chore: adopt the organization's shared standard

.github/workflows/ci.yml

@@ -1,13 +1,14 @@
 name: CI
 on:
   pull_request:
+    types: [opened, synchronize, reopened]
   push:
     branches: [master]
   workflow_dispatch:
 permissions:
   contents: read
 concurrency:
-  group: ci-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 jobs:
   package:
@@ -29,7 +30,7 @@ jobs:
           /usr/bin/swift test --disable-automatic-resolution
           /usr/bin/swift build -c release --disable-automatic-resolution
           python3 -m unittest discover -s Tests -p 'test_*.py'
-          python3 Scripts/build_package.py dist > package-receipt.json
+          python3 scripts/build_package.py dist > package-receipt.json
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: swift-format-plugin-${{ github.sha }}
@@ -51,6 +52,10 @@ jobs:
       - name: Verify the oldest supported package interpreter
         run: |
           python3 -m unittest discover -s Tests -p 'test_*.py'
-          python3 Scripts/build_package.py dist
-  brand:
-    uses: computer-mcp/.github/.github/workflows/brand-check.yml@f402911abcdfb87ef0c41a2759e8c51387b18935 # master
+          python3 scripts/build_package.py dist
+  validate:
+    if: always()
+    needs: [package, minimum-python]
+    uses: computer-mcp/github-workflows/.github/workflows/result.yml@d65bc20504f39c3a30232d67043abeca43d2c7b1
+    with:
+      needs-json: ${{ toJSON(needs) }}

.github/workflows/notify-catalog.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       - name: Request complete catalog reconciliation
         id: catalog
-        uses: computer-mcp/computer-mcp.github.io/.github/actions/notify-catalog@cda692839487f03a2b4740d945f9a8bd818554e5
+        uses: computer-mcp/github-workflows/actions/notify-catalog@d65bc20504f39c3a30232d67043abeca43d2c7b1
         with:
           client-id: ${{ vars.CATALOG_APP_CLIENT_ID }}
           private-key: ${{ secrets.CATALOG_APP_PRIVATE_KEY }}

.github/workflows/release.yml

@@ -16,11 +16,11 @@ jobs:
     permissions:
       contents: write
       actions: read
-    uses: computer-mcp/.github/.github/workflows/plugin-release.yml@35766b350427ed900b456aa3c39098e97d9d3aa1 # master
+    uses: computer-mcp/github-workflows/.github/workflows/plugin-release.yml@d65bc20504f39c3a30232d67043abeca43d2c7b1
     with:
       ref: ${{ inputs.ref }}
       publish: ${{ inputs.publish }}
-      build: python3 Scripts/build_package.py
+      build: python3 scripts/build_package.py
       ci_artifact: swift-format-plugin-${commit}
   notify-catalog:
     needs: release

.github/workflows/source-policy.yml

@@ -0,0 +1,17 @@
+name: Source policy checks
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+  push:
+    branches: [master]
+  merge_group:
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  policy:
+    uses: computer-mcp/github-workflows/.github/workflows/policy.yml@d65bc20504f39c3a30232d67043abeca43d2c7b1
+    with:
+      declaration-revision: 5c54a40cb7953db7472ebbefd3db608036b7b3ab

AGENTS.md

@@ -152,13 +152,3 @@ source of truth instead of a literal value.
 ## Repository Guardrails
 
 Read Package.swift and computer-mcp-plugin.toml before editing. Keep the exporter separate from the vendor formatter. Generate cli-tree.json from verified native input; preserve upstream notices and never hand-edit generated output. Run swift build, swift test and swift-format lint before handoff. Do not install vendor binaries or change global PATH.
-
-## Brand delivery
-
-The organization `.github` repository owns the design system and renders every
-image; the main Computer MCP repository owns ProductIdentity. Imported
-`Documentation/Brand/header-light.png` and `header-dark.png` travel with the
-packaged manual; `.github/brand/social.png` supplies the repository preview.
-`.github/brand/brand.lock.json` binds them to the organization exports, and CI
-verifies it with the shared brand-check workflow. Update imports with the
-organization repository's `python3 Brand/brand.py sync`.

