Both sides added real content and this merge keeps both rather than picking one.
The branch predates the v2.1.0 release, so merging it straight would have REVERTED that
release: every plugin.json back from 2.1.0 to 2.0.0, and tests/test_consistency.py and
tests/test_validator.py deleted. Merged instead of pushed.
Conflicts, all resolved by combining:
- pm-ai-shipping/.claude-plugin/plugin.json - v2.1.0's version, the branch's description.
- security-audit-static - both checks survive as two steps: verify citations (2.1.0), then
report with the OWASP Top 10 coverage backstop (branch).
- ship-check - the new correctness review becomes Step 3, and 2.1.0's parallel security +
performance pair renumbers to Steps 4 + 5 behind it, keeping the branch's model-mix
carry-through on the security bullet.
- Notes - 2.1.0's untrusted-input rule and both of the branch's bullets.
The v2.1.0 test suite then caught what the branch had missed: a third skill in pm-ai-shipping
without the counts to match. Root README headline 68 -> 69 skills, its pm-ai-shipping summary
2 -> 3, and marketplace.json's total and description synced to plugin.json. 15/15 tests and the
validator pass.
No version bump. The CHANGELOG entry sits under `## Unreleased`, which the tag-on-merge workflow
ignores by design, so this lands the skill without cutting a release - that call is Pawel's.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G42vsxSKL7je39AsHZ5aJm
pm-ai-shipping: mandatory Evidence citations verified before reporting,
concrete subagent fan-out contract, read-only allowed-tools on both audits,
N+1/waterfall detection and a refute pass in the performance audit,
untrusted-input hardening across the kit, parallel audits in /ship-check,
severity anchors + report consolidation, repo-relative paths.
Repo: CHANGELOG.md as release source of truth with auto-tag-and-release on
merge to main (adapted from phuryn/claude-usage, minus the .vsix build),
Tests workflow on every PR/push, unit + docs-consistency test suite,
contributor-credit conventions in CONTRIBUTING, all manifests synced at 2.1.0.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011URgT9hYuNrXeCvzjnqRxJ
Codex CLI (0.136+) reads the same .claude-plugin/marketplace.json as Claude
Code, so PM Skills installs natively via `codex plugin marketplace add` — no
file-copying required.
- Add a first-class "Codex CLI (OpenAI)" install section (marketplace add +
per-plugin `codex plugin add`).
- Note the difference vs. Claude Code: skills work and are invocable by name;
`/slash` commands install but do not run as Codex slash commands.
- Document an optional path: ask Codex to convert the bundled command files
into skills (best-effort, model-driven).
- Remove the now-inaccurate "copy skills to .codex/skills/ — Skills only" row
from the "Other AI assistants" table.
Docs-only; no plugin/marketplace contents changed (counts unchanged, no
version bump). Validator: all 9 plugins pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Delete .docs/images/plugins-overview.webp (already replaced by plugins.png in v2.0.0).
- Delete .docs/images/how-skills-work.webp and its reference in README.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Relocate image assets into .docs/images and update README image references accordingly. Four files were renamed/moved: add-marketplace.webp, how-skills-work.webp, plugins-overview.webp, and pm-skills-install.gif; README.md paths were updated to point to .docs/images/*. Keeps documentation assets organized under .docs/images.
Pawel HurynandClaude Opus 5
Fahri Meral