Add coding-agent-first Doable testing workflow

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "doable-code-context",
-      "description": "Connect a private workspace and resolve published Doable context questions before TRD creation.",
+      "description": "Resolve grounded Doable context requests or start a managed feature-testing workflow from the coding agent.",
       "source": "./plugins/doable-code-context"
     }
   ]

.cursor-plugin/marketplace.json

@@ -10,7 +10,7 @@
     {
       "name": "doable-code-context",
       "source": "./plugins/doable-code-context",
-      "description": "Connect a private workspace and resolve published Doable context questions before TRD creation."
+      "description": "Resolve grounded Doable context requests or start a managed feature-testing workflow from the coding agent."
     }
   ]
 }

PRIVACY.md

@@ -4,11 +4,11 @@ Repository inspection happens inside the coding agent selected by the customer a
 
 ## Doable Code Context
 
-`doable-code-context` connects only to the configured Doable REST API. The API key is read from `DOABLE_API_KEY` at request time, used as a Bearer credential, and never written to disk or included in a generated payload.
+`doable-code-context` performs remote operations only through the configured Doable MCP connection. The coding agent host owns that connection's credential; the Skill and bundled helper neither read nor persist it.
 
 Its local `.doable/workspace-candidate.json`, `.doable/workspace-private.json`, and `.doable/requests/` records may contain real repository identities, explicitly user-supplied artifact roots, local paths, Git provenance, exact evidence locators, and frozen Doable questions. They are written with private permissions and ignored by Git. Artifact roots are never serialized into the remote workspace profile.
 
-The helper validates every outbound workspace profile and answer payload. Doable may receive only:
+The helper validates every workspace profile and answer payload before the coding agent passes it to Doable MCP. Doable may receive only:
 
 - opaque workspace, repository, evidence, round, and question identifiers;
 - a sanitized workspace display name, product roles, surfaces, descriptions, feature scope, and externally observable findings;

README.md

@@ -4,7 +4,7 @@ Official beta plugins for [Doable](https://getdoable.ai), supporting Codex, Clau
 
 | Plugin | Version | Purpose | Network |
 | --- | --- | --- | --- |
-| `doable-code-context` | `0.1.2` | Connect a workspace and resolve a published pre-TRD feature-context round | Doable REST only |
+| `doable-code-context` | `0.2.0` | Resolve context requests or start a managed feature-testing workflow | Configured Doable MCP |
 
 The repository is private during beta. Installation requires GitHub access to `getdoable/doable-agent-plugins`.
 
@@ -24,16 +24,16 @@ Use **Doable Code Context** for the connected pre-TRD workflow:
 3. The coding agent performs demand-driven workspace setup if needed, pulls that exact frozen round, grounds the base request across the relevant private repositories, answers the focused supplements, asks one batched clarification round only when product authority is missing, and pushes structured grounded findings suitable for later knowledge reuse.
 4. Doable reviews the dispositions and continues the existing TRD loop.
 
-The connected plugin uses REST in this MVP, not MCP. Its bundled helper is invoked by the Skills and is not installed as a standalone CLI.
+All remote operations use the separately configured Doable MCP connection. The bundled helper is not a service or standalone CLI: it deterministically maps local repositories, keeps exact provenance private, builds safe payloads, and validates MCP responses.
 
 ## Requirements
 
 - Codex, Claude Code, or Cursor with Agent Skills or plugin support;
 - Node.js 20 or newer;
 - Git for repository-bound evidence;
-- for `doable-code-context`, a Doable organization API key configured as `DOABLE_API_KEY` in the coding agent's local environment.
+- an authenticated Doable MCP connection configured in the coding agent.
 
-Never paste an API key into chat or save it under `.doable/`. `DOABLE_API_BASE_URL` is an optional local/staging override; production uses the built-in Doable API origin.
+Never paste an API key into chat or save it under `.doable/`. The MCP connection owns organization authentication; the helper never reads a credential or calls the Doable API directly.
 
 ## Install
 
@@ -57,6 +57,7 @@ Natural-language requests activate the Skills. Explicit invocations are:
 
 - `/doable-code-context:doable-connect`
 - `/doable-code-context:doable-answer-questions`
+- `/doable-code-context:doable-test-feature`
 
 ### Cursor
 
@@ -76,6 +77,10 @@ ln -s "$(pwd)/doable-agent-plugins/plugins/doable-code-context" ~/.cursor/plugin
 
 Cursor Marketplace installation will replace this fallback after approval.
 
+## Connect Doable MCP once
+
+The plugin supplies Skills and the local privacy helper; it does not bundle or duplicate the remote MCP server. Configure the official Streamable HTTP endpoint `https://mcp.getdoable.ai/mcp` once in the coding-agent host using the organization API key from Doable Settings. The host stores and sends this credential; the Skill and helper never read it. See the [Doable MCP client instructions](https://github.com/getdoable/doable-mcp#connect-a-client) for host-specific configuration.
+
 ## Use Doable Code Context
 
 Normally, paste the short prompt copied from the Doable TRD composer:
@@ -90,6 +95,17 @@ Setup is recovered inside the same conversation if needed. The user may also req
 Doable setup for this workspace.
 ```
 
+Or start from the coding agent after implementing a feature:
+
+```text
+Use Doable to test the feature I just implemented.
+```
+
+The agent reuses or creates the appropriate suite, opens one coding-agent-origin
+Round only when context or requirements changed, resolves that Round from the
+private workspace, and then continues through the existing TRD and managed-case
+workflow.
+
 The connected plugin writes private state under:
 
 ```text
@@ -127,7 +143,7 @@ See [PRIVACY.md](PRIVACY.md) for the exact per-plugin boundary.
 - The connected workflow requires server-side code-context rounds and organization capability enablement.
 - Multiple workspaces are selected in Doable before publishing the round; the coding agent never guesses across workspaces.
 - Required skips return to platform-user review. Coding agents cannot defer or waive scope.
-- MCP, active notifications, setup-time exhaustive knowledge mapping, and automatic TRD creation after the last answer are outside this MVP.
+- Active notifications, setup-time exhaustive knowledge mapping, and automatic historical-knowledge reuse are outside this MVP.
 
 ## Verify
 
@@ -136,7 +152,7 @@ npm test
 claude plugin validate ./plugins/doable-code-context
 ```
 
-The release verifier requires exactly two Skills and one dependency-free helper limited to the explicit Doable REST contract.
+The release verifier requires exactly three Skills and one dependency-free, local-only helper with no network or credential primitives.
 
 Use [TESTING.md](TESTING.md) for the fresh-session acceptance matrix.
 
@@ -147,6 +163,7 @@ plugins/
   doable-code-context/
     skills/doable-connect/
     skills/doable-answer-questions/
+    skills/doable-test-feature/
     scripts/doable-code-context.mjs
 ```
 

SECURITY.md

@@ -2,6 +2,6 @@
 
 Report suspected security or privacy issues privately to support@getdoable.ai. Do not include credentials, source code, customer data, or private environment details.
 
-`doable-code-context` contains no MCP server, credential store, standalone CLI package, runtime dependency, or telemetry. Its helper reads `DOABLE_API_KEY` only at request time, restricts transport to the centralized Doable REST endpoint table, validates local/private versus remote/sanitized schemas, writes private state atomically with mode `0600`, and uses content-derived idempotency keys for profile and answer retries.
+`doable-code-context` contains no bundled MCP server, credential store, standalone CLI package, runtime dependency, or telemetry. Its helper has no network or credential primitives: it validates local/private versus remote/sanitized schemas, writes private state atomically with mode `0600`, and checks content-derived payload digests around calls made through the separately configured Doable MCP connection.
 
 Never commit `.doable/workspace-candidate.json`, `.doable/workspace-private.json`, or `.doable/requests/`. Rotate a Doable API key if it is pasted into a conversation, terminal transcript, issue, or log.

TESTING.md

@@ -1,6 +1,6 @@
 # Beta acceptance checklist
 
-Run these checks from fresh agent sessions. `doable-code-context` exposes exactly two Skills (`doable-connect` and `doable-answer-questions`), no MCP server, and one bundled REST helper.
+Run these checks from fresh agent sessions. `doable-code-context` exposes exactly three Skills (`doable-connect`, `doable-answer-questions`, and `doable-test-feature`), no bundled MCP server, and one local-only deterministic helper. The workflow expects the existing Doable MCP to be configured separately; the helper must contain no network or credential handling.
 
 For every scenario, confirm that the agent inspects only evidence needed for the named feature, keeps exact provenance local, asks only material product-authority questions, and sends only privacy-safe findings and opaque references to Doable.
 

plugins/doable-code-context/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "doable-code-context",
-  "version": "0.1.2",
-  "description": "Connect a private workspace to Doable and resolve one published pre-TRD context request with grounded, privacy-safe answers.",
+  "version": "0.2.0",
+  "description": "Connect private code to Doable through MCP, resolve grounded context requests, and start managed feature-testing workflows.",
   "author": {
     "name": "Doable AI",
     "email": "support@getdoable.ai"

plugins/doable-code-context/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "doable-code-context",
-  "version": "0.1.2",
-  "description": "Connect a private workspace to Doable and resolve one published pre-TRD context request with grounded, privacy-safe answers.",
+  "version": "0.2.0",
+  "description": "Connect private code to Doable through MCP, resolve grounded context requests, and start managed feature-testing workflows.",
   "author": {
     "name": "Doable AI",
     "email": "support@getdoable.ai",
@@ -21,7 +21,7 @@
   "interface": {
     "displayName": "Doable Code Context",
     "shortDescription": "Resolve Doable questions from private code",
-    "longDescription": "Connect the current private workspace to the organization bound to a Doable API key, then answer one frozen pre-TRD context request with grounded findings. Exact source locations stay local; Doable receives only sanitized product behavior and opaque references.",
+    "longDescription": "Connect the current private workspace through the configured Doable MCP connection, answer frozen context requests with grounded findings, or start a complete feature-testing workflow through Doable. Exact source locations stay local; Doable receives only sanitized product behavior and opaque references.",
     "developerName": "Doable AI",
     "category": "Developer Tools",
     "capabilities": [
@@ -34,7 +34,8 @@
     "privacyPolicyURL": "https://qa.getdoable.ai/privacy-policy",
     "defaultPrompt": [
       "Resolve Doable context request DQ-7F3K for this workspace.",
-      "Connect this workspace to Doable for code-context requests."
+      "Connect this workspace to Doable for code-context requests.",
+      "Use Doable to test the feature I just implemented."
     ]
   }
 }

plugins/doable-code-context/.cursor-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "doable-code-context",
   "displayName": "Doable Code Context",
-  "version": "0.1.2",
-  "description": "Connect a private workspace to Doable and resolve one published pre-TRD context request with grounded, privacy-safe answers.",
+  "version": "0.2.0",
+  "description": "Connect private code to Doable through MCP, resolve grounded context requests, and start managed feature-testing workflows.",
   "author": {
     "name": "Doable AI"
   },