at most 120 seconds) and + 64 KiB of output. Normal install treats probe failure as advisory unknown state; bootstrap rejects it as a failed postcondition. - Lifecycle mutations use canonical/disjoint path checks, target and backup-pool locks, same-filesystem staging, pre-commit verification, atomic rename, and diff --git a/build/manifest.json b/build/manifest.json index 8c11eb5..0548080 100644 --- a/build/manifest.json +++ b/build/manifest.json @@ -64,7 +64,7 @@ }, "runtime_probe_policy": { "resolution": "resolve and canonicalize one executable before invoking it", - "timeout_seconds": 3, + "timeout_seconds": 30, "max_output_bytes": 65536, "advisory_failure": "timeout, nonzero exit, excessive output, decode/runtime error, or missing executable becomes unknown/not-installed without aborting install", "bootstrap_postcondition": "bootstrap remains strict and rejects an unknown or mismatched CLI version" diff --git a/build/release-evidence.json b/build/release-evidence.json index acd2726..49eabda 100644 --- a/build/release-evidence.json +++ b/build/release-evidence.json @@ -2,11 +2,11 @@ "schema_version": 2, "module": { "repository": "NDDev-it-com/nddev-zcode-app", - "setup_digest": "sha256:b0e22d023e2d56303eedd3bb8ffefdd91608b25ba3f3e7182a14af26ce720e5a" + "setup_digest": "sha256:51f95a940c545ea1c590d8613a7bd018815dbef6864acdfc974f7e4dd0fb689a" }, "harness": { "repository": "NDDev-it-com/nddev-harnesses", - "commit": "275354c5fca5af5da0baff1be96f0c15219a7587" + "commit": "f00fc21cc43b1510b33160e5026a743a6591d890" }, "adapter": { "id": "zcode", @@ -30,8 +30,8 @@ } ], "lanes": [], - "generated_at_utc": "2026-07-18T06:15:06Z", - "expires_at_utc": "2027-01-14T06:15:06Z", + "generated_at_utc": "2026-07-19T02:11:35Z", + "expires_at_utc": "2027-01-15T02:11:35Z", "promotion": { "decision": "pending", "waivers": [] diff --git a/cli-tools/validate_public_contracts.py b/cli-tools/validate_public_contracts.py index 604d524..0ff9603 100644 --- a/cli-tools/validate_public_contracts.py +++ b/cli-tools/validate_public_contracts.py @@ -250,6 +250,22 @@ def main() -> int: errors.append( "nddev-builder core plugin version disagrees with build/version.json:build_version" ) + marketplace = load_json( + "zcode_tools/marketplaces/nddev-builder/marketplace.json", errors + ) + if marketplace is not None: + core_entries = [ + entry + for entry in marketplace.get("plugins", []) + if isinstance(entry, dict) and entry.get("name") == "core" + ] + if len(core_entries) == 1 and core_entries[0].get("version") != version.get( + "build_version" + ): + errors.append( + "nddev-builder marketplace core plugin version disagrees with " + "build/version.json:build_version" + ) if manifest is not None and version is not None: if manifest.get("build_version") != version.get("build_version"): diff --git a/docs/architecture.md b/docs/architecture.md index b97a45f..1e250ae 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -52,7 +52,7 @@ prefix. ### Setup profiles - `nddev-builder` enables `core@nddev-builder`, a native component-authoring - toolkit with 13 skills, 13 matching commands, and one reviewer agent. + toolkit with 16 skills, 16 matching commands, and one reviewer agent. - `nddev-designer` is a production-ready minimal design profile. Its empty extension maps are intentional; project-specific design tools come from the active workspace. diff --git a/zcode_tools/marketplaces/nddev-builder/plugins/core/README.md b/zcode_tools/marketplaces/nddev-builder/plugins/core/README.md index fb12e71..123277e 100644 --- a/zcode_tools/marketplaces/nddev-builder/plugins/core/README.md +++ b/zcode_tools/marketplaces/nddev-builder/plugins/core/README.md @@ -3,14 +3,16 @@ The `core` plugin is a reusable ZCode-native toolkit for creating and managing marketplaces, plugins, and convention-discovered components. -- **13 skills**: `add-marketplace`, `add-plugin`, `add-skill`, `add-command`, +- **16 skills**: `add-marketplace`, `add-plugin`, `add-skill`, `add-command`, `add-agent`, `add-hook`, `add-mcp-server`, `add-provider`, `add-reference`, - `add-tool`, `list-components`, `remove-component`, and `enable-plugin`. -- **13 slash commands**: `/nddev-add-marketplace`, `/nddev-add-plugin`, + `add-tool`, `add-instructions`, `list-components`, `remove-component`, + `enable-plugin`, `nddev-builder-orientation`, and `validate-components`. +- **16 slash commands**: `/nddev-add-marketplace`, `/nddev-add-plugin`, `/nddev-add-skill`, `/nddev-add-command`, `/nddev-add-agent`, `/nddev-add-hook`, `/nddev-add-mcp`, `/nddev-add-provider`, - `/nddev-add-reference`, `/nddev-add-tool`, `/nddev-list`, `/nddev-remove`, - and `/nddev-enable`. + `/nddev-add-reference`, `/nddev-add-tool`, `/nddev-add-instructions`, + `/nddev-list`, `/nddev-remove`, `/nddev-enable`, `/nddev-orient`, and + `/nddev-validate`. - **1 subagent**: `nddev-native-reviewer` (GLM-5.2). ## Capabilities