officialsuyogdixit · Oct 22, 2026 · Oct 22, 2026
diff --git a/.github/workflows/verify-packages.yml b/.github/workflows/verify-packages.yml
@@ -0,0 +1,32 @@
+name: Verify canonical packages
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  canonical-packages:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    strategy:
+      matrix:
+        node: [22, 24]
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: ${{ matrix.node }}
+      - name: Verify released ZIPs, manifests, catalog paths and complete file inventory
+        run: python3 scripts/sync-plugins.py check
+      - name: Check bundled JavaScript syntax
+        run: |
+          node --check codex/feedbacks/mcp.mjs
+          node --check claude/feedbacks/mcp.mjs
+          node --check codex/feedbacks/install-skill.mjs
+          node --check claude/feedbacks/install-skill.mjs
diff --git a/README.md b/README.md
@@ -49,12 +49,29 @@ As of 21 October 2026, the direct installations above are available. Anthropic
 
 ## Source and support
 
+The direct-install Codex and Claude Code plugins are **0.3.1**, copied without modification from the [verified OSS release](https://github.com/Softinator-TechLabs/feedbacks-oss/releases/tag/v0.3.1). Existing clients must update their marketplace plugin and start a new session; this publication does not update installed clients automatically.
+
 Built from the versioned public source; see `SOURCE.json` for the exact revision and file hashes. Runtime code, skills and licensing are generated/copied from the canonical OSS build. Do not edit bundled code here; change the source and rebuild.
 
 ## MCP bundle
 
 Other clients that support MCPB can install the [portable stdio adapter](https://github.com/Softinator-TechLabs/feedbacks-plugins/releases/tag/v0.2.3). Configure your own server URL and personal scoped key in the client's private settings. Native Claude Code and Codex skills remain available through the installation commands above.
 
+The separately versioned portable MCPB and MCP Registry entry remain at **0.2.3**. They are not the native Codex/Claude plugin version.
+
 Maintainers publish `registry/server.json` using the manually triggered **Publish MCP Registry** workflow on `main`. The pinned official publisher authenticates with a short-lived GitHub Actions identity; no stored GitHub token or repository access is supplied to the registry. Update the manifest only after the referenced versioned bundle and its SHA-256 are available.
 