CONTRIBUTING.md

@@ -14,10 +14,10 @@ swift format lint --strict --recursive --configuration .swift-format Package.swi
 swift test --disable-automatic-resolution
 swift build -c release --disable-automatic-resolution
 python3 -m unittest discover -s Tests -p 'test_*.py'
-python3 Scripts/build_package.py OUTPUT_DIRECTORY
+python3 scripts/build_package.py OUTPUT_DIRECTORY
 ```
 
-CI also repeats the Python tests and package build on Python 3.11, and runs the organization brand check. Exercise help, valid input and invalid input from outside the checkout. Keep command output contracts and generated resources covered by tests.
+CI also repeats the Python tests and package build on Python 3.11. Exercise help, valid input and invalid input from outside the checkout. Keep command output contracts and generated resources covered by tests.
 
 ## Documentation
 

Documentation/Architecture/Package.md

@@ -19,14 +19,14 @@ is a separately resolved host dependency, never bundled or installed here.
 
 ## Boundaries
 
-The host owns workspace access, caller permissions, executable bindings and
+The host owns project access, caller permissions, executable bindings and
 runtime output limits. Version/interface checks distinguish the reviewed tree
 from an incompatible external installation. Current mapping and intentional
 coverage limits are described in [Interface](../Reference/Interface.md).
 
 ## Distribution
 
-`Scripts/build_package.py` packages regular, bounded source files into a
+`scripts/build_package.py` packages regular, bounded source files into a
 deterministic ZIP. It includes the host-consumed declaration and CLI Tree,
 manuals and notices, while build products and maintainer source stay in the
 repository. The Python standard-library builder requires no vendor process.

Documentation/Reference/Release.md

@@ -9,7 +9,7 @@ The organization [VERSIONING](https://github.com/computer-mcp/.github/blob/maste
 owns version rules, including tags, version choice and the changelog. This
 reference records this repository's version sources, compatibility, release
 procedure and checks. The shared
-[release workflow guide](https://github.com/computer-mcp/.github/blob/master/Documentation/Reference/PluginRelease.md)
+[release workflow guide](https://github.com/computer-mcp/github-workflows/blob/master/docs/plugin-release.md)
 describes workflow verification and recovery.
 
 ## Components and Version Sources
@@ -22,7 +22,8 @@ The `export-swift-format-tree` executable is a maintainer tool that regenerates
 `cli-tree.json`. It is not shipped and has no version of its own.
 
 The archive contains the manifest, `cli-tree.json`, the README, contribution
-guide, license, notices, `ThirdPartyNotices/` and `Documentation/`.
+guide, license, notices, `ThirdPartyNotices/`, `Documentation/`, and the README
+images `.github/assets/logo/logo-light.png` and `.github/assets/logo/logo-dark.png`.
 The exporter, tests, build scripts and workflows are excluded from the archive.
 
 ## Compatibility Surface
@@ -55,8 +56,9 @@ host installation and real format/lint calls are separate manual acceptance.
 
 ## Derived Metadata and Drift Checks
 
-`Scripts/build_package.py` verifies the plugin ID, parses the CLI tree, skips
-hidden files and Python caches, rejects links and special files, and produces
+`scripts/build_package.py` verifies the plugin ID, parses the CLI tree, skips
+hidden files and Python caches during directory traversal, explicitly includes
+the two README logo files, rejects links and special files, and produces
 the same archive bytes from the same source. The builder receipt prints the ID,
 version and SHA-256.
 
@@ -78,7 +80,7 @@ The shared workflow checks that setting before writing a Release.
    and that the reviewed `master` commit has a successful `ci.yml` push run.
 2. Dispatch `release.yml` from `master` with `ref` set to that full commit SHA
    and `publish` set to `false` (the default). The pinned reusable workflow runs
-   `python3 Scripts/build_package.py` with an output directory and requires its
+   `python3 scripts/build_package.py` with an output directory and requires its
    `swift-format.zip` to match the archive in the exact
    `swift-format-plugin-<commit>` CI artifact byte for byte. Inspect the
    `plugin-release-<run-id>-<attempt>` workflow artifact: `assets/` contains the
@@ -117,9 +119,9 @@ The job checks this repository's immutable ID, does not check out package code,
 and grants its own token no repository permissions. Missing or rejected
 authority fails the run visibly.
 
-The website's notification action is pinned to a reviewed full commit. Publish
-that website commit first, then update the pin here when adopting a change to
-the notification contract.
+The shared notification action in `computer-mcp/github-workflows` is pinned to a
+reviewed full commit. Update the pin here when adopting a reviewed change to the
+notification contract.
 
 A release published with a repository `GITHUB_TOKEN` does not trigger
 release-event workflows. `release.yml` calls `notify-catalog.yml` as a dependent
@@ -147,8 +149,8 @@ acceptance record.
 | Operation | Existing command or explicit manual procedure | Required access |
 | --- | --- | --- |
 | Version update and check | Edit `computer-mcp-plugin.toml`; `python3 -m unittest discover -s Tests -p 'test_*.py'` | Local checkout |
-| Candidate validation and build | `ci.yml`; locally the commands in [CONTRIBUTING](../../CONTRIBUTING.md#validation), then `python3 Scripts/build_package.py dist` | CI or local checkout with Swift toolchain and resolved dependencies |
-| Native and host acceptance | Validate and install the exact archive with the selected host, bind the supported formatter and exercise format/lint calls | Selected host, formatter and authorized workspace |
+| Candidate validation and build | `ci.yml`; locally the commands in [CONTRIBUTING](../../CONTRIBUTING.md#validation), then `python3 scripts/build_package.py dist` | CI or local checkout with Swift toolchain and resolved dependencies |
+| Native and host acceptance | Validate and install the exact archive with the selected host, bind the supported formatter and exercise format/lint calls | Selected host, formatter and authorized project |
 | Acceptance and publication | Manual checks above; dispatch `release.yml`, dry run first | Repository Actions; publication also needs a signing key and release write access |
 | Status and interrupted-run recovery | Inspect CI or `release.yml`; follow [Retry](#retry) | Repository Actions |
 | Cleanup | Delete obsolete local output directories and reproducible `.build/` products | Local checkout |
@@ -161,7 +163,7 @@ retention.
 ### Retry
 
 For a failed release run, use **Re-run failed jobs**. The shared workflow's
-[recovery procedure](https://github.com/computer-mcp/.github/blob/master/Documentation/Reference/PluginRelease.md#run-and-recover)
+[recovery procedure](https://github.com/computer-mcp/github-workflows/blob/master/docs/plugin-release.md#run-and-recover)
 owns draft recovery, frozen provenance and expired artifacts. A notification
 failure needs only the notification job rerun or a manual notification dispatch.