feat(kyberforge): execute plugin-to-apm marketplace conversion

Why:
ADR-0015 established that Microsoft APM (apm.yml + .apm/) should replace
this repo's hand-authored plugin.json/marketplace.json model, with those
files becoming compiled output of `apm pack` instead of files edited by
hand via the (now-retired) plugin-author/marketplace-author skills.
Issue #90 was the deferred execution of that decision, gated on #88
(apm tooling) and #89 (apm-native agent-author/skill-author routing).

Implementation notes:
- All six plugins (bin, core, git, gitea, kyberforge, lint) now carry
  apm.yml + .apm/{skills,agents,hooks} as their authoring source. Skills
  moved with a plain git mv (content-identical across targets). Agents
  were re-authored, not moved: per ADR-0016, .apm/agents/*.agent.md
  compiles verbatim to both Claude and Copilot, so plugin-scope agents
  now carry only name/description/model/source_keys -- no tools: field,
  no Claude-only knobs (isolation, maxTurns, effort, memory,
  permissionMode).
- Root apm.yml registers all 7 marketplace packages (6 local plus
  mattpocock-skills as a remote entry) under versioning: per_package,
  matching this repo's existing independent-plugin-versioning practice.
- .claude-plugin/marketplace.json and every plugin's plugin.json are now
  apm-pack-compiled output, verified against the prior hand-maintained
  content: same names/descriptions/versions/licenses/authors, only
  cosmetic serialization differences (JSON key order, owner email vs.
  url, Unicode escaping).
- plugin-author and marketplace-author are retired now that apm-based
  authoring fully replaces their job; kyberforge bumped 1.3.1 -> 1.4.0
  for that removal, and the root marketplace catalog bumped
  0.3.1 -> 0.3.2 to match, per the version-bump convention now
  documented in apm-workflow's reference docs instead of a dedicated
  script (apm has no native version-bump automation).
- Fixed hardcoded pre-.apm/ path assumptions across
  .pre-commit-config.yaml, .pre-commit-hooks.yaml,
  scripts/check-scope-walkup-sync.sh, scripts/sync-vale-styles.sh,
  scripts/check-vale-style-sync.sh, six plugins' root plugin.json
  (stale skills/hooks/agents pointer fields that check-manifests.sh
  validates), and several tests/*.bats and tests/*.sh fixtures --
  including a bats REPO_ROOT relative-path depth bug (10 files, one
  extra .apm/ directory level to walk up) and a vale probe-path
  isolation regression introduced mid-fix.
- Corrected empirically-wrong assumptions surfaced this session in
  apm-workflow/apm-install's own reference docs: `apm marketplace
  package add` does not accept local paths (only owner/repo remote
  shorthand -- local packages are registered by editing apm.yml's
  marketplace.packages[] directly); `apm compile` is a consumer-side
  AGENTS.md/CLAUDE.md generator, not the plugin.json producer, and
  hard-fails on skill/agent-only packages without --clean; `apm plugin
  init <name>` nests a stray subdirectory when run with a positional
  name arg from inside a same-named directory; no native Copilot
  marketplace output profile exists; .mcp.json is merged into the
  compiled plugin.json content-aware and target-scoped, with no
  dependencies.mcp entry needed for simple passthrough; pipx is the
  correct pip fallback on externally-managed Python environments.
- Renamed agent-author's copilot.agent.md template asset to
  copilot.agent.md.template so apm compile's recursive *.agent.md glob
  stops misparsing the placeholder template as a real agent primitive.

Impact:
plugin.json and marketplace.json are compiled artifacts from here on --
editing them by hand is no longer the workflow; edit apm.yml/.apm/ and
run apm pack. CONTEXT.md's Plugin/Plugin marketplace glossary entries
reflect this. ADR-0001 is marked superseded, ADR-0006 moot, and
ADR-0010 updated for the new .apm/agents/ path (project/user scope
unaffected, per ADR-0016). Full local verification: claude plugin
validate --strict on all 6 plugins, apm audit --ci, apm marketplace
check, check-manifests.sh, and the full test suite (165/165 bats,
13/13 shell scripts) all pass clean.

Fixes: #90
Refs: #88, #89
ADR: 0015
ADR: 0016

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ub96PyaSRD9BHPktotj1pC

.claude-plugin/marketplace.json

@@ -2,48 +2,57 @@
   "description": "AI development skills for Claude Code and GitHub Copilot CLI \u2014 factory, design, implement, review, and cross-cutting workflows.",
   "name": "holocron",
   "owner": {
-    "email": "defame1297@rkdr.net",
-    "name": "Defame1297"
+    "name": "Defame1297",
+    "url": "https://git.dev.rkdr.net/Defame1297/"
   },
   "plugins": [
     {
       "description": "Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.",
       "name": "kyberforge",
-      "source": "./plugins/kyberforge"
+      "source": "./plugins/kyberforge",
+      "version": "1.4.0"
     },
     {
       "description": "A place for things to be binned",
       "name": "bin",
-      "source": "./plugins/bin"
+      "source": "./plugins/bin",
+      "version": "1.1.1"
     },
     {
       "description": "Skills for working with Git \u2014 conventional commits, branch management, pull requests, and feature flow.",
       "name": "git",
-      "source": "./plugins/git"
+      "source": "./plugins/git",
+      "version": "1.3.2"
     },
     {
       "description": "Skills for managing Gitea repositories \u2014 issues, pull requests, milestones, releases, and wikis.",
       "name": "gitea",
-      "source": "./plugins/gitea"
+      "source": "./plugins/gitea",
+      "version": "1.3.3"
     },
     {
       "description": "Cross-cutting utility skills for everyday AI-assisted coding \u2014 triage, diagnosis, architecture review, and session navigation.",
       "name": "core",
-      "source": "./plugins/core"
+      "source": "./plugins/core",
+      "version": "1.1.0"
     },
     {
       "description": "Skills for Real Engineers \u2014 planning, TDD, architecture, and debugging workflows from Matt Pocock's .claude directory.",
       "name": "mattpocock-skills",
       "source": {
+        "ref": "v1.2.3",
         "repo": "mattpocock/skills",
-        "source": "github"
+        "sha": "835450ef244ab7335f75d95b83e7d979eae22a6d",
+        "source": "github",
+        "tag_pattern": "v{version}"
       }
     },
     {
       "description": "Skills and agents for configuring and running linters.",
       "name": "lint",
-      "source": "./plugins/lint"
+      "source": "./plugins/lint",
+      "version": "1.1.5"
     }
   ],
-  "version": "0.3.1"
+  "version": "0.3.2"
 }

