Move Taskboard and Usage Tracker to Git releases

.empirical/capabilities/plugin-git-distribution/spec.md

@@ -0,0 +1,52 @@
+# Plugin Git Distribution Specification
+
+## Purpose
+
+Define the shared active distribution boundary for repository plugins whose
+installable releases live in Git rather than the npm registry.
+
+## Requirements
+
+### Requirement: Active Git-only install surfaces
+
+Taskboard and Usage Tracker SHALL expose only BB Community and immutable Git
+release sources in current user-facing documentation, automation, and
+marketplace metadata. Their workspaces SHALL be private and SHALL omit npm
+publication configuration and hooks.
+
+#### Scenario: Audit current distribution surfaces
+
+- **WHEN** active README, changelog, manifest, CI, config, and marketplace files
+  are searched for either plugin's former registry source
+- **THEN** no npm package badge, package URL, `npm:` plugin source, publish or
+  unpublish command, publishing token/config, or npm marketplace source remains
+- **AND** both documented install paths resolve through BB Community or the
+  plugin's public Git tag range
+
+### Requirement: Preserve Git-build package tooling
+
+Git-only distribution SHALL retain the package manifests, stable package names,
+workspace/lockfile dependency graph, source entry points, and package-manager
+development commands required to install dependencies, build, test, and derive
+BB plugin identity.
+
+#### Scenario: Distinguish tooling from distribution
+
+- **WHEN** an active audit encounters `package.json`, lockfile package records,
+  `@get-bb/plugin-sdk`, or npm install/run development commands
+- **THEN** those build and identity contracts remain intact
+- **AND** none is treated as evidence that either plugin is published to npm
+
+### Requirement: Preserve distribution history
+
+Historical Empirical records SHALL retain their accurate npm attempt,
+publication, failure, deletion, and migration evidence while current install
+surfaces remain Git-only.
+
+#### Scenario: Complete a current cleanup
+
+- **WHEN** stale active distribution copy is removed
+- **THEN** immutable historical specifications, receipts, and release artifacts
+  remain byte-valid
+- **AND** the current repository clearly separates history from supported
+  installation paths

.empirical/capabilities/taskboard-distribution/spec.md

@@ -6,32 +6,28 @@ Define reproducible, immutable Taskboard release and marketplace provenance.
 
 ## Requirements
 
-### Requirement: Immutable npm release
+### Requirement: Marketplace range alignment
 
-Every Taskboard release SHALL bind one package version, reviewed Git commit,
-plugin-specific annotated Git tag, verified npm archive, and GitHub release
-without moving or replacing an existing version or tag. The real archive SHALL
-be created with scripts disabled, inspected, identified by a recorded SHA-256,
-rechecked immediately before publishing that exact file with lifecycle scripts
-disabled, and published with credentials scoped to that one process.
+The BB Community Taskboard entry SHALL reference the public Git repository,
+plugin subdirectory, semver range, and Taskboard tag prefix that resolve the
+current immutable Git release while preserving listing identity.
 
-#### Scenario: Prepare Taskboard 0.3.0 after review fixes
+#### Scenario: Resolve the marketplace release
 
-- **WHEN** the final product source differs from an earlier candidate archive
-- **THEN** Taskboard rebuilds and replaces the local candidate with a newly
-  inspected archive derived from the final source
-- **AND** exact-version npm absence, archive SHA-256, and Git tag absence are
-  reconfirmed before remote approval
+- **WHEN** the marketplace validates Taskboard range `^0.3.0`
+- **THEN** it resolves `taskboard/v0.3.0` from the public repository
+- **AND** marketplace build and Git-source liveness checks pass without npm
 
-### Requirement: Marketplace range alignment
+### Requirement: Immutable Git release
 
-The BB Community Taskboard entry SHALL reference a published npm semver range
-that resolves the current release while preserving listing identity. Before a
-marketplace push, verification SHALL assert the exact package version is public
-in addition to running the marketplace's package-level liveness check.
+Every Taskboard release SHALL bind one reviewed Git commit, one immutable
+`taskboard/vX.Y.Z` annotated tag, and one GitHub Release. A Taskboard workspace
+SHALL be marked private/non-publishable and SHALL omit npm publication,
+packaging, and prepack configuration.
 
