Prepare Doable agent plugins for public release

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "doable-code-context",
-      "description": "Connect a private workspace and resolve published Doable context questions before TRD creation.",
+      "description": "Resolve grounded Doable context requests or start a managed feature-testing workflow from the coding agent.",
       "source": "./plugins/doable-code-context"
     }
   ]

.cursor-plugin/marketplace.json

@@ -10,7 +10,7 @@
     {
       "name": "doable-code-context",
       "source": "./plugins/doable-code-context",
-      "description": "Connect a private workspace and resolve published Doable context questions before TRD creation."
+      "description": "Resolve grounded Doable context requests or start a managed feature-testing workflow from the coding agent."
     }
   ]
 }

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,41 @@
+name: Bug report
+description: Report a reproducible plugin or workflow problem
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Do not include API keys, source code, customer data, private URLs, local paths,
+        or files from `.doable/`. Report security issues privately using SECURITY.md.
+  - type: dropdown
+    id: host
+    attributes:
+      label: Coding-agent host
+      options:
+        - Codex
+        - Claude Code
+        - Cursor
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: Versions
+      description: Plugin version and coding-agent host version
+    validations:
+      required: true
+  - type: textarea
+    id: behavior
+    attributes:
+      label: What happened?
+      description: Include sanitized steps, expected behavior, and actual behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: verification
+    attributes:
+      label: Sanitized diagnostics
+      description: Include only non-sensitive status or validation output.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security and privacy reports
+    url: https://github.com/getdoable/doable-agent-plugins/security/policy
+    about: Report suspected security or privacy issues privately.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,30 @@
+name: Feature request
+description: Propose a plugin workflow or compatibility improvement
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What developer workflow is difficult today?
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: Describe the result without including private repository or customer data.
+    validations:
+      required: true
+  - type: dropdown
+    id: host
+    attributes:
+      label: Coding-agent host
+      multiple: true
+      options:
+        - Codex
+        - Claude Code
+        - Cursor
+        - Host-independent

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,15 @@
+## Summary
+
+<!-- What developer problem does this change solve? -->
+
+## Privacy and compatibility
+
+<!-- Note any privacy, authentication, manifest, or host-compatibility impact. -->
+
+## Verification
+
+<!-- List exact commands and fresh-session checks. State what was not tested. -->
+
+- [ ] `npm test`
+- [ ] No credentials, customer data, private URLs, local paths, or `.doable/` state included
+- [ ] Documentation and manifests updated when the public contract changed

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+All notable changes to Doable Agent Plugins are documented here.
+
+## [0.2.0] - Unreleased
+
+### Added
+
+- Doable Code Context for Codex, Claude Code, and Cursor.
+- MCP-backed pre-TRD context rounds with grounded, privacy-safe findings.
+- Coding-agent-first feature testing through the existing Doable suite, TRD, and managed-case workflow.
+- Demand-driven mono-repo and multi-repo workspace mapping with local-only provenance.
+
+### Changed
+
+- Replaced the legacy context-file workflow with MCP-backed context rounds and managed feature testing.
+- Added direct public setup instructions for Codex, Claude Code, and Cursor.
+
+### Security and privacy
+
+- Remote operations are isolated to the separately configured Doable MCP connection.
+- The bundled helper has no network or credential primitives.
+- Real repository identities, source locations, commits, local paths, and private artifacts remain local.

CONTRIBUTING.md

@@ -0,0 +1,32 @@
+# Contributing
+
+Thanks for helping improve Doable Agent Plugins.
+
+## Before opening a change
+
+- Open an issue for a new workflow or a material contract change.
+- Keep each pull request focused on one plugin behavior.
+- Never include credentials, customer data, source excerpts, private URLs, local paths, or `.doable/` state.
+- Treat the privacy boundary in [PRIVACY.md](PRIVACY.md) as part of the public contract.
+
+## Validate locally
+
+Use Node.js 20 or newer and run:
+
+```bash
+npm test
+claude plugin validate ./plugins/doable-code-context
+```
+
+For host-specific changes, also validate the affected manifest and complete the relevant fresh-session checks in [TESTING.md](TESTING.md).
+
+## Pull requests
+
+Describe:
+
+- the user problem and intended behavior;
+- any privacy, authentication, or compatibility impact;
+- the commands and host versions used for verification;
+- what was not tested.
+
+Report security issues privately as described in [SECURITY.md](SECURITY.md), not in a public issue.