.github/plugin/marketplace.json

@@ -2,48 +2,57 @@
   "description": "AI development skills for Claude Code and GitHub Copilot CLI \u2014 factory, design, implement, review, and cross-cutting workflows.",
   "name": "holocron",
   "owner": {
-    "email": "defame1297@rkdr.net",
-    "name": "Defame1297"
+    "name": "Defame1297",
+    "url": "https://git.dev.rkdr.net/Defame1297/"
   },
   "plugins": [
     {
       "description": "Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.",
       "name": "kyberforge",
-      "source": "./plugins/kyberforge"
+      "source": "./plugins/kyberforge",
+      "version": "1.4.0"
     },
     {
       "description": "A place for things to be binned",
       "name": "bin",
-      "source": "./plugins/bin"
+      "source": "./plugins/bin",
+      "version": "1.1.1"
     },
     {
       "description": "Skills for working with Git \u2014 conventional commits, branch management, pull requests, and feature flow.",
       "name": "git",
-      "source": "./plugins/git"
+      "source": "./plugins/git",
+      "version": "1.3.2"
     },
     {
       "description": "Skills for managing Gitea repositories \u2014 issues, pull requests, milestones, releases, and wikis.",
       "name": "gitea",
-      "source": "./plugins/gitea"
+      "source": "./plugins/gitea",
+      "version": "1.3.3"
     },
     {
       "description": "Cross-cutting utility skills for everyday AI-assisted coding \u2014 triage, diagnosis, architecture review, and session navigation.",
       "name": "core",
-      "source": "./plugins/core"
+      "source": "./plugins/core",
+      "version": "1.1.0"
     },
     {
       "description": "Skills for Real Engineers \u2014 planning, TDD, architecture, and debugging workflows from Matt Pocock's .claude directory.",
       "name": "mattpocock-skills",
       "source": {
+        "ref": "v1.2.3",
         "repo": "mattpocock/skills",
-        "source": "github"
+        "sha": "835450ef244ab7335f75d95b83e7d979eae22a6d",
+        "source": "github",
+        "tag_pattern": "v{version}"
       }
     },
     {
       "description": "Skills and agents for configuring and running linters.",
       "name": "lint",
-      "source": "./plugins/lint"
+      "source": "./plugins/lint",
+      "version": "1.1.5"
     }
   ],
-  "version": "0.3.1"
+  "version": "0.3.2"
 }

.pre-commit-config.yaml

@@ -131,25 +131,25 @@ repos:
         description: Enforce agentskills.io's 500-line/5,000-token SKILL.md size ceiling
         entry: scripts/skill-size-check.sh
         language: script
-        files: '^plugins/[^/]+/skills/[^/]+/SKILL\.md$'
+        files: '^plugins/[^/]+/\.apm/skills/[^/]+/SKILL\.md$'
         pass_filenames: true
 
       - id: vale-audit-prefilter-skill
         stages: ['pre-commit']
         name: Vale audit prefilter (SKILL.md)
         description: Run Vale against SKILL.md files as a deterministic prefilter for skill-audit, via skill-audit's own bundled copy
-        entry: plugins/kyberforge/skills/skill-audit/scripts/vale-wrap.sh
+        entry: plugins/kyberforge/.apm/skills/skill-audit/scripts/vale-wrap.sh
         language: script
-        files: '^plugins/[^/]+/skills/[^/]+/SKILL\.md$'
+        files: '^plugins/[^/]+/\.apm/skills/[^/]+/SKILL\.md$'
         pass_filenames: true
 
       - id: vale-audit-prefilter-agent
         stages: ['pre-commit']
         name: Vale audit prefilter (agent files)
         description: Run Vale against agent markdown files as a deterministic prefilter for agent-audit, via agent-audit's own bundled copy
-        entry: plugins/kyberforge/skills/agent-audit/scripts/vale-wrap.sh
+        entry: plugins/kyberforge/.apm/skills/agent-audit/scripts/vale-wrap.sh
         language: script
-        files: '^plugins/[^/]+/agents/[^/]+\.md$'
+        files: '^plugins/[^/]+/\.apm/agents/[^/]+\.agent\.md$'
         pass_filenames: true
 
