NDDev-it-com · rldyourmnd · Jul 19, 2026 · Jul 19, 2026
@@ -6,6 +6,19 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [2.1.5] - 2026-07-19
+
+### Added
+
+- The `nddev-builder` `core` toolkit gains three workflow skills (and matching
+  slash commands) on top of the `add-*` set: `scaffold-plugin` composes a whole
+  plugin from an intent, `devtest-plugin` runs an isolated install-and-verify
+  loop in throwaway `HOME`/`ZCODE_HOME`, and `release-review` gates a whole
+  marketplace for release readiness. These stay within the ZCode 3.3.6 surface
+  (flatten-to-user-scope; no `plugin add`, cache, or dev-mode), so no publish,
+  managed-requirements, or remote-marketplace-source features were added. The
+  toolkit is now 19 skills / 19 slash commands.
+
 ## [2.1.4] - 2026-07-16
 
 ### Changed

@@ -8,7 +8,7 @@ changes.
 
 - **Author:** Danil Silantyev (github:rldyourmnd), CEO NDDev
 - **License:** AGPL-3.0-or-later
-- **Build version:** 2.1.4
+- **Build version:** 2.1.5
 - **Verified ZCode runtime:** app 3.3.6, CLI 0.15.2, model GLM-5.2
 
 ## What this repository contains
@@ -69,7 +69,7 @@ restore, remove, and custom-target usage.
 
 Each directory under `zcode_tools/marketplaces/` is a complete setup:
 
-- `nddev-builder` enables its reusable 16-skill, 16-command `core` toolkit for
+- `nddev-builder` enables its reusable 19-skill, 19-command `core` toolkit for
   creating and managing ZCode marketplaces, plugins, and components.
 - `nddev-designer` is a deliberately lean product-design profile focused on
   design-system consistency, accessibility, responsive states, and

@@ -1 +1 @@
-2.1.4
+2.1.5
@@ -1,6 +1,6 @@
 {
   "name": "nddev-zcode-app",
-  "build_version": "2.1.4",
+  "build_version": "2.1.5",
   "source_root": "zcode_tools/marketplaces/",
   "installer": "cli-tools/scripts/install.sh install --setup <id>",
   "layout": {

@@ -2,15 +2,15 @@
   "schema_version": 2,
   "module": {
     "repository": "NDDev-it-com/nddev-zcode-app",
-    "setup_digest": "sha256:51f95a940c545ea1c590d8613a7bd018815dbef6864acdfc974f7e4dd0fb689a"
+    "setup_digest": "sha256:7da756e9cd3e22080d2ac0d44ae9a55bfbcef7f248877058eb1e13898ae2ed0a"
   },
   "harness": {
     "repository": "NDDev-it-com/nddev-harnesses",
-    "commit": "f00fc21cc43b1510b33160e5026a743a6591d890"
+    "commit": "3fa150a3215943e32778f956282d75e4cbc0af32"
   },
   "adapter": {
     "id": "zcode",
-    "version": "2.1.4"
+    "version": "2.1.5"
   },
   "vendor": {
     "app_version": "3.3.6",
@@ -30,8 +30,8 @@
     }
   ],
   "lanes": [],
-  "generated_at_utc": "2026-07-19T02:11:35Z",
-  "expires_at_utc": "2027-01-15T02:11:35Z",
+  "generated_at_utc": "2026-07-19T08:34:26Z",
+  "expires_at_utc": "2027-01-15T08:34:26Z",
   "promotion": {
     "decision": "pending",
     "waivers": []

@@ -1,5 +1,5 @@
 {
-  "build_version": "2.1.4",
+  "build_version": "2.1.5",
   "zcode_app_version": "3.3.6",
   "zcode_cli_version": "0.15.2",
   "zcode_runtime": "GLM-5.2",

@@ -52,7 +52,7 @@ prefix.
 ### Setup profiles
 
 - `nddev-builder` enables `core@nddev-builder`, a native component-authoring
-  toolkit with 16 skills, 16 matching commands, and one reviewer agent.
+  toolkit with 19 skills, 19 matching commands, and one reviewer agent.
 - `nddev-designer` is a production-ready minimal design profile. Its empty
   extension maps are intentional; project-specific design tools come from the
   active workspace.

