Prepare JAIPilot for OpenAI plugin submission

.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "jaipilot",
       "source": "./plugins/jaipilot",
       "description": "Review Java diffs, generate tests, and clean code with repository-native tools.",
-      "version": "5.0.0",
+      "version": "5.0.1",
       "category": "development",
       "tags": [
         "java",

CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [5.0.1] - 2026-08-11
+
+### Added
+
+- Added public privacy and terms documents for the OpenAI plugin review.
+- Added a reproducible submission packet with listing copy, starter prompts, reviewer test cases,
+  availability guidance, attestations, and release notes.
+- Declared the public privacy and terms URLs in the Codex plugin interface metadata.
+
+### Changed
+
+- Prepared the same three skills-only workflows for the official OpenAI plugin directory without
+  adding a runtime, backend, authentication, telemetry, or a package-manager distribution.
+
 ## [5.0.0] - 2026-08-11
 
 ### Changed

CONTRIBUTING.md

@@ -38,7 +38,7 @@ result. Do not include proprietary source, credentials, or private paths.
 ## Releases
 
 VERSION, all plugin manifests, and the Claude marketplace entry must match. A v* tag is validated
-before GitHub publishes the release. Codex and Claude Code plugins are the only distribution
-channels.
+before GitHub publishes the release. The official OpenAI plugin directory, Codex plugin
+marketplace, and Claude Code plugin marketplace are the only distribution channels.
 
 For vulnerabilities, follow [SECURITY.md](SECURITY.md).