   - repo: meta

.pre-commit-hooks.yaml

@@ -1,14 +1,14 @@
 -   id: kyberforge-vale-audit-skill
     name: Kyberforge Vale prose audit (SKILL.md)
     description: Deterministic prose-pattern prefilter for kyberforge's skill-audit, via its own bundled Vale config/styles
-    entry: plugins/kyberforge/skills/skill-audit/scripts/vale-wrap.sh
+    entry: plugins/kyberforge/.apm/skills/skill-audit/scripts/vale-wrap.sh
     language: script
     files: '(^|/)SKILL\.md$'
 
 -   id: kyberforge-vale-audit-agent
     name: Kyberforge Vale prose audit (agent files)
     description: Deterministic prose-pattern prefilter for kyberforge's agent-audit, via its own bundled Vale config/styles
-    entry: plugins/kyberforge/skills/agent-audit/scripts/vale-wrap.sh
+    entry: plugins/kyberforge/.apm/skills/agent-audit/scripts/vale-wrap.sh
     language: script
     files: '(^|/)agents/[^/]+\.md$|\.agent\.md$'
 

AGENTS.md

@@ -22,7 +22,7 @@ Fall back to raw shell only when no skill covers it.
 ## Setup and testing
 
 - Install git hooks via `git:pc-run`, wiring all three stages — this repo's `.pre-commit-config.yaml` has no `default_install_hook_types`, so a plain install silently skips `commit-msg` (Conventional Commits) and `pre-push` (tests, manifest check).
-- Install the `vale` binary — required by the `vale-audit-prefilter-skill`/`-agent` pre-commit hooks, which run on every commit touching a `SKILL.md` or agent `.md` file. Without it the hooks fail with a bare "command not found" and no install pointer. `brew install vale` (macOS), `snap install vale` (Linux), `choco install vale` (Windows), or see https://vale.sh/docs/vale-cli/installation/. No `vale sync` needed — the `Kyberforge` styles are committed under `plugins/kyberforge/skills/{skill-audit,agent-audit}/assets/vale/styles/`, not downloaded packages (see ADR-0014).
+- Install the `vale` binary — required by the `vale-audit-prefilter-skill`/`-agent` pre-commit hooks, which run on every commit touching a `SKILL.md` or agent `.md` file. Without it the hooks fail with a bare "command not found" and no install pointer. `brew install vale` (macOS), `snap install vale` (Linux), `choco install vale` (Windows), or see https://vale.sh/docs/vale-cli/installation/. No `vale sync` needed — the `Kyberforge` styles are committed under `plugins/kyberforge/.apm/skills/{skill-audit,agent-audit}/assets/vale/styles/`, not downloaded packages (see ADR-0014).
 - Run `bash tests/run-tests.sh` before considering any change done — it runs every `test-*.sh` script in the repo plus the bats suite (`--bats-only` for just bats). First run auto-initializes the bats submodules; no manual `git submodule update` needed.
 - Pushing re-runs the full suite plus `scripts/check-manifests.sh` via the pre-push hook — same commands, so run them locally first.
 - Author commits with `git:git-commits` — it validates Conventional Commits (enforced at `commit-msg`) for you.

CONTEXT.md

@@ -27,10 +27,10 @@ A separate product (separate repo) for browsing, editing, and configuring AI dev
 Reusable slash commands for AI coding tools, defined as `SKILL.md` files following the [Agent Skills open standard](https://agentskills.io). Deployed via plugin — `plugins/<plugin-name>/skills/<skill-name>/SKILL.md`, available after the plugin is installed (`claude plugin install <name>@<marketplace>`). Skills are self-contained — they cannot reference files outside the plugin directory after install-time caching.
 
 ### Plugin
-The deployable unit in the plugin marketplace. A plugin bundles one or more skills, agents, hooks, prompts, MCP servers, and optionally a `bin/` directory into a single installable directory. Each plugin has two manifests: `.claude-plugin/plugin.json` (Claude Code) and `plugin.json` at the plugin root (Copilot CLI). Plugins are copied to a cache on install — they cannot reference files outside their own directory. In this repo, plugins live under `plugins/<name>/`. Install a plugin with `claude plugin install <name>@<marketplace>`. These manifests are hand-authored today but are slated to become APM-compiled output per ADR-0015, pending issue #90 (not yet changed).
+The deployable unit in the plugin marketplace. A plugin bundles one or more skills, agents, hooks, prompts, MCP servers, and optionally a `bin/` directory into a single installable directory. In this repo, plugins live under `plugins/<name>/`, each with its own `apm.yml` + `.apm/{skills,agents,hooks,...}` — this is the authoring source of truth for the plugin's content (ADR-0015). `.claude-plugin/plugin.json` (Claude Code) and `.github/plugin/plugin.json` (Copilot CLI) are **compiled output** of `apm pack`/`apm compile`, generated from `apm.yml` + `.apm/` — they are not hand-edited. Plugins are copied to a cache on install — they cannot reference files outside their own directory. Install a plugin with `claude plugin install <name>@<marketplace>`.
 
 ### Plugin marketplace
-A Git repository with a `marketplace.json` manifest listing installable plugins. No backend, registry, or SaaS required — the Git repo is the marketplace. This repo is the `holocron` marketplace. The manifest lives at `.claude-plugin/marketplace.json` (read by both Claude Code and Copilot CLI) and is mirrored to `.github/plugin/marketplace.json`. This manifest is hand-authored today but is slated to become APM-compiled output per ADR-0015, pending issue #90 (not yet changed).
+A Git repository with a `marketplace.json` manifest listing installable plugins. No backend, registry, or SaaS required — the Git repo is the marketplace. This repo is the `holocron` marketplace. The manifest at `.claude-plugin/marketplace.json` (read by both Claude Code and Copilot CLI, mirrored to `.github/plugin/marketplace.json`) is **compiled output** of `apm pack`, generated from the root `apm.yml`'s `marketplace:` block (owner, build/output config, versioning strategy, and the `packages:` list of installable plugins) — it is not hand-edited. See ADR-0015.
 