 [Setup guide](https://feedbacks.softinator.ai/docs/guide/mcp) · [Storage guide](https://feedbacks.softinator.ai/docs/guide/storage) · [Privacy](https://feedbacks.softinator.ai/privacy.html) · [Issues](https://github.com/Softinator-TechLabs/feedbacks-oss/issues) · [License](LICENSE)
+
+## Maintainer verification
+
+Run `python3 scripts/sync-plugins.py check` to download the canonical versioned release, verify its checksums and source revision, and compare both native plugin trees byte for byte. CI also checks the bundled JavaScript on Node 22 and 24. No server credentials or dependency installation are needed.
+
+For a native plugin release, first publish and verify the canonical OSS assets. Then run:
+
+```sh
+python3 scripts/sync-plugins.py sync --version VERSION --source-revision FULL_OSS_SHA --source-ci EXACT_SOURCE_CI_URL
+python3 scripts/sync-plugins.py check
+```
+
+Review changes through a pull request and wait for its package checks before merging. Publish the unchanged canonical ZIPs with checksums in the versioned release. Keep prior releases and the separate MCPB manifest unless that adapter is also being released.
diff --git a/SOURCE.json b/SOURCE.json
@@ -1,10 +1,24 @@
 {
-  "version": "0.2.3",
+  "version": "0.3.1",
   "source_repository": "https://github.com/Softinator-TechLabs/feedbacks-oss",
-  "source_revision": "1bbdbabf718d9c8dc551243256efdf118703f711",
-  "source_tag": "v0.2.3",
-  "source_ci": "https://github.com/Softinator-TechLabs/feedbacks-oss/actions/runs/39533813828",
+  "source_revision": "6387b8d61971edaf75063aaeb6478a73f41542c5",
+  "source_tag": "v0.3.1",
+  "source_ci": "https://github.com/Softinator-TechLabs/feedbacks-oss/actions/runs/39648999766",
   "packaging": "Exact published canonical native Claude Code/Codex bundles; catalogs point to runtime subdirectories. No private launch material.",
+  "bundles": {
+    "codex": {
+      "asset": "feedbacks-codex-plugin-0.3.1.zip",
+      "sha256": "6108daf7535ff559cca6575e77f8153e6fa345f5662aa2c10b95f3cf58c80d56",
+      "bytes": 356606,
+      "file_count": 24
+    },
+    "claude": {
+      "asset": "feedbacks-claude-plugin-0.3.1.zip",
+      "sha256": "7ce235f13f5cf1892432ff2cc9dd497788c0a1b8c7513a49dcb2c72cd866acc3",
+      "bytes": 353837,
+      "file_count": 22
+    }
+  },
   "files": [
     {
       "path": ".agents/plugins/marketplace.json",
@@ -18,6 +32,10 @@
       "path": ".github/workflows/publish-mcp-registry.yml",
       "sha256": "e4b68e2bc9806582092aa06d53b4ae7ac748f91f4e61ed7ca3e8640ed4b5d1d1"
     },
+    {
+      "path": ".github/workflows/verify-packages.yml",
+      "sha256": "063766bf88bc0da93a0e3c1df0bbcbf9bbedc826eb65c1457746bf4483f77b5b"
+    },
     {
       "path": ".gitignore",
       "sha256": "2324f666f71c24bd375d94e847e50ab987df36297b02f1218ceda8e2ad8a4147"
@@ -32,23 +50,23 @@
     },
     {
       "path": "README.md",
-      "sha256": "44b0a662b6d9b564a14e0f82559150d7a2464cd8db3b8dc078e2fcde81cc701c"
+      "sha256": "d1023b5d4ade42de5392303e6b49a4ee0a179b11628a976888b933cd43d63d00"
     },
     {
       "path": "THIRD_PARTY_NOTICES.md",
-      "sha256": "fdc5c602deb0fcea4a06a099283421174301d72d5974f11615d55a777d014af6"
+      "sha256": "a6378d72b05566e1cf3d47901b7c5fa2d9a11183fb749a1a1ca9813a14099cc7"
     },
     {
       "path": "claude/feedbacks/.claude-plugin/plugin.json",
