Own the Codex marketplace in the Codex plugin repository

.agents/plugins/marketplace.json

@@ -0,0 +1,21 @@
+{
+  "name": "mainsequence",
+  "interface": {
+    "displayName": "MainSequence"
+  },
+  "plugins": [
+    {
+      "name": "mainsequence",
+      "source": {
+        "source": "npm",
+        "package": "@dev-mainsequence/codex-plugin",
+        "version": "0.7.10"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_USE"
+      },
+      "category": "Productivity"
+    }
+  ]
+}

README.md

@@ -34,10 +34,10 @@ presentation layer, the manifests, skills and icons, the host checks and the rel
 
 ## Install
 
-The marketplace stays where people added it, in the devtools repository:
+Install from this repository’s published marketplace:
 
 ```sh
-codex plugin marketplace add mainsequence-sdk/mainsequence-devtools
+codex plugin marketplace add mainsequence-sdk/mainsequence-codex-plugin
 codex plugin add mainsequence@mainsequence
 ```
 
@@ -48,12 +48,29 @@ package. Node 22 or newer is required. Review and trust the plugin's hook before
 hooks, and an untrusted hook cannot intercept `/ms`. Then start a new chat, or toggle
 MainSequence off and on in the desktop Plugins settings to hot-reload an existing chat.
 
+### Replacing the retired devtools marketplace
+
+The Codex marketplace belongs to this repository. The catalog in the shared devtools
+repository has been removed. If you previously added that marketplace, replace its
+source before upgrading:
+
+```sh
+codex plugin marketplace remove mainsequence
+codex plugin marketplace add mainsequence-sdk/mainsequence-codex-plugin
+codex plugin add mainsequence@mainsequence
+```
+
+This replaces the marketplace source, not the installed plugin. The marketplace name
+and plugin ID remain `mainsequence` and `mainsequence@mainsequence`. MainSequence login
+and saved MCP connections remain outside the plugin; no account or settings migration
+is required. Start a new chat, or toggle the plugin off and on after any running turn.
+
 ### Upgrading from `mainsequence-devtools`
 
 The plugin was renamed, and Codex identifies a plugin by its marketplace entry name, so the
-installed `mainsequence-devtools@mainsequence` is not updated in place. Refresh the
-marketplace, install the new entry, trust its hook, then remove the old plugin so that only
-one hook answers `/ms`:
+installed `mainsequence-devtools@mainsequence` is not updated in place. First replace
+the retired marketplace source as described above, then install the new entry, trust its
+hook, and remove the old plugin so that only one hook answers `/ms`:
 
 ```sh
 codex plugin marketplace upgrade mainsequence
@@ -178,5 +195,7 @@ plugin installed from another marketplace. Results are recorded in
 A `v<version>` tag runs the same checks from the published devtools archive and publishes
 the verified npm archive with provenance through npm trusted publishing (repository
 `mainsequence-sdk/mainsequence-codex-plugin`, workflow `release.yml`, environment `npm`).
-Published versions are immutable. After publishing, point the marketplace entry in the
-devtools repository at the new version.
+Published versions are immutable. After publishing and verifying the npm archive, advance
+`.agents/plugins/marketplace.json` in this repository to the published version. The
+marketplace stays on the last published version while a new release is being prepared.
+`node scripts/check-marketplace.cjs` validates its identity, npm source and version pin.

docs/codex-verification.md

@@ -1,5 +1,28 @@
 # Codex plugin verification
 
+## Marketplace ownership (2026-10-24)
+
+The public `.agents/plugins/marketplace.json` now belongs to this repository. It
+retains the existing `mainsequence@mainsequence` identity and pins the already
+published `@dev-mainsequence/codex-plugin@0.7.10` archive. The shared devtools
+repository no longer hosts the Codex catalog. No runtime, dependency, credential,
+backend or provider changes are part of this move.
+
+The README documents new installation from `mainsequence-sdk/mainsequence-codex-plugin`
+and replacement of a configured devtools source. `scripts/check-marketplace.cjs`
+validates catalog ownership, identity, exact npm version, source and install policy
+as part of the release check.
+
+Both release checks passed: 56 Codex tests, 182 devtools tests, complete builds and
+npm package verification. Codex CLI 0.163.0 installed the published 0.7.10 npm package
+in a disposable `CODEX_HOME`. Removing its old marketplace source and adding this
+repository’s local catalog preserved every installed-plugin field except the
+marketplace source: ID, version, enabled state, package and policy were unchanged.
+A repeated install resolved the same cached plugin. No hook trust was granted and
+no MainSequence backend, model endpoint or user account was used. The normal Codex
+configuration’s before/after SHA-256 matched. Public-URL acceptance follows the
+catalog’s merge, before removal of the devtools catalog.
+
 ## 0.3.1 — devtools 0.3.1: MCP names stored with saved connections (2026-10-22)
 
 The plugin bundles [devtools 0.3.1](https://github.com/mainsequence-sdk/mainsequence-devtools/pull/15)
@@ -83,7 +106,8 @@ Findings:
   of the upgrade, not optional cleanup. Removal leaves the old `hooks.state` trust entry in
   `config.toml`; it is inert.
 
-Migration note for users of `mainsequence-devtools` (also in the README):
+Historical 0.3.0 migration note for users of `mainsequence-devtools` (the current
+README additionally replaces the retired devtools marketplace source):
 
 ```sh
 codex plugin marketplace upgrade mainsequence

scripts/check-marketplace.cjs

@@ -0,0 +1,19 @@
+// The Codex repository owns its public marketplace; shared devtools owns no catalog.
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const root = path.resolve(__dirname, '..');
+const pkg = require(path.join(root, 'package.json'));
+const marketplace = require(path.join(root, '.agents/plugins/marketplace.json'));
+assert.equal(marketplace.name, 'mainsequence');
+assert.equal(marketplace.interface.displayName, 'MainSequence');
+assert.equal(marketplace.plugins.length, 1);
+const plugin = marketplace.plugins[0];
+assert.equal(plugin.name, 'mainsequence');
+assert.equal(plugin.source.source, 'npm');
+assert.equal(plugin.source.package, pkg.name);
+assert.match(plugin.source.version, /^\d+\.\d+\.\d+$/);
+const compare = (a, b) => a.split('.').map((n, i) => Number(n) - Number(b.split('.')[i])).find(n => n !== 0) ?? 0;
+assert.ok(compare(plugin.source.version, pkg.version) <= 0, 'The marketplace cannot advertise a newer version than the source');
+assert.deepEqual(plugin.policy, { installation: 'AVAILABLE', authentication: 'ON_USE' });
+assert.equal(plugin.category, 'Productivity');
+console.log(`Codex marketplace: ${plugin.name}@${marketplace.name} from ${plugin.source.package}@${plugin.source.version}.`);

scripts/check-release.cjs

@@ -4,6 +4,7 @@ const pkg = require('../package.json');
 const manifest = require('../codex/.codex-plugin/plugin.json');
 const build = require('../codex/build-info.json');
 const lock = require('../package-lock.json');
+require('./check-marketplace.cjs');
 assert.equal(pkg.private, undefined);
 assert.equal(pkg.publishConfig.access, 'public');
 assert.equal(pkg.name, '@dev-mainsequence/codex-plugin');