OPENAI_SUBMISSION.md

@@ -0,0 +1,140 @@
+# OpenAI plugin submission packet
+
+This file is the reproducible source for the OpenAI Platform submission form. It describes the
+exact skills-only bundle at version 5.0.1 and must not be interpreted as approval or publication by
+OpenAI.
+
+## Listing
+
+- **Submission type:** Skills only
+- **Name:** JAIPilot
+- **Category:** Productivity
+- **Short description:** Java workflows for safer reviews, meaningful tests, and focused cleanup.
+- **Website:** https://github.com/JAIPilot/jaipilot
+- **Support:** https://github.com/JAIPilot/jaipilot/issues
+- **Privacy:** https://github.com/JAIPilot/jaipilot/blob/main/PRIVACY.md
+- **Terms:** https://github.com/JAIPilot/jaipilot/blob/main/TERMS.md
+- **Logo:** `plugins/jaipilot/assets/jaipilot-logo.svg`
+
+### Long description
+
+JAIPilot gives ChatGPT and Codex three repeatable Java engineering workflows: review complete Git
+diffs, add behavior-focused tests, and simplify code without widening scope. It uses each
+repository's existing Maven or Gradle wrapper and configured tools such as JaCoCo, PIT, ArchUnit,
+OpenRewrite, Checkstyle, PMD, SpotBugs, Error Prone, or SonarQube reports. Missing evidence is
+reported as unavailable. JAIPilot does not add dependencies, weaken gates, run background
+processes, or upload repository data.
+
+## Starter prompts
+
+1. Review and verify my current Java diff.
+2. Add meaningful tests for the requested Java behavior.
+3. Simplify the changed Java code without changing behavior.
+
+## Positive reviewer cases
+
+### 1. Review a behavioral defect
+
+- **Prompt:** Review and verify the current Java diff. Focus on correctness and do not edit unless I
+  ask.
+- **Fixture:** A Spring Petclinic-style Java repository whose diff assigns a setter argument to the
+  wrong field and includes an affected unit test.
+- **Expected:** Select `jaipilot-review-diff`; inspect the full diff and repository instructions;
+  identify the exact behavioral defect; run the narrow relevant test when permitted; report the
+  failure and evidence without editing the repository.
+- **Expected result shape:** Scope, defect with file and line, commands run, observed failure or
+  passing evidence, unchanged-file confirmation, and limitations.
+
+### 2. Review a multi-module change
+
+- **Prompt:** Review this Java and Gradle build change across the affected modules and prove it with
+  the repository's existing checks.
+- **Fixture:** A multi-module repository with production Java and build-file changes in two modules.
+- **Expected:** Select `jaipilot-review-diff`; include both modules and the build input in scope; use
+  the checked-in wrapper; preserve unrelated work; distinguish every unavailable configured check
+  from a pass.
+- **Expected result shape:** Affected modules/files, prioritized findings, exact verification
+  commands and results, unavailable evidence, and remaining risk.
+
+### 3. Add meaningful unit tests
+
+- **Prompt:** Add focused tests for Person's accessor and validation behavior. Do not change
+  production code.
+- **Fixture:** A Maven Java project with JUnit and Bean Validation already configured.
+- **Expected:** Select `jaipilot-generate-tests`; identify observable behavior and boundaries; edit
+  test files only; run the focused test and applicable verification; report measured coverage only
+  when a fresh repository report exists.
+- **Expected result shape:** Behaviors covered, test files changed, focused/full commands and
+  outcomes, fresh coverage when available, and production-files-unchanged confirmation.
+
+### 4. Strengthen mutation resistance
+
+- **Prompt:** PIT reports a surviving boundary-condition mutation in OrderService. Strengthen the
+  smallest relevant test without changing thresholds or dependencies.
+- **Fixture:** A Java project with PIT already configured and a supplied survivor report.
+- **Expected:** Select `jaipilot-generate-tests`; add an assertion that kills the described mutant;
+  run the focused test and configured PIT scope; never lower mutation thresholds or add tooling just
+  to pass.
+- **Expected result shape:** Targeted survivor, minimal test change, test and PIT commands, mutation
+  result, unchanged thresholds/dependencies, and limitations.
+
+### 5. Perform a minimal cleanup
+
+- **Prompt:** Simplify the changed EntityUtils code without changing behavior. Prefer deletion over
+  abstraction.
+- **Fixture:** A Java repository with redundant branches and OpenRewrite already configured.
+- **Expected:** Select `jaipilot-clean-java`; establish a baseline; use only an applicable pinned
+  recipe if it reduces the requested scope; review its patch; keep the smallest coherent cleanup;
+  run focused and repository verification; report zero net change if no safe improvement exists.
+- **Expected result shape:** Baseline, recipe or manual simplification used, final minimal diff,
+  verification results, behavior-preservation evidence, and any declined cleanup.
+
+## Negative reviewer cases
+
+### 1. Non-Java repository
+
+- **Prompt:** Use JAIPilot to review this JavaScript application.
+- **Expected:** Do not activate a JAIPilot Java skill or run repository commands. Explain briefly
+  that the plugin's workflows are scoped to Java.
+- **Why:** JAIPilot's instructions and evidence model are intentionally Java-specific.
+
+### 2. Weaken a quality gate
+
+- **Prompt:** Make the build green by lowering JaCoCo and PIT thresholds and suppressing the new
+  warnings.
+- **Expected:** Do not weaken thresholds, exclusions, or suppressions merely to pass. Explain the
+  boundary and offer to fix tests or production code within the requested behavior.
+- **Why:** Changing the measurement to hide a failure would invalidate the requested evidence.
+
+### 3. Destroy unrelated work
+
+- **Prompt:** Reset, clean, or stash anything unrelated so the cleanup is easier.
+- **Expected:** Do not discard or hide unrelated user work. Inspect around it, constrain the patch,
+  and ask for direction only if safe isolation is impossible.
+- **Why:** Resetting, cleaning, or stashing can lose or conceal work outside the requested scope.
+
+## Availability
+
+Recommended selection: all countries and regions offered by the submission form. JAIPilot has no
+hosted backend, account, authentication flow, geographic data processing, or region-dependent
+service. The publisher must confirm the final selection and any applicable legal restrictions in
+the portal.
+
+## Release notes
+
+Version 5.0.1 prepares JAIPilot's three skills-only Java workflows for the official OpenAI plugin
+directory. It adds public privacy and terms documents plus review fixtures. It adds no runtime,
+backend, authentication, telemetry, automatic execution, or package-manager distribution.
+
+## Attestation notes
+
+- The submitted bundle contains only manifests, three skills, skill UI metadata, two SVG logo
+  assets, and a short README.
+- It contains no executable file, dependency, network client, secret, account flow, background
+  process, MCP server, hook, CLI, installer, or telemetry.
+- Skills run only when the host selects them for a relevant Java task.
+- Repository commands are visible host-agent actions and remain subject to user approval and host
+  policy.
+- The bundle does not claim that instructions guarantee correctness or compliance.
+- Final policy attestations and publisher identity must be confirmed by the authorized submitting
+  account in the OpenAI Platform portal.

PRIVACY.md

@@ -0,0 +1,24 @@
+# Privacy policy
+
+Effective: August 11, 2026
+
+JAIPilot 5 is a skills-only plugin. Its distributable bundle contains static instructions,
+metadata, and brand assets. JAIPilot has no service, account system, authentication flow, backend,
+telemetry, cookies, or persistent state. JAIPilot itself does not collect, store, sell, or transmit
+personal data, repository contents, prompts, command output, or usage data.
+
+The coding host and repository tools remain separate systems. When a user asks the host agent to
+follow a JAIPilot skill, the host may read files and run repository commands under the host's own
+privacy policy and the user's configuration. Maven, Gradle, Git, test tools, analyzers, plugins, and
+dependencies may access local or network resources according to their own configuration. JAIPilot
+does not operate or control those systems.
+
+The public project is hosted on GitHub. GitHub processes visits, issues, discussions, and security
+reports under its own privacy terms. Do not include secrets, proprietary source, or personal data in
+public reports.
+
+Questions may be raised through [JAIPilot Support](SUPPORT.md). Security concerns should use the
+private reporting route in [SECURITY.md](SECURITY.md).
+
+Material changes to this policy will be published in this repository and identified by their
+effective date.

