feat: add the-workshop plugin — multi-agent coordination with persistent desks

[jennyf19]

What

Adds the-workshop — a multi-agent coordination framework where long-running AI agents (desks) work in the same room, on the same work, each with its own memory and history.

Install

copilot plugin install the-workshop@awesome-copilot

Why it belongs here

The Workshop complements Ember (already on awesome-copilot):

• Ember = partnership framework for ONE agent (how an AI shows up)
• The Workshop = coordination framework for MANY agents (how a room works together)

Install both for the full stack.

Components

Type	Name	Description
Agent	Workshop TA	Room coordinator — sees all desks, routes work, tracks state
Skill	desk-open	Create a new desk with journal and folder structure
Skill	desk-journal	Read/write persistent memory across sessions
Skill	signal-write	Emit structured signals: hands-up, blocked, done, checkpoint
Skill	bench-read	Read shared artifacts from the workspace

Key concepts

• Desks — long-running agents with persistent journals. Each has its own frame and equal standing to disagree with other desks.
• The Bench — shared workspace where desks leave artifacts for each other.
• Signals — structured state changes (hands-up, blocked, done, checkpoint).
• The Cairn — operating disposition: stop is a valid finish, never bluff, equal standing. Read it →

Source

jennyf19/the-workshop — includes a canvas extension (signals dashboard) for the GHCP app.

Files

• plugins/the-workshop/ — plugin entry (plugin.json + README)
• agents/workshop-ta.agent.md — TA coordinator agent
• skills/{desk-open,desk-journal,signal-write,bench-read}/ — skills
• .github/plugin/marketplace.json — marketplace entry added

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

🔒 PR Risk Scan Results

Scanned 15 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	2
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	package-exec-command	docs/README.skills.md	31	| [acreadiness-assess](../skills/acreadiness-assess/SKILL.md)<br />`gh skills install github/awesome-copilot acreadiness-assess` | Run the AgentRC readiness assessment on the curre
🟠	unpinned-version-indicator	extensions/signals-dashboard/package.json	7	"@​​github/copilot-sdk": "latest"

Skipped non-text or missing files

• extensions/signals-dashboard/assets/preview.png

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔍 Vally Lint Results

⚠️ Warnings or advisories found

Scope	Checked
Skills	5
Agents	1
Total	6

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	1

Summary

Level	Finding
ℹ️	Vally currently lints SKILL.md content. Agent files were detected but skipped:

Full linter output

### Linting skills/bench-read
npm warn EBADENGINE Unsupported engine {
npm warn EBADENGINE   package: 'commander@15.0.0',
npm warn EBADENGINE   required: { node: '>=22.12.0' },
npm warn EBADENGINE   current: { node: 'v20.20.2', npm: '10.8.2' }
npm warn EBADENGINE }
npm warn deprecated prebuild-install@7.1.3: No longer maintained. Please contact the author of the relevant native addon; alternatives are available.
✅ bench-read (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Linting skills/desk-journal
✅ desk-journal (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Linting skills/desk-open
✅ desk-open (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Linting skills/signal-write
✅ signal-write (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Linting skills/workshop-create
✅ workshop-create (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Agent files detected (not linted by vally)
ℹ️ Vally currently lints SKILL.md content. Agent files were detected but skipped:
agents/workshop-ta.agent.md

[Copilot]

Pull request overview

Adds The Workshop plugin for coordinating persistent multi-agent desks through shared journals, artifacts, and signals.

