[showxu]

Summary

This PR moves every reusable workflow and shared check for Computer MCP repositories here. .github keeps only rules, data, documents and thin callers. Members pin this repository by full commit SHA.

• Plugin runtime and release: these move here from .github with unchanged behavior and contracts.
  • The shared Python plugin runtime, its sync/check script and plugin-runtime.yml keep the same digest contract.
  • plugin-release.yml keeps isolated builds, digest verification, immutable publication and recovery of earlier receipts. Its consumer guide is now docs/plugin-release.md.
• Catalog notification: the notify-catalog action that plugin releases call moves from the website unchanged. The website's receiving contract stays the same.
• Organization check (organization.yml):
  • The catalog in .github's profile/catalog.json must match the public, non-archived, non-fork inventory, and each About must equal its catalog about.
  • Declared settings are compared with live settings using GET requests only.
  • scope: membership checks only inventory and About, which the workflow token can read. scope: full adds settings and is meant for an owner's gh login.
  • The check records the .github revision it enforced.
• Source policy (policy.yml): enforces the rules declared in .github MAINTENANCE.
  • Commit identity and signatures, and Conventional Commit messages and PR titles.
  • No tool or agent attribution in the PR title, PR body or any commit. An attribution phrase followed by a tool name from data/attribution-tools.json fails; a co-author trailer is judged by its email, so real people may be credited.
  • No machine paths or .agent/ references. A caller may exempt listed repository paths through path-exceptions and states why in its workflow.
• Aggregation: result.yml aggregates required jobs.
• This repository: its own CI runs the tests, workflow checks and the source policy. docs/adoption.md lists the caller changes for each member.
• Not migrated: .github's brand-check workflow. Under the current standard, member CI no longer checks a brand lock.

Validation

• 155 repository tests pass.
• 64 Claude plugin archive tests pass against the moved release code.
• The offline organization fixture passes in full and membership scope.
• scripts/check-workflows.py checks YAML structure, full pins and workflow boundaries, and runs actionlint.
• The runtime and notification copies are byte-identical to the originals.