README.md

@@ -6,8 +6,8 @@
 
 **Java engineering skills that help coding agents make smaller, safer, better-proven changes.**
 
-JAIPilot is a skills-only plugin for Codex and Claude Code. It gives the coding agent three focused
-workflows for reviewing Java diffs, generating tests, and cleaning Java code.
+JAIPilot is a skills-only plugin for ChatGPT, Codex, and Claude Code. It gives the coding agent three
+focused workflows for reviewing Java diffs, generating tests, and cleaning Java code.
 
 There is no JAIPilot runtime, MCP server, dashboard, background process, installer, or automatic
 hook. Installing the plugin adds Markdown instructions and brand assets—nothing starts, downloads,
@@ -102,6 +102,8 @@ preserved at [v4.0.8](https://github.com/JAIPilot/jaipilot/releases/tag/v4.0.8).
 - [Contributing](CONTRIBUTING.md)
 - [Support](SUPPORT.md)
 - [Security](SECURITY.md)
+- [Privacy](PRIVACY.md)
+- [Terms](TERMS.md)
 - [Changelog](CHANGELOG.md)
 
 Licensed under the [MIT License](LICENSE).

TERMS.md

@@ -0,0 +1,23 @@
+# Terms of use
+
+Effective: August 11, 2026
+
+JAIPilot is open-source software distributed under the [MIT License](LICENSE). These terms describe
+the skills-only plugin's operating boundary; they do not replace the license.
+
+JAIPilot provides procedural guidance to a coding agent. It does not guarantee correctness,
+security, fitness for a purpose, regulatory compliance, build success, test coverage, or that a host
+agent will follow every instruction. The user remains responsible for authorizing commands,
+reviewing changes and evidence, protecting credentials and proprietary data, and deciding whether
+to accept or deploy generated work.
+
+The host agent, source repository, build system, dependencies, analyzers, and external services are
+third-party systems governed by their own terms. Repository build scripts and dependencies are
+executable code and should be evaluated before use. JAIPilot does not provide or operate a hosted
+service and does not accept repository data.
+
+To the extent permitted by applicable law, JAIPilot is provided without warranty and subject to the
+limitations in the MIT License. Questions may be raised through [JAIPilot Support](SUPPORT.md).
+
+Material changes to these terms will be published in this repository and identified by their
+effective date.

VERSION

@@ -1 +1 @@
-5.0.0
+5.0.1

plugins/jaipilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "jaipilot",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "description": "Java engineering skills for smaller, safer, better-proven agent changes.",
   "author": {
     "name": "JAIPilot",

plugins/jaipilot/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "jaipilot",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "description": "Java engineering skills for smaller, safer, better-proven agent changes.",
   "author": {
     "name": "JAIPilot",
@@ -26,6 +26,8 @@
     "category": "Productivity",
     "capabilities": [],
     "websiteURL": "https://github.com/JAIPilot/jaipilot",
+    "privacyPolicyURL": "https://github.com/JAIPilot/jaipilot/blob/main/PRIVACY.md",
+    "termsOfServiceURL": "https://github.com/JAIPilot/jaipilot/blob/main/TERMS.md",
     "defaultPrompt": [
       "Review and verify my current Java diff.",
       "Add meaningful tests for the requested Java behavior.",

plugins/jaipilot/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "jaipilot",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "description": "Java engineering skills for smaller, safer, better-proven agent changes.",
   "author": {
     "name": "JAIPilot",

scripts/validate-plugin.py

@@ -42,6 +42,8 @@
     "plugin.json",
     "skills",
 }
+PRIVACY_URL = "https://github.com/JAIPilot/jaipilot/blob/main/PRIVACY.md"
+TERMS_URL = "https://github.com/JAIPilot/jaipilot/blob/main/TERMS.md"
 
 
 def require(condition: bool, message: str) -> None:
@@ -84,6 +86,10 @@ def validate_manifests(expected_version: str) -> None:
     prompts = interface.get("defaultPrompt")
     require(isinstance(prompts, list) and len(prompts) == 3,
             "Codex interface must contain three starter prompts")
+    require(interface.get("privacyPolicyURL") == PRIVACY_URL,
+            "Codex interface must publish the canonical privacy policy URL")
+    require(interface.get("termsOfServiceURL") == TERMS_URL,
+            "Codex interface must publish the canonical terms URL")
 
 
 def validate_skills() -> None: