the plugin record trees are held only by README prose: agents/ is a second record family with its own constitution (itd-5 frontmatter per prompt, an injection-canary fixture for every untrusted-input agent, a per-agent changelog) and commands/, hooks/, .claude-plugin/ carry similar structure, but no lint root or gate checks any of it — currently conformant, enforced by nothing. Decide the gate: either a record-lint root over the plugin trees with rules for the frontmatter/fixture/changelog invariants, or an explicit ruling that these trees stay prose-governed.

the plugin record trees are held only by README prose: agents/ is a second record family with its own constitution (itd-5 frontmatter per prompt, an injection-canary fixture for every untrusted-input agent, a per-agent changelog) and commands/, hooks/, .claude-plugin/ carry similar structure, but no lint root or gate checks any of it — currently conformant, enforced by nothing. Decide the gate: either a record-lint root over the plugin trees with rules for the frontmatter/fixture/changelog invariants, or an explicit ruling that these trees stay prose-governed.

Grounds

• pursued: the plugin trees are no longer held by README prose alone, because each invariant the record lists has a rule or a test that fails on it; an agent prompt without its trust fields, canary or changelog entry that record-lint still passes would show this wrong.