-      "sha256": "b4eb711be0c823d61bdfc770229487ec7de321a1b3a590922fd1bd61531a7489"
+      "sha256": "693e97c865be8937f36135b9de661df8f937edbe05cd6ccbe099fa52d721275d"
     },
     {
       "path": "claude/feedbacks/.mcp.json",
       "sha256": "c077076a109af2a562a44a9300afc5cc3195dcea77c91b0e3f9e12cb4eef8996"
     },
     {
       "path": "claude/feedbacks/BUILD.json",
-      "sha256": "8498425b4d3a5e29ebaa553d522c48b8d5742de98024351d26ba7313322152b8"
+      "sha256": "3195415aa6f1047a00db5c54660e8b14ee55738ef3d14373dc8f9e865bdf2317"
     },
     {
       "path": "claude/feedbacks/LICENSE",
@@ -64,7 +82,7 @@
     },
     {
       "path": "claude/feedbacks/THIRD_PARTY_NOTICES.md",
-      "sha256": "fdc5c602deb0fcea4a06a099283421174301d72d5974f11615d55a777d014af6"
+      "sha256": "a6378d72b05566e1cf3d47901b7c5fa2d9a11183fb749a1a1ca9813a14099cc7"
     },
     {
       "path": "claude/feedbacks/assets/icon.png",
@@ -96,7 +114,7 @@
     },
     {
       "path": "claude/feedbacks/mcp.mjs",
-      "sha256": "96bf54265da9703ee152c235761ef01bb3461d9407f21c69b876c365a5ff3746"
+      "sha256": "9d1628fd082ae294472a0c57edeaf5ac8151a495ae54356d1537b2a5d97bc104"
     },
     {
       "path": "claude/feedbacks/mcp.mjs.LEGAL.txt",
@@ -128,15 +146,15 @@
     },
     {
       "path": "codex/feedbacks/.codex-plugin/plugin.json",
-      "sha256": "32bc5570ff5ccef6c1406a24799a58b0ed831ea9013f29c2f57f9f27ffb2efe0"
+      "sha256": "cd099964ffc250ea2361ebb8199c96f3175afbbd50eaa1cc6f6768c2f7dd4b10"
     },
     {
       "path": "codex/feedbacks/.mcp.json",
       "sha256": "4b614afe3e39af74d8aa0a56cb562bf8e73d92fadbef9cc0c590a5daab8a3d79"
     },
     {
       "path": "codex/feedbacks/BUILD.json",
-      "sha256": "8498425b4d3a5e29ebaa553d522c48b8d5742de98024351d26ba7313322152b8"
+      "sha256": "3195415aa6f1047a00db5c54660e8b14ee55738ef3d14373dc8f9e865bdf2317"
     },
     {
       "path": "codex/feedbacks/LICENSE",
@@ -152,7 +170,7 @@
     },
     {
       "path": "codex/feedbacks/THIRD_PARTY_NOTICES.md",
-      "sha256": "fdc5c602deb0fcea4a06a099283421174301d72d5974f11615d55a777d014af6"
+      "sha256": "a6378d72b05566e1cf3d47901b7c5fa2d9a11183fb749a1a1ca9813a14099cc7"
     },
     {
       "path": "codex/feedbacks/assets/icon.png",
@@ -188,15 +206,15 @@
     },
     {
       "path": "codex/feedbacks/mcp.mjs",
-      "sha256": "96bf54265da9703ee152c235761ef01bb3461d9407f21c69b876c365a5ff3746"
+      "sha256": "9d1628fd082ae294472a0c57edeaf5ac8151a495ae54356d1537b2a5d97bc104"
     },
     {
       "path": "codex/feedbacks/mcp.mjs.LEGAL.txt",
       "sha256": "728cac7ea021e5d5d50b6f4f15d1ca1b2c25fd31bdb25ed49e3d2fced5f513dd"
     },
     {
       "path": "codex/feedbacks/plugin.json",
-      "sha256": "dbbd9813c125e031b46b9bb9e6cee7dafc668ccb639973e60ca5524d2347a6e7"
+      "sha256": "61727109d2b1df56c8da9b3a683c7556f810d560738cedf1378e8cbb12d1838e"
     },
     {
       "path": "codex/feedbacks/skills/manage-feedbacks-context/SKILL.md",
@@ -225,6 +243,10 @@
     {
       "path": "registry/server.json",
       "sha256": "c9e51600b3f994bcdd8e0f850f56d6129a436fbfd3b9c4d09d2c88c54dc9c902"
+    },
+    {
+      "path": "scripts/sync-plugins.py",
+      "sha256": "ada61b99a023301197249025e9601c5409ea6449673ae5ec47e09119a4661a81"
     }
   ]
 }
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
@@ -4,7 +4,7 @@ Feedbacks' own source is covered by `LICENSE` and `NOTICE`. Dependencies retain
 
 The principal runtime packages are React/React DOM, React Markdown (MIT), Express, pg, Zod, Argon2, Sharp, tldts, the AWS SDK and the Model Context Protocol SDK. Development tools include TypeScript, Vite, tsx, Prettier, PGlite and Playwright (Apache-2.0). Native dependencies such as libvips have their own notices in the relevant packages. Use `npm sbom --sbom-format cyclonedx` after `npm ci` for the installed dependency inventory; this does not replace reviewing license text.
 
-The public documentation build uses VitePress (MIT) and its local search. VitePress and its build dependencies are installed only while building the static website. The static output includes VitePress client assets and self-hosted font files; their package licenses remain in the npm dependency tree. The S3 request presigner is part of the AWS SDK family and runs only on the application server.
+The public documentation build uses VitePress (MIT) and its local search. VitePress and its build dependencies are installed only while building the static website. The static output includes VitePress client assets and self-hosted font files; their package licenses remain in the npm dependency tree. The S3 request presigner and SES v2 client are part of the AWS SDK family (Apache-2.0) and run only on the application server. Nodemailer (MIT-0) handles SMTP authentication, TLS and MIME; its package license remains with the installed runtime dependency. Mailjet requests use the platform HTTPS client and copy no provider SDK source.
 
 Existing reference research is recorded in [reference provenance](docs/reference-provenance.md). It records inspected examples, not a claim of copied code or permission to reuse proprietary features. New source reuse requires its exact origin, revision, license and required notices here.
 

diff --git a/claude/feedbacks/.claude-plugin/plugin.json b/claude/feedbacks/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "feedbacks",
-  "version": "0.2.3",
+  "version": "0.3.1",
   "description": "Visual website feedback, team discussion and reviewer context for coding assistants.",
   "author": {
     "name": "Softinator TechLabs",

diff --git a/claude/feedbacks/BUILD.json b/claude/feedbacks/BUILD.json
@@ -165,25 +165,37 @@
     "src/shared/agent-start.ts",
     "src/shared/agent-task-context.ts",
     "src/shared/agent-workflow.ts",
+    "src/shared/app-capture.ts",
+    "src/shared/board.ts",
     "src/shared/contracts.ts",
     "src/shared/contracts/common.ts",
+    "src/shared/contracts/domains/analytics.ts",
     "src/shared/contracts/domains/assets.ts",
     "src/shared/contracts/domains/assignments.ts",
+    "src/shared/contracts/domains/board.ts",
+    "src/shared/contracts/domains/channels.ts",
     "src/shared/contracts/domains/context.ts",
     "src/shared/contracts/domains/diagnostics.ts",
+    "src/shared/contracts/domains/github-comments.ts",
     "src/shared/contracts/domains/guest.ts",
     "src/shared/contracts/domains/identity.ts",
+    "src/shared/contracts/domains/intake.ts",
     "src/shared/contracts/domains/integrations.ts",
+    "src/shared/contracts/domains/notifications.ts",
     "src/shared/contracts/domains/projects.ts",
     "src/shared/contracts/domains/recordings.ts",
+    "src/shared/contracts/domains/replay-links.ts",
     "src/shared/contracts/domains/surveys.ts",
     "src/shared/contracts/domains/threads.ts",
+    "src/shared/contracts/domains/time-tracking.ts",
+    "src/shared/contracts/domains/trackers.ts",
     "src/shared/contracts/domains/views.ts",
     "src/shared/contracts/output-common.ts",
     "src/shared/contracts/registry.ts",
     "src/shared/contracts/scopes.ts",
     "src/shared/diagnostic-export.ts",
     "src/shared/diagnostics.ts",
+    "src/shared/notifications.ts",
     "src/shared/operation-descriptions.ts",
     "src/shared/recording-export.ts",
     "src/shared/recordings.ts",

diff --git a/claude/feedbacks/THIRD_PARTY_NOTICES.md b/claude/feedbacks/THIRD_PARTY_NOTICES.md
@@ -4,7 +4,7 @@ Feedbacks' own source is covered by `LICENSE` and `NOTICE`. Dependencies retain
 
 The principal runtime packages are React/React DOM, React Markdown (MIT), Express, pg, Zod, Argon2, Sharp, tldts, the AWS SDK and the Model Context Protocol SDK. Development tools include TypeScript, Vite, tsx, Prettier, PGlite and Playwright (Apache-2.0). Native dependencies such as libvips have their own notices in the relevant packages. Use `npm sbom --sbom-format cyclonedx` after `npm ci` for the installed dependency inventory; this does not replace reviewing license text.
 
-The public documentation build uses VitePress (MIT) and its local search. VitePress and its build dependencies are installed only while building the static website. The static output includes VitePress client assets and self-hosted font files; their package licenses remain in the npm dependency tree. The S3 request presigner is part of the AWS SDK family and runs only on the application server.
+The public documentation build uses VitePress (MIT) and its local search. VitePress and its build dependencies are installed only while building the static website. The static output includes VitePress client assets and self-hosted font files; their package licenses remain in the npm dependency tree. The S3 request presigner and SES v2 client are part of the AWS SDK family (Apache-2.0) and run only on the application server. Nodemailer (MIT-0) handles SMTP authentication, TLS and MIME; its package license remains with the installed runtime dependency. Mailjet requests use the platform HTTPS client and copy no provider SDK source.
 
 Existing reference research is recorded in [reference provenance](docs/reference-provenance.md). It records inspected examples, not a claim of copied code or permission to reuse proprietary features. New source reuse requires its exact origin, revision, license and required notices here.