git:20260529.5656e38 to git:20260529.0565655

104 added, 115 removed. Audit A to A.

---

- name: mall-source-inventory

- description: "Maintain and inventory the C:\\Development\\MALL source repos that feed the Plugin Mall: refresh, health-check, add, retire"

- lastReviewed: 2026-05-03

+ name: source-inventory

+ description: "Maintain the source registry in sources/supported-stores.json — add a new third-party plugin store, retire one, refresh metadata, validate the schema. Use when proposing a registry change, after the weekly cron flags a source as unhealthy, or when a candidate store needs evaluation before adding."

+ lastReviewed: 2026-05-29

---

- # Mall Source Inventory

- Maintain the upstream source repos in `C:\Development\MALL` that feed the Plugin Mall. These are the raw material: external repos cloned locally so the Supervisor can scan, evaluate, and promote plugins into `Alex_ACT_Plugin_Mall`.

- ## When to Use

- - Before any `/audit-mall` or `/scan-stores` run (refresh first)

- - Weekly or on-demand via `/refresh-mall-sources`

- - When adding a new upstream repo to the MALL folder

- - When a store appears dead, archived, or relocated

- - When `store-sync.cjs` reports SKIP or WARN for a store

- ## Relationship to Other Skills

- | Skill | Scope | This skill's role |

- | --- | --- | --- |

- | `mall-curation` | Curates Plugin Mall entries (plugins/, CATALOG.json) | Feeds raw material to mall-curation |

- | `store-evaluation` | Scores a proposed plugin for Mall inclusion | This skill manages the *repos* that contain those plugins |

- | `staleness-discipline` | Detects stale Mall plugins | This skill detects stale *source repos* |

- | `store-sync.cjs` (script) | Mechanical fetch + flat inventory | This skill governs *when and how* to run it, plus the judgment calls the script cannot make |

- ## The MALL Folder

+ # Source Inventory

- `C:\Development\MALL` contains cloned repos organized by source quality tier:

+ Maintain `sources/supported-stores.json` — the single source of truth for which upstream plugin repos the Mall scans.

- | Tier | Description | Examples |

- | --- | --- | --- |

- | **Internal** | Microsoft Agency governance-reviewed repos | `.github-private`, `playground` |

- | **Official** | GitHub, Microsoft, or Anthropic maintained | `copilot-plugins`, `microsoft-skills`, `hve-core`, `mcp-servers` |

- | **Community curated** | Community repos with editorial standards | `awesome-copilot`, `awesome-mcp-servers`, `awesome-claude-code` |

- | **Community** | Individual or small-team repos | `claude-skills`, `copilot-kit`, `wshobson-agents` |

- | **Domain** | Vertical-specific collections | `game-studios`, `marketingskills` |

- | **Reference** | High-signal individual contributors | `andrej-karpathy-skills` |

+ The Mall does NOT keep persistent local clones of source repos. The weekly cron clones each registered source into a workflow temp directory (`$SOURCES_DIR`), scans it, scores it, and discards the clone. The registry file is the only persistent record.

- The canonical store list lives in `scripts/store-sync.cjs` (the `STORES` array). The MALL folder and the STORES array must agree.

+ ## When to Use

- ## Refresh Procedure

+ - Proposing a new source store (run [store-evaluation](../store-evaluation/SKILL.md) first)

+ - Retiring a source store (run [staleness-discipline](../staleness-discipline/SKILL.md) first; use `/prune-source`)

+ - A weekly cron PR flags a source as unhealthy (broken remote, archived, license drift)

+ - Schema validation after editing `supported-stores.json`

- ### 1. Pull all repos

+ ## The registry: `sources/supported-stores.json`

- ```powershell

- foreach ($d in (Get-ChildItem -Directory C:\Development\MALL)) {

- Push-Location $d.FullName

- if (Test-Path ".git") {

- Write-Host "=== $($d.Name) ==="

- git pull --ff-only 2>&1