PRIVACY.md

@@ -4,11 +4,11 @@ Repository inspection happens inside the coding agent selected by the customer a
 
 ## Doable Code Context
 
-`doable-code-context` connects only to the configured Doable REST API. The API key is read from `DOABLE_API_KEY` at request time, used as a Bearer credential, and never written to disk or included in a generated payload.
+`doable-code-context` performs remote operations only through the configured Doable MCP connection. The coding agent host owns that connection's credential; the Skill and bundled helper neither read nor persist it.
 
 Its local `.doable/workspace-candidate.json`, `.doable/workspace-private.json`, and `.doable/requests/` records may contain real repository identities, explicitly user-supplied artifact roots, local paths, Git provenance, exact evidence locators, and frozen Doable questions. They are written with private permissions and ignored by Git. Artifact roots are never serialized into the remote workspace profile.
 
-The helper validates every outbound workspace profile and answer payload. Doable may receive only:
+The helper validates every workspace profile and answer payload before the coding agent passes it to Doable MCP. Doable may receive only:
 
 - opaque workspace, repository, evidence, round, and question identifiers;
 - a sanitized workspace display name, product roles, surfaces, descriptions, feature scope, and externally observable findings;

README.md

@@ -1,12 +1,13 @@
 # Doable Agent Plugins
 
-Official beta plugins for [Doable](https://getdoable.ai), supporting Codex, Claude Code, and Cursor.
+Official agent plugins for [Doable](https://getdoable.ai), supporting Codex, Claude Code, and Cursor.
+
+[![Validate plugin packages](https://github.com/getdoable/doable-agent-plugins/actions/workflows/validate.yml/badge.svg)](https://github.com/getdoable/doable-agent-plugins/actions/workflows/validate.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
 | Plugin | Version | Purpose | Network |
 | --- | --- | --- | --- |
-| `doable-code-context` | `0.1.2` | Connect a workspace and resolve a published pre-TRD feature-context round | Doable REST only |
-
-The repository is private during beta. Installation requires GitHub access to `getdoable/doable-agent-plugins`.
+| `doable-code-context` | `0.2.0` | Resolve context requests or start a managed feature-testing workflow | Configured Doable MCP |
 
 ## Workflow
 
@@ -24,16 +25,16 @@ Use **Doable Code Context** for the connected pre-TRD workflow:
 3. The coding agent performs demand-driven workspace setup if needed, pulls that exact frozen round, grounds the base request across the relevant private repositories, answers the focused supplements, asks one batched clarification round only when product authority is missing, and pushes structured grounded findings suitable for later knowledge reuse.
 4. Doable reviews the dispositions and continues the existing TRD loop.
 
-The connected plugin uses REST in this MVP, not MCP. Its bundled helper is invoked by the Skills and is not installed as a standalone CLI.
+All remote operations use the separately configured Doable MCP connection. The bundled helper is not a service or standalone CLI: it deterministically maps local repositories, keeps exact provenance private, builds safe payloads, and validates MCP responses.
 
 ## Requirements
 
 - Codex, Claude Code, or Cursor with Agent Skills or plugin support;
 - Node.js 20 or newer;
 - Git for repository-bound evidence;
-- for `doable-code-context`, a Doable organization API key configured as `DOABLE_API_KEY` in the coding agent's local environment.
+- an authenticated Doable MCP connection configured in the coding agent.
 
-Never paste an API key into chat or save it under `.doable/`. `DOABLE_API_BASE_URL` is an optional local/staging override; production uses the built-in Doable API origin.
+Never paste an API key into chat or save it under `.doable/`. The MCP connection owns organization authentication; the helper never reads a credential or calls the Doable API directly.
 