Changes:

• Adds the Workshop TA coordinator agent.
• Adds four desk-management and signaling skills.
• Adds plugin metadata, documentation, and marketplace registration.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
agents/workshop-ta.agent.md	Defines the coordinator agent.
skills/desk-open/SKILL.md	Creates persistent desks.
skills/desk-journal/SKILL.md	Manages desk journals.
skills/signal-write/SKILL.md	Defines structured signals.
skills/bench-read/SKILL.md	Reads shared artifacts.
plugins/the-workshop/README.md	Documents installation and concepts.
plugins/the-workshop/.github/plugin/plugin.json	Declares plugin components.
.github/plugin/marketplace.json	Registers the plugin.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (6)

plugins/the-workshop/README.md:25

• The manifest installs workshop-create, and the Workshop TA explicitly invokes it, but the plugin's component inventory omits it. Add the skill here so users can discover every installed component and understand how workshop roots are created.

| Skill | [Bench Read](../../skills/bench-read/) | Read shared artifacts from the workspace where desks leave work for each other |

extensions/signals-dashboard/extension.mjs:103

• The parsed signal is accepted without any schema or type validation, but its score, token, outcome-rating, and effort fields are later interpolated into HTML without consistent escaping. A crafted .signals/*.json file can therefore inject markup or script into the canvas (partnership scores are rendered even when their values are strings). Validate/coerce the complete signal schema and escape every dynamic render sink before retaining the object.

                    const raw = await readFile(fp, "utf-8");
                    const parsed = JSON.parse(raw);
                    allSignals.push({ parsed, mtimeMs: s.mtimeMs, path: fp });

extensions/signals-dashboard/extension.mjs:128

• When a latest signal has a run_id but no matching outcome, this fallback can attach an outcome belonging to a different run merely because it was written within an hour. That produces an incorrect quality rating and honesty gap. Legacy fallback should only pair records where both sides lack run_id; otherwise leave the outcome unmatched.

                // Also check for any recent outcome (within 1hr of latest signal) if no run_id match
                if (!outcome) {
                    const recentOutcomes = allSignals
                        .filter(s => s.parsed.signal_type === "outcome" && s.mtimeMs >= latestTime && (s.mtimeMs - latestTime) < 3600000)
                        .sort((a, b) => a.mtimeMs - b.mtimeMs);

extensions/signals-dashboard/extension.mjs:101

• Every dashboard refresh stats, reads, and parses every historical signal file, while the client refreshes every five seconds and desks are designed to accumulate signals indefinitely. The scan cost therefore grows without bound and overlapping refreshes can amplify disk I/O on long-running workshops. Cache parsed files by path/mtime or maintain a bounded/indexed latest-signal view instead of rereading the full history.

            for (const f of jsonFiles) {
                const fp = join(sigDir, f);
                try {
                    const s = await stat(fp);
                    const raw = await readFile(fp, "utf-8");

extensions/signals-dashboard/extension.mjs:590

• Replacing the entire content subtree every five seconds destroys the currently focused stash/path/restore button. Keyboard users lose their position repeatedly and may be unable to operate controls reliably. Preserve and restore focus by the button's action/desk identity, or update keyed cards without replacing focused nodes.

                const newContent = doc.getElementById('content');
                if (newContent) {
                    document.getElementById('content').innerHTML = newContent.innerHTML;

skills/bench-read/SKILL.md:43

• workshop-create scaffolds bench/ as the shared workspace, but this reader instead defines the entire root and desk directories as the bench and never directs agents to bench/. Producers and consumers can therefore place and search for cross-desk artifacts in different locations. Define bench/ as the canonical shared-artifact path and distinguish it from desk-local work.

The bench is the workshop directory itself and its subdirectories.
Common patterns:

desks// # each desk's own workspace
journal.md # the desk's memory
# work products from this desk

# cross-desk artifacts

[Copilot]

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (7)

extensions/signals-dashboard/extension.mjs:652

• The same-origin check trusts the request's Host header both here and in isCrossSiteRequest. A DNS-rebinding page can therefore send Host: attacker.example:<port> and the matching Origin, pass the check, read workshop signals, and invoke stash/restore/open. Validate the Host against the canonical 127.0.0.1:<actual-port> before serving requests (the hardened pattern is demonstrated in extensions/connector-namespaces/server.mjs:38-39,138-147).

