Task: Publish scaffold Skill through official Marketplace

Identity

Task ID: 20260904-marketplace-scaffold-client-6c4e8a21
Mode: Feature
Branch: codex/20260904-integrate-project-scaffold-b6d3e8a1-integrate-project-scaffold
Worktree: D:\Datas\OthersProjects.codex-worktrees\makelore\20260904-integrate-project-scaffold-b6d3e8a1
Base commit: 2207806038
Owner: codex
Status: Ready for Integration

Publish makelore.project-scaffold as a code-owned bundled Marketplace plugin.
Move the existing project-scaffold Skill runtime into resources/coding-plugins/project-scaffold so it ships with the signed MakeLore application.
Register the bundled release in the client plugin registry and preserve the acquire, project-enable, and Agent-assignment lifecycle.
Cover the official-script boundary with focused manifest, resolver, scaffold, and artifact-package tests.

The Skill owns creation of the fixed interactive AI application starter and static publish-readiness checks; it does not build, upload, submit, or approve a project.
Official executable resources may be loaded only from the code-owned bundled plugin root. Downloadable Marketplace artifacts keep the existing text/image-only P0 asset policy, including rejection of .mjs.
Keep one runtime copy of the Skill rather than a Device Package copy plus a bundled copy.
Use plugin ID makelore.project-scaffold, Skill ID makelore-project-scaffold, release version 1.0.0, and minimum client version 2.0.0.
Preserve non-overwrite scaffolding and explicit user invocation of the Skill.

Moved the existing scaffold Skill, templates, release reference, and .mjs runner into the signed client resource tree at resources/coding-plugins/project-scaffold; no second runtime copy remains.
Added schema-v2 MakeLore capability metadata and retained the portable .codex-plugin/plugin.json, both identifying makelore.project-scaffold version 1.0.0 and Skill makelore-project-scaffold.
Registered the plugin as a fixed, code-owned, skill_only bundled release with ID 00000000-0000-4000-8000-000000000303 and the existing acquire, project-enable, and Agent-assignment lifecycle.
Narrowed executable-script authority to the fixed bundled root. Downloaded Marketplace ZIPs still reject .mjs; they do not install this plugin's runtime.
Preserved the existing non-overwrite scaffold behavior, legacy mini_game / mini_program read compatibility, canonical interactive_ai_app output, and static publication-readiness guidance.

pnpm exec vitest run tests/unit/coding-plugin-manifest.test.ts tests/unit/coding-plugin-marketplace-client.test.ts tests/unit/project-scaffold-plugin.test.ts --maxWorkers=2: 54 passed.
node --test tests/project-scaffold/scaffold.test.mjs: 12 passed.
pnpm exec vitest run tests/unit/plugin-workspace-model.test.ts tests/unit/coding-plugin-effective-resolver.test.ts tests/unit/coding-composition-paths.test.ts --maxWorkers=2: 33 passed.
ESLint on the changed TypeScript files: passed.
pnpm run typecheck: passed.
Plugin manifest validation: passed. Skill validation: passed with UTF-8 mode and the repository Python environment that provides PyYAML.
pnpm test: 224 test files and 1,879 tests passed, 2 skipped; one unrelated real-process timing assertion exceeded two seconds under full parallel load. Re-running tests/unit/pi-agent-server-process-real.test.ts alone with one worker passed all 6 tests, so no unrelated timeout change was made.

Run a packaged-app smoke test before the first public client release to prove the signed resource layout and ELECTRON_RUN_AS_NODE execution path outside the repository environment.

Update ADR-008 after integration: project scaffolding is distributed as a code-owned bundled Marketplace plugin, while downloadable artifacts remain non-executable in P0.