-#### Scenario: Publish before marketplace submission
+#### Scenario: Install Taskboard 0.3.0 directly
 
-- **WHEN** `bb-plugin-taskboard@0.3.0` is published
-- **THEN** an exact-version registry query returns `0.3.0`
-- **AND** marketplace build/liveness checks pass before its branch is pushed
+- **WHEN** a user installs Git range `^0.3.0` with subdirectory
+  `plugins/taskboard` and tag prefix `taskboard/`
+- **THEN** BB resolves public tag `taskboard/v0.3.0` and its immutable commit
+- **AND** builds the plugin from the reviewed Git source

.empirical/context/architecture.md

@@ -2,7 +2,7 @@
 
 ## Components and ownership
 
-- The root npm workspace fans build, typecheck, test, and check scripts into all
+- The root workspace fans build, typecheck, test, and check scripts into all
   leaf plugins while keeping one lockfile and dependency installation.
 - `plugins/taskboard/server.ts` is the backend composition root. It wires typed
   RPC handlers, project-scoped configuration and credentials, the local cache,
@@ -17,6 +17,9 @@
   `sources/` contains the GitHub, Linear, and Jira adapters behind one interface.
 - `plugins/usage-tracker` is independent and owns its own server, app, provider
   usage model, tests, and assets.
+- Both plugin manifests remain workspace/build manifests but are private.
+  BB resolves releases from the monorepo's plugin-specific Git tags and the
+  corresponding `plugins/taskboard` or `plugins/usage-tracker` subdirectory.
 
 ## Data and control flow
 

.empirical/context/commands.md

@@ -8,7 +8,11 @@ Commands below are verified from workspace and plugin manifests.
   or dependency/lockfile change.
 - `bb plugin install ./plugins/taskboard` — register the local Taskboard path in
   BB for live verification.
+- `bb plugin install git:https://github.com/MateoCerquetella/bb-plugins.git@^0.3.0 --subdirectory plugins/taskboard --tag-prefix taskboard/`
+  — install the released Taskboard Git range directly.
 - `bb plugin install ./plugins/usage-tracker` — register Usage Tracker locally.
+- `bb plugin install git:https://github.com/MateoCerquetella/bb-plugins.git@^0.1.2 --subdirectory plugins/usage-tracker --tag-prefix usage-tracker/`
+  — install the released Usage Tracker Git range directly.
 
 ## Run, test, and build
 
@@ -21,7 +25,7 @@ Commands below are verified from workspace and plugin manifests.
 - `npm run typecheck --workspace bb-plugin-taskboard` and
   `npm test --workspace bb-plugin-taskboard` — focused Taskboard iteration.
 - `npm run check --workspace bb-plugin-taskboard` — Taskboard SDK-type check,
-  typecheck, tests, build, and packed-output verification.
+  typecheck, tests, build, and build-metadata verification.
 - `npm run types:refresh --workspace bb-plugin-taskboard` followed by
   `npm install` — deliberate SDK declaration pin refresh when the minimum BB
   release changes.

.empirical/context/conventions.md

@@ -3,7 +3,7 @@
 ## Code and structure
 
 - New independently installable plugins live at `plugins/<id>` and must be
-  added to the root npm workspaces, `.bb/plugins.json`, and README catalog.
+  added to the root workspaces, `.bb/plugins.json`, and README catalog.
 - Keep plugin IDs, package names, CLI commands, realtime channels, persisted
   keys, schemas, tests, and documentation aligned.
 - Manifest `bb.server` and `bb.app` entries point to source files. Never repoint

.empirical/context/index.md

@@ -4,9 +4,9 @@
 Generated from bounded repository metadata.
 
 - Repository: bb-plugins-taskboard-dev
-- Source fingerprint: sha256:7eec076fe90c5cbc57984cfab992ac000553c42d3a1d7cc5242ae43e45775857
-- Included files: 95
-- Roots: .agents, .bb, .claude, .codex, .cursor, .gemini, .github, ., .windsurf, demos, plugins
+- Source fingerprint: sha256:ff6a92e5f69bcf805c3c47999eac4debf8e23d0aac79020c98063858c6f4107a
+- Included files: 96
+- Roots: .agents, .bb, .claude, .codex, .cursor, .gemini, ., .github, .windsurf, demos, plugins
 - Manifests: package.json, plugins/taskboard/package.json, plugins/usage-tracker/package.json
 - Primary docs: README.md, plugins/taskboard/README.md, plugins/usage-tracker/README.md