    const server = createServer(async (req, res) => {
        const url = new URL(req.url, `http://${req.headers.host}`);

extensions/signals-dashboard/extension.mjs:652

• The async HTTP listener has no top-level error boundary. Failures from writeFile (for example a read-only workshop or full disk), malformed percent-encoding in decodeURIComponent, or another awaited operation reject the listener promise; Node's HTTP server does not turn that rejection into a response, so the extension can terminate instead of returning an error. Wrap request dispatch in try/catch and return a controlled 4xx/5xx response.

async function startServer(instanceId, workshopDir) {
    const server = createServer(async (req, res) => {
        const url = new URL(req.url, `http://${req.headers.host}`);

skills/workshop-create/SKILL.md:47

• Path B creates and clones the repository before this skill tells the agent to check whether the destination parent is already in a Git worktree. Because gh repo create --clone clones into the current directory, invoking the skill from an existing repository creates exactly the nested repository the skill promises to prevent (and creates the remote before discovering the mistake). Select and validate the clone parent before running gh repo create.

2. **Create the repo:** `gh repo create <owner>/<name> --private --clone`
   - Use the operator's signed-in GitHub account as `<owner>`
   - Clone it to a sensible location (ask the operator where, or use
     their configured workshops directory)

plugins/the-workshop/README.md:22

• The installed manifest includes the new workshop-create skill, and the TA directs users to it, but the plugin's component inventory omits it. Users reading the plugin README cannot discover the only documented workflow for creating the workshop root. Add it to this table.

| Skill | [Desk Open](../../skills/desk-open/) | Create a new desk with journal and folder structure |

extensions/signals-dashboard/extension.mjs:132

• Every dashboard refresh stats, reads, and parses every historical signal file for every desk, while the bundled client repeats this scan every five seconds and signal-write continually creates timestamped files. For the advertised long-running desks, refresh cost and I/O therefore grow without bound. Keep an index/cache, read only the newest non-outcome signal plus relevant outcomes, or define a retention policy rather than rescanning the full history.

            for (const f of jsonFiles) {
                const fp = join(sigDir, f);
                try {
                    const s = await stat(fp);
                    const raw = await readFile(fp, "utf-8");

skills/workshop-create/SKILL.md:52

• desks/ and bench/ are empty, so Git will not include them in the commit made by step 4. The pushed repository—and any later clone—therefore lacks two directories that this flow claims to scaffold. Add tracked sentinel files (for example .gitkeep) or another initial tracked file in each directory before committing.

     desks/
     bench/

skills/bench-read/SKILL.md:34

• This location contract conflicts with workshop-create, which explicitly creates bench/ as the shared workspace. Calling the whole workshop root “the bench” and showing shared artifacts at the root gives desks two incompatible destinations and can make producers and readers look in different places. Define bench/ as the cross-desk artifact location while retaining desks/<name>/ for desk-owned work.

The bench is the workshop directory itself and its subdirectories.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (2)

extensions/signals-dashboard/extension.mjs:45

• The same-origin check trusts the request's Host header. A DNS-rebinding request can send Host: attacker.example:<port> and Origin: http://attacker.example:<port>, pass this equality check, and invoke the state-changing stash/restore APIs. Compare against the canonical 127.0.0.1:<bound-port> origin and reject noncanonical Host headers; extensions/connector-namespaces/server.mjs:126-155 demonstrates both checks.

function isCrossSiteRequest(req) {
    const origin = req.headers.origin;
    if (origin) {
        if (origin === `http://${req.headers.host}`) return false;
        if (origin === "null") return true;

extensions/signals-dashboard/extension.mjs:652

• An async HTTP listener's rejected promise is not handled by Node. Here malformed percent encoding in any decodeURIComponent call, or a failed stash write, rejects the listener and can terminate the extension instead of returning an HTTP error. Invoke an async request handler from a non-async listener and attach a catch that sends a 400/500 response, as done in extensions/connector-namespaces/server.mjs:576-584.

