Add debt-ops (bcanfield/agentic-tech-debt)

[bcanfield]

Adds debt-ops under Development & Workflow: it catches tech debt as the agent writes it. Hooks watch each edit and log deferred decisions (loosened types, swallowed errors, "for now" defaults) to a registry in the repo; a review skill ranks paydown by file churn. Stdlib Python only, fully local, no network calls. MIT.

What's in the PR:

• README entry, alphabetized within Development & Workflow
• Mirrored bundle under plugins/bcanfield/agentic-tech-debt/ (generated with mirror_plugin_bundle from scripts/generate_plugins_json.py, plugin root codex/ in the source repo)
• An EXTRA_MIRROR_PATHS entry for hooks/: the manifest points at hooks/hooks.json, but the hook commands invoke sibling Python scripts in that directory at runtime, so the mirror needs the whole folder
• plugins.json and .agents/plugins/marketplace.json entries spliced at the README position

Ran check-alphabetical.py and validate-plugin-pr.py locally; both pass (one warning: no .codexignore upstream yet).

Smoke test: codex plugin marketplace add bcanfield/agentic-tech-debt then install debt-ops.

[gemini-code-assist]

Code Review

This pull request registers and implements the new debt-ops (agentic-tech-debt) Codex plugin, adding its configuration, hooks (drop.py, feedback.py, session-start.py, stop.py), and skills (register.py, review.py). Feedback on the changes highlights two issues in feedback.py: first, the $CHANGED_FILES expansion needs to split file paths into separate arguments to prevent subprocess failures when running tools without a shell; second, the test count warning mechanism should automatically initialize the test-count file if it is missing to ensure self-healing robustness.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[bcanfield]

Both review points were real and are now fixed upstream (released as v0.9.1); the mirror in this PR is refreshed to match.

• $CHANGED_FILES expansion: a bare $CHANGED_FILES token now expands to one argv entry per file. We pass the actual file list into run_one and extend argv with it rather than re-splitting a joined string, which also keeps filenames with spaces intact. Embedded uses (--files=$CHANGED_FILES) still get the space-joined string.
• test-count baseline: feedback.py now seeds the baseline file on first run instead of relying on prior initialization. The suggested snippet alone wasn't enough — on a true first run the cache directory doesn't exist yet either, so the seed path also creates it.

Upstream commit: bcanfield/agentic-tech-debt@666e26d

[internet-dot]

The plugin bundle and index entries are complete, but the install_url in plugins.json is broken:\n\n\nhttps://raw.githubusercontent.com/bcanfield/agentic-tech-debt/HEAD/codex/.codex-plugin/plugin.json\n\n\nThe actual file in the bundle is at plugins/bcanfield/agentic-tech-debt/.codex-plugin/plugin.json. Please fix the install_url to match the correct path.

[bcanfield]

I double-checked this one and I believe the install_url is correct as-is:

• It resolves: codex/.codex-plugin/plugin.json exists on the source repo's default branch, so https://raw.githubusercontent.com/bcanfield/agentic-tech-debt/HEAD/codex/.codex-plugin/plugin.json returns the manifest.
• It's the verbatim output of build_raw_manifest_url() in scripts/generate_plugins_json.py, which intentionally points at the source repo (with the plugin-root prefix), not the mirrored bundle. The mirror is addressed separately via the marketplace entry's source.path.
• Eight existing subdir plugins on main use the same shape, e.g. …/Maksim-Burtsev/simple-man/HEAD/plugins/simple-man/.codex-plugin/plugin.json and …/BlockchainHB/launchfast_codex_plugin/HEAD/plugins/launchfast/.codex-plugin/plugin.json.
• If I hand-edited it to the plugins/bcanfield/… path, the post-merge "Sync marketplace artifacts" workflow would regenerate plugins.json and revert it.

Happy to change it if you'd rather point install_url at the mirrored bundle, but that would be a generator-level convention change affecting all subdir plugins rather than a fix in this PR.

[internet-dot]

Before this PR can be merged, your plugin repo needs the HOL AI Plugin Scanner running in CI. This is a mandatory requirement for all submissions.

Add this workflow to your plugin repo at .github/workflows/hol-plugin-scanner.yml:

name: HOL Plugin Scanner

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

permissions:
  contents: read
  security-events: write

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: HOL Plugin Scanner
        uses: hashgraph-online/ai-plugin-scanner-action@v1
        with:
          plugin_dir: "."
          mode: scan
          min_score: 80
          fail_on_severity: high
          format: sarif
          upload_sarif: true

Also run the scanner locally and include the score in your PR description:

pipx install plugin-scanner
plugin-scanner scan . --format text

Your plugin needs a score of 80/130 or higher with no critical or high severity findings. Link the CI run or paste the score in this PR description.

See the full guide: SCANNER_GUIDE.md

Additional issues:
plugins.json has a broken install_url path. Fix that, and add marketplace.json entry.

[bcanfield]

The HOL Plugin Scanner is now wired into CI on the source repo and passing.

• Workflow: .github/workflows/hol-plugin-scanner.yml — runs hashgraph-online/ai-plugin-scanner-action (pinned to the v1.2.21 commit SHA) on push + PR, with contents: read / security-events: write and SARIF upload.
• Passing run on main: https://github.com/bcanfield/agentic-tech-debt/actions/runs/27161245162/job/80176967913
• Score: 92/100 (A), 0 critical / 0 high (1 medium, 4 low). I also pinned the existing workflow actions to commit SHAs and added SECURITY.md + a Dependabot config to clear the operational-security checks.
• I've also rebased this PR on the latest main and resolved the plugins.json conflict.