Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions .agents/plugins/marketplace.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
{
"name": "corpus-agent-kit",
"interface": {
"displayName": "Corpus Agent Kit"
},
"plugins": [
{
"name": "corpus",
"source": {
"source": "local",
"path": "./plugins/corpus"
},
"policy": {
"installation": "AVAILABLE",
"authentication": "ON_INSTALL"
},
"category": "Productivity"
}
]
}
2 changes: 1 addition & 1 deletion .env.example
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# curl -H "Authorization: Bearer $QWEN_API_KEY" $QWEN_BASE_URL/models
QWEN_API_KEY=
QWEN_BASE_URL=https://dashscope-intl.aliyuncs.com/compatible-mode/v1
QWEN_MODEL_FAST=qwen-flash
QWEN_MODEL_FAST=qwen-flash-2025-07-28
QWEN_MODEL_CRITICAL=qwen3.7-max
# Hosted Corpus platform (the kit is a thin client of it)
CORPUS_BASE_URL=https://corpuslaw.us
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -20,3 +20,11 @@ jobs:
- run: npm run build
- run: npm pack --workspace mcp-server --dry-run
- run: node scripts/check-plugin-package.mjs
- uses: actions/setup-python@v5
with:
python-version: '3.12'
- run: python3 -m unittest discover -s scripts/tests -p 'test_*.py'
- run: python3 scripts/package-openai-plugin.py HEAD

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Reproducibility Is Not Tested

CI builds the archive only once and checks ZIP integrity, so it does not verify the newly documented guarantee that repeated builds of the same ref are byte-identical. A change that reintroduces timestamps, unstable ordering, or compression variance could pass unnoticed. Build the same ref into separate output directories and compare the resulting archive bytes or checksums before the unzip check.

Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/ci.yml
Line: 26

Comment:
**Reproducibility Is Not Tested**

CI builds the archive only once and checks ZIP integrity, so it does not verify the newly documented guarantee that repeated builds of the same ref are byte-identical. A change that reintroduces timestamps, unstable ordering, or compression variance could pass unnoticed. Build the same ref into separate output directories and compare the resulting archive bytes or checksums before the unzip check.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Fix in Codex Fix in Claude Code

- run: python3 scripts/package-openai-plugin.py HEAD --output-dir dist/repeat
- run: cmp dist/corpus-openai-*.zip dist/repeat/corpus-openai-*.zip
- run: unzip -t dist/corpus-openai-*.zip
24 changes: 18 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ Autopilot from this repo (`autopilot/`), running on Alibaba Cloud Function
Compute. Describe a business in plain English; get a cited launch checklist and
a prefilled formation handoff.

### 3. Drop a skill folder — or install the Hermes plugin
### 3. Drop a skill folder — or install a plugin

Two portable [Agent Skills](https://agentskills.io/specification):

Expand All @@ -74,7 +74,19 @@ agent learns to reach for Corpus *before any MCP connection exists*
([install paths](skills/corpus-business-formation/README.md)).

Or install **both skills plus the MCP URL** as one plugin. This repo is a
Claude Code plugin marketplace:
plugin marketplace. For **OpenAI Codex**, use a local checkout or the extracted
OpenAI release archive:

```bash
codex plugin marketplace add /absolute/path/to/corpus-agent-kit
codex plugin add corpus@corpus-agent-kit
```

See the [OpenAI package guide](docs/OPENAI_PLUGIN.md) for archive installation,
verification, and reproducible tagged builds. Restart Codex or open a new task
after installation so both skills and the MCP connector load.