async function startServer(instanceId, workshopDir) {
    const server = createServer(async (req, res) => {
        try {

[Copilot]

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (2)

extensions/signals-dashboard/extension.mjs:44

• The same-origin exception trusts the request's Host header, so a DNS-rebinding request with Host: attacker.example:<port> and the matching Origin is accepted as local and can invoke the stash/restore endpoints. The repository's canonical implementation explicitly compares against the captured loopback origin and rejects noncanonical hosts (extensions/connector-namespaces/server.mjs:126-155, tested at server.test.mjs:76-80). Capture this server's 127.0.0.1:<port> origin after binding and validate against that value instead of req.headers.host.

function isCrossSiteRequest(req) {
    const origin = req.headers.origin;
    if (origin) {
        if (origin === `http://${req.headers.host}`) return false;

extensions/signals-dashboard/extension.mjs:76

• These stash updates are unprotected read-modify-write operations. Two quick stash/restore requests can both read the same array and then overwrite each other, losing one user's state change; the delegated click handler can issue exactly such concurrent requests. Serialize mutations per workshop (or use an atomic locked update) so each operation reads the result of the previous one.

async function stashDesk(workshopDir, deskName) {
    const stash = await readStash(workshopDir);
    if (stash.some(e => e.name === deskName)) return stash;
    stash.push({ name: deskName, stashedAt: new Date().toISOString() });
    await writeStash(workshopDir, stash);

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (6)

extensions/signals-dashboard/extension.mjs:46

• The same-origin check derives trust from the attacker-controlled Host header. A DNS-rebinding request can send matching Host/Origin values, pass this gate, fetch dashboard data, and invoke /api/open to expose local paths. Capture the canonical 127.0.0.1:<bound-port> origin after listening, reject noncanonical hosts, and compare Origin only to that value (as in extensions/connector-namespaces/server.mjs:38-39,141-154).

    if (origin) {
        if (origin === `http://${req.headers.host}`) return false;
        if (origin === "null") return true;
        if (/^https?:\/\//i.test(origin)) return true;

extensions/signals-dashboard/extension.mjs:134

• Filesystem mtime is not a persistent event timestamp: cloning or checking out a Git-backed workshop resets mtimes. The dashboard can then select an old signal as latest and report it as newly emitted. Add a validated emitted_at field to the signal schema (or a standardized filename timestamp fallback) and use that for ordering/display.

                    const s = await stat(fp);
                    const raw = await readFile(fp, "utf-8");
                    const parsed = JSON.parse(raw);
                    allSignals.push({ parsed, mtimeMs: s.mtimeMs, path: fp });

extensions/signals-dashboard/extension.mjs:160

• Time proximity does not establish correlation. If execution B is latest and an outcome for execution A arrives afterward within an hour, this pairs A's rating with B and computes a false honesty gap; it can also attach an outcome to an escalation. Require a matching run_id or another explicit correlation ID, and leave uncorrelated outcomes unpaired.

                if (!outcome) {
                    const recentOutcomes = allSignals
                        .filter(s => s.parsed.signal_type === "outcome" && s.mtimeMs >= latestTime && (s.mtimeMs - latestTime) < 3600000)
                        .sort((a, b) => a.mtimeMs - b.mtimeMs);
                    if (recentOutcomes.length > 0) outcome = recentOutcomes[0].parsed;

extensions/signals-dashboard/extension.mjs:132

• Every refresh stats, reads, and parses every historical signal for every desk. Since refresh() runs every five seconds and signals accumulate for long-running desks, I/O grows without bound. Maintain a latest/outcome index or cache parsed files and bound retained history so refresh cost does not scale with the full archive.

