chore: adopt the organization's shared standard

.github/workflows/ci.yml

@@ -1,14 +1,15 @@
 name: CI
 on:
   pull_request:
+    types: [opened, synchronize, reopened]
   push:
     branches: [master]
   workflow_dispatch:
 permissions:
   contents: read
 concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 jobs:
   package:
     runs-on: macos-latest
@@ -27,16 +28,16 @@ jobs:
         env:
           BASE_COMMIT: ${{ github.event.pull_request.base.sha || github.event.before }}
         run: |
-          python3 Scripts/version.py check
+          python3 scripts/version.py check
           if [[ "$BASE_COMMIT" =~ ^[0-9a-f]{40}$ && "$BASE_COMMIT" != 0000000000000000000000000000000000000000 ]]; then
-            python3 Scripts/version.py check --base "$BASE_COMMIT"
+            python3 scripts/version.py check --base "$BASE_COMMIT"
           fi
           /usr/bin/swift --version
           /usr/bin/swift package resolve
           git diff --exit-code -- Package.resolved
-          Scripts/verify-swift-codex-release-gate.sh
+          scripts/verify-swift-codex-release-gate.sh
           node --test Tests/schema-import.test.mjs
-          node Scripts/import-schema.mjs --check
+          node scripts/import-schema.mjs --check
           /usr/bin/swift format lint --strict --recursive Package.swift Sources Tests
           /usr/bin/swift build --build-tests --disable-automatic-resolution
       - name: Run Swift tests
@@ -63,11 +64,11 @@ jobs:
       - name: Validate package ownership and publication
         run: |
           python3 -m unittest discover -s Tests -p 'test_*.py' -v
-          python3 Scripts/check-workflow.py --check-release-workflow
+          python3 scripts/check-workflow.py --check-release-workflow
       - name: Build relocatable adapter and receipt
         run: |
-          python3 Scripts/package.py --output dist --configuration release
-          python3 Scripts/check-package.py --archive dist/codex-plugin-macos-arm64.zip --receipt dist/receipt.json --destination .build/accepted-package
+          python3 scripts/package.py --output dist --configuration release
+          python3 scripts/check-package.py --archive dist/codex-plugin-macos-arm64.zip --receipt dist/receipt.json --destination .build/accepted-package
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: codex-plugin-macos-arm64-${{ github.sha }}
@@ -77,5 +78,9 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
-  brand:
-    uses: computer-mcp/.github/.github/workflows/brand-check.yml@f402911abcdfb87ef0c41a2759e8c51387b18935 # master
+  validate:
+    if: always()
+    needs: [package]
+    uses: computer-mcp/github-workflows/.github/workflows/result.yml@d65bc20504f39c3a30232d67043abeca43d2c7b1
+    with:
+      needs-json: ${{ toJSON(needs) }}

.github/workflows/notify-catalog.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       - name: Request complete catalog reconciliation
         id: catalog
-        uses: computer-mcp/computer-mcp.github.io/.github/actions/notify-catalog@cda692839487f03a2b4740d945f9a8bd818554e5
+        uses: computer-mcp/github-workflows/actions/notify-catalog@d65bc20504f39c3a30232d67043abeca43d2c7b1
         with:
           client-id: ${{ vars.CATALOG_APP_CLIENT_ID }}
           private-key: ${{ secrets.CATALOG_APP_PRIVATE_KEY }}

