init

.github/PULL_REQUEST_TEMPLATE/plugin-registry.md

@@ -0,0 +1,44 @@
+<!--
+Use this template for a PR that adds or updates ONE entry in plugins-registry.json.
+Select it by appending ?template=plugin-registry.md to the PR-compare URL, or
+the plugin template's release workflow opens it for you on a release tag.
+ONE plugin per PR. Change ONLY that plugin's entry.
+-->
+
+## Plugin registry change
+
+Home issue: #____
+
+Paste the registry entry (one object), pinned to the exact reviewed commit:
+
+```json
+{
+  "name": "career-ops-plugin-<name>",
+  "id": "<name>",
+  "repo": "https://github.com/<you>/career-ops-plugin-<name>",
+  "author": "<you>",
+  "hooks": ["provider"],
+  "description": "Mission-framed one-liner.",
+  "requiredEnv": [],
+  "allowedHosts": ["api.example.com"],
+  "skill": true,
+  "license": "MIT",
+  "version": "1.0.0",
+  "sha": "<40-hex-commit>"
+}
+```
+
+### Maintainer review checklist
+
+- [ ] Naming `career-ops-plugin-<name>`; `id` == name minus the prefix
+- [ ] Minimum files present (manifest.json, index.mjs, README.md, LICENSE)
+- [ ] Manifest valid: apiVersion 1, `humanInTheLoop: true`, hooks ⊆ {provider, ingest, search, notify, export} — **no apply/submit**
+- [ ] MIT-compatible LICENSE; no personal data in the repo
+- [ ] Egress: `allowedHosts` are real public hosts; no IP literals / metadata / `*.internal`; no localhost without `allowsLocalhost` + a reason
+- [ ] Static audit clean: no `child_process`/`playwright`/raw sockets/global `fetch`/`eval`/bare-dependency imports (egress only via `ctx.fetch`)
+- [ ] No core-owned secrets in `requiredEnv`
+- [ ] Reads PUBLIC data or the user's OWN account only — no centralized infrastructure, no auto-submit, no blind-apply
+- [ ] No commercial / hosted-service / monetization wording (the project is free and local-first)
+- [ ] If it ships a skill: domain-scoped — does not instruct the agent to edit core files, change scoring, reveal secrets, or act outside its hooks
+- [ ] `sha` is pinned to the exact reviewed commit
+- [ ] CI (`plugin-registry-validate`) is green