            for (const f of jsonFiles) {
                const fp = join(sigDir, f);
                try {
                    const s = await stat(fp);
                    const raw = await readFile(fp, "utf-8");

extensions/signals-dashboard/extension.mjs:141

• If every JSON file is malformed or is an outcome without a primary signal, latest remains null and this removes the desk entirely. Empty or missing signal directories correctly render the desk as awaiting, so one bad agent-written file should not make it disappear. Emit the same no-signal record here, optionally with an invalid-signal status.

            if (!latest) continue;

extensions/signals-dashboard/extension.mjs:76

• This read-modify-write is not serialized. Two quick stash requests can both read the same array and the last write drops the other desk; the click handlers launch these requests concurrently. Serialize stash mutations per workshop and use an atomic temp-file rename for persistence.

async function stashDesk(workshopDir, deskName) {
    const stash = await readStash(workshopDir);
    if (stash.some(e => e.name === deskName)) return stash;
    stash.push({ name: deskName, stashedAt: new Date().toISOString() });
    await writeStash(workshopDir, stash);

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (4)

extensions/signals-dashboard/extension.mjs:653

• The loopback server trusts the request's Host header as its canonical origin. A DNS-rebound request can therefore send matching attacker-controlled Host/Origin values, read the default dashboard response (including local signal contents), and pass the POST CSRF check. Reject any host other than the actual 127.0.0.1:<listening-port> before routing, as extensions/connector-namespaces/server.mjs:138-155 does.

        const url = new URL(req.url, `http://${req.headers.host}`);

extensions/signals-dashboard/extension.mjs:134

• A valid JSON file can still parse to null or an array. null is added to allSignals before parsed.signal_type throws; if another valid latest signal exists, the later outcome filters dereference that retained null, the outer catch drops the entire desk, and its card disappears. Skip non-object signal documents before retaining them.

                    const parsed = JSON.parse(raw);
                    allSignals.push({ parsed, mtimeMs: s.mtimeMs, path: fp });

extensions/signals-dashboard/extension.mjs:296

• withOutcomes can be positive while gaps is empty—for example, an outcome paired with a signal that has no confidence score. In that case the summary renders a green gap null badge because null <= 1. Base the badge count and average on outcomes that actually produced an honesty gap.

    const withOutcomes = activeSignals.filter(s => s.outcomeRating !== null).length;
    const avgGap = (() => {
        const gaps = activeSignals.filter(s => s.honestyGap !== null).map(s => s.honestyGap);
        return gaps.length ? (gaps.reduce((a, b) => a + b, 0) / gaps.length).toFixed(1) : null;
    })();

plugins/the-workshop/README.md:44

• This install guidance contradicts the manifest and the TA documentation: x-awesome-copilot.extensions causes materialization to copy signals-dashboard into the-workshop, so installing the plugin already includes it (eng/materialize-plugins.mjs:214-233). Requiring a second install misleads users; present the standalone command as optional instead.

It ships as a separate extension. Install it alongside the plugin to get the live canvas:

copilot plugin install signals-dashboard@awesome-copilot

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (6)

extensions/signals-dashboard/extension.mjs:136

• Filesystem mtime is used as the emission time for latest-signal selection, outcome matching, and displayed age. Git does not preserve mtimes, so cloning or checking out a repository-backed workshop can reorder historical signals and pair an outcome with the wrong execution. Persist a stable emission timestamp in the signal schema (or define a sortable filename format) and use that, with mtime only as a legacy fallback.

                    if ((parsed.signal_type || "execution") !== "outcome" && s.mtimeMs > latestTime) {

extensions/signals-dashboard/extension.mjs:134

• A valid JSON primitive such as null is pushed into allSignals before property access fails. Later outcome filters dereference every parsed value, so that one malformed file triggers the outer catch and removes an otherwise valid desk from the dashboard. Reject non-object records before storing them.