@@ -10,7 +10,7 @@
       "name": "core",
       "source": "./plugins/core",
       "description": "Reusable toolkit: skills, slash commands, and a reviewer subagent for building plugins, managing MCP servers and providers, authoring skills, and listing or removing components.",
-      "version": "2.1.4",
+      "version": "2.1.5",
       "author": {
         "name": "Danil Silantyev (github:rldyourmnd), CEO NDDev"
       },

@@ -1,6 +1,6 @@
 {
   "name": "core",
-  "version": "2.1.4",
+  "version": "2.1.5",
   "description": "Reusable ZCode toolkit: skills, slash commands, and a reviewer subagent for building plugins, managing MCP servers and providers, authoring skills, and listing or removing components.",
   "author": {
     "name": "Danil Silantyev (github:rldyourmnd), CEO NDDev",

@@ -3,16 +3,18 @@
 The `core` plugin is a reusable ZCode-native toolkit for creating and managing
 marketplaces, plugins, and convention-discovered components.
 
-- **16 skills**: `add-marketplace`, `add-plugin`, `add-skill`, `add-command`,
+- **19 skills**: `add-marketplace`, `add-plugin`, `add-skill`, `add-command`,
   `add-agent`, `add-hook`, `add-mcp-server`, `add-provider`, `add-reference`,
   `add-tool`, `add-instructions`, `list-components`, `remove-component`,
-  `enable-plugin`, `nddev-builder-orientation`, and `validate-components`.
-- **16 slash commands**: `/nddev-add-marketplace`, `/nddev-add-plugin`,
+  `enable-plugin`, `nddev-builder-orientation`, `validate-components`,
+  `scaffold-plugin`, `devtest-plugin`, and `release-review`.
+- **19 slash commands**: `/nddev-add-marketplace`, `/nddev-add-plugin`,
   `/nddev-add-skill`, `/nddev-add-command`, `/nddev-add-agent`,
   `/nddev-add-hook`, `/nddev-add-mcp`, `/nddev-add-provider`,
   `/nddev-add-reference`, `/nddev-add-tool`, `/nddev-add-instructions`,
-  `/nddev-list`, `/nddev-remove`, `/nddev-enable`, `/nddev-orient`, and
-  `/nddev-validate`.
+  `/nddev-list`, `/nddev-remove`, `/nddev-enable`, `/nddev-orient`,
+  `/nddev-validate`, `/nddev-scaffold`, `/nddev-devtest`, and
+  `/nddev-release-review`.
 - **1 subagent**: `nddev-native-reviewer` (GLM-5.2).
 
 ## Capabilities
@@ -32,6 +34,9 @@ marketplaces, plugins, and convention-discovered components.
 | `list-components` | Inventory marketplace components without mutation |
 | `remove-component` | Remove a component after reference checks |
 | `enable-plugin` | Enable or disable a plugin in the CLI configuration |
+| `scaffold-plugin` | Compose a whole plugin from an intent |
+| `devtest-plugin` | Isolated install-and-verify loop in throwaway state |
+| `release-review` | Gate a whole marketplace for release readiness |
 | `nddev-native-reviewer` | Review ZCode-native format correctness |
 
