fix(scripts): consolidate org-agnosticism enforcement behind its stated rule

[kyle-sexton]

Context

Split out of #3127 item 5. The documentation half landed in #3139: docs/PLUGIN-PHILOSOPHY.md § "Design boundary" now names org-agnosticism as a rule and states what it governs. scripts/ and plugins/ were outside that PR's fence, so the enforcement change is here.

Where enforcement lives today

Layered across three code sites in two independent mechanisms, neither aware of the other, and both steps of the same plugin-gate CI job (.github/workflows/ci.yml):

• scripts/validate-plugin-contracts.mjs:75-77 — setup-skill files may not bind to the marketplace name.
• scripts/validate-plugin-contracts.mjs:80-88 — the fleet-wide form over every plugin skill .md: the marketplace id, melodic-software/github-iac, and MELODIC_* publisher-prefixed keys.
• scripts/validate-plugin-contracts.mjs:240-265 — a stricter token set (melodic-software|ci-workflows|github-iac) scoped to the autonomy plugin only, with plugin.json author exempted.
• plugins/github/github.test.sh:63-70 — a separate section labeled "agnostic conformance", a sibling of that file's D4 zero-vendored-knowledge sweeps (:34-61), not one of them. Its token set (melodic|medley|github-iac|pulumi) is a superset of the fleet check's, and its reach is narrower but prose-wide: one plugin, all its markdown including README, CHANGELOG, and reference files.

A fleet-wide changelog or prose edit therefore answers to two mechanisms with two different token sets and two different exemption conventions for the same underlying rule.

(Corrected 2026-08-23: an earlier version of this body said the github sweep was "part of its D4 zero-vendored-knowledge checks" and that the two mechanisms ran "in two CI jobs". Both were wrong per the files. Whoever implements this should trust the files over any prose, including this.)

A second, larger gap: the rule outruns its enforcement

docs/PLUGIN-PHILOSOPHY.md states the rule over four token classes across "skill, agent, or schema content". Mechanically, only publisher-prefixed MELODIC_* keys and the @-qualified marketplace id are gated fleet-wide. The bare organization name and the publisher's own repository names are not; agent content has no gate at all; and the only .schema.json rule (validate-plugin-contracts.mjs:99-103) is an unrelated neutral-URI check.

Independently measured on 1f7525fe6: 48 shipped skill-content files contain melodic-software while the validator exits 0. The doctrine paragraph concedes that enforcement is layered rather than unified and names the validator's reach honestly, so nothing in the doc is false — but no tracked item closes the conformance gap, which is why it is recorded here rather than left implicit.

Ask

1. Consolidate so the rule has one implementation and the narrower sites are declared narrowings of it rather than parallel rules: one shared token set held as data (scripts/skill-portability-tokens.txt is the repo's idiom), autonomy's stricter set expressed as an extension, plugins/github's sweep either delegating to the shared check or documenting precisely what it adds, and each site citing docs/PLUGIN-PHILOSOPHY.md § "Design boundary".
2. Decide the conformance gap deliberately, in the same pass: either widen enforcement to the classes the rule names (and remediate the 48 files), or narrow the stated rule to what is actually gated. Do not leave the doc claiming more than any gate checks.

Note for whoever implements this

A third agnosticism gate exists in a different job — portability-lint (ci.yml:1367) — whose publisher-token class is staged but commented out in scripts/skill-portability-tokens.txt:139-152. The doc's "both steps of the same plugin-gate CI job" is exact today and becomes false the day that class activates. Consolidating should account for it rather than being surprised by it.

Related

• fix(docs): setup-contract drift — unstamped --config claim in three docs, no SSOT for the contract, stale PR-section config #3127 — parent; fix(docs): correct setup-contract drift in docs and tracked PR config #3139 carries the documentation half (the named rule).
• fix(plugins): correct the unstamped --config reconfiguration claim (#3111) #3115 — surfaced this: a fleet-wide changelog sweep tripped github.test.sh's agnostic-conformance check while the shared validator was green.

[kyle-sexton]

[kyle-sexton]

Cross-reference: #3182 finding 1 lands in this same paragraph — the fetch/cite boundary added by #3139 states a cause ('made the publisher a runtime dependency') that does not hold for the non-publisher documentation URLs its own sanction covers, with a live counterexample at plugins/claude-config/skills/audit/SKILL.md:167. Settle it with the consolidation here rather than separately; the wording and the enforcement decision are the same call.