 ### HITL (human-in-the-loop)
 Agent pauses before a consequential action; human approves before execution. Required for irreversible or high-stakes actions (architecture changes, production deployments, security configuration). The agent drafts the change plan and waits — it does not proceed autonomously. Contrast with HOTL.

apm.yml

@@ -0,0 +1,71 @@
+name: holocron
+version: 0.3.2
+description: AI development skills for Claude Code and GitHub Copilot CLI — factory, design, implement, review, and cross-cutting workflows.
+license: MIT
+marketplace:
+  # apm's Claude marketplace mapper only emits description:/version: into the
+  # compiled marketplace.json when set explicitly here (an override) — the
+  # top-level apm.yml description:/version: above are NOT inherited into the
+  # compiled output despite being used elsewhere (e.g. by `apm audit`).
+  description: AI development skills for Claude Code and GitHub Copilot CLI — factory, design, implement, review, and cross-cutting workflows.
+  version: 0.3.2
+  owner:
+    name: Defame1297
+    url: https://git.dev.rkdr.net/Defame1297/
+
+  # Default tag pattern used to resolve version ranges for each package.
+  build:
+    tagPattern: "v{version}"
+
+  # Output targets (map form). 'claude' is enabled by default;
+  # uncomment 'codex' below to publish the Codex artifact too.
+  # Each output writes to its profile default path; add 'path:'
+  # under a key to override.
+  outputs:
+    claude: {}
+    # codex: {}
+    #
+    # Note: enabling codex requires every package below to declare
+    # 'category:' (e.g. category: Productivity).
+
+  # CI tip: build one or all formats with a machine-readable manifest:
+  #   apm pack --marketplace=claude,codex --json | jq -r '.marketplace.outputs[].path'
+
+  versioning:
+    strategy: per_package
+
+  packages:
+    - name: kyberforge
+      description: Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.
+      source: ./plugins/kyberforge
+      version: 1.4.0
+
+    - name: bin
+      description: A place for things to be binned
+      source: ./plugins/bin
+      version: 1.1.1
+
+    - name: git
+      description: Skills for working with Git — conventional commits, branch management, pull requests, and feature flow.
+      source: ./plugins/git
+      version: 1.3.2
+
+    - name: gitea
+      description: Skills for managing Gitea repositories — issues, pull requests, milestones, releases, and wikis.
+      source: ./plugins/gitea
+      version: 1.3.3
+
+    - name: core
+      description: Cross-cutting utility skills for everyday AI-assisted coding — triage, diagnosis, architecture review, and session navigation.
+      source: ./plugins/core
+      version: 1.1.0
+
+    - name: mattpocock-skills
+      description: Skills for Real Engineers — planning, TDD, architecture, and debugging workflows from Matt Pocock's .claude directory.
+      source: mattpocock/skills
+      version: "^1.2.0"
+
+    - name: lint
+      description: Skills and agents for configuring and running linters.
+      source: ./plugins/lint
+      version: 1.1.5

docs/adr/0001-skills-in-agents-dir.md

@@ -1,5 +1,16 @@
 # Skills are distributed via plugins, not monolithic repo deployment
 
+**Superseded by:** ADR-0015 (Microsoft APM replaces the hand-authored plugin/marketplace model
+as this repo's authoring source of truth) and, for plugin-scope agent files specifically,
+ADR-0016 (plugin-scope `.apm/agents/*.agent.md` drops provider-specific fields). Since issue
+#90's conversion executed, plugin content is authored under `plugins/<name>/apm.yml` +
+`.apm/{skills,agents,hooks}/` — not the flat `skills/`/`agents/` layout this ADR describes —
+and `.claude-plugin/plugin.json`/`.github/plugin/plugin.json` are compiled output of `apm pack`,
+not hand-authored. This ADR's content is kept below as the historical record of the
+pre-APM decision; it is no longer the current model.
+
+---
+
 Skills (slash commands) are authored and distributed as part of **plugins** — each plugin contains its own `skills/` directory alongside agents and other artifacts. Plugins are installed via `claude plugin install <name>@holocron` rather than deployed from the repo's local tree. This decision decouples skill authoring cadence from core provider deployments and allows independent versioning per plugin.
 
 ## Context

docs/adr/0006-plugin-version-parity.md

@@ -1,5 +1,18 @@
 # version field is present in both plugin manifests
 
+**Moot as of ADR-0015.** This ADR addressed drift risk between two independently
+*hand-maintained* manifests. Since issue #90's conversion executed, `.claude-plugin/plugin.json`
+and `.github/plugin/plugin.json` are both **compiled output** of `apm pack`, generated in the
+same pass from a single `apm.yml` per plugin — there is no longer a second hand-authored file
+that could drift out of parity. The invariant this ADR required (`version` present and
+identical in both manifests) still holds in the compiled output, but structurally, not because
+a skill enforces it: both files are derived from the same `apm.yml` `version:` field, so
+divergence is no longer possible by construction. `plugin-author`, the skill that enforced this
+invariant, is deleted per ADR-0015 rather than adapted. Kept below as the historical record of
+the pre-APM decision.
+
+---
+
 Each plugin has two manifests: `plugin.json` (Copilot CLI) and `.claude-plugin/plugin.json` (Claude Code). Both tools support a `version` field. Prior to this decision, only the CC manifest carried `version`; the Copilot manifest omitted it.
 