                    const parsed = JSON.parse(raw);
                    allSignals.push({ parsed, mtimeMs: s.mtimeMs, path: fp });

extensions/signals-dashboard/extension.mjs:308

• When outcomes exist but none has a computable honesty gap, avgGap is null; JavaScript then treats it as zero in the color comparison and the summary displays a green gap null. Render this badge only when a gap was actually calculated.

    const calibrationBadge = withOutcomes > 0
        ? `<span style="font-size:11px;color:${avgGap <= 1 ? '#22c55e' : avgGap <= 2 ? '#eab308' : '#ef4444'};" title="${withOutcomes} outcome signal${withOutcomes > 1 ? 's' : ''}, avg gap: ${avgGap}">🔍 gap ${avgGap}</span>`
        : "";

extensions/signals-dashboard/extension.mjs:570

• This transient toast is the only confirmation that copying the desk path succeeded or failed, but dynamically inserted content without a live-region role is not announced by screen readers. Mark it as a polite status message.

        function showToast(title, detail) {
            const toast = document.createElement('div');

extensions/signals-dashboard/extension.mjs:792

• This action claims to open a new session, but its handler only validates the directory and returns a path; it never creates or navigates to a session. That can make callers assume the desk is active when no session was opened. Either perform the supported session action or describe this as path resolution.

                    description: "Open a desk as a new session in the GHCP app. Returns the desk path so the agent can create_session or navigate to it.",

plugins/the-workshop/README.md:40

• The plugin manifest bundles signals-dashboard via x-awesome-copilot.extensions, so the main install already includes it. Telling users to install it alongside the plugin can register a duplicate copy; document the standalone command as an alternative instead.

It ships as a separate extension. Install it alongside the plugin to get the live canvas:

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (4)

extensions/signals-dashboard/extension.mjs:88

• readStash is called by unlocked GET/refresh paths, but expiration cleanup writes the stash file here. That bypasses withStashLock, so a cleanup racing with stashDesk/restoreDesk can overwrite the newer mutation; a cleanup write failure also makes the catch return an empty stash. Keep reads side-effect free and let locked mutations persist their filtered result.

        const now = Date.now();
        const live = stash.filter(e => (now - new Date(e.stashedAt).getTime()) < STASH_TTL_MS);
        if (live.length !== stash.length) await writeStash(workshopDir, live);
        return live;

extensions/signals-dashboard/extension.mjs:164

• A valid JSON value such as null is appended to allSignals before parsed.signal_type throws. If the directory also contains a valid latest signal, the later outcome filters dereference that retained null, and the outer catch drops the desk from the dashboard entirely. Reject non-object JSON before adding it to allSignals.

                    const parsed = JSON.parse(raw);
                    const emittedMs = signalTime(parsed, s.mtimeMs);
                    allSignals.push({ parsed, mtimeMs: emittedMs, path: fp });

extensions/signals-dashboard/extension.mjs:203

• The recent-outcome fallback also runs when the latest signal has a run_id but no matching outcome, so it can attach another run's nearby outcome and report a false honesty gap. The skill contract says temporal fallback applies only when run_id is absent; gate this branch accordingly.

                // Also check for any recent outcome (within 1hr of latest signal) if no run_id match
                if (!outcome) {
                    const recentOutcomes = allSignals
                        .filter(s => s.parsed.signal_type === "outcome" && s.mtimeMs >= latestTime && (s.mtimeMs - latestTime) < 3600000)
                        .sort((a, b) => a.mtimeMs - b.mtimeMs);
                    if (recentOutcomes.length > 0) outcome = recentOutcomes[0].parsed;
                }

plugins/the-workshop/README.md:43

• This contradicts both the plugin manifest and the TA instructions: x-awesome-copilot.extensions causes materialization to bundle signals-dashboard with the-workshop (eng/materialize-plugins.mjs:214-233). Requiring a second install unnecessarily installs the same extension again; describe the standalone command as optional instead.

It ships as a separate extension. Install it alongside the plugin to get the live canvas:

copilot plugin install signals-dashboard@awesome-copilot

</details>