+ ```jsonc

+ {

+ "$schema": "./supported-stores.schema.json",

+ "schema_version": "2.0",

+ "stores": [

+ {

+ "name": "plugin-mall", // unique kebab-case; matches catalog/stores/<name>.json

+ "remote": "https://github.com/<org>/<repo>", // upstream URL (informational; not cloned for plugin-mall)

+ "pluginDir": "plugins", // where plugins live in the upstream repo

+ "quality": "first-party", // tier tag — see § Quality tiers

+ "provenance": true, // true ONLY for plugin-mall (drives +50 trust signal)

+ "license": "PolyForm-Noncommercial-1.0.0", // SPDX id, or null if unknown

+ "added_at": "2026-05-29"

+ },

+ {

+ "name": "awesome-copilot",

+ "remote": "https://github.com/github/awesome-copilot",

+ "pluginDir": "skills",

+ "quality": "official",

+ "provenance": false,

+ "license": "MIT",

+ "added_at": "2026-04-15"

}

- Pop-Location

+ ]

}

```

- Or use `store-sync.cjs` which does the same fetch as its first step:

- ```bash

- node scripts/store-sync.cjs

- ```

- ### 2. Check health

- After pulling, verify each repo:

+ ### Required fields

- | Check | Pass | Fail action |

- | --- | --- | --- |

- | `git pull` succeeds (ff-only) | Clean fast-forward or "already up to date" | If diverged: investigate local changes. If network error: retry later. |

- | Remote URL resolves | GitHub returns 200 | Repo may have moved or been deleted. Check for redirect or replacement. |

- | Repo is not archived | GitHub API: `archived: false` | Flag for retirement review. Archived + stable = keep with note. Archived + stale = retire. |

- | Last upstream commit within 12 months | Recent activity | Low-velocity is OK for reference repos (e.g., karpathy-skills). No activity + no value = retire candidate. |

- | No local uncommitted changes | Clean working tree | MALL repos should never have local changes. If found, discard or investigate. |

- | Branch is default (main/master) | On default branch | Reset to default. MALL clones track upstream only. |

+ | Field | Type | Notes |

+ |---|---|---|

+ | `name` | string | Kebab-case, ≤32 chars, unique across the registry; produces `catalog/stores/<name>.json` |

+ | `remote` | string | Upstream URL (HTTPS). For `plugin-mall`, this is informational; for everyone else, it's what `bootstrap-sources.cjs` clones |

+ | `pluginDir` | string | Path under the upstream repo where plugins live (`.`, `plugins`, `skills`, `agents`, etc.). Use `.` if plugins live at the repo root. |

+ | `quality` | enum | See § Quality tiers below |

+ | `provenance` | bool | `true` ONLY for `plugin-mall` (drives the +50 trust signal). `false` for all third-party stores. |

+ | `license` | string or null | SPDX identifier (e.g., `MIT`, `Apache-2.0`, `PolyForm-Noncommercial-1.0.0`). `null` if unknown — license signal will score 0. |

+ | `added_at` | string | `YYYY-MM-DD` of registry add |

- ### 3. Reconcile with store-sync.cjs

+ ### Optional fields

- The `STORES` array in `store-sync.cjs` must match the MALL folder contents:

+ | Field | Type | Notes |

+ |---|---|---|

+ | `local_dir_name` | string | Override the directory name used inside `$SOURCES_DIR` when bootstrapping. Defaults to `name`. Use when the upstream repo has a different conventional folder name. |

+ | `note` | string | Human-readable note (audit trail) |

+ | `pruned_at` | string | `YYYY-MM-DD` of removal (use during the two-step prune; final delete removes the entry entirely) |

- | MALL folder | STORES array | Action |

- | --- | --- | --- |

- | Present | Listed | OK |

- | Present | Not listed | Add to STORES array, or the repo does not belong in MALL |

- | Absent | Listed | Clone it, or remove from STORES array |

+ ## Quality tiers

- ## Adding a New Source Repo

+ | Tier | Meaning | Examples of fit |

+ |---|---|---|

+ | `first-party` | The Mall's own curated plugins (`plugin-mall` only) | `plugin-mall` |

+ | `official` | Maintained by a major platform vendor with editorial standards | `awesome-copilot` (GitHub), `microsoft-skills` |

+ | `community-curated` | Community repo with explicit curation standards | `awesome-mcp-servers`, `awesome-claude-code` |

+ | `community` | Individual or small-team plugin collections | personal skill repos |

+ | `domain` | Vertical-specific plugin collections | game-dev, marketing, healthcare |

+ | `reference` | High-signal individual contributors | named researchers, well-known authors |

- 1. **Evaluate fit**: Does this repo contain plugins, skills, or agents relevant to ACT-Edition heirs? Apply the same judgment as store-evaluation but at the repo level.

- 2. **Clone**: `git clone <url> C:\Development\MALL\<short-name>`

- 3. **Register**: Add an entry to the `STORES` array in `scripts/store-sync.cjs` with:

- - `name`: short kebab-case identifier

- - `path`: `path.join(MALL_DIR, '<folder-name>')`

- - `pluginDir`: where plugins live in that repo (`.`, `plugins`, `skills`, `src`, etc.)

- - `quality`: tier tag (see tier table above)

- 4. **Verify**: Run `node scripts/store-sync.cjs` and confirm the new store appears in `mall/STORE-INVENTORY.md`

- 5. **Record**: Note the addition in `docs/ledgers/curation-log.md`

+ The `quality` tier is informational — it does NOT directly affect the trust score. Trust is computed from the six published signals (provenance, maintenance, adoption, license, frontmatter, README). Quality tier helps reviewers triage; the signals do the scoring.

- ## Retiring a Source Repo

+ ## Adding a new source

- 1. **Confirm**: The repo is archived, deleted, or no longer produces relevant content

- 2. **Check dependencies**: Grep `Alex_ACT_Plugin_Mall/` for plugins that originated from this store. If any exist, they survive independently in the Mall (retirement of the source does not retire the plugins).

- 3. **Remove from STORES array** in `store-sync.cjs`

- 4. **Optionally delete** the local clone from `C:\Development\MALL\` (reversible by re-cloning)

- 5. **Record**: Note the retirement in `docs/ledgers/curation-log.md`

+ Use the `/add-source` prompt. Sequence:

- ## Inventory Report

+ 1. Run [store-evaluation](../store-evaluation/SKILL.md) first (scorecard ≥ 7 required)

+ 2. Determine `name`, `pluginDir`, `quality`, `license`

+ 3. Add the entry to `supported-stores.json` (alphabetical by `name`)

+ 4. Run `node scripts/scan-sources.cjs` locally with `SOURCES_DIR` pointing at a temp dir

+ 5. Verify the new store produces a plausible `catalog/stores/<name>.json`

+ 6. Commit `[behaviour] add source: <name>` and let Monday's cron produce the first full catalog refresh

- `store-sync.cjs` produces two artifacts:

+ ## Retiring a source

- | Artifact | Location | Content |

- | --- | --- | --- |

- | `mall/STORE-INVENTORY.md` | Markdown | Human-readable plugin list with descriptions, grouped by store |

- | `mall/store-inventory.json` | JSON | Machine-readable inventory for downstream tooling |

+ Use the `/prune-source` prompt. Sequence:

- The `/scan-stores` prompt consumes these to match plugins against fleet needs.

+ 1. Run [staleness-discipline](../staleness-discipline/SKILL.md) to confirm a staleness signal fires

+ 2. Add a `// pruned-pending: YYYY-MM-DD reason: <reason>` line above the entry and comment the entry out

+ 3. Commit `[behaviour] prune source (pending): <name>`

+ 4. Wait one weekly cron cycle to verify the catalog refresh PR shows the expected removal cleanly

+ 5. Delete the commented-out entry in the next commit

+ 6. Commit `[behaviour] prune source (delete): <name>`

- ## Health Dashboard (manual)

+ ## Health checks (run during PR review)

- After a refresh, summarize the fleet of source repos:

+ When reviewing a weekly catalog-refresh PR, sanity-check each store:

- ```

- | --- | --- | --- | --- | --- |

- | .github-private | agency-microsoft/.github-private | 2026-05-01 | active | 42 |

- | ... | ... | ... | ... | ... |

- ```

+ | Check | Pass | Action on fail |

+ |---|---|---|

+ | `bootstrap-sources.cjs` cloned the remote successfully | Workflow log shows clone success | Investigate remote; remote may have moved or repo may be deleted — surface in PR comments |

+ | `scan-sources.cjs` produced a non-zero plugin count | Plugin count > 0 in `catalog/stores/<name>.json` | Check `pluginDir` — upstream may have renamed the plugins folder |

+ | `fetch-github-stats.cjs` returned data | Stars / contributors / last_commit populated in `scoring/github-stats.json` | API rate-limit hit, OR repo is archived/private — surface in PR |

+ | `compute-trust.cjs` produced a non-null score | `trust_score` populated in `catalog/stores/<name>.json` | A signal is missing or unparseable — check `scoring/trust-audit.md` for the per-store breakdown |

## Anti-Patterns

| Anti-pattern | Correction |

- | --- | --- |

- | Making local edits in MALL repos | MALL clones are read-only mirrors. Never commit locally. |

- | Adding a repo to MALL without registering in store-sync.cjs | Unregistered repos are invisible to the inventory pipeline |

- | Keeping archived repos indefinitely | Review archived repos quarterly; retire if no longer producing value |

- | Cloning huge repos for one plugin | Prefer shallow clone (`--depth 1`) for large repos with narrow relevance |

- | Running `/scan-stores` without refreshing first | Stale clones produce stale inventory. Always pull before scanning. |

+ |---|---|

+ | Adding a source without running store-evaluation | The scorecard is the bar; skip it and stale stores accumulate |

+ | Setting `provenance: true` for a third-party store | Provenance is for `plugin-mall` only — it drives the +50 first-party trust signal, not "I trust this maintainer" |

+ | Hand-editing `catalog/stores/<name>.json` | Catalog is generated; the only thing you edit is the registry |

+ | Deleting a registry entry in one commit | Always use the two-step prune so one cron cycle can verify the catalog refresh PR is clean |

+ | Skipping the schema validation step | The schema catches simple errors (typo'd field name, wrong enum value, malformed URL) before they break the workflow |

## Falsifiability

- This skill is not earning its tokens if, after 90 days:

+ This skill is wrong if any of the following occur by **2026-08-29** (90 days):

- - The MALL folder and STORES array have drifted (repos present but unregistered, or vice versa)

- - No source repo health check has been recorded in the curation log

- - A stale source repo caused a bad plugin promotion that could have been caught by the health check

+ - A registry entry that passed `/add-source` review gets pruned within 30 days (scorecard bar too lax)

+ - A pruned store gets re-added within 30 days (staleness signals miscalibrated)

+ - The schema lets through an invalid entry that breaks the workflow ≥1 time

+ - The quality-tier taxonomy needs revision ≥2 times in a quarter (taxonomy is wrong shape)

+ Track outcomes in `docs/curation-log.md` tagged `[SOURCE-INVENTORY]`.

## Related

- - [mall-curation](../mall-curation/SKILL.md) -- downstream: curates the Plugin Mall itself

- - [store-evaluation](../store-evaluation/SKILL.md) -- downstream: scores individual plugins

- - [staleness-discipline](../staleness-discipline/SKILL.md) -- parallel: detects stale Mall content

- - `scripts/store-sync.cjs` -- mechanical fetch and inventory

- - `/refresh-mall-sources` prompt -- operator entry point

- - `/scan-stores` prompt -- consumes the inventory this skill produces

+ - [store-evaluation](../store-evaluation/SKILL.md) — gate before adding

+ - [staleness-discipline](../staleness-discipline/SKILL.md) — gate before pruning

+ - [mall-self-curation](../mall-self-curation/SKILL.md) — the pipeline this registry feeds

+ - `/add-source` prompt

+ - `/prune-source` prompt

+ - `sources/supported-stores.schema.json` — JSON schema