 We now require `version` in both manifests, always identical. A reader of `plugin.json` alone should be able to determine the plugin version without consulting the CC manifest. The `plugin-author` skill enforces this invariant on every create, update, and release operation.

docs/adr/0010-agent-sources-relocated-outside-agents-dir.md

@@ -5,6 +5,21 @@ claim that "both files share a single `agents/sources.md` for provenance." The r
 ADR-0005 (dual-provider generation, scope detection, single-root script interface) is
 unaffected and remains in force.
 
+**Path update per ADR-0016:** at plugin scope, agent files no longer live at
+`<plugin-root>/agents/<name>.md`. The authoring source is now
+`<plugin-root>/.apm/agents/<name>.agent.md` — a single vendor-neutral file (no dual Claude/
+Copilot pair) compiled to both targets via `apm pack`. See ADR-0016 for why (the field-dropping
+rationale, `tools:` incompatibility, the compiled-output mechanics) — not restated here. This
+ADR's own conclusion is unaffected by that move: the provenance file still belongs at
+`<plugin-root>/sources.md`, outside any directory `claude plugin validate --strict`
+auto-scans, and `.apm/agents/` is, if anything, further removed from plugin-root than the old
+flat `agents/` directory was, so the reasoning below still holds. References below to
+`<plugin-root>/agents/` describe the pre-APM layout in effect when this decision was made.
+**Scope boundary (per ADR-0016):** this path change is plugin scope only. Project scope
+(`.claude/agents/` + `.github/agents/`) and user scope (`~/.claude/agents/` +
+`~/.copilot/agents/`) are unaffected — they are not APM packages and keep the dual-file
+Claude+Copilot pair model this ADR originally described.
+
 `claude plugin validate --strict` auto-discovers every `.md` file directly under a plugin's
 `agents/` directory and treats it as an agent definition requiring YAML frontmatter (`name`,
 `description`, etc.). A flat provenance file at `agents/sources.md` — no frontmatter, by

docs/adr/0015-apm-replaces-plugin-marketplace-authoring.md

@@ -1,7 +1,9 @@
 # Microsoft APM replaces the hand-authored plugin/marketplace model as this repo's authoring source of truth
 
-**Will supersede:** ADR-0001 ("Skills are distributed via plugins... each plugin contains its
-own `skills/` directory") — once issue #90's conversion actually executes; not yet in effect.
+**Status: executed (2026-08-12, issue #90).** All six plugins now carry `apm.yml` + `.apm/` as
+their authoring source; `.claude-plugin/marketplace.json` and every plugin's `plugin.json` are
+`apm pack`-compiled output. **Supersedes ADR-0001** ("Skills are distributed via plugins... each
+plugin contains its own `skills/` directory") — in effect.
 
 This repo replaces its hand-maintained Claude Code plugin/marketplace authoring model
 (`.claude-plugin/marketplace.json` + per-plugin `plugin.json`) with Microsoft APM (`apm.yml` +
@@ -31,10 +33,9 @@ new hand-maintained manifest format.
   and per-provider `plugin.json` files become **compiled output** via `apm compile`/`apm pack`,
   generated from `apm.yml` + `.apm/` per plugin, extensible to other `apm runtime`-supported
   providers without hand-maintaining a separate manifest per provider.
-- **This will supersede ADR-0001** ("Skills are distributed via plugins... each plugin
-  contains its own `skills/` directory"), but not yet — supersession is pending on issue #90's
-  conversion. Once that real conversion executes, skills and agents physically move to
-  `plugins/<name>/.apm/skills/` and `plugins/<name>/.apm/agents/*.agent.md`.
+- **This supersedes ADR-0001** ("Skills are distributed via plugins... each plugin
+  contains its own `skills/` directory"). Executed in issue #90: skills and agents physically moved
+  to `plugins/<name>/.apm/skills/` and `plugins/<name>/.apm/agents/*.agent.md`.
 - New operational tooling — `apm-install` (skill), `apm-workflow` (skill), `apm-orchestrate`
   (agent) — lands in `kyberforge`, tracked in issue #88
   (https://git.dev.rkdr.net/Defame1297/holocron/issues/88).
@@ -49,13 +50,11 @@ new hand-maintained manifest format.
   routing: `apm compile`/`apm pack` will generate `.claude-plugin/marketplace.json` and
   per-provider `plugin.json` directly from `apm.yml` + `.apm/`, so `apm-install`/`apm-workflow`/
   `apm-orchestrate` (issue #88, already landed on this branch) fully replace what these two skills
-  did. Deleting `plugin-author`/`marketplace-author` is part of issue #90's execution, not #89's.
-- Actually translating the existing plugins into `apm.yml` + `.apm/` and running the real
-  conversion is deferred to issue #90
-  (https://git.dev.rkdr.net/Defame1297/holocron/issues/90).
-- `CONTEXT.md`'s "Plugin"/"Plugin marketplace" glossary entries get a forward-pointer to this
-  ADR so a session-start read surfaces the pending change; their substantive definitions remain
-  accurate until issue #90's conversion actually executes — this ADR does not rewrite them.
+  did. `plugin-author`/`marketplace-author` were deleted in issue #90's execution.
+- Translating the existing plugins into `apm.yml` + `.apm/` and running the real conversion was
+  executed in issue #90 (https://git.dev.rkdr.net/Defame1297/holocron/issues/90, closed).
+- `CONTEXT.md`'s "Plugin"/"Plugin marketplace" glossary entries were rewritten in issue #90 to
+  describe the compiled-output model directly, rather than carrying a forward-pointer to this ADR.
 
