.codex-plugin/plugin.json

{
  "name": "app-6a5d18a424c48191bd58114d73a14b38",
  "version": "1.2.0",
  "description": "Portable engineering skills with controlled AICtrl workflow execution",
  "author": {
    "name": "aictrl.dev",
    "email": "info@aictrl.dev",
    "url": "https://aictrl.dev"
  },
  "homepage": "https://aictrl.dev",
  "repository": "https://github.com/aictrl-dev/skills",
  "license": "MIT",
  "keywords": [
    "sdlc",
    "engineering",
    "code-review",
    "workflow",
    "agent-skills"
  ],
  "skills": "./skills/",
  "mcpServers": "./.mcp.json",
  "interface": {
    "displayName": "AICtrl",
    "shortDescription": "Engineering skills & workflows",
    "longDescription": "aictrl brings engineering skills and controlled delivery workflows to software teams that use aictrl.dev.\n\nWhat it does:\n- Skills that run in your session: turn requests into implementation-ready issues, review specs, implement changes and prepare pull requests, review code at the current head revision, judge and reply to review findings, run root-cause analyses, plan measurements, polish UI, test agent usability, author and run workflows, and explain changes.\n- An aictrl.dev connector (OAuth) that lets you search connected repository context, update your project backlog, list and inspect published workflows, start a workflow run after you confirm its inputs and side effects, follow run status, approve or cancel gated steps, start PR Explanation or Code Review tasks, and record verdicts on code-review findings.\n\nWho it is for: software engineers and engineering leads whose organization has connected GitHub repositories to aictrl.dev.\n\nLimitations: the connector only sees the organizations, repositories, and workflows your aictrl.dev account can access. It does not push code itself; repository changes happen only inside workflow runs, which perform only the side effects their published definition declares and wait at gated steps for explicit approval. The skills work without an account; connector features need an aictrl.dev organization.",
    "developerName": "aictrl.dev",
    "category": "Developer Tools",
    "capabilities": [
      "Read",
      "Write",
      "MCP"
    ],
    "websiteURL": "https://aictrl.dev",
    "supportURL": "https://aictrl.dev/support",
    "privacyPolicyURL": "https://aictrl.dev/privacy",
    "termsOfServiceURL": "https://aictrl.dev/terms",
    "defaultPrompt": [
      "Turn this request into an implementation-ready issue.",
      "Implement this issue and prepare a merge-ready pull request.",
      "Review this pull request at its current head revision."
    ],
    "brandColor": "#4c6ef5",
    "composerIcon": "./assets/icon.svg",
    "logo": "./assets/icon.svg"
  },
  "extensions": {
    "com.openai": {
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "Discover organizations and workflows",
              "prompt": "List my aictrl.dev organizations and show the published workflows available across them. Identify the organization that owns implement-code-change.",
              "tools_triggered": "list_organizations, list_workflows",
              "expected_behavior": "Calls `list_organizations` and `list_workflows` without changing any project or workflow data. Returns only organizations and published workflows accessible to the reviewer and identifies `Plugin Reviewer` as the owner of `implement-code-change`."
            },
            {
              "description": "Search connected code",
              "prompt": "In my Plugin Reviewer organization, search the connected code for implement-code-change and show the matching file path.",
              "tools_triggered": "list_organizations, query_context",
              "expected_behavior": "Calls `list_organizations` and `query_context` in the `code` domain without changing repository or project data. Returns `.aictrl/workflows/implement-code-change.yaml` as the matching file."
            },
            {
              "description": "Judge a recorded code-review finding",
              "prompt": "In my Plugin Reviewer organization, list the code-review findings on aictrl-dev/aictrl-plugin-reviewer-fixture pull request 4. Using the code snippet and description returned with the finding about the JSDoc step order not matching the code, record a TRUE verdict with action FIX at the reviewed commit 8587f86996681be971fae71e9d3bf547a4efb778, citing src/labels.mjs as evidence.",
              "tools_triggered": "list_organizations, list_pr_findings, record_finding_verdict",
              "expected_behavior": "Calls `list_organizations`, `list_pr_findings`, and `record_finding_verdict`; writes one verdict with an observed / root-cause / proof reasoning chain bound to the given commit, and does not post to GitHub. No other tool is needed: the public catalog returns neither file contents nor a head SHA, so the prompt pins the commit the finding was reviewed at, where the mismatch is real (the PR's later head commit fixed it), and the verdict relies on the returned snippet and description. Lists the recorded findings with their exact IDs, then confirms the verdict was stored for the JSDoc-order finding, with the commit and evidence verified, while the finding stays open."
            },
            {
              "description": "Apply a repeatable backlog update",
              "prompt": "In my Plugin Reviewer organization, find \"OpenAI plugin reviewer fixture task\" under \"Publishing OpenAI Codex Plugin\" and reset it to a draft, low-complexity story tagged openai-review-fixture. Keep its existing title and description.",
              "tools_triggered": "list_organizations, query_context, update_backlog",
              "expected_behavior": "Calls `list_organizations`, `query_context`, and `update_backlog`; writes only the repeatable fixture values requested by the prompt. Updates only the dedicated fixture task and returns its task and epic identifiers with `draft` status."
            },
            {
              "description": "Inspect and start a bounded workflow",
              "prompt": "In my Plugin Reviewer organization, inspect implement-code-change, show its inputs, side effects, and manual gate, then start it for aictrl-dev/aictrl-plugin-reviewer-fixture issue 1 using the stable idempotency key openai-plugin-review-fixture-v1. Show the initial run status and do not approve the gate.",
              "tools_triggered": "list_organizations, list_workflows, get_workflow, start_workflow, get_workflow_run",
              "expected_behavior": "Calls `list_organizations`, `list_workflows`, `get_workflow`, `start_workflow`, and `get_workflow_run`; starts or reuses exactly one run and does not approve its gate. Shows the workflow's declared bounds and reports the run ID, version, current stage, and status without approving repository writes."
            }
          ],
          "negative": [
            {
              "description": "Unrelated calendar request",
              "prompt": "What meetings do I have tomorrow?"
            },
            {
              "description": "Standalone coding question",
              "prompt": "Write a Python function that reverses a string."
            },
            {
              "description": "Unrelated external message",
              "prompt": "Send an email to my team announcing tomorrow's lunch."
            }
          ]
        }
      },
      "publication": {
        "release_notes": "Feature release of aictrl.dev's engineering plugin for Codex and ChatGPT.\n\n- Essential, local-first skills cover issue creation, bug reporting, spec\n  review, implementation, pull-request creation, code review, finding judgment,\n  review replies, root-cause analysis, workflow authoring and execution, design\n  review, measured UI polish, agent usability testing, measurement planning,\n  and change explanation.\n- Code-review findings are now reachable from the connector: list every\n  recorded finding on a pull request, then record a TRUE / FALSE / UNCERTAIN\n  verdict bound to the exact commit you read, with an auditable reasoning chain.\n- Workflow runs can be listed and filtered, so an assistant can find an\n  existing run before starting a new one.\n- Connected `implement-code-change` uses native OAuth and the public workflow\n  lifecycle tools, with explicit approvals, cancellation, revision evidence,\n  and bounds.\n- Security hardening: patched development dependencies, and the bundled\n  usability-test harness declares plain-text responses with `nosniff`.\n- Claude, Codex, and OpenCode consume the same canonical root `skills/` tree and\n  `https://aictrl.dev/mcp` declaration from one release commit.\n- The plugin contains no API keys, access tokens, client secrets, repository\n  credentials, telemetry hook, or generated secret-bearing file."
      }
    }
  },
  "apps": "./.app.json"
}