feat(platform-integrations): unify plugin code under a single canonical source

.github/workflows/check-code.yaml

@@ -83,6 +83,26 @@ jobs:
     - name: Check typing
       run: uv run mypy .
 
+  check-plugins-rendered:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.12']
+    steps:
+    - uses: actions/checkout@v5
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Install uv
+      uses: astral-sh/setup-uv@v6
+      with:
+        enable-cache: true
+        python-version: ${{ matrix.python-version }}
+    - name: Verify platform-integrations matches a fresh render of plugin-source
+      run: uv run python plugin-source/build_plugins.py check
+
   ui-tests:
     runs-on: ubuntu-latest
     steps:

.gitignore

@@ -17,4 +17,5 @@ dist
 .secrets
 event.json
 site/
+example-guidelines
 .codex

.pre-commit-config.yaml

@@ -50,3 +50,15 @@ repos:
         name: detect secrets
         args: ['--baseline', '.secrets.baseline']
         exclude: package.lock.json
+
+  # Plugin render-equality gate — fails if platform-integrations/ has drifted
+  # from plugin-source/. Runs whenever plugin-source/ or the rendered tree
+  # under platform-integrations/ has changed.
+  - repo: local
+    hooks:
+      - id: plugins-rendered
+        name: plugins-rendered
+        entry: uv run python plugin-source/build_plugins.py check
+        language: system
+        pass_filenames: false
+        files: ^(plugin-source/|platform-integrations/)

justfile

@@ -78,3 +78,12 @@ codex-run:
 # Smoke-test that Codex is installed and working
 codex-test:
     docker run --rm --env-file {{env_file}} {{codex_image}} codex exec --skip-git-repo-check "who are you"
+
+# Render plugin-source/ into platform-integrations/. Edit plugin-source/, then run this.
+compile-plugins:
+    uv run python plugin-source/build_plugins.py render
+
+# Verify committed platform-integrations/ matches a fresh render of plugin-source/.
+# CI and the pre-commit hook run this; nonzero exit means the source and output have drifted.
+check-plugins-rendered:
+    uv run python plugin-source/build_plugins.py check

platform-integrations/bob/evolve-lite/commands/evolve-lite-learn.md

@@ -0,0 +1,4 @@
+---
+description: Must be used near the end of any non-trivial turn that produced potentially reusable tools, guidance, errors, workarounds, or workflows, so those lessons are saved for future turns.
+---
+Use the `evolve-lite-learn` skill on the current conversation. Follow the skill's instructions exactly.

platform-integrations/bob/evolve-lite/commands/evolve-lite-publish.md

@@ -0,0 +1,4 @@
+---
+description: Publish a private guideline to a configured write-scope repo.
+---
+Use the `evolve-lite-publish` skill on the current conversation. Follow the skill's instructions exactly.

platform-integrations/bob/evolve-lite/commands/evolve-lite-recall.md

@@ -0,0 +1,4 @@
+---
+description: Must be used at the start of any non-trivial task involving code changes, debugging, repo exploration, file inspection, or environment/tooling investigation to surface stored guidance before analysis or tool use.
+---
+Use the `evolve-lite-recall` skill on the current conversation. Follow the skill's instructions exactly.

platform-integrations/bob/evolve-lite/commands/evolve-lite-save-trajectory.md

@@ -0,0 +1,4 @@
+---
+description: Save the current conversation as a trajectory JSON file in OpenAI chat completion format for analysis and fine-tuning
+---
+Use the `evolve-lite-save-trajectory` skill on the current conversation. Follow the skill's instructions exactly.

platform-integrations/bob/evolve-lite/commands/evolve-lite-save.md

@@ -0,0 +1,4 @@
+---
+description: Captures the current session's successful workflow and saves it as a reusable skill with SKILL.md and helper scripts
+---
+Use the `evolve-lite-save` skill on the current conversation. Follow the skill's instructions exactly.

platform-integrations/bob/evolve-lite/commands/evolve-lite-subscribe.md

@@ -0,0 +1,4 @@
+---
+description: Add a shared guidelines repo (read-scope subscription or write-scope publish target) to the unified repos list.
+---
+Use the `evolve-lite-subscribe` skill on the current conversation. Follow the skill's instructions exactly.

platform-integrations/bob/evolve-lite/commands/evolve-lite-sync.md

@@ -0,0 +1,4 @@
+---
+description: Pull the latest guidelines from every configured repo (read- and write-scope).
+---
+Use the `evolve-lite-sync` skill on the current conversation. Follow the skill's instructions exactly.

platform-integrations/bob/evolve-lite/commands/evolve-lite-unsubscribe.md

@@ -0,0 +1,4 @@
+---
+description: Remove a repo from the unified repos list and delete its local clone.
+---
+Use the `evolve-lite-unsubscribe` skill on the current conversation. Follow the skill's instructions exactly.