 ## Considered options
 
@@ -89,27 +88,36 @@ correction) sorted what they document into three buckets:
   because of hand-authored dual manifests (ADR-0006's version-parity/patch-bump rule, the
   CC-vs-Copilot field-placement split, dual-file mirroring) are obsolete under `apm.yml`'s
   single-manifest model and were deliberately dropped.
-- **Holocron policy choice — flagged for #90, not resolved here.** `marketplace-author`'s
-  catalog-version convention (minor bump for package add/remove, patch bump for field-only
-  updates) isn't an APM mechanic — `apm` doesn't enforce it — but it's still a meaningful holocron
-  policy worth re-applying to `apm.yml`'s `marketplace.packages[].version` field once #90 wires up
-  real marketplace authoring. Where/how that gets implemented is #90's decision, not this ADR's.
+- **Holocron policy choice — resolved in #90.** `marketplace-author`'s catalog-version convention
+  (minor bump for package add/remove, patch bump for field-only updates) isn't an APM mechanic —
+  `apm` doesn't enforce it, and has no native version-bump automation at all — so rather than
+  building a new script, the convention is now documented as guidance inside `apm-workflow`'s
+  reference docs (`references/marketplace.md` for the root catalog version rule,
+  `references/configure.md` for the per-package version-bump-on-content-edit rule), applied
+  manually by whoever edits `apm.yml`.
 
 ## Consequences
 
-- ADR-0001 is superseded once issue #90 executes.
-- ADR-0006 (plugin-version-parity) becomes moot once #90 lands: `plugin.json`/`marketplace.json`
-  become compiled output of a single `apm.yml`, so there's no second hand-authored file left to
-  keep in parity, and `plugin-author` — the skill that enforced ADR-0006 — is deleted rather than
-  adapted (see "Content migration" above). Not resolved by this ADR.
-- ADR-0010 (agent sources relocated outside agents dir) needs revisiting once agents move to
-  `plugins/<name>/.apm/agents/` — the directory path changes, not the pre-existing `.agent.md`
-  extension convention (ADR-0005/ADR-0010, unaffected) — not resolved by this ADR.
-- ADR-0014 (Vale prefilter ships from the plugin) has hardcoded path regexes assuming
-  `plugins/<name>/skills/...`/`plugins/<name>/agents/...`; these will need updating once paths
-  move under `.apm/` — not resolved by this ADR.
-- `kyberforge` gains three new artifacts (issue #88) before any conversion of existing content
-  happens.
-- Two follow-up issues track the remaining work: #89 (`skill-author`/`agent-author` routing
-  adaptation) and #90 (the actual repo conversion, which also deletes `plugin-author`/
-  `marketplace-author`).
+- ADR-0001 is superseded (issue #90).
+- ADR-0006 (plugin-version-parity) is moot (issue #90): `plugin.json`/`marketplace.json` are now
+  compiled output of a single `apm.yml`, so there's no second hand-authored file left to keep in
+  parity, and `plugin-author` — the skill that enforced ADR-0006 — was deleted rather than adapted
+  (see "Content migration" above).
+- ADR-0010 (agent sources relocated outside agents dir) was updated (issue #90) for agents now
+  living at `plugins/<name>/.apm/agents/*.agent.md` — the directory path changed; the pre-existing
+  `.agent.md` extension convention (ADR-0005/ADR-0010) and project/user scope are unaffected, per
+  ADR-0016.
+- ADR-0014 (Vale prefilter ships from the plugin) had its hardcoded path regexes
+  (`plugins/<name>/skills/...`/`plugins/<name>/agents/...`) updated for the `.apm/` nesting as part
+  of issue #90's execution.
+- `kyberforge` gained three new artifacts (issue #88) before any conversion of existing content
+  happened, then lost two (`plugin-author`/`marketplace-author`, deleted once issue #90 verified
+  parity) — net version bump 1.3.1 → 1.4.0. The root marketplace catalog bumped 0.3.1 → 0.3.2 to
+  match.
+- ADR-0016 (a narrower decision discovered while designing issue #89) turned out to gate how
+  issue #90 had to re-author plugin-scope agents: `.apm/agents/*.agent.md` compiles verbatim to
+  both Claude and Copilot, so those files carry only `name`/`description`/`model`/`source_keys` —
+  existing dual-file `<name>.md`+`<name>.agent.md` pairs could not be raw-moved, only re-authored.
+- Two follow-up issues tracked the remaining work, both done: #89 (`skill-author`/`agent-author`
+  routing adaptation, merged in #93) and #90 (the actual repo conversion, which also deleted
+  `plugin-author`/`marketplace-author`).

