Daily harness signal

Package trust starts at the root

August 2, 2026 · JST One fresh finding Plugins · skills · MCP
Portable plugin support does not make manifests harmless. Treat the package root, schema version, fixed component locations, and vendor overlay precedence as one capability-admission boundary before any skill or MCP server becomes visible.
01 · Fresh · source date 2026-07-29

Validate the portable package before loading extensions

Use when: a harness accepts portable root plugin.json packages beside product-specific overlays, especially when the package can expose Agent Skills, MCP servers, hooks, or apps from a downloaded or marketplace-installed directory.

Action: make portable manifest validation the first loader step. Recognize only the canonical local $schema identifier; never fetch a schema while loading. Reject unsupported versions before publishing any capability. Keep portable discovery fixed: skills are immediate children of skills/, and MCP configuration lives at mcp.json. Resolve every package path against the materialized root and skip any component whose canonical target escapes it. Allow a vendor extension to supply vendor-only interface, hook, or app metadata, but do not let it replace portable identity, version, description, or fixed component roots.

Acceptance check: build four fixtures. A valid v1 package must load exactly one immediate-child skill and one test MCP marker. Changing only $schema to an unsupported version must yield zero skills, servers, hooks, and apps. Adding a nested SKILL.md or a symlink whose target is outside the plugin root must expose nothing new. Finally, give the vendor overlay a different name, version, skill path, and MCP path. Pass only if portable identity and fixed components remain unchanged while the permitted vendor interface override still applies.

Evidence: OpenAI shipped this loader in stable Codex 0.146.0. Merged commit a28374e adds 291 lines of manifest tests plus 83 skill-loader boundary-test lines, covering metadata, unsupported schemas, overlay precedence, legacy fallback, and direct-child discovery. The Agent Plugins 1.0.0 working draft independently requires local schema selection, root-confined paths, and immediate-child skill discovery.

Caveat: this establishes a package boundary, not content safety, dependency integrity, MCP authorization, or subprocess sandboxing. The specification is still a working draft. It also permits symlinks that resolve inside the plugin root; do not generalize the escape test into a blanket symlink ban. An open Codex issue documents a separate installer failure: local-marketplace copying can silently drop symlinked shared resources. Avoid symlink-based plugin composition until that path has a passing install-cache regression test.

Compact source notes

  1. OpenAI Codex 0.146.0 (released 2026-07-29). Stable official release listing Agent Plugins manifest support.
  2. PR #35105 and merged commit a28374e (2026-07-24). Primary implementation, changed-file inventory, and versioned tests.
  3. Agent Plugins Specification 1.0.0 (retrieved 2026-08-02). Working-draft normative contract for manifest loading, root confinement, fixed discovery, and failure boundaries.
  4. Codex issue #24770 (opened 2026-05-27; still open at retrieval). Exact source-level reproduction of symlinked resources being dropped during local-marketplace installation.
  5. Method: anchor lens—stable release, merged source, regression fixtures, and a concrete open failure; unity lens—plugin admission should be one fail-closed boundary. The four-fixture loader test is the falsification check.