From 99318fc60e6b675ff18d79ba43ca1f2f3ae69efe Mon Sep 17 00:00:00 2001 From: Lucas1479 Date: Thu, 5 Nov 2026 12:56:17 +1300 Subject: [PATCH 1/2] catalog: prepare GUI Runtime Connector 0.0.8 publication --- catalog/README.md | 7 ++-- catalog/v1/index.json | 90 ++++++++++++++++++++++++++++++++++++++++--- 2 files changed, 88 insertions(+), 9 deletions(-) diff --git a/catalog/README.md b/catalog/README.md index 61c78ff..f77190f 100644 --- a/catalog/README.md +++ b/catalog/README.md @@ -1,7 +1,7 @@ -# Curated catalog v1 (experimental, no public store yet) +# Curated catalog v1 (experimental) This directory defines distribution facts, not new extension execution rights. -The sole official index URL will be +The sole official index URL is `https://raw.githubusercontent.com/Code-Amadeus/Amadeus-Extensions/main/catalog/v1/index.json` on protected main. There is no signature in v1: repository access, branch protection, independent review, maintainer 2FA and least-privilege Actions @@ -49,8 +49,7 @@ future signatures. Never replace the official index trust root with a mirror. `toolchain.json` fixes Host commit, Windows, CPython 3.12.10 and the hash of the Host's generated minimal dependency list. Obtain that exact Host checkout; the tools reject a different or modified checker. Install its minimal environment -with `pip --require-hashes`. The Host pin is currently a local experimental commit -and must be pushed/reviewed before GitHub Actions can retrieve it. No SDK or Host +with `pip --require-hashes`. The Host pin is publicly retained by the extension-catalog-checker-d1 tag. No SDK or Host protocol pin is changed by this catalog work. 1. Commit proposed artifact/review/ownership facts. CI uses protected-base tools diff --git a/catalog/v1/index.json b/catalog/v1/index.json index 9f476eb..81c7ab8 100644 --- a/catalog/v1/index.json +++ b/catalog/v1/index.json @@ -1,10 +1,90 @@ { - "entries": [], + "entries": [ + { + "compatibility": { + "contributions": [ + { + "contract": "amadeus.mcp-server/v0", + "kind": "mcp_server", + "role": "" + }, + { + "contract": "amadeus.skill/v0", + "kind": "skill", + "role": "" + } + ], + "delivery": "python-wheel", + "dependencies": [], + "host_api": ">=0.1,<0.2", + "platforms": [ + "win32" + ], + "python": "<3.13,>=3.12", + "runtime": "none", + "sdk": "0.1.0" + }, + "display": { + "access": { + "os": { + "network": [ + "*" + ] + }, + "services": [ + { + "id": "execution", + "kind": "mcp_server", + "transport": "http", + "url": "${config.runtime_url}" + } + ] + }, + "author": { + "name": "Desolate-Jix" + }, + "description": { + "en": "Connector to a separately installed and started Windows GUI Runtime. Recommend 0.1.11; 0.1.6 marks the minimum HTTP protocol, not a compatibility range. Check the actual version, authenticated HTTP MCP and review/continue tools. Configure trusted loopback runtime_url and connection_token; bind MCP and Skill to Pi. You deploy and stop Runtime separately. Disabling/uninstalling this connector does not stop/uninstall Runtime or delete its data. External model APIs may charge usage fees.", + "zh-CN": "\u8fde\u63a5\u5668\uff1a\u9700\u81ea\u884c\u5355\u72ec\u5b89\u88c5\u3001\u914d\u7f6e\u5e76\u542f\u52a8 Windows GUI Runtime\u3002\u5efa\u8bae\u4f7f\u7528 0.1.11\uff1b0.1.6 \u8868\u793a\u6700\u4f4e HTTP \u534f\u8bae\u8d77\u70b9\uff0c\u4e0d\u4fdd\u8bc1\u6240\u6709\u540e\u7eed\u7248\u672c\u517c\u5bb9\u3002\u987b\u6838\u5bf9\u5b9e\u9645\u7248\u672c\u3001\u9274\u6743 HTTP MCP \u53ca\u5ba1\u6838\uff0f\u7ee7\u7eed\u5de5\u5177\u3002\u586b\u5199\u53ef\u4fe1\u672c\u673a runtime_url \u548c connection_token\uff0c\u5c06 MCP \u4e0e Skill \u7ed1\u5b9a Pi\u3002Runtime \u7531\u7528\u6237\u72ec\u7acb\u90e8\u7f72\u548c\u505c\u6b62\uff1b\u505c\u7528\uff0f\u5378\u8f7d\u672c\u8fde\u63a5\u5668\u4e0d\u4f1a\u505c\u6b62\u3001\u5378\u8f7d Runtime \u6216\u5220\u9664\u5176\u6570\u636e\u3002\u5916\u90e8\u6a21\u578b API \u53ef\u80fd\u6309\u7528\u91cf\u6536\u8d39\u3002" + }, + "display_name": { + "en": "Windows GUI Runtime Connector", + "zh-CN": "Windows GUI Runtime \u8fde\u63a5\u5668" + }, + "homepage": "https://github.com/Desolate-Jix/agent-gui-runtime/blob/amadeus-extension-v0.0.8/integrations/amadeus/agent-review-instant/README.md", + "license": "ISC", + "repository": "https://github.com/Desolate-Jix/agent-gui-runtime" + }, + "id": "io.github.desolate-jix.gui-runtime", + "publisher": { + "evidence": "https://github.com/Desolate-Jix/agent-gui-runtime/releases/tag/amadeus-extension-v0.0.8", + "id": "Desolate-Jix", + "maintainers": [ + "Desolate-Jix" + ], + "package_ids": [ + "io.github.desolate-jix.gui-runtime" + ] + }, + "review": { + "date": "2026-11-05", + "evidence": "https://github.com/Code-Amadeus/Amadeus-Extensions/pull/11", + "policy": "curated-v1", + "reviewer": "Lucas1479", + "sha256": "2f532faf152faf2e1e3ab3140e1097487689be34d638e4ee86539e06886cbcaf" + }, + "sha256": "2f532faf152faf2e1e3ab3140e1097487689be34d638e4ee86539e06886cbcaf", + "size": 27990, + "url": "https://github.com/Desolate-Jix/agent-gui-runtime/releases/download/amadeus-extension-v0.0.8/amadeus_agent_gui_runtime-0.0.8-py3-none-any.whl", + "version": "0.0.8", + "withdrawal": null + } + ], "format": "amadeus.catalog/v1", - "generator_commit": "85f49315dd01818748e4079b69bdf67d47eb7170", + "generator_commit": "0afb576b2366a455be64e53322abf26259edfede", "host_commit": "1840c8e4f646992ddaebea3139c8895f29743a8f", "security": [], - "sequence": 0, - "source_commit": "85f49315dd01818748e4079b69bdf67d47eb7170", - "source_time": "2026-10-21T09:03:48+13:00" + "sequence": 1, + "source_commit": "0afb576b2366a455be64e53322abf26259edfede", + "source_time": "2026-11-05T12:49:22+13:00" } From a42b797341eecd1e7f08faa61c7e5152635f32bf Mon Sep 17 00:00:00 2001 From: Lucas1479 Date: Thu, 5 Nov 2026 22:14:07 +1300 Subject: [PATCH 2/2] docs(catalog): make maintainer 2FA guidance optional --- catalog/README.md | 7 ++++++- catalog/REVIEW_CHECKLIST.md | 9 +++++++-- catalog/VERIFICATION.md | 5 +++++ 3 files changed, 18 insertions(+), 3 deletions(-) diff --git a/catalog/README.md b/catalog/README.md index f77190f..40e857e 100644 --- a/catalog/README.md +++ b/catalog/README.md @@ -4,10 +4,15 @@ This directory defines distribution facts, not new extension execution rights. The sole official index URL is `https://raw.githubusercontent.com/Code-Amadeus/Amadeus-Extensions/main/catalog/v1/index.json` on protected main. There is no signature in v1: repository access, -branch protection, independent review, maintainer 2FA and least-privilege Actions +branch protection, independent review and least-privilege Actions are the trust root. These publication controls must be verified before S3. No real package is reviewed or published by the empty sequence-0 bootstrap. +Maintainer two-factor authentication is recommended account protection, not a +prerequisite for catalog approval, merge or publication. Organization-wide 2FA +enforcement is not required by the catalog. GitHub's own account requirements +remain separate. + ## Inputs and review Put one JSON file per artifact below `packages/`. Hand-maintained keys are exactly: diff --git a/catalog/REVIEW_CHECKLIST.md b/catalog/REVIEW_CHECKLIST.md index 3e7eedc..db67b70 100644 --- a/catalog/REVIEW_CHECKLIST.md +++ b/catalog/REVIEW_CHECKLIST.md @@ -72,8 +72,13 @@ maintainer withdrawal for ordinary retirement, and security decisions for unsafe artifacts. Do not relabel copyright removal as a security ban or delete user data. Before first public release: protect main, require reviewed merges, verify -maintainer two-factor authentication and least-privilege workflows, and ensure -submission execution jobs have no publishing credentials. S3 owns that evidence. +least-privilege workflows, and ensure submission execution jobs have no publishing +credentials. S3 owns that evidence. + +Maintainer two-factor authentication is recommended account protection, not a +prerequisite for catalog approval, merge or publication. Organization-wide 2FA +enforcement is not required by the catalog. GitHub's own account requirements +remain separate. For author preflight, ownership/transfer, review invalidation, PR responsibilities, diff --git a/catalog/VERIFICATION.md b/catalog/VERIFICATION.md index 9392e77..de995f1 100644 --- a/catalog/VERIFICATION.md +++ b/catalog/VERIFICATION.md @@ -1,5 +1,10 @@ # S0 local verification — 2026-10-21 +Policy update (2026-11-05): maintainer 2FA is recommended, not a catalog approval, +merge or publication prerequisite. The dated observations below preserve the +former policy as history; the current requirements are in +[REVIEW_CHECKLIST.md](REVIEW_CHECKLIST.md). + Experimental branch: `codex/extension-community-preview`. Nothing was pushed or published. The empty `index.json` is a sequence-0 bootstrap, not a reviewed package listing. Its `source_commit` and `generator_commit` identify the actual committed