Align the two publisher/portability token files

[kyle-sexton]

Two token files gate publisher and portability tokens, read by two different checks:

• scripts/org-agnosticism-tokens.txt, read by scripts/validate-plugin-contracts.mjs (via scripts/validate-plugins.sh).
• scripts/skill-portability-tokens.txt, read by scripts/check-skill-portability.sh (the portability-lint CI job).

docs/plugin-philosophy.md (Design boundary, the paragraph after the token-class list) already says that if the portability file activates a publisher class it "must consume or align with org-agnosticism-tokens.txt rather than invent a third set". Nothing enforces that alignment today.

Ask: decide whether the two files share one source for overlapping classes (one reads the other, or both read one file), and add a check that fails when an overlapping class drifts between them. The upcoming plugin conformance audit's dependency inventory must reuse this, not add a third file.

Found by the plugin-alignment-audit design (PR #4538, docs/topics/plugin-alignment-audit/design/capability-matrix.md, "Existing duplication found" item 1).

[kyle-sexton]

This was generated by AI during the 2026-09-29 audit of the Cursor run.

The gate merged in PR #4867 (scripts/check-publisher-token-alignment.sh) passed trivially. Its test had one assertion and would pass with exit 0, and zero active tokens read as PASS.

PR #5339 (draft, Refs #4582) fixes that:

• Env overrides PUBLISHER_TOKEN_ORG_FILE and PUBLISHER_TOKEN_PORT_FILE let the test point the gate at fixtures.
• Fail-closed handling: exit 2 when the # --- ACTIVE marker is missing, or when either token set is empty.
• The test now runs fixtures for pass, drift (names the token), renamed marker, comment-only section, empty org file, missing file, and the real repo files: 13 pass, 0 fail. The real files still pass (2 active portability tokens, 11 org patterns).
• The suite was checked against a body of exit 0 and fails there.

This issue's "decide whether the files share one source" was resolved as align-by-check, which docs/plugin-philosophy.md already permits ("consume or align with"). No shared source was created.

The issue stays closed; the fix is not merged until the owner merges #5339.

[kyle-sexton]

This was generated by AI during the 2026-09-29 audit of the Cursor run.

This records the decision behind PR #4867, which the PR did not state.

• Two token files stay. scripts/org-agnosticism-tokens.txt holds the org-name tokens. scripts/skill-portability-tokens.txt holds the ERE patterns check-skill-portability.sh matches against changed skill files. They feed different checks, so neither replaces the other.
• Alignment is a one-way check. scripts/check-publisher-token-alignment.sh fails when an ACTIVE portability token looks like a publisher token and is missing from the org file. It compares exact strings and does not check the reverse direction. docs/plugin-philosophy.md (Design boundary) allows "consume or align with", and this check is how the two files stay aligned.
• The "must reuse this" ask resolved as not applicable. docs/specs/plugin-conformance-audit-plan.md (Phase 3, item 1) says the dependency-inventory patterns are new, and that org-agnosticism-tokens.txt holds org-name tokens only and "is not reused or duplicated". So the inventory is not required to read the org file.

PR #5339 (Refs #4582) also trims surrounding whitespace on both sides before comparing. Both files are now read through scripts/lib/read-list.sh, the parser the portability gate uses, and a test covers padded lines on either side.