 Development-only test, benchmark, release, and repository-doctor capabilities

@@ -0,0 +1,12 @@
+---
+description: Isolated install-and-verify loop for a marketplace using temporary HOME/ZCODE_HOME, proving components flatten and load without touching live ~/.zcode.
+---
+
+Behaviorally test a marketplace in throwaway state.
+
+Follow the `devtest-plugin` skill exactly: static-gate with
+`validate-components`, isolate `HOME` and `ZCODE_HOME` in a temporary directory,
+run `install.sh --plan` then `--apply`, assert each basename flattened once into
+`~/.zcode/{skills,commands,agents}` (references and tools are not flattened),
+restart to reload, then tear down. Never touch live `~/.zcode`. ZCode has no
+`plugin add`, cache, or dev-mode reload.
@@ -0,0 +1,11 @@
+---
+description: Review a whole marketplace for release readiness — identity and version-lockstep presence, cross-plugin basename safety, inert-field and secret scans, and a clean install plan.
+---
+
+Review a whole marketplace for release readiness.
+
+Follow the `release-review` skill exactly: run `validate-components`, pass each
+new or changed artifact through `nddev-native-reviewer`, then check bundle
+coherence — plugin identity, version-lockstep presence, no inert fields, no
+secrets, English only, and a clean `install.sh --plan`. Authoring-time gate only;
+never set pins, tags, or evidence.
@@ -0,0 +1,10 @@
+---
+description: Compose a complete ZCode plugin from an intent — a metadata-only manifest plus the needed skills, commands, agents, hooks, or MCP — and register it in the marketplace.
+---
+
+Compose a whole plugin from a described intent.
+
+Follow the `scaffold-plugin` skill exactly: fix the plugin boundary and the
+minimal component set, scaffold with `add-plugin`, add each component with its
+`add-*` skill (keeping every basename repo-unique), wire only real dependencies,
+and finish with `validate-components` and a clean `install.sh --plan`.
@@ -0,0 +1,43 @@
+---
+name: devtest-plugin
+description: Runs an isolated install-and-verify loop for a marketplace using temporary HOME and ZCODE_HOME, proving components flatten and load without touching live ~/.zcode. Use to behaviorally test a plugin during development, after static validation.
+---
+
+# devtest-plugin
+
+Prove a marketplace actually installs and its components load — in throwaway
+state, never against the owner's live `~/.zcode`.
+
+## What ZCode does and does NOT provide (read this first)
+
+ZCode 3.3.6 has **no** `zcode plugin add`, no plugin cache, no `/plugins`
+command, and no developer-mode hot reload. Headless activation is the installer
+**flattening** each plugin's `skills/`, `commands/`, and `agents/` into
+`~/.zcode/{skills,commands,agents}`; UI activation (Discover → +) is a separate,
+non-scriptable path. So this loop is install-and-inspect, not a CLI cache-buster.
+See `nddev-builder-orientation`.
+
+## Procedure
+
+1. **Static gate.** `validate-components` must pass first.
+2. **Isolate.** Create a temporary directory and point both `HOME` and
+   `ZCODE_HOME` into it. Never run against the real `~/.zcode`.
+3. **Plan.** `install.sh install --setup <mp> --target <tmp> --plan` — read-only
+   staged verification; it must report a clean plan.
+4. **Apply.** `install.sh install --setup <mp> --target <tmp> --apply` into the
+   isolated target.
+5. **Assert the flatten.** Confirm each expected skill, command, and agent
+   basename now exists exactly once under the isolated
+   `~/.zcode/{skills,commands,agents}`, and that `references/` and `tools/` were
+   NOT flattened.
+6. **Reload to observe.** Component discovery is read at startup; a running ZCode
+   must be restarted to pick up changes. Note this rather than expecting a live
+   reload.
+7. **Tear down.** Remove the temporary state; the loop leaves no trace in live
+   user state.
+
+## Rules
+
+- Never touch live `HOME` or `~/.zcode`; always isolated temporary state.
+- Static validation (`validate-components`) precedes every behavioral run.
+- Report exactly what installed and loaded; a static pass is not a load proof.
@@ -95,3 +95,9 @@ Author with the dedicated skills; each now documents the flatten reality:
 `add-provider`, `add-plugin`, `add-marketplace`, `add-reference`, `add-tool`,
 `add-instructions`; inspect with `list-components`, remove with
 `remove-component`, pre-check with `validate-components`.
+
+For whole-plugin and whole-marketplace work, three workflow skills sit on top of
+the `add-*` set: `scaffold-plugin` composes a complete bundle from an intent,
+`devtest-plugin` runs an isolated install-and-verify loop in throwaway
+`HOME`/`ZCODE_HOME`, and `release-review` gates the whole marketplace for release
+readiness before shipping.
@@ -0,0 +1,42 @@
+---
+name: release-review
+description: Reviews a whole ZCode marketplace for release readiness across all plugins — identity and version-lockstep presence, cross-plugin basename safety, inert-field and secret scans, English-only, and a clean install plan. Use before shipping a marketplace, after per-artifact review and static validation.
