Source inventory

Source Inventory

Maintain sources/supported-stores.json — the single source of truth for which upstream plugin repos the Mall scans.

The Mall does NOT keep persistent local clones of source repos. The weekly cron clones each registered source into a workflow temp directory ($SOURCES_DIR), scans it, scores it, and discards the clone. The registry file is the only persistent record.

When to Use

• Proposing a new source store (run store-evaluation first)
• Retiring a source store (run staleness-discipline first; use /prune-source)
• A weekly cron PR flags a source as unhealthy (broken remote, archived, license drift)
• Schema validation after editing supported-stores.json

The registry: sources/supported-stores.json

{
  "$schema": "./supported-stores.schema.json",
  "schema_version": "2.0",
  "stores": [
    {
      "name": "plugin-mall",                       // unique kebab-case; matches catalog/stores/<name>.json
      "remote": "https://github.com/<org>/<repo>", // upstream URL (informational; not cloned for plugin-mall)
      "pluginDir": "plugins",                      // where plugins live in the upstream repo
      "quality": "first-party",                    // tier tag — see § Quality tiers
      "provenance": true,                          // true ONLY for plugin-mall (drives +50 trust signal)
      "license": "PolyForm-Noncommercial-1.0.0",   // SPDX id, or null if unknown
      "added_at": "2026-05-29"
    },
    {
      "name": "awesome-copilot",
      "remote": "https://github.com/github/awesome-copilot",
      "pluginDir": "skills",
      "quality": "official",
      "provenance": false,
      "license": "MIT",
      "added_at": "2026-04-15"
    }
  ]
}

Required fields

Field	Type	Notes
name	string	Kebab-case, ≤32 chars, unique across the registry; produces catalog/stores/<name>.json
remote	string	Upstream URL (HTTPS). For plugin-mall, this is informational; for everyone else, it's what bootstrap-sources.cjs clones
pluginDir	string	Path under the upstream repo where plugins live (., plugins, skills, agents, etc.). Use . if plugins live at the repo root.
quality	enum	See § Quality tiers below
provenance	bool	true ONLY for plugin-mall (drives the +50 trust signal). false for all third-party stores.
license	string or null	SPDX identifier (e.g., MIT, Apache-2.0, PolyForm-Noncommercial-1.0.0). null if unknown — license signal will score 0.
added_at	string	YYYY-MM-DD of registry add

Optional fields

Field	Type	Notes
local_dir_name	string	Override the directory name used inside $SOURCES_DIR when bootstrapping. Defaults to name. Use when the upstream repo has a different conventional folder name.
note	string	Human-readable note (audit trail)
pruned_at	string	YYYY-MM-DD of removal (use during the two-step prune; final delete removes the entry entirely)

Quality tiers

Tier	Meaning	Examples of fit
first-party	The Mall's own curated plugins (plugin-mall only)	plugin-mall
official	Maintained by a major platform vendor with editorial standards	awesome-copilot (GitHub), microsoft-skills
community-curated	Community repo with explicit curation standards	awesome-mcp-servers, awesome-claude-code
community	Individual or small-team plugin collections	personal skill repos
domain	Vertical-specific plugin collections	game-dev, marketing, healthcare
reference	High-signal individual contributors	named researchers, well-known authors

The quality tier is informational — it does NOT directly affect the trust score. Trust is computed from the six published signals (provenance, maintenance, adoption, license, frontmatter, README). Quality tier helps reviewers triage; the signals do the scoring.

Adding a new source

Use the /add-source prompt. Sequence:

1. Run store-evaluation first (scorecard ≥ 7 required)
2. Determine name, pluginDir, quality, license
3. Add the entry to supported-stores.json (alphabetical by name)
4. Run node scripts/scan-sources.cjs locally with SOURCES_DIR pointing at a temp dir
5. Verify the new store produces a plausible catalog/stores/<name>.json
6. Commit [behaviour] add source: <name> and let Monday's cron produce the first full catalog refresh

Retiring a source

Use the /prune-source prompt. Sequence:

1. Run staleness-discipline to confirm a staleness signal fires
2. Add a // pruned-pending: YYYY-MM-DD reason: <reason> line above the entry and comment the entry out
3. Commit [behaviour] prune source (pending): <name>
4. Wait one weekly cron cycle to verify the catalog refresh PR shows the expected removal cleanly
5. Delete the commented-out entry in the next commit
6. Commit [behaviour] prune source (delete): <name>

Health checks (run during PR review)

When reviewing a weekly catalog-refresh PR, sanity-check each store:

Check	Pass	Action on fail
bootstrap-sources.cjs cloned the remote successfully	Workflow log shows clone success	Investigate remote; remote may have moved or repo may be deleted — surface in PR comments
scan-sources.cjs produced a non-zero plugin count	Plugin count > 0 in catalog/stores/<name>.json	Check pluginDir — upstream may have renamed the plugins folder
fetch-github-stats.cjs returned data	Stars / contributors / last_commit populated in scoring/github-stats.json	API rate-limit hit, OR repo is archived/private — surface in PR
compute-trust.cjs produced a non-null score	trust_score populated in catalog/stores/<name>.json	A signal is missing or unparseable — check scoring/trust-audit.md for the per-store breakdown

Anti-Patterns

Anti-pattern	Correction
Adding a source without running store-evaluation	The scorecard is the bar; skip it and stale stores accumulate
Setting provenance: true for a third-party store	Provenance is for plugin-mall only — it drives the +50 first-party trust signal, not "I trust this maintainer"
Hand-editing catalog/stores/<name>.json	Catalog is generated; the only thing you edit is the registry
Deleting a registry entry in one commit	Always use the two-step prune so one cron cycle can verify the catalog refresh PR is clean
Skipping the schema validation step	The schema catches simple errors (typo'd field name, wrong enum value, malformed URL) before they break the workflow

Falsifiability

This skill is wrong if any of the following occur by 2026-08-29 (90 days):

• A registry entry that passed /add-source review gets pruned within 30 days (scorecard bar too lax)
• A pruned store gets re-added within 30 days (staleness signals miscalibrated)
• The schema lets through an invalid entry that breaks the workflow ≥1 time
• The quality-tier taxonomy needs revision ≥2 times in a quarter (taxonomy is wrong shape)

Track outcomes in docs/curation-log.md tagged [SOURCE-INVENTORY].

Related

• store-evaluation — gate before adding
• staleness-discipline — gate before pruning
• mall-self-curation — the pipeline this registry feeds
• /add-source prompt
• /prune-source prompt
• sources/supported-stores.schema.json — JSON schema