 ## Install
 
@@ -57,6 +58,7 @@ Natural-language requests activate the Skills. Explicit invocations are:
 
 - `/doable-code-context:doable-connect`
 - `/doable-code-context:doable-answer-questions`
+- `/doable-code-context:doable-test-feature`
 
 ### Cursor
 
@@ -66,15 +68,52 @@ In a new Cursor Agent chat, install the plugin:
 /add-plugin doable-code-context@https://github.com/getdoable/doable-agent-plugins
 ```
 
-For local beta development, clone the repository, link the selected plugin, and fully restart Cursor:
+## Connect Doable MCP once
+
+The plugin supplies Skills and the local privacy helper; it does not bundle or duplicate the remote MCP server. Get the organization API key from Doable Settings and configure the official Streamable HTTP endpoint once in the coding-agent host.
+
+Keep the key in the host environment or credential store. Never paste it into chat, commit it, add it to a project-level MCP file, or save it under `.doable/`.
+
+### Codex
+
+Make `DOABLE_API_KEY` available to the environment that launches Codex, then register the remote server without putting the key value in Codex configuration:
 
 ```bash
-git clone https://github.com/getdoable/doable-agent-plugins.git
-mkdir -p ~/.cursor/plugins/local
-ln -s "$(pwd)/doable-agent-plugins/plugins/doable-code-context" ~/.cursor/plugins/local/doable-code-context
+codex mcp add doable \
+  --url https://mcp.getdoable.ai/mcp \
+  --bearer-token-env-var DOABLE_API_KEY
 ```
 
-Cursor Marketplace installation will replace this fallback after approval.
+### Claude Code
+
+Make `DOABLE_API_KEY` available to the environment that launches Claude Code. Single quotes preserve the environment reference instead of placing the key value in shell history:
+
+```bash
+claude mcp add doable \
+  --scope user \
+  --transport http \
+  https://mcp.getdoable.ai/mcp \
+  --header 'Authorization: Bearer ${DOABLE_API_KEY}'
+```
+
+### Cursor
+
+Make `DOABLE_API_KEY` available to the Cursor process and add the server to the global `~/.cursor/mcp.json` file, not the customer's repository:
+
+```json
+{
+  "mcpServers": {
+    "doable": {
+      "url": "https://mcp.getdoable.ai/mcp",
+      "headers": {
+        "Authorization": "Bearer ${env:DOABLE_API_KEY}"
+      }
+    }
+  }
+}
+```
+
+Restart the coding-agent host after changing its environment. Confirm that the `doable` tools are connected before starting a context request.
 
 ## Use Doable Code Context
 
@@ -90,6 +129,17 @@ Setup is recovered inside the same conversation if needed. The user may also req
 Doable setup for this workspace.
 ```
 
+Or start from the coding agent after implementing a feature:
+
+```text
+Use Doable to test the feature I just implemented.
+```
+
+The agent reuses or creates the appropriate suite, opens one coding-agent-origin
+Round only when context or requirements changed, resolves that Round from the
+private workspace, and then continues through the existing TRD and managed-case
+workflow.
+
 The connected plugin writes private state under:
 
 ```text
@@ -111,7 +161,7 @@ PRDs, screenshots, Figma exports, and runtime captures outside Git can be used o
 
 The connected plugin:
 
-- support mono-repos, multi-repo workspaces, selected changes, PRDs, designs, screenshots, and supplied artifacts;
+- supports mono-repos, multi-repo workspaces, selected changes, PRDs, designs, screenshots, and supplied artifacts;
 - inspect the smallest connected evidence graph for the named feature;
 - distinguish desired, implemented, deployed/artifact, inference, and unknown truth planes;
 - record fixtures, permissions, validation, persistence, failures, and cross-repo seams only when they affect testing;
@@ -121,13 +171,15 @@ Doable never receives source code or snippets, real repository names or paths, b
 
 See [PRIVACY.md](PRIVACY.md) for the exact per-plugin boundary.
 
+See [CHANGELOG.md](CHANGELOG.md) for version history and [CONTRIBUTING.md](CONTRIBUTING.md) before proposing changes.
+
 ## Current limitations
 
 - One run resolves one identified feature or coherent feature domain, not an entire product.
 - The connected workflow requires server-side code-context rounds and organization capability enablement.
 - Multiple workspaces are selected in Doable before publishing the round; the coding agent never guesses across workspaces.
 - Required skips return to platform-user review. Coding agents cannot defer or waive scope.
-- MCP, active notifications, setup-time exhaustive knowledge mapping, and automatic TRD creation after the last answer are outside this MVP.
+- Active notifications, setup-time exhaustive knowledge mapping, and automatic historical-knowledge reuse are outside this MVP.
 
 ## Verify
 
@@ -136,7 +188,7 @@ npm test
 claude plugin validate ./plugins/doable-code-context
 ```
 