.github/workflows/release.yml

@@ -15,9 +15,6 @@ on:
         type: boolean
         default: false
 permissions: {}
-concurrency:
-  group: plugin-release-${{ github.repository }}-${{ inputs.release_tag || inputs.source_run }}
-  cancel-in-progress: false
 jobs:
   verify:
     if: github.repository == 'computer-mcp/plugin-codex' && github.ref == 'refs/heads/master'
@@ -52,15 +49,15 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          python3 -I Scripts/plugin_release.py verify \
+          python3 -I scripts/plugin_release.py verify \
             --repository "$GH_REPOSITORY" --source-run "$SOURCE_RUN" \
             --tag "$RELEASE_TAG" --publish "$RELEASE_PUBLISH" \
             --workflow-ref "$RELEASE_WORKFLOW_REF" --workflow-sha "$RELEASE_WORKFLOW_SHA" \
             --output .build/plugin-release/assets
           python3 -I - <<'PY'
           import hashlib, os
           from pathlib import Path
-          data = Path('Scripts/plugin_release.py').read_bytes()
+          data = Path('scripts/plugin_release.py').read_bytes()
           Path('.build/plugin-release/plugin_release.py').write_bytes(data)
           with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
               output.write('helper_digest=' + hashlib.sha256(data).hexdigest() + '\n')

.github/workflows/source-policy.yml

@@ -0,0 +1,17 @@
+name: Source policy checks
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+  push:
+    branches: [master]
+  merge_group:
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  policy:
+    uses: computer-mcp/github-workflows/.github/workflows/policy.yml@d65bc20504f39c3a30232d67043abeca43d2c7b1
+    with:
+      declaration-revision: 5c54a40cb7953db7472ebbefd3db608036b7b3ab

AGENTS.md

@@ -162,16 +162,6 @@ Do not install or bundle vendor Codex binaries. Keep generated schema provenance
 
 Use Swift Testing. Run strict swift-format lint, swift build, swift test, schema
 drift checks, and an isolated standard MCP client before handoff. Use `Documentation/Reference/Release.md` for packaged runtime acceptance through
-the installed host; run `Scripts/check-host.py --help` and its Python unit tests
+the installed host; run `scripts/check-host.py --help` and its Python unit tests
 when changing that driver. Logs must never
 write to the protocol stdout. Do not publish repositories or releases implicitly.
-
-## Brand delivery
-
-The organization `.github` repository owns the design system and renders every
-image; the main Computer MCP repository owns ProductIdentity. Imported
-`Documentation/Brand/header-light.png` and `header-dark.png` travel with the
-packaged manual; `.github/brand/social.png` supplies the repository preview.
-`.github/brand/brand.lock.json` binds them to the organization exports, and CI
-verifies it with the shared brand-check workflow. Update imports with the
-organization repository's `python3 Brand/brand.py sync`.

CONTRIBUTING.md

@@ -10,19 +10,19 @@ CI runs these checks on macOS; run them before opening a pull request. They need
 Node.js, `jq` and `ripgrep`:
 
 ```sh
-python3 Scripts/version.py check
+python3 scripts/version.py check
 swift package resolve && git diff --exit-code -- Package.resolved
-Scripts/verify-swift-codex-release-gate.sh
+scripts/verify-swift-codex-release-gate.sh
 node --test Tests/schema-import.test.mjs
-node Scripts/import-schema.mjs --check
+node scripts/import-schema.mjs --check
 swift format lint --strict --recursive Package.swift Sources Tests
 swift build --build-tests --disable-automatic-resolution
 swift test --skip-build --disable-automatic-resolution --no-parallel
 python3 -m unittest discover -s Tests -p 'test_*.py'
-python3 Scripts/package.py --output OUTPUT_DIRECTORY --configuration release
+python3 scripts/package.py --output OUTPUT_DIRECTORY --configuration release
 ```
 
-CI also runs the organization brand check. Exercise help, valid input and invalid input
+Exercise help, valid input and invalid input
 from outside the checkout. Keep command output contracts and generated resources
 covered by tests.
 

Documentation/Architecture/Package.md

@@ -332,7 +332,7 @@ and API documentation scope.
 