platform-integrations/bob/evolve-lite/custom_modes.yaml

@@ -6,13 +6,8 @@ customModes:
 
       ⚠️ CRITICAL: THE FOLLOWING WORKFLOW IS ABSOLUTELY MANDATORY AND CANNOT BE SKIPPED ⚠️
 
-      WORKFLOW (5 steps, strict order):
+      WORKFLOW (4 steps, strict order):
 
-      0. ⚠️ BEFORE FIRST USE (MANDATORY): Read the skill SKILL.md files from .bob/skills/ directory.
-         - Read .bob/skills/evolve-lite:recall/SKILL.md
-         - Read .bob/skills/evolve-lite:learn/SKILL.md
-         - Read .bob/skills/evolve-lite:save-trajectory/SKILL.md
-         - Do this ONCE per conversation before using the skills
       1. ⚠️ FIRST ACTION (MANDATORY): Use the evolve-lite:recall skill to retrieve relevant guidelines.
          - This MUST be your FIRST action in EVERY conversation
          - NO exceptions - even for simple tasks like "echo hello world"
@@ -24,10 +19,14 @@ customModes:
          - This MUST happen BEFORE attempt_completion
          - NO exceptions - even if you think there's nothing to learn
 
+      Before using any skill for the first time in a conversation, read its
+      SKILL.md so you know the exact invocation syntax. Bob installs skills
+      under `.bob/skills/`; the runtime will resolve a skill by name.
+
       ⚠️ ENFORCEMENT RULES ⚠️
       - Do not skip steps. Do not reorder steps.
-      - Step 0 must happen before using any skill for the first time in a conversation. read_file on .bob/skills/*/SKILL.md is allowed before Step 1.
-      - Step 1 must happen before any other tool use (except the SKILL.md reads in Step 0).
+      - Step 1 must happen before any other tool use (except a one-time
+        SKILL.md read for a skill you have not invoked yet).
       - Step 3 must happen before Step 4.
       - Step 4 must happen before attempt_completion.
       - If you forget Step 1, STOP and call evolve-lite:recall immediately.
@@ -40,16 +39,12 @@ customModes:
       - If no errors or non-obvious discoveries occurred, saving zero entities is correct — do not force low-quality entities.
 
       MEMORY SHARING (Optional):
-      The following skills enable sharing guidelines with others:
-      - evolve-lite:publish — Publish your private guidelines to a public Git repo
-      - evolve-lite:subscribe — Subscribe to another user's public guidelines
-      - evolve-lite:unsubscribe — Remove a subscription
-      - evolve-lite:sync — Pull latest updates from all subscribed repos (manual invocation required)
-
-      These skills are OPTIONAL and do not affect the core workflow. Use them when you want to:
-      - Share your learnings with teammates
-      - Learn from others' guidelines
-      - Keep subscribed guidelines up to date
+      Additional evolve-lite skills handle sharing guidelines with others
+      (publish, subscribe, unsubscribe, sync). They are OPTIONAL and do not
+      affect the core workflow. Use them when you want to share your
+      learnings with teammates, learn from others' guidelines, or keep
+      subscribed guidelines up to date. Read the SKILL.md for any of these
+      before first use.
 
       PRE-COMPLETION GATE:
       Before calling attempt_completion, ask yourself:

platform-integrations/bob/evolve-lite/lib/audit.py

@@ -0,0 +1,33 @@
+"""Append-only audit log writer for .evolve/audit.log."""
+
+import datetime
+import json
+import pathlib
+
+
+def append(project_root=".", **fields):
+    """Append a JSON audit entry to .evolve/audit.log.
+
+    Args:
+        project_root: Root directory that contains .evolve/.
+        **fields: Arbitrary key-value fields to include in the log entry.
+    """
+    path = pathlib.Path(project_root) / ".evolve" / "audit.log"
+    path.parent.mkdir(parents=True, exist_ok=True)
+    entry = {**fields, "ts": datetime.datetime.now(datetime.UTC).isoformat().replace("+00:00", "Z")}
+    with path.open("a", encoding="utf-8") as f:
+        f.write(json.dumps(entry) + "\n")
+
+
+if __name__ == "__main__":
+    import tempfile
+
+    with tempfile.TemporaryDirectory() as d:
+        append(project_root=d, action="test", actor="alice")
+        log_path = __import__("pathlib").Path(d) / ".evolve" / "audit.log"
+        line = log_path.read_text(encoding="utf-8").strip()
+        entry = __import__("json").loads(line)
+        assert entry["action"] == "test"
+        assert entry["actor"] == "alice"
+        assert "ts" in entry
+    print("audit.py ok")