plugins/bin/.claude-plugin/plugin.json

@@ -1,12 +1,21 @@
 {
   "author": {
+    "email": "defame1297@rkdr.net",
     "name": "Defame1297",
     "url": "https://git.dev.rkdr.net/Defame1297/"
   },
   "description": "A place for things to be binned",
-  "displayName": "bin",
-  "keywords": [],
   "license": "MIT",
+  "mcpServers": {
+    "obsidian": {
+      "args": [
+        "@bitbonsai/mcpvault@latest",
+        "docs/"
+      ],
+      "command": "npx",
+      "type": "stdio"
+    }
+  },
   "name": "bin",
   "version": "1.1.1"
 }

plugins/bin/.github/plugin/plugin.json

@@ -0,0 +1,11 @@
+{
+  "author": {
+    "email": "defame1297@rkdr.net",
+    "name": "Defame1297",
+    "url": "https://git.dev.rkdr.net/Defame1297/"
+  },
+  "description": "A place for things to be binned",
+  "license": "MIT",
+  "name": "bin",
+  "version": "1.1.1"
+}

plugins/bin/apm.yml

@@ -0,0 +1,26 @@
+name: bin
+version: 1.1.1
+description: A place for things to be binned
+author:
+  name: Defame1297
+  email: defame1297@rkdr.net
+  url: https://git.dev.rkdr.net/Defame1297/
+license: MIT
+keywords: []
+
+# Constrains what .apm/ may contain: instructions, skill, hybrid, or prompts
+type: skill
+
+# Which agent platforms to deploy to.
+# Resolution order: --target flag > this field > auto-detect from filesystem.
+# Accepted values: agent-skills, antigravity, claude, codex, copilot, cursor, gemini, grok-build, kiro, opencode, windsurf
+targets:
+- claude
+- copilot
+dependencies:
+  apm: []
+  mcp: []
+includes: auto
+devDependencies:
+  apm: []
+scripts: {}

plugins/bin/plugin.json

@@ -1,15 +1,12 @@
 {
   "author": {
     "email": "defame1297@rkdr.net",
-    "name": "Defame1297"
+    "name": "Defame1297",
+    "url": "https://git.dev.rkdr.net/Defame1297/"
   },
   "description": "A place for things to be binned",
   "keywords": [],
   "license": "MIT",
-  "mcpServers": ".mcp.json",
   "name": "bin",
-  "skills": [
-    "skills/"
-  ],
   "version": "1.1.1"
 }

plugins/core/.apm/skills/agentsmd-audit/tests/README.md

@@ -18,7 +18,7 @@ git clone https://github.com/bats-core/bats-assert tests/test_helper/bats-assert
 Run all tests for this skill (from the repo root):
 
 ```bash
-bats plugins/core/skills/agentsmd-audit/tests/
+bats plugins/core/.apm/skills/agentsmd-audit/tests/
 ```
 
 ## Files

plugins/core/.apm/skills/agentsmd-audit/tests/validate-drift.bats

@@ -1,7 +1,7 @@
 #!/usr/bin/env bats
 
 setup() {
-    REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../../../../../" && pwd)"
+    REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../../../../../../" && pwd)"
     load "$REPO_ROOT/tests/test_helper/bats-support/load"
     load "$REPO_ROOT/tests/test_helper/bats-assert/load"
 

plugins/core/.apm/skills/agentsmd-audit/tests/validate-secrets.bats

@@ -1,7 +1,7 @@
 #!/usr/bin/env bats
 
 setup() {
-    REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../../../../../" && pwd)"
+    REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../../../../../../" && pwd)"
     load "$REPO_ROOT/tests/test_helper/bats-support/load"
     load "$REPO_ROOT/tests/test_helper/bats-assert/load"
 

plugins/core/.apm/skills/agentsmd-audit/tests/validate-structure.bats

@@ -1,7 +1,7 @@
 #!/usr/bin/env bats
 
 setup() {
-    REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../../../../../" && pwd)"
+    REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../../../../../../" && pwd)"
     load "$REPO_ROOT/tests/test_helper/bats-support/load"
     load "$REPO_ROOT/tests/test_helper/bats-assert/load"
 

plugins/core/.apm/skills/provider-adapter-author/tests/README.md

@@ -18,7 +18,7 @@ git clone https://github.com/bats-core/bats-assert tests/test_helper/bats-assert
 Run all tests for this skill (from the repo root):
 
 ```bash
-bats plugins/core/skills/provider-adapter-author/tests/
+bats plugins/core/.apm/skills/provider-adapter-author/tests/
 ```
 
 ## Files

plugins/core/.apm/skills/provider-adapter-author/tests/validate-adapter.bats

@@ -1,7 +1,7 @@
 #!/usr/bin/env bats
 
 setup() {
-    REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../../../../../" && pwd)"
+    REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../../../../../../" && pwd)"
     load "$REPO_ROOT/tests/test_helper/bats-support/load"
     load "$REPO_ROOT/tests/test_helper/bats-assert/load"
 

plugins/core/.claude-plugin/plugin.json

@@ -1,10 +1,10 @@
 {
   "author": {
+    "email": "defame1297@rkdr.net",
     "name": "Defame1297",
     "url": "https://git.dev.rkdr.net/Defame1297/"
   },
   "description": "Cross-cutting utility skills for everyday AI-assisted coding \u2014 triage, diagnosis, architecture review, and session navigation.",
-  "displayName": "Core",
   "keywords": [
     "cross-cutting",
     "triage",

plugins/core/.github/plugin/plugin.json

@@ -0,0 +1,18 @@
+{
+  "author": {
+    "email": "defame1297@rkdr.net",
+    "name": "Defame1297",
+    "url": "https://git.dev.rkdr.net/Defame1297/"
+  },
+  "description": "Cross-cutting utility skills for everyday AI-assisted coding \u2014 triage, diagnosis, architecture review, and session navigation.",
+  "keywords": [
+    "cross-cutting",
+    "triage",
+    "diagnose",
+    "architecture",
+    "debug"
+  ],
+  "license": "MIT",
+  "name": "core",
+  "version": "1.1.0"
+}

