ticket: accept plugin authoring cli

.yoi/tickets/00001KVHKWNQS/artifacts/orchestration-plan.jsonl

@@ -1 +1,2 @@
 {"id":"orch-plan-20260620-052336-1","ticket_id":"00001KVHKWNQS","kind":"blocked_by","related_ticket":"00001KVHKWNQA","note":"Panel Queue was accepted for routing review, but implementation cannot start yet because `00001KVHKWNQS` depends on `00001KVHKWNQA` Rust PDK/templates, which is currently `inprogress` and in a reviewer-requested-changes loop. Leave `00001KVHKWNQS` queued until `00001KVHKWNQA` is closed, then reroute.","author":"yoi-orchestrator","at":"2026-06-20T05:23:36Z"}
+{"id":"orch-plan-20260620-055356-2","ticket_id":"00001KVHKWNQS","kind":"accepted_plan","accepted_plan":{"summary":"`yoi plugin new rust-component-tool`, `yoi plugin check`, `yoi plugin pack` を追加する。new は embedded template only、check/pack は Plugin code を実行せず、directory/package safety、manifest/runtime/schema/permission diagnostics、deterministic digest/package output、JSON reports、enablement guidance を提供する。","branch":"impl/00001KVHKWNQS-plugin-authoring-cli","worktree":"/home/hare/Projects/yoi/.worktree/00001KVHKWNQS-plugin-authoring-cli","role_plan":"Orchestrator は acceptance records を commit 後、専用 implementation worktree `.worktree/00001KVHKWNQS-plugin-authoring-cli` を作成し、Coder をその child worktree への narrow write scope で起動する。Coder 実装後、Reviewer が non-execution checks、archive safety、deterministic pack/digest、JSON report stability、template use、workspace/config non-mutation、Nix/resource packaging を確認する。"},"author":"yoi-orchestrator","at":"2026-06-20T05:53:56Z"}

.yoi/tickets/00001KVHKWNQS/item.md

@@ -1,8 +1,8 @@
 ---
 title: 'Plugin: add authoring CLI new/check/pack'
-state: 'queued'
+state: 'inprogress'
 created_at: '2026-06-20T04:16:14Z'
-updated_at: '2026-06-20T05:23:44Z'
+updated_at: '2026-06-20T05:54:45Z'
 assignee: null
 readiness: 'implementation_ready'
 risk_flags: ['plugin', 'cli', 'authoring', 'templates', 'package-validation', 'packaging', 'read-only-check']

.yoi/tickets/00001KVHKWNQS/thread.md

@@ -34,3 +34,78 @@ Action:
 - `00001KVHKWNQA` が closed になった後、改めて body/thread/relations/workspace state を確認して routing する。
 