 The repository validation workflow resolves and verifies the checked-in dependency
 lock, lints and tests the Swift package, verifies package input ownership and
-exclusive output publication, then invokes `Scripts/package.py` for a
+exclusive output publication, then invokes `scripts/package.py` for a
 relocatable release-configuration archive. It retains the ZIP and file/digest
 receipt with read-only repository permissions. The version-controlled manifest
 owns archive compatibility; packaging verifies the built adapter's slices against

Documentation/Reference/Installation.md

@@ -12,7 +12,7 @@ From this independent repository, with Python 3.11 or newer and its Swift
 dependencies already resolved:
 
 ```sh
-python3 Scripts/package.py --output /absolute/new/artifact-directory
+python3 scripts/package.py --output /absolute/new/artifact-directory
 ```
 
 The default build is release; `--configuration debug` is available for development.
@@ -32,6 +32,15 @@ Computer MCP version. Official GitHub installation verifies the archive
 manifest against its release tag.
 See [third-party components](../../THIRD_PARTY_NOTICES.md) for distribution terms.
 
+The archive includes `README.md`, `CONTRIBUTING.md`, `LICENSE`,
+`THIRD_PARTY_NOTICES.md`, `Package.resolved`, `Documentation/`, the manifest,
+the executable and resource bundle, and collected `ThirdPartyNotices/` and
+`ThirdPartyNotices.txt`. README images retain their relative paths at
+`.github/assets/logo/logo-light.png` and `.github/assets/logo/logo-dark.png`.
+ZIP entries use sorted paths, fixed timestamps and normalized permissions;
+identical staged file bytes and executable bits produce identical archive bytes.
+Native rebuilds may still produce different executable bytes.
+
 Package inputs must be regular files and directories. Symbolic links and special
 files are rejected before signing or running the staged adapter. The output is
 published atomically without replacing any existing destination, including an
@@ -41,7 +50,7 @@ packager's temporary staging directory; existing outputs remain unchanged.
 The repository's CI workflow (`ci.yml`) runs on pull requests, `master` pushes
 and manual dispatch. It checks formatting, tests and the dependency lock, then
 retains the macOS ZIP and receipt as a downloadable workflow artifact. CI verifies
-and relocates the exact archive with `Scripts/check-package.py`. These outputs
+and relocates the exact archive with `scripts/check-package.py`. These outputs
 are validation builds, not published or verified official releases.
 Check the receipt's architecture before installation. Public distribution needs
 separate publisher authorization and its signing/provenance review.

Documentation/Reference/Release.md

@@ -53,7 +53,7 @@ requirements are:
 
 The [package dependency overview](../Architecture/Package.md#dependencies)
 records their architectural responsibilities. CI resolves the committed lock
-and rejects drift. `Scripts/verify-swift-codex-release-gate.sh` checks the
+and rejects drift. `scripts/verify-swift-codex-release-gate.sh` checks the
 declared exact swift-codex version and resolved revision against its public Git
 tag, accepting the tag's peeled commit when it is annotated. The SDK's public
 tag owns its release identity.
@@ -67,20 +67,20 @@ combination's runtime acceptance.
 
 ## Derived Metadata and Drift Checks
 
-`python3 Scripts/version.py update --kind <fix|feature|breaking> --reason <reason>`
+`python3 scripts/version.py update --kind <fix|feature|breaking> --reason <reason>`
 updates the manifest and generated constant. After an explicit manifest edit,
-`python3 Scripts/version.py generate` regenerates
+`python3 scripts/version.py generate` regenerates
 `Sources/CodexAdapter/CodexAdapterBuildInfo.swift`.
 
-`python3 Scripts/version.py check` is read-only and rejects generated metadata
+`python3 scripts/version.py check` is read-only and rejects generated metadata
 drift. Its `--binary <adapter>` option checks the actual executable's `--version`.
 `check --base <commit>` rejects version regression when HEAD has parents and the
 base is an available ancestor; otherwise it checks the current version and
 reports why comparison was skipped. CI supplies the pull request base or
 previous `master` commit. `check --tag <tag>` verifies the manifest version and
 the tag's commit.
 
-`node Scripts/import-schema.mjs --check` verifies bundled protocol resources
+`node scripts/import-schema.mjs --check` verifies bundled protocol resources
 against the locked SDK commit; [Protocol inputs](../../README.md#protocol-inputs)
 owns regeneration instructions. Packaging checks the manifest, generated
 version and dependency lock, validates the built executable's version and
@@ -89,8 +89,8 @@ checks the relocated bytes before runtime acceptance.
 
 ## Candidate, Acceptance and Publication
 
-CI runs source checks and `Scripts/package.py`, then verifies and relocates the
-archive with `Scripts/check-package.py`. It uploads the ZIP and native build
+CI runs source checks and `scripts/package.py`, then verifies and relocates the
+archive with `scripts/check-package.py`. It uploads the ZIP and native build
 receipt as the commit-named candidate artifact. `release.yml` promotes those
 accepted CI bytes and receipts without rebuilding. Verification, publication
 and catalog notification are separate jobs.
@@ -105,12 +105,12 @@ not model execution. Run the ordinary checks in [Contributing](../../CONTRIBUTIN
 first.
 
 ```sh
-python3 Scripts/check-package.py --archive <archive.zip> --receipt <receipt.json> \
+python3 scripts/check-package.py --archive <archive.zip> --receipt <receipt.json> \
   --destination .build/accepted-package
-python3 Scripts/check-workflow.py \
+python3 scripts/check-workflow.py \
   --adapter "$PWD/.build/accepted-package/bin/codex-mcp-adapter" \
   --codex /absolute/path/to/codex
-python3 Scripts/check-host.py \
+python3 scripts/check-host.py \
   --host /absolute/path/to/computer-mcp \
   --adapter "$PWD/.build/accepted-package/bin/codex-mcp-adapter" \
   --codex /absolute/path/to/codex \
@@ -217,7 +217,7 @@ python3 -m unittest discover -s Tests -p 'test_host_acceptance.py' -v
 The Release assets are exactly the manifest's `compatibility.artifacts` ZIPs,
 their `<archive-stem>.receipt.json` native build receipts, `release-receipt.json`
 and `SHA256SUMS`. The native receipts remain inputs to `check-package.py`.
-`Scripts/plugin_release.py` assembles the schema 1 receipt and checksums under
+`scripts/plugin_release.py` assembles the schema 1 receipt and checksums under
 the organization's
 [release content contract](https://github.com/computer-mcp/.github/blob/master/VERSIONING.md#plugin-release-contents)
 and [Codex promotion contract](https://github.com/computer-mcp/.github/blob/master/VERSIONING.md#codex-promotion-exception).
@@ -315,8 +315,8 @@ operator decision.
 | --- | --- | --- |
 | Version update and drift checks | [Metadata entry points](#derived-metadata-and-drift-checks) | Local source write for updates; read-only checks |
 | Source validation | [Contributing checks](../../CONTRIBUTING.md#validation) | Local toolchain; dependency resolution and public SDK tag lookup |
-| Release workflow validation | `python3 Scripts/check-workflow.py --check-release-workflow` and `python3 -m unittest discover -s Tests -p 'test_*.py'` | Local files; no host, vendor or credentials |
-| Candidate build | `python3 Scripts/package.py --output dist --configuration release` | Local build tools and resolved dependencies; new output directory |
+| Release workflow validation | `python3 scripts/check-workflow.py --check-release-workflow` and `python3 -m unittest discover -s Tests -p 'test_*.py'` | Local files; no host, vendor or credentials |
+| Candidate build | `python3 scripts/package.py --output dist --configuration release` | Local build tools and resolved dependencies; new output directory |
 | Archive and runtime acceptance | [Runtime acceptance](#runtime-acceptance) | Verified archive, installed host and vendor; authorized file-store login for full mode |
 | Dry run and publication | [Publish](#publish) | Actions dispatch; verified immutable-release setting; publication job has contents write access |
 | Interrupted-run recovery and catalog status | [Retry](#retry) | Actions access; catalog authority isolated to the notifier |