plugins/core/apm.yml

@@ -0,0 +1,32 @@
+name: core
+version: 1.1.0
+description: Cross-cutting utility skills for everyday AI-assisted coding — triage, diagnosis, architecture review, and session navigation.
+author:
+  name: Defame1297
+  email: defame1297@rkdr.net
+  url: https://git.dev.rkdr.net/Defame1297/
+license: MIT
+keywords:
+  - cross-cutting
+  - triage
+  - diagnose
+  - architecture
+  - debug
+
+# Constrains what .apm/ may contain: instructions, skill, hybrid, or prompts
+type: skill
+
+targets:
+  - claude
+  - copilot
+
+# "auto" publishes the authoritative local source layout, or list explicit
+# repo paths to define the complete publication set.
+includes: auto
+
+dependencies:
+  apm: []
+  mcp: []
+devDependencies:
+  apm: []
+scripts: {}

plugins/core/plugin.json

@@ -1,10 +1,10 @@
 {
   "author": {
     "email": "defame1297@rkdr.net",
-    "name": "Defame1297"
+    "name": "Defame1297",
+    "url": "https://git.dev.rkdr.net/Defame1297/"
   },
   "description": "Cross-cutting utility skills for everyday AI-assisted coding \u2014 triage, diagnosis, architecture review, and session navigation.",
-  "hooks": "hooks.json",
   "keywords": [
     "cross-cutting",
     "triage",
@@ -13,10 +13,6 @@
     "debug"
   ],
   "license": "MIT",
-  "mcpServers": ".mcp.json",
   "name": "core",
-  "skills": [
-    "skills/"
-  ],
   "version": "1.1.0"
 }

plugins/git/.apm/agents/git-orchestrate.agent.md

@@ -3,8 +3,6 @@ name: git-orchestrate
 
 description: Orchestrates git workflow operations for other agents. Invoke when a caller needs a multi-step or destructive git operation (rebase, force-push, branch deletion) coordinated across domain skills with safety gates, session context, and structured results.
 
-tools: ["execute", "read", "edit"]
-
 source_keys:
   - context7-git-htmldocs
   - git-scm-docs
@@ -12,7 +10,6 @@ source_keys:
   - git-scm-submodule-docs
   - git-scm-remote-docs
   - conventional-commits-spec
-
 ---
 
 You are the orchestrator for the git plugin—a composable workflow dispatcher designed for other agents to invoke multi-step git operations reliably. Your one job is routing and safety-gating: you do not execute git logic yourself, you delegate to domain skills and enforce confirmation on destructive operations.
@@ -44,7 +41,7 @@ Sub-skills carry their own local copies of these rules for humans who invoke the
 When invoked, you:
 1. Parse the incoming workflow request (operation type, parameters, context overrides)
 2. Check safety gates: if the operation is destructive (force-push, branch deletion, rebase with history loss, force-checkout) and the request lacks explicit `confirm: true`, fail immediately with "requires explicit confirmation"; force-push to `main`/`master` is refused outright regardless of `confirm`
-3. Route to the appropriate domain skill: git-commits, git-branches, git-history, git-submodules, git-worktrees, git-remotes
+3. Route to the appropriate domain skill: `git-commits`, `git-branches`, `git-history`, `git-submodules`, `git-worktrees`, `git-remotes`
 4. Manage session context: carry forward the current branch, workflow intent, and configuration, passing explicitly to each skill
 5. Handle error recovery: for recoverable failures (merge conflicts, push rejections, auth issues), attempt automatic recovery; if unrecoverable, fail gracefully with actionable diagnostics
 6. Aggregate results and return structured JSON output suitable for agent chaining
@@ -67,11 +64,27 @@ When invoked, you:
 2. Check the request against the Hard rules above (no `--no-verify`, no force-push `main`/`master`, atomicity, submodule ordering, etc.) — refuse outright on violation, independent of `confirm`
 3. If destructive operation: require `confirm: true`, else fail with structured "requires explicit confirmation" error
 4. Read plugin config from `.claude/plugins/git/config.json` if present — see `config.example.json` in the plugin root for the expected shape (`branching_pattern`, `commit_style`, `rebase_strategy`) — or fall back to sensible defaults
-5. Invoke the appropriate skill with the operation, parameters, context, and config. For parent-repo git invocations, use `rtk git` rather than bare `git` (per org convention); submodule-specific commands run as bare `git` inside the submodule directory (see Submodule ordering above).
+5. Invoke the appropriate skill via `Skill` or direct bash call with the operation, parameters, context, and config. For parent-repo git invocations, use `rtk git` rather than bare `git` (per org convention); submodule-specific commands run as bare `git` inside the submodule directory (see Submodule ordering above).
 6. Catch and handle git errors: attempt automatic recovery (offer rebase strategies for conflicts, suggest `--force-with-lease` for rejections)
 7. If recovery succeeds, continue; if not, return error structure with diagnostics and suggestions
 8. Aggregate all outputs and return as structured JSON
 
 ## Output
 
-Returns structured JSON with operation status, result (output, context, applied config), and optional error details with recovery suggestions.
+```json
+{
+  "status": "success" | "error",
+  "operation": "<operation_name>",
+  "result": {
+    "output": "<command output or result>",
+    "context": { "current_branch": "...", "workflow_intent": "..." },
+    "applied_config": { "commit_style": "...", "rebase_strategy": "..." }
+  },
+  "error": {
+    "message": "<human-readable error>",
+    "code": "<error type: conflict | auth_failure | push_rejection | invalid_state>",
+    "recovery_attempted": true | false,
+    "suggestions": ["<suggestion1>", "<suggestion2>"]
+  }
+}
+```