Constraint: Public skills are published only by explicit administrator action unless they are tracked third-party market sources.
Confidence: high
Scope-risk: narrow
Directive: Keep private/internal skills out of the public marketplace.
Tested: Marketplace validation passed.
Constraint: Maintainers need repeatable ingestion for external skill repositories with different layouts.\nRejected: Git submodules as the primary mechanism | Codex marketplace installs do not reliably recurse external submodules, and adapters still need layout conversion.\nConfidence: medium\nScope-risk: moderate\nDirective: Add new upstreams through config/external-sources.json and adapter logic rather than hand-copying plugin folders.\nTested: scripts/sync_external_plugins.ps1 -Proxy http://127.0.0.1:18085; scripts/sync_external_plugins.ps1 -Only ui-ux-pro-max -Proxy http://127.0.0.1:18085; python scripts/validate_marketplace.py; validate_plugin.py for superpowers and ui-ux-pro-max; codex plugin add superpowers@eapil-skill-market; codex plugin add ui-ux-pro-max@eapil-skill-market; verified ui-ux-pro-max data/scripts directories in cache.\nNot-tested: Scheduled .gitea workflow execution on git.playones runner.
KeyInfo Bot