Instruction file imported from fabioc-aloha/Alex_Skill_Mall (
.github/instructions/mall-maintenance-rules.instructions.md). Copyright stays with the author.
Mall Maintenance Rules
The Plugin Mall is self-curating. This always-on rule routes any Mall-internal work to the right skill at the right moment.
Always-on rationale: Mall operations can begin from scripts, workflow files, plugin payloads, source-registry changes, or contributor PRs. The ownership and approval boundary must be available before any of those paths writes state.
Routing Table
| Trigger | Fire skill |
|---|---|
| Pipeline operations (scan / score / render / publish) | mall-self-curation |
| Import or refresh a curated plugin | npm run vendor per mall-self-curation § Canonical operator commands |
| Contributor prepares a plugin PR | npm run submit:prepare, then npm run submit:validate |
| Curated plugin PR needs review | Automated checks plus @fabioc-aloha CODEOWNER approval; never auto-merge |
| First-party catalog/README maintenance | npm run maintain -- --curated |
Add / remove a source store in supported-stores.json |
source-inventory |
| Evaluate a candidate store before adding it to the registry | store-evaluation |
| Source store appears stale (no upstream activity, broken remote, etc.) | staleness-discipline |
Catalog refresh PR (catalog-refresh/YYYY-MM-DD) needs review |
mall-self-curation § Workflow + cadence |
| New plugin shape (frontmatter convention) breaks the scan | mall-self-curation § Anti-Patterns + normalize-frontmatter.cjs |
| Trust score formula tuning | mall-self-curation § Trust scoring formula |
| Substantive change worth consolidating | meditation |
Stale brain file (lastReviewed expired) |
currency-audit |
Curated plugin under plugins/<category>/<name>/ needs editorial change |
Out of automation scope — editorial changes ship via PR review, not via the workflow |
| Downstream consumer reports a broken plugin reference | Out of automation scope — fix the consumer reference first; the Mall does not own consumer policy |
Hard Rules (cannot be overridden)
- The workflow MUST NOT modify
plugins/. Mall self-curation is automation overcatalog/,scoring/,README.md,sources/SOURCES.mdonly. Editorial changes to curated plugins ship via PR review. - Bootstrap MUST skip
plugin-mall. The Mall self-entry insupported-stores.jsonis for scan inclusion, not clone inclusion.bootstrap-sources.cjsfiltersname !== "plugin-mall". - Scan MUST include
plugin-mall. The self-scan walks$REPO_ROOT/plugins/and producescatalog/stores/plugin-mall.jsonlike any other store. - Every commit touching brain artifacts (skills, instructions, workflow files) carries a severity tag per severity-tagged-commits —
[typo | clarification | behaviour | constitutional]. Structural changes to the trust formula or pipeline shape are[behaviour]; reframes of the constitutional boundary are[constitutional]. - The Mall does not own downstream policy. If the question is "should a consumer project use this plugin?" the answer comes from that consumer, not from the Mall. The Mall scores; consumers decide.
- Contributor automation never approves.
submit:preparewrites only to the contributor branch;submit:validateis read-only;validate-plugin-pr.ymlnever merges. A CODEOWNER makes the editorial decision. - Canonical packaging only. Maintainers and contributors use
plugin-package.cjsthrough the documented wrappers. No one-off vendor scripts for individual plugins.
What the Mall does vs out-of-scope
| What the Mall does | Out of scope for the Mall |
|---|---|
Source registry (supported-stores.json) maintenance |
Editorial decisions on individual curated plugins |
Scan pipeline (scripts under scripts/scan-*.cjs) |
Deciding which plugins consumer projects should bundle |
| Trust scoring + published signals | Coherence with any specific consumer project |
Catalog publishing (catalog/, scoring/, rendered MD) |
Constitutional reframes of what counts as "curated" |
| Structural validation of contributor payloads | Automatic acceptance of contributor payloads |
| Staleness detection + pruning of catalog entries | Periodic review of how the catalog is used downstream |
The line is: the Mall owns mechanical and data-driven operations over its own catalog; everything editorial or downstream is out of scope.
Would Revise If
Revise by 2026-08-29 (90 days) or sooner if any of the following fires:
- The routing table sends a Mall-internal operation outside the Mall ≥2 times in a quarter (boundary miscalibrated)
- Hard Rule 1 (workflow does not modify
plugins/) is violated ≥1 time - Hard Rule 5 (Mall does not own downstream policy) is violated ≥1 time — Mall self-modifies cross-repo policy
- A new operation surfaces that isn't covered by the routing table ≥2 times in a quarter (table incomplete)
Track in docs/curation-log.md tagged [MALL-ROUTING].