[AntTheLimey]

What changed

• skills/ moves to plugins/pgedge/skills/, beside the plugin's own .claude-plugin/plugin.json, a README.md and assets/pgedge-icon.png (the pgedge.com site icon, 300×300). The root .claude-plugin/marketplace.json source and the root .cursor-plugin/plugin.json (skills, logo) point at that folder.
• Why: Anthropic's directory submits the plugin folder as the plugin. With the repo root as the plugin folder it was 726 files, 4 of them over 256 KiB, and their checks hold anything over 512 files or with a file over 256 KiB for manual review. The plugin folder is now 8 files, none over 256 KiB.
• The plugin README says what the skills run, including the brew and curl … | sh install of a missing CLI, because the directory's security scan expects that disclosed.
• Path updates: test file paths, README.md, CLAUDE.md, docs/ai-agents.md, docs/getting-started.md, the pgedge skill and embed.go. The install command and skill names are unchanged.
• Release pinning. The marketplace entry is a git-subdir source for plugins/pgedge at ref: v0.5.0-beta.4, over HTTPS, and both manifests carry version: 0.5.0-beta.4. Plugin installs therefore get the skills that shipped with a release, not main. The release workflow fails a tag whose number doesn't match the manifests, before anything is published.
• TestPluginManifestsAgree now also holds the three to one version and ref, and checks the marketplace source, the icon, the Cursor logo and the Cursor skills path, and that the plugin README exists.

Checks

• npx skills add <checkout> --list still finds all 5 skills.
• claude plugin validate . and claude plugin validate plugins/pgedge pass. The only warning is the deliberate missing version.
• Installed pgedge@pgedge-cli from the checkout into a throwaway CLAUDE_CONFIG_DIR: enabled, read from plugins/pgedge, 5 SKILL.md.
• make test, make lint, make lint-docs, make docs-check and make test-scripts are clean. The skill-doc and recipe gates ran 449 subtests against the new path.
• Cursor: an export of .cursor-plugin/ and plugins/pgedge/ in ~/.cursor/plugins/local/pgedge was picked up by cursor agent. Asked how to sign in to Starfleet, with no skill named, it read pgedge and then pgedge-starfleet from the plugin and answered from them. A control run without the plugin listed none of the five.
• A git-subdir install from the pushed branch, in a throwaway config, installed 0.5.0-beta.4 with all 5 skills. The first try used the pgEdge/pgedge-cli shorthand, which cloned over SSH and failed without a GitHub key, so the entry now uses the HTTPS URL. marketplace add pgEdge/pgedge-cli itself clones fine.
• The release check's script passes for GITHUB_REF_NAME=v0.5.0-beta.4 and fails for v0.5.0-beta.3, naming the file and both versions.
• Mutation check: pointing the ref at v0.5.0-beta.3 fails TestPluginManifestsAgree.
• Mutation check: pointing the Cursor logo at a missing file fails TestPluginManifestsAgree.

Risks

• The plugin can't be installed until v0.5.0-beta.4 exists. Until then the marketplace points at a tag that hasn't been cut yet.

• Every CUT now bumps three values: two manifest versions and the marketplace ref. The release fails if they're missed.

• Existing npx skills installs pinned to an older tag keep that tag's layout, which still works.