 ---
+
+<!-- event: decision author: yoi-orchestrator at: 2026-06-20T05:54:38Z -->
+
+## Decision
+
+Routing decision: implementation_ready
+
+Reason:
+- Panel Queue により、この Ticket は Orchestrator routing 対象として明示許可された。
+- 前回は `00001KVHKWNQA` Rust PDK/templates が inprogress だったため blocked/queued hold としたが、現在 `00001KVHKWNQA` は closed。
+- Ticket body は `new` / `check` / `pack` の CLI surface、non-execution safety、archive safety、deterministic digest/package、JSON reports、diagnostics、tests、validation、non-goals を実装可能な粒度で定義している。
+- Related Plugin CLI inspection (`00001KVFD3YSV`) と Component runtime (`00001KVG0HR96`) は closed。
+- 現在 queued はこの Ticket のみ、inprogress は 0 件、child implementation Pods はなし、matching branch/worktree はなし、Orchestrator worktree は clean。
+- Risk domain は plugin / CLI / authoring / templates / package-validation / packaging / read-only-check だが、Ticket は check/pack が Plugin code を実行しない、new は embedded templates only、enablement config を mutate しない、safe overwrite refusal、archive traversal/root-escape rejection などの invariants を明示している。bounded context check 後も implementation 前に必要な追加 human decision は見つからなかった。
+
+Evidence checked:
+- Ticket `00001KVHKWNQS` body / thread / relations / artifacts。
+- `TicketRelationQuery(00001KVHKWNQS)`: outgoing `depends_on 00001KVHKWNQA` is now closed。Related records are closed context。
+- `TicketOrchestrationPlanQuery(00001KVHKWNQS)`: previous `blocked_by` plan is resolved by `00001KVHKWNQA` closure; accepted plan recorded now。
+- Workspace state:
+  - Orchestrator worktree clean at `902b383d`。
+  - queued: this Ticket only。
+  - inprogress: 0。
+  - visible Pods: self + peers only; spawned children 0。
+  - no matching implementation branch/worktree。
+- Code/resource context:
+  - Rust PDK/template resources are now merged from `00001KVHKWNQA`。
+  - Component Model runtime and Plugin CLI inspection work are closed and available as implementation context。
+
+IntentPacket:
+
+Intent:
+- Add first-party local Plugin authoring CLI commands: `yoi plugin new rust-component-tool <path-or-name>`, `yoi plugin check <path-or-package>`, and `yoi plugin pack <path> [--output <file>]`。
+- Make local authoring safe and deterministic without remote scripts, without executing Plugin code during validation, and without mutating workspace enablement config。
+
+Binding decisions / invariants:
+- `new` uses embedded templates only; no network, no remote template fetch, no `curl | sh` flow。
+- `new` writes only to the requested destination and refuses non-empty destinations unless a narrow explicit safe option is intentionally added。
+- Generated Rust Component Tool template should use the current PDK/template resources and current checkout/release dependency policy。
+- `check` and `pack` must not execute Plugin code or instantiate components。
+- `check` validates directory and `.yoi-plugin` package inputs with bounded diagnostics and stable JSON report shape for `--json`。
+- `pack` creates deterministic `.yoi-plugin` output and prints digest/path; `pack --json` returns stable typed output。
+- `check` validates manifest/runtime/schema/permission/host API declarations, referenced artifact presence, archive safety, and deterministic digest where applicable。
+- `pack` rejects unsafe paths/root escapes and unsupported package shapes; use currently supported archive format/constraints。
+- Commands do not mutate enablement/workspace config and do not generate/embed secrets。
+- Diagnostics/status language should align with existing `yoi plugin list/show` where possible。
+- Do not implement registry publish/install, enabling/disabling config, Plugin execution, Service/Ingress scaffolding, or extra language templates。
+
+Requirements / acceptance criteria:
+- `yoi plugin new rust-component-tool ./my-plugin` creates the expected file set from embedded template without network access。
+- `yoi plugin check ./my-plugin` validates the generated template and reports next steps/digest/enablement guidance。
+- `yoi plugin pack ./my-plugin` creates a `.yoi-plugin` package discoverable by existing Plugin discovery。
+- `check` validates existing `.yoi-plugin` archive inputs and rejects unsafe archives。
+- `check --json` and `pack --json` provide stable typed reports for tests/agents。
+- Tests cover generated file set, overwrite refusal, valid/invalid check paths, missing runtime artifact, unsafe package archive, deterministic pack digest, discoverability by existing Plugin discovery, and JSON report shape。
+- Validation includes focused CLI/plugin authoring tests, relevant `cargo check` / `cargo test`, `cargo fmt --check`, `git diff --check`, and `nix build .#yoi` because CLI/resources/package behavior changes。
+
+Escalate if:
+- Current package/archive format lacks enough existing helpers and needs a broader package-format decision。
+- `check` cannot validate Component world metadata without executing code and needs explicit scope narrowing。
+- Deterministic packaging conflicts with current discovery/package reader behavior。
+- Embedded template resource packaging/source filtering needs broader product decision。
+
+Next action:
+- Record `queued -> inprogress` and commit Ticket records before creating the implementation worktree and spawning Coder。
+
+---
+
+<!-- event: state_changed author: yoi-orchestrator at: 2026-06-20T05:54:45Z from: queued to: inprogress reason: orchestrator_acceptance_plugin_authoring_cli field: state -->
+
+## State changed
+
+Ticket body/thread, relation metadata, resolved Rust PDK dependency, related closed Tickets, Orchestrator worktree state, visible Pods, existing branch/worktree, and bounded CLI/resource/package context were checked. Dependency `00001KVHKWNQA` is closed, no inprogress/capacity blocker exists, and no missing planning decision was found. Accepting this queued Ticket for implementation before worktree/Pod side effects.
+
+---