-The release verifier requires exactly two Skills and one dependency-free helper limited to the explicit Doable REST contract.
+The release verifier requires exactly three Skills and one dependency-free, local-only helper with no network or credential primitives.
 
 Use [TESTING.md](TESTING.md) for the fresh-session acceptance matrix.
 
@@ -147,6 +199,7 @@ plugins/
   doable-code-context/
     skills/doable-connect/
     skills/doable-answer-questions/
+    skills/doable-test-feature/
     scripts/doable-code-context.mjs
 ```
 

SECURITY.md

@@ -2,6 +2,16 @@
 
 Report suspected security or privacy issues privately to support@getdoable.ai. Do not include credentials, source code, customer data, or private environment details.
 
-`doable-code-context` contains no MCP server, credential store, standalone CLI package, runtime dependency, or telemetry. Its helper reads `DOABLE_API_KEY` only at request time, restricts transport to the centralized Doable REST endpoint table, validates local/private versus remote/sanitized schemas, writes private state atomically with mode `0600`, and uses content-derived idempotency keys for profile and answer retries.
+## Supported versions
+
+Security fixes are provided for the current release line. Upgrade to the latest published release before reporting a reproducible issue.
+
+## Reporting
+
+Include the plugin version, coding-agent host, and sanitized reproduction steps. Do not open a public issue for a suspected vulnerability. We will acknowledge a report and coordinate disclosure after validating its impact.
+
+## Security boundary
+
+`doable-code-context` contains no bundled MCP server, credential store, standalone CLI package, runtime dependency, or telemetry. Its helper has no network or credential primitives: it validates local/private versus remote/sanitized schemas, writes private state atomically with mode `0600`, and checks content-derived payload digests around calls made through the separately configured Doable MCP connection.
 
 Never commit `.doable/workspace-candidate.json`, `.doable/workspace-private.json`, or `.doable/requests/`. Rotate a Doable API key if it is pasted into a conversation, terminal transcript, issue, or log.

TESTING.md

@@ -1,6 +1,6 @@
 # Beta acceptance checklist
 
-Run these checks from fresh agent sessions. `doable-code-context` exposes exactly two Skills (`doable-connect` and `doable-answer-questions`), no MCP server, and one bundled REST helper.
+Run these checks from fresh agent sessions. `doable-code-context` exposes exactly three Skills (`doable-connect`, `doable-answer-questions`, and `doable-test-feature`), no bundled MCP server, and one local-only deterministic helper. The workflow expects the existing Doable MCP to be configured separately; the helper must contain no network or credential handling.
 
 For every scenario, confirm that the agent inspects only evidence needed for the named feature, keeps exact provenance local, asks only material product-authority questions, and sends only privacy-safe findings and opaque references to Doable.
 

package.json

@@ -2,8 +2,16 @@
   "name": "doable-agent-plugins",
   "version": "0.2.0",
   "private": true,
-  "description": "Private-beta installable agent plugins for Doable.",
+  "description": "Official installable agent plugins for Doable.",
   "license": "MIT",
+  "homepage": "https://github.com/getdoable/doable-agent-plugins#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/getdoable/doable-agent-plugins.git"
+  },
+  "bugs": {
+    "url": "https://github.com/getdoable/doable-agent-plugins/issues"
+  },
   "engines": {
     "node": ">=20"
   },