Consolidate collection manifests and remove attributions

[WilliamBerryiii]

Summary

This PR consolidates the collection infrastructure to use a single core-manifest.yml source of truth and removes legacy "Brought to you by microsoft/hve-core" attribution footers.

Changes

Collection Consolidation

• Introduce collections/core-manifest.yml as canonical registry for all artifact paths, kinds, collection membership, and maturity
• Remove committed *.collection.yml / *.collection.md files (now projected in-memory)
• Add maturity-dependency validation to prevent experimental artifacts in stable collections
• Update plugin generation tooling to consume single manifest
• Add plugin parity check and test fixtures

Attribution Removal

• Strip "Brought to you by microsoft/hve-core" footer lines from 67 files
• Remove attribution requirements from prompt-builder.instructions.md
• Clean description suffixes from agents, prompts, instructions, and skills

Testing

• npm run lint:all passes
• npm run test:ps passes
• npm run plugin:generate produces correct outputs

Related Issues

Closes #2046
Closes #2047

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 28 package(s) with unknown licenses.
• ⚠️ 4 packages with OpenSSF Scorecard issues.

View full job summary

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.96%. Comparing base (44b42d4) to head (415f091).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2048      +/-   ##
==========================================
- Coverage   81.24%   79.96%   -1.29%     
==========================================
  Files         127      132       +5     
  Lines       18831    20496    +1665     
  Branches       12       12              
==========================================
+ Hits        15300    16390    +1090     
- Misses       3528     4103     +575     
  Partials        3        3              

Flag	Coverage Δ
docusaurus	61.84% <ø> (ø)
pester	82.46% <ø> (-3.60%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
docs/docusaurus/src/data/collectionCards.ts	71.42% <ø> (ø)

... and 12 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[WilliamBerryiii]

📝 A note for reviewers — where to spend your time

This is a large diff (341 files, +10,970 / −5,150), but the changes fall into a few clear buckets and only a small slice needs careful, line-by-line review. Here's how I'd suggest approaching it.

🎯 Review these closely (the real logic)

This is the heart of the change — the new "single source of truth" projection engine. Everything else is downstream of it.

1. collections/core-manifest.yml (new, ~2,015 lines) — the canonical registry. Worth confirming that membership, kind, and maturity values look right per artifact, since every projection derives from this file. You don't need to read all 2,015 lines; spot-check a handful of artifacts you know well and confirm the schema/shape is consistent.
2. scripts/collections/Modules/CoreManifestHelpers.psm1 (new, ~1,276 lines) — the projection logic that turns the manifest into in-memory collections. This is the most important file to actually read.
3. scripts/collections/Validate-CoreManifest.ps1 + the maturity-dependency validation — guards against experimental artifacts leaking into stable collections. Worth confirming the rule matches intent.
4. scripts/collections/Verify-CollectionProjection.ps1 — the parity check that proves the in-memory projection matches what we used to commit. This is the safety net for the whole consolidation.
5. scripts/collections/Promote-Agent.ps1 and Render-Collections.ps1 — supporting tooling; lighter review.
6. Schema changes — scripts/linting/schemas/base-frontmatter.schema.json and collection-manifest.schema.json.
7. New test suites under scripts/tests/collections/, scripts/tests/plugins/ — a good place to confirm the contract is pinned down (8 new test files).

👀 Skim only (mechanical / generated)

• plugins/** (~110 files) — these are generated by npm run plugin:generate, never hand-edited. The trustworthy way to review them is to run npm run plugin:generate locally and confirm it produces no diff against this branch, rather than reading each file.
• Attribution removal (~67 files, ~142 lines) — purely the removal of the legacy "Brought to you by microsoft/hve-core" suffix from agent/prompt/instruction/skill descriptions. Mechanical and repetitive.
• 26 deleted *.collection.yml / *.collection.md files — these are intentionally removed; they're now projected in-memory from core-manifest.yml.

✅ Validation status

• npm run lint:all — passing
• npm run test:ps — passing
• npm run plugin:generate — produces correct outputs (no drift)

🔁 Suggested review order

1. core-manifest.yml (understand the new source of truth) →
2. CoreManifestHelpers.psm1 (how it's projected) →
3. Validate-CoreManifest.ps1 + Verify-CollectionProjection.ps1 (how it's guarded) →
4. the new tests (the contract) →
5. regenerate plugins/ to confirm parity, then skim the attribution removals.

Happy to walk through any of the projection logic if it's helpful. 🙏

[bindsi]

Approved: the core manifest consolidation preserves existing behavior while centralizing collection metadata. I did not find actionable correctness or generated-artifact issues.

[github-actions]

Eval Execution

❌ Status: Failed

• Artifacts evaluated: 78
• Specs run: 4
• Assertions passed: 13166
• Assertions failed: 5542
• Failed specs: 1

Artifact	Kind	Status	Passed	Failed
accessibility-planner	agent	❌ fail	188	86
accessibility-reviewer	agent	❌ fail	188	86
accessibility-framework-assessor	agent	❌ fail	188	86
ado-backlog-manager	agent	❌ fail	188	86
code-review-accessibility	agent	❌ fail	188	86
code-review-full	agent	❌ fail	188	86
code-review-functional	agent	❌ fail	188	86
code-review-standards	agent	❌ fail	188	86
eval-dataset-creator	agent	❌ fail	188	86
gen-data-spec	agent	❌ fail	188	86
gen-jupyter-notebook	agent	❌ fail	188	86
gen-streamlit-dashboard	agent	❌ fail	188	86
test-streamlit-dashboard	agent	❌ fail	188	86
dt-coach	agent	❌ fail	188	86
dt-learning-tutor	agent	❌ fail	188	86
github-backlog-manager	agent	❌ fail	188	86
documentation	agent	❌ fail	188	86
pr-review	agent	❌ fail	188	86
task-challenger	agent	❌ fail	188	86
jira-backlog-manager	agent	❌ fail	188	86
adr-creation	agent	❌ fail	188	86
agile-coach	agent	❌ fail	188	86
brd-builder	agent	❌ fail	188	86
meeting-analyst	agent	❌ fail	188	86
network-isa95-planner	agent	❌ fail	188	86
prd-builder	agent	❌ fail	188	86
product-manager-advisor	agent	❌ fail	188	86
brd-quality-reviewer	agent	❌ fail	188	86
prd-quality-reviewer	agent	❌ fail	188	86
system-architecture-reviewer	agent	❌ fail	188	86
ux-ui-designer	agent	❌ fail	188	86
rai-planner	agent	❌ fail	188	86
rai-reviewer	agent	❌ fail	188	86
rai-skill-assessor	agent	❌ fail	188	86
security-planner	agent	❌ fail	188	86
security-reviewer	agent	❌ fail	188	86
sssc-planner	agent	❌ fail	188	86
report-generator	agent	❌ fail	188	86
ado-backlog-sprint	instruction	❌ fail	96	76
ado-backlog-triage	instruction	❌ fail	96	76
ado-interaction-templates	instruction	❌ fail	96	76
ado-update-wit-items	instruction	❌ fail	96	76
diff-computation	instruction	❌ fail	96	76
review-artifacts	instruction	❌ fail	96	76
graphify	instruction	❌ fail	96	76
community-interaction	instruction	❌ fail	96	76
github-backlog-discovery	instruction	❌ fail	96	76
github-backlog-planning	instruction	❌ fail	96	76
github-backlog-triage	instruction	❌ fail	96	76
github-backlog-update	instruction	❌ fail	96	76
prompt-builder	instruction	❌ fail	96	76
jira-backlog-discovery	instruction	❌ fail	96	76
jira-backlog-planning	instruction	❌ fail	96	76
jira-backlog-triage	instruction	❌ fail	96	76
jira-backlog-update	instruction	❌ fail	96	76
adr-byo-template	instruction	❌ fail	96	76
adr-handoff	instruction	❌ fail	96	76
adr-identity	instruction	❌ fail	96	76
adr-standards	instruction	❌ fail	96	76
hve-core-location	instruction	❌ fail	96	76
code-review-full	prompt	❌ fail	204	7
dt-figma-export	prompt	❌ fail	204	7
graph-research	prompt	❌ fail	204	7
github-execute-backlog	prompt	❌ fail	204	7
dt-coaching-foundation	skill	❌ fail	221	41
dt-curriculum	skill	❌ fail	221	41
dt-methods	skill	❌ fail	221	41
dt-rpi-integration	skill	❌ fail	221	41
customer-card-render	skill	❌ fail	221	41
mural	skill	❌ fail	221	41
powerpoint	skill	❌ fail	221	41
tts-voiceover	skill	❌ fail	221	41
vscode-playwright	skill	❌ fail	221	41
gh-code-scanning	skill	❌ fail	221	41
vally-tests	skill	❌ fail	221	41
adr-author	skill	❌ fail	221	41
requirements-author	skill	❌ fail	221	41
supply-chain-security	skill	❌ fail	221	41

[katriendg]

PR Review: Consolidate collection manifests and remove attributions

Consolidates collection infrastructure onto a single collections/core-manifest.yml source of truth (replacing the committed *.collection.yml / *.collection.md files), adds maturity-dependency validation, updates plugin/extension generation to consume the manifest, and removes "Brought to