For **Claude Code**:

```
/plugin marketplace add teakesdev/corpus-agent-kit
Expand Down Expand Up @@ -136,8 +148,8 @@ guessing.
- **`widget/`** — embeddable law-search widget (Preact, ~12 kB gzipped).
- **`skills/corpus-business-formation/`** — portable Agent Skill (formation).
- **`skills/corpus-legal-research/`** — portable Agent Skill (live statute search).
- **`plugins/corpus/`** — Agent Plugins v1 package for Hermes (generated skill
copies + headerless `mcp.json`).
- **`plugins/corpus/`** — plugin wrappers for Codex, Hermes, Claude Code, and
Cursor, sharing generated skills and the headerless hosted MCP endpoint.

All of these are thin clients of the hosted Corpus platform. The law corpus, hybrid
search engine, human approval gate, and filing execution live in the hosted
Expand Down Expand Up @@ -166,7 +178,7 @@ See [docs/architecture.md](docs/architecture.md) for the Mermaid source.

The autopilot uses two Qwen models with different cost/quality profiles:

- **Fast lane** (`QWEN_MODEL_FAST`, default `qwen-flash`): all standard turns —
- **Fast lane** (`QWEN_MODEL_FAST`, default `qwen-flash-2025-07-28`): all standard turns —
intent parsing, law search, checklist generation. Low latency, low spend.
- **Critical lane** (`QWEN_MODEL_CRITICAL`, default `qwen3.7-max`): the final
pre-handoff draft review only. Higher quality for the one turn that shapes the
Expand Down Expand Up @@ -225,7 +237,7 @@ cp .env.example .env
|---|---|---|
| `QWEN_API_KEY` | _(required)_ | Qwen Cloud API key |
| `QWEN_BASE_URL` | _(required)_ | Qwen OpenAI-compatible base URL (e.g. `https://dashscope-intl.aliyuncs.com/compatible-mode/v1`) |
| `QWEN_MODEL_FAST` | `qwen-flash` | Fast-lane model — standard turns |
| `QWEN_MODEL_FAST` | `qwen-flash-2025-07-28` | Fast-lane model — standard turns |
| `QWEN_MODEL_CRITICAL` | `qwen3.7-max` | Critical-lane model — pre-handoff review |
| `CORPUS_BASE_URL` | `https://corpuslaw.us` | Hosted Corpus platform base URL |
| `CORPUS_API_KEY` | _(optional)_ | Corpus platform API key (optional — anonymous is rate-limited) |
Expand Down
69 changes: 69 additions & 0 deletions WORKLOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -87,3 +87,72 @@ Validation: 39 autopilot + 6 bridge tests, typechecks, builds, packaging and
Hermes validate/doctor pass. Clean temporary Hermes home installed the pinned
plugin over SSH after HTTPS timed out; runtime discovery/live call evidence is
recorded with the Corpus release-readiness report. No paid transaction performed.

## 2026-09-12 — agent-checkout rehearsal split (historical observation)

Superseded by the ten-tool public checkout release recorded on 2026-09-19.
The observations and next steps below describe September 12 only.

### Verified live on corpuslaw.us (no deploy this session)
- Public headerless `https://corpuslaw.us/api/mcp` still lists **8 tools**:
`law.search`, `law.get_node`, `law.list_coverage`, `account.status`,
`formation.requirements`, `formation.compare`, `formation.lookup_naics`,
`formation.handoff`.
- `formation.checkout` / `formation.payment_status` exist on the server but are
gated: without `X-Corpus-Rehearsal`, `tools/call` returns
`agent_checkout_disabled` (**not** `Unknown tool`). Production flag = `rehearsal`.

### Decisions
- Rehearsal is a **private connector header** only: `X-Corpus-Rehearsal` with the
token stored in Vercel as `FORMATION_AGENT_CHECKOUT_REHEARSAL_TOKEN`. The token
is never written into this repo.
- Marketplace / published plugin stays **headerless**: `plugins/corpus/mcp.json`
and `plugins/corpus/.cursor-plugin/plugin.json` remain URL-only (no
`Authorization`, no `X-Corpus-Rehearsal`). Both re-read and confirmed unchanged.
- Public demo path unchanged — stops at the `formation.handoff` link. The two
checkout tools stay out of the public skill tool table until the public flag is on.
- GATE 2 unchanged: never auto-file. Rehearsal covers spend, not filing.
- **No USDC canary run and none claimed.**

### Files changed
- `docs/GROK_BOT.md` — 8-tool public install kept; new "Rehearsal connector (not
the marketplace plugin)" section; 2026-09-12 re-verification line
- `plugins/corpus/README.md` — one sentence: marketplace MCP headerless on
purpose, rehearsal is a private connector header
- `WORKLOG.md` — this entry

### Not done (deliberately)
- No deploy. No manifest/header edits. No `SKILL.md` formation-procedure change.
- Env files remain absent by design.

### Next
- Flip the public flag (server-side) before the two checkout tools go into the
public skill tool table; re-verify the public tool list at that point.


## 2026-09-20 — merge readiness audit

Integrated the OpenAI plugin package and private rehearsal-header guidance.
Corrected the latter's stale eight-tool/public-disabled claims before landing;
current public checkout documentation remains the ten-tool contract. Original
session branches and worktrees are preserved. No release tag, package publication,
paid request, flag change, or production deployment is part of this integration.

Also integrated the older `chore/pin-qwen-flash-snapshot` branch: fast-lane
model defaults to `qwen-flash-2025-07-28`, with environment overrides preserved.
Alibaba's model documentation still identifies that snapshot as equivalent to
`qwen-flash`: https://help.aliyun.com/zh/model-studio/qwen-flash (checked 2026-09-20).
No inference request was made during this audit.

Validation on the combined code: 39 autopilot + 6 bridge tests passed, all
workspace typechecks/builds and plugin checks passed. OpenAI archive integrity
passed; repeated builds of the same ref matched byte-for-byte. GitHub CI passed
at `52d8397`. Older Cursor and Grok work is already present (with later copy
corrections); initialize and canonical law.search fixes are already ancestors of
main. Existing peer branches/checkouts remain untouched.

Greptile's PR review found two packaging gaps. Release tag validation now checks
Git's resolved tag ref, including differently named tags; isolated repository
tests cover invalid names/versions, a valid annotated tag, and byte stability
despite working-tree edits (3 tests passed). CI now builds twice and compares
archives. These fixes do not touch user tags or publish a release.
2 changes: 1 addition & 1 deletion autopilot/src/routing.ts
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,5 @@ export type Lane = "fast" | "critical";

export function lane(name: Lane): string {
if (name === "critical") return process.env.QWEN_MODEL_CRITICAL || "qwen3.7-max";
return process.env.QWEN_MODEL_FAST || "qwen-flash";
return process.env.QWEN_MODEL_FAST || "qwen-flash-2025-07-28";
}
2 changes: 1 addition & 1 deletion autopilot/test/routing.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ describe("lane", () => {
delete process.env.QWEN_MODEL_FAST;
delete process.env.QWEN_MODEL_CRITICAL;
});
it("defaults fast lane to qwen-flash", () => expect(lane("fast")).toBe("qwen-flash"));
it("defaults fast lane to the pinned qwen-flash snapshot", () => expect(lane("fast")).toBe("qwen-flash-2025-07-28"));
it("defaults critical lane to qwen3.7-max", () => expect(lane("critical")).toBe("qwen3.7-max"));
it("honors env overrides", () => {
process.env.QWEN_MODEL_FAST = "qwen-turbo";
Expand Down
33 changes: 33 additions & 0 deletions docs/GROK_BOT.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,39 @@ Verified dry-run (2026-09-10): `formation.requirements` for MS LLC returns the
live checklist and all-in pricing; `formation.handoff` returns **COMPLETE** and
a prefilled approval link. Agents never auto-file (GATE 2 human approval). USDC pay is email-confirmed; filing still needs human approval. Sept 15 demo stops at the handoff link — USDC pay is optional.

## Private rehearsal connector

The public endpoint now lists ten tools, including `formation.checkout` and
`formation.payment_status`. The eight-tool rehearsal-only state observed on
2026-09-12 is historical; it is not the current public install contract.

If a deployment is explicitly configured in rehearsal mode, its checkout tools
require a private connector header. This is a deployment-specific testing setup,
not a prerequisite for the public marketplace plugin.

To rehearse agent checkout, add the header on a **private** Grok Bot connector
only:

```
X-Corpus-Rehearsal: <token>
```

The token is stored in Vercel as `FORMATION_AGENT_CHECKOUT_REHEARSAL_TOKEN`.
Never write it into this repo, a bot template, or a marketplace manifest.

Rules:

- The marketplace / published plugin stays **headerless**:
`plugins/corpus/mcp.json` and `plugins/corpus/.cursor-plugin/plugin.json` are
URL-only — no `Authorization`, no `X-Corpus-Rehearsal`.
- If the checkout tools are missing, or a call returns `agent_checkout_disabled`,
**stop** and use the `formation.handoff` approval link. Do not invent a payment
step or a pay tool id.
- GATE 2 is unchanged: never auto-file. Rehearsal covers spend, not filing.
- A handoff creates no order or payment request. Public checkout requires
the founder to confirm the exact amount in the current turn; filing still
requires separate human approval.

## Install skills (optional, richer intake)

Copy from this repo into your Grok Bot / Cursor skills library:
Expand Down
81 changes: 81 additions & 0 deletions docs/OPENAI_PLUGIN.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,81 @@
# Corpus for OpenAI Codex

This package connects Codex to `https://corpuslaw.us/api/mcp` and includes two
skills: `corpus-legal-research` and `corpus-business-formation`. Research works
anonymously. The packaged connector has no authentication or rehearsal headers.

## Install a local release archive

Verify the checksum next to the archive before extracting it:

```bash
shasum -a 256 -c corpus-openai-0.1.0.zip.sha256
unzip corpus-openai-0.1.0.zip
codex plugin marketplace add "$(pwd)/corpus-openai-0.1.0"
codex plugin add corpus@corpus-agent-kit
```

Keep the extracted directory in place: it is the local marketplace source.
For a source checkout, pass the repository root to `marketplace add` instead.
These commands register and install the package locally; they do not publish it.
This package does not imply a listing in the OpenAI or ChatGPT catalog.

Restart Codex or start a new task. Confirm that both Corpus skills are available,
then ask: **"Use Corpus to call law.list_coverage and summarize its coverage."**
That read-only call checks the live connector without starting a formation order.
Manifest validation and archive checks alone do not prove a live MCP connection.

## What is included

- `.agents/plugins/marketplace.json` points to `plugins/corpus`.
- `plugins/corpus/.codex-plugin/plugin.json` declares the two skills and MCP file.
- `plugins/corpus/.mcp.json` registers the hosted server as `corpus` using HTTP.
- `plugins/corpus/skills/` contains generated copies of both canonical skills,
including the vendored formation intake and harness setup references.
- The logo, this guide as `README.md`, Apache-2.0 `LICENSE`, and `release.json`
with the source ref, commit SHA, and plugin version complete the archive.

The archive excludes the other harness wrappers, application code, dependencies,
and local configuration. It needs no Node build or local MCP server process.

## Before using the formation skill

The formation skill displays fixed Corpus-authored warnings about sponsored
formation offers, including a named competitor and a Corpus comparison link.
The text is vendor-authored, not an independent assessment by the agent.

The intake collects the founder's name, email, phone, and street address. Sending
these to MCP tools or opening a populated Corpus handoff link transmits them to
Corpus. Contact details use the URL fragment in connector-free handoffs; other
fields use the query string. The skill never collects a Social Security Number.
The intake instructions are bundled in the package, not fetched at runtime.

Creating an order or USDC payment request requires the founder to confirm the
exact amount in the current turn. USDC must come from a self-custody wallet;
refunds go to the sending wallet. Email confirmation is required within 48 hours,
and every filing still requires human approval of the exact filing payload.
`formation.handoff` alone creates no order or charge.

## Build from a Git ref

From a source checkout, after committing the package changes:

```bash
python3 scripts/package-openai-plugin.py corpus-openai-v0.1.0
```

The command requires an existing ref and reads only files from that commit.
It writes `dist/corpus-openai-0.1.0.zip` and its `.sha256` file. Repeating the
command with the same ref produces identical bytes, even with working-tree edits.
For CI or a pre-release check, pass `HEAD` instead. A release tag must use
`corpus-openai-v<manifest version>` and point at the intended release commit.
Existing tags `v0.1.0` and `corpus--v0.1.0` predate the OpenAI package and cannot
build it. Do not move those tags to retrofit the new files.

The corrected Hermes instructions are already on `main`: plugin installs use
`hermes plugins doctor corpus --ci` followed by a fresh-chat tool check.
`hermes mcp test corpus` checks only a separately configured standalone server;
it does not validate the installed plugin's namespaced MCP server.

Source and license: [corpus-agent-kit](https://github.com/teakesdev/corpus-agent-kit),
Apache-2.0. Building or tagging locally does not publish a GitHub release.
2 changes: 1 addition & 1 deletion docs/architecture.html
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@
<div class="zone-sub">model inference</div>
</div>
<div class="node gold" style="left:548px; top:238px; width:270px;">
<div class="n-title">qwen-flash</div>
<div class="n-title">qwen-flash-2025-07-28</div>
<div class="n-sub">FAST lane &middot; every turn<br/>intent &middot; search &middot; checklist</div>
</div>
<div class="node gold" style="left:862px; top:238px; width:270px;">
Expand Down
2 changes: 1 addition & 1 deletion docs/architecture.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ is the machine-readable equivalent.
```mermaid
flowchart LR
subgraph OPEN["corpus-agent-kit (Apache-2.0, this repo)"]
UI[Chat UI] --> A[Formation Autopilot<br/>qwen-flash default lane<br/>qwen3.7 critical lane]
UI[Chat UI] --> A[Formation Autopilot<br/>qwen-flash-2025-07-28 default lane<br/>qwen3.7 critical lane]
A -->|search_law| MCPC[law_search tool]
A --> N[NAICS lookup]
A --> H[handoff builder]
Expand Down
30 changes: 30 additions & 0 deletions plugins/corpus/.codex-plugin/plugin.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
{
"name": "corpus",
"version": "0.1.0",
"description": "US legal research and LLC or nonprofit formation intake, with cited law and human-approved filing.",
"author": {
"name": "Corpus",
"url": "https://corpuslaw.us"
},
"homepage": "https://corpuslaw.us",
"repository": "https://github.com/teakesdev/corpus-agent-kit",
"license": "Apache-2.0",
"keywords": ["legal", "law", "formation", "llc", "nonprofit", "mcp"],
"skills": "./skills/",
"interface": {
"displayName": "Corpus",
"shortDescription": "Research US law and prepare a business formation.",
"longDescription": "Search and cite US law, or work through LLC and nonprofit formation intake. Includes two skills and the hosted Corpus MCP connector. Filing requires human approval; creating a payment request requires the founder's explicit consent.",
"developerName": "Corpus",
"category": "Productivity",
"capabilities": [],
"websiteURL": "https://corpuslaw.us",
"logo": "./assets/logo.png",
"defaultPrompt": [
"What does Mississippi require to form an LLC?",
"Find the law and cite the official text.",
"Help me prepare a nonprofit formation intake."
]
},
"mcpServers": "./.mcp.json"
}
8 changes: 8 additions & 0 deletions plugins/corpus/.mcp.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{
"mcpServers": {
"corpus": {
"type": "http",
"url": "https://corpuslaw.us/api/mcp"
}
}
}
Loading
Loading