test(m1): assert plugin manifest and pin a build stamp

scripts/build_stamp.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+# Write the short hash of the commit this build came from to BUILD_STAMP.
+#
+# bash 3.2-clean and ASCII-only on purpose: the system bash on this Mac is 3.2.
+#
+# Why a stamp and not the manifest version: Cowork caches an uploaded plugin,
+# and plugin.json's version does not change between milestones, so a stale
+# build would echo the right number and every answer after it would be about
+# some other build (risk H11). The short hash moves on every commit, which is
+# exactly the property the check needs.
+#
+# The stamp is a build artefact and is gitignored. It is regenerated by
+# scripts/package_plugin.sh before every archive; a committed stamp would be
+# false the instant the next commit moved HEAD.
+#
+# Usage:
+#   bash scripts/build_stamp.sh                 # write <plugin root>/BUILD_STAMP
+#   bash scripts/build_stamp.sh --ut <sti>      # write somewhere else
+
+set -eu
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+REPO_ROOT=$(cd "$SCRIPT_DIR/.." && pwd)
+OUT="${REPO_ROOT}/BUILD_STAMP"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --ut)
+      if [ $# -lt 2 ]; then
+        echo "build_stamp: --ut needs a path" >&2
+        exit 2
+      fi
+      OUT="$2"
+      shift 2 ;;
+    -h|--help)
+      sed -n '2,20p' "$0"
+      exit 0 ;;
+    *)
+      echo "build_stamp: unknown argument: $1" >&2
+      exit 2 ;;
+  esac
+done
+
+if ! git -C "$REPO_ROOT" rev-parse --git-dir >/dev/null 2>&1; then
+  echo "build_stamp: $REPO_ROOT is not a git working tree." >&2
+  echo "build_stamp: the stamp is the commit this build came from; there is nothing to stamp." >&2
+  exit 1
+fi
+
+STAMP=$(git -C "$REPO_ROOT" rev-parse --short HEAD)
+printf '%s\n' "$STAMP" > "$OUT"
+echo "build_stamp: $STAMP -> $OUT"

scripts/package_plugin.sh

@@ -0,0 +1,98 @@
+#!/bin/bash
+# Build jobbsok.plugin from an explicit include list.
+#
+# bash 3.2-clean and ASCII-only on purpose: the system bash on this Mac is 3.2.
+#
+# The include list is the whole point, and it is not a convenience. zip does
+# not consult .gitignore, so archiving the repository root would ship .git,
+# the virtualenv from Step 2, the local-only STATE.md and everything under
+# .claude/ -- which holds the operator's decisions and absolute home paths.
+# This archive is uploaded to Cowork once per milestone and its command is
+# printed in a public README. An include list is the only form that is safe to
+# publish.
+#
+# The virtualenv is excluded for a second reason on top of that one: a venv's
+# absolute paths do not survive relocation, so an archived one would be broken
+# wherever it landed. The supported route in an installed copy is to run
+# scripts/bootstrap.sh once against it, which builds the environment under
+# $CLAUDE_PLUGIN_DATA. README.md says so.
+#
+# Usage:
+#   bash scripts/package_plugin.sh              # -> <repo root>/jobbsok.plugin
+#   bash scripts/package_plugin.sh --ut <sti>   # -> somewhere else
+
+set -eu
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+REPO_ROOT=$(cd "$SCRIPT_DIR/.." && pwd)
+OUT="${REPO_ROOT}/jobbsok.plugin"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --ut)
+      if [ $# -lt 2 ]; then
+        echo "package_plugin: --ut needs a path" >&2
+        exit 2
+      fi
+      OUT="$2"
+      shift 2 ;;
+    -h|--help)
+      sed -n '2,23p' "$0"
+      exit 0 ;;
+    *)
+      echo "package_plugin: unknown argument: $1" >&2
+      exit 2 ;;
+  esac
+done
+
+case "$OUT" in
+  /*) ;;
+  *) OUT="$(pwd)/$OUT" ;;
+esac
+
+# Regenerate first: an archive carrying a stale stamp is the exact failure the
+# stamp exists to catch, and building one would be worse than not stamping.
+bash "${SCRIPT_DIR}/build_stamp.sh"
+
+# The include list. Directories are archived whole, minus the exclusions below.
+# Entries that do not exist yet are reported and skipped -- hooks/, templates/
+# and SECURITY.md land in later steps -- but the two the archive is worthless
+# without are required outright.
+INCLUDE=".claude-plugin skills scripts hooks templates .mcp.json README.md SECURITY.md LICENSE BUILD_STAMP"
+REQUIRED=".claude-plugin/plugin.json BUILD_STAMP"
+
+for path in $REQUIRED; do
+  if [ ! -e "${REPO_ROOT}/${path}" ]; then
+    echo "package_plugin: required entry missing: $path" >&2
+    exit 1
+  fi
+done
+
+PRESENT=""
+SKIPPED=""
+for path in $INCLUDE; do
+  if [ -e "${REPO_ROOT}/${path}" ]; then
+    PRESENT="$PRESENT $path"
+  else
+    SKIPPED="$SKIPPED $path"
+  fi
+done
+
+if [ -n "$SKIPPED" ]; then
+  echo "package_plugin: not present yet, skipped:$SKIPPED"
+fi
+
+rm -f "$OUT"
+
+# -X drops the extra file attributes, so the archive is reproducible enough
+# that two builds of the same commit differ only in timestamps. The exclusions
+# are belt to the include list's braces: nothing under scripts/ or skills/ that
+# is a build artefact of a local test run may ride along.
+cd "$REPO_ROOT"
+# shellcheck disable=SC2086 -- PRESENT is a deliberate word-split list
+zip -q -r -X "$OUT" $PRESENT \
+  -x '*/__pycache__/*' '*.pyc' '*/.pytest_cache/*' '*/.venv/*' '*.local.md' \
+  '*/.DS_Store'
+
+echo "package_plugin: $(basename "$OUT") built from $(cat "${REPO_ROOT}/BUILD_STAMP")"
+echo "package_plugin: $OUT"