+---
+
+# release-review
+
+A whole-marketplace, cross-artifact readiness gate. `nddev-native-reviewer`
+reviews one artifact and `validate-components` runs mechanical static checks;
+this skill reviews the **bundle** for release coherence. It is an authoring-time
+gate only — it never sets version pins, tags, or release evidence, which are
+owned by the repository's private release process.
+
+## What to review (whole marketplace)
+
+1. **Static gate first.** `validate-components` must pass: frontmatter, name
+   patterns, JSON validity, cross-plugin basename uniqueness, and a clean
+   `install.sh install --setup <mp> --plan`.
+2. **Per-artifact quality.** Each new or changed skill, command, and agent passes
+   `nddev-native-reviewer` (ZCode-native format plus an actionable trigger
+   description).
+3. **Identity coherence.** Every plugin's `.zcode-plugin/plugin.json` `name`
+   equals its directory and its `marketplace.json` entry; each `source` is a
+   local `./plugins/<name>` that exists; descriptions match between the manifest
+   and the catalog entry.
+4. **Version-lockstep presence.** If the marketplace ships in this release, the
+   five version sources agree (see `add-plugin` step 8). Flag any drift; do not
+   set pins here.
+5. **Execution-boundary hygiene.** No inert `lspServers`/`outputStyles`/
+   `channels`/`settings` fields and no manifest component arrays (ZCode 3.3.6
+   records but never executes them).
+6. **Safety and language.** No secrets, credentials, or machine-local absolute
+   paths in any tracked file; English only across code, docs, and manifests.
+7. **Install proof.** The `--plan` gate is clean; for a behavioral pass, run
+   `devtest-plugin` into isolated state.
+
+## Result
+
+Return PASS only when the static gate, every per-artifact review, and the
+whole-bundle coherence checks all succeed. Otherwise return FAIL with the
+plugin or component path, the coherence risk, and the correction. Never return a
+green result while any check is unproven.
@@ -0,0 +1,58 @@
+---
+name: scaffold-plugin
+description: Composes a complete ZCode plugin from a described intent — a metadata-only manifest plus the right mix of skills, commands, agents, hooks, and MCP config — and registers it in the marketplace. Use when starting a plugin from a goal rather than adding one component at a time.
+---
+
+# scaffold-plugin
+
+Turn a described capability into a complete, install-ready ZCode plugin bundle in
+one pass, then hand off to `validate-components`. This orchestrates the focused
+`add-*` skills; it does not replace them.
+
+## When to use
+
+Use when the input is an intent ("a plugin that reviews Terraform and blocks
+unsafe applies") rather than a single component. To add one skill or command to
+an existing plugin, use the matching `add-*` skill directly.
+
+## ZCode facts this skill respects
+
+- A plugin is a metadata-only `.zcode-plugin/plugin.json` plus components under
+  convention directories. ZCode 3.3.6 executes only `commands`, `skills`,
+  `hooks`, `mcpServers`, and user-scope `agents`; never scaffold the inert
+  `lspServers`/`outputStyles`/`channels`/`settings` fields or manifest component
+  arrays. See `nddev-builder-orientation`.
+- The headless install flattens every plugin's `skills/`, `commands/`, and
+  `agents/` into `~/.zcode/{skills,commands,agents}` and fails closed on a
+  duplicate basename, so every component this skill emits must have a
+  repo-unique name.
+
+## Procedure
+
+1. **Fix the boundary.** From the intent, decide the plugin's single
+   responsibility and the exact components it needs — which skills, which
+   commands, whether an agent, a hook, or an MCP server is genuinely required.
+   Prefer the smallest set that meets the intent.
+2. **Pick or create the marketplace.** Use `add-marketplace` if none fits, then
+   scaffold the empty bundle with `add-plugin` (manifest + directories + README +
+   marketplace entry).
+3. **Add each component** with its focused skill: `add-skill`, `add-command`,
+   `add-agent`, `add-hook`, `add-mcp-server`, `add-instructions`,
+   `add-reference`, `add-tool`, `add-provider`. Keep every basename unique across
+   the whole repository.
+4. **Wire dependencies only if real** (for example, an MCP-consuming plugin
+   depends on the MCP transport plugin) — `name@marketplace` strings, with
+   cross-marketplace dependencies listed in `allowCrossMarketplaceDependenciesOn`.
+5. **Validate** with `validate-components`, then the non-mutating
+   `install.sh install --setup <mp> --plan` gate. Run `devtest-plugin` for a
+   behavioral pass.
+6. **Record the release** per `add-plugin` step 8 (one SemVer across the five
+   version sources plus `CHANGELOG.md`) if the bundle ships.
+
+## Rules
+
+- English only. Metadata-only manifests; never declare component arrays.
+- Smallest component set that meets the intent; every emitted basename unique
+  across all plugins.
+- Generated content is a starting point — complete each component and run
+  `validate-components` before shipping.