Add first-class OpenAI Codex plugin and marketplace linting

.apm/instructions/development.instructions.md

@@ -111,6 +111,11 @@ from the markdown-it-py AST — read it via `block.markdown` (a
   hooks, MCP JSON) subclass `JsonConfigBlock` instead; dedicated rules find
   them with `find(SettingsBlock)`. Never add a config file type under
   `ContentBlock` — content rules would then lint its JSON as instruction text.
+- **Structured YAML config gets a direct `LintTarget` subclass, never
+  `ContentBlock`** — `OpenAIMetadataBlock` is the pattern. It is deliberately
+  neither `ContentBlock` (content rules would lint its YAML as instruction
+  text) nor `JsonConfigBlock` (that hierarchy is JSON-specific and file-level;
+  YAML keeps line numbers via `read_yaml_commented()`).
 
 Never require line numbers for JSON files — the `json` module does not
 preserve them. Keep JSON rules at file-level reporting.
@@ -129,3 +134,41 @@ preserve them. Keep JSON rules at file-level reporting.
   duplicate key on every run and never converges (issue #321).
 - **Add new SAFE-autofix edge cases** to the `tests/fixtures/autofix/safe-idempotency`
   fixture so `TestSafeAutofixIdempotency` guards them; update `EXPECTED_SAFE_VIOLATIONS` when the fixture grows.
+- **Autofix stands down entirely for plugins installed under `.codex/plugins/`**
+  — vendor-managed content is diagnostic-only, so every rule's `fix()` silently
+  no-ops there, by design. A new rule's fix needs no guard of its own for that
+  case, and a "fix didn't apply" report from such a path is expected behavior,
+  not a bug.
+
+## Ecosystem provenance
+
+"Which ecosystem owns this plugin directory" is decided in exactly one
+place: `RepositoryContext.provenance()`, which returns a cached
+`PluginProvenance` record per directory. Never answer an ownership
+question with a fresh filesystem probe in a rule or in the tree builder —
+two call sites probing independently is how a directory falls between
+per-ecosystem attach paths and loses its content silently.
+
+- **Evidence is filesystem-first and `--type`-invariant.** An override
+  changes what discovery walks, not what the author declared, so
+  provenance reads markers, contained manifests, and catalog files
+  directly (`_codex_catalog_files()`), never discovery output.
+- **The lint tree builds plugins in ONE pass** over the union of claimed
+  directories. Each directory gets one container; prose (`commands/`,
+  `agents/`, `rules/`, README) attaches once with containment; config
+  files attach per claiming ecosystem through the contained helpers.
+  Never add a second per-ecosystem plugin loop.
+- **Format rules gate on provenance, not on tool names in-line.**
+  Claude-format rules skip `context.is_codex_only_plugin(...)`
+  directories; ecosystem-tightened checks (hooks/MCP shapes) apply only
+  to that ecosystem's exclusive directories, so dual-manifest plugins
+  keep their established results.
+
+**Adding an ecosystem** (the next Codex): add its evidence probe to
+`RepositoryContext.provenance()` and its catalog enumeration beside
+`_codex_catalog_files()`; add its config-file cluster to the single
+plugin pass in `build_lint_tree` (attached through a contained helper);
+gate its format rules on its provenance and keep them out of
+`is_codex_only_plugin`-exempt directories; extend the union in
+`merge_plugin_dirs` callers if it discovers plugin directories of its
+own. Prose needs no work — every claimed directory already gets it.

.apm/skills/skillsaw-maintenance/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: skillsaw-maintenance
-description: Analyze upstream specs (agentskills.io, Claude Code plugin/marketplace format, OpenClaw, MCP, CodeRabbit, APM) for changes, identify gaps in skillsaw's rule coverage, and create or update PRs to close those gaps. Use when performing periodic maintenance on the skillsaw linter.
+description: Analyze upstream specs (agentskills.io, Claude Code plugin/marketplace format, OpenAI Codex plugins/marketplace, OpenClaw, MCP, CodeRabbit, APM) for changes, identify gaps in skillsaw's rule coverage, and create or update PRs to close those gaps. Use when performing periodic maintenance on the skillsaw linter.
 compatibility: Requires git, gh CLI, and internet access
 license: Apache-2.0
 user-invocable: true
@@ -35,15 +35,22 @@ to check, the rules that map, and sync notes (hand-copied values that can drift)
 |---|---|---|
 | Agent Skills (agentskills.io) | [references/agentskills.md](references/agentskills.md) | `agentskills/` |
 | Claude Code (plugins, marketplace, .claude, hooks, mcp, skills, agents) | [references/claude.md](references/claude.md) | `plugins/`, `commands/`, `marketplace/`, `hooks/`, `mcp/`, `skills/`, `agents/` |
+| OpenAI Codex (plugins, marketplaces, `agents/openai.yaml` skill metadata) | [references/codex.md](references/codex.md) | `codex/` |
 | OpenClaw | [references/openclaw.md](references/openclaw.md) | `openclaw/` |
 | Model Context Protocol | [references/mcp.md](references/mcp.md) | `mcp/` |
 | CodeRabbit (`.coderabbit.yaml`) | [references/coderabbit.md](references/coderabbit.md) | `coderabbit/` |
 | APM (`.apm/`) | [references/apm.md](references/apm.md) | `apm/` |
 
 Pay special attention to the **Sync notes** in each reference: rules that hand-copy
 upstream value sets (OpenClaw's install kinds/os/archive, MCP transport types, APM
-required fields) are the highest drift risk. OpenClaw is the top risk — it publishes no
-JSON Schema, so skillsaw's rule is the de-facto validator.
+required fields, Codex's policy enums) are the highest drift risk. OpenClaw is the top
+risk — it publishes no JSON Schema, so skillsaw's rule is the de-facto validator. Codex
+is second: its prose spec publishes no schema, while a separate field-level spec inside
+the `plugin-creator` skill is stricter — so the two can drift apart from each other.
+
+Where a reference marks a check as deliberately omitted, that omission is binding. A
+"missing" check listed there was left out on purpose; add it only when the upstream
+spec changes.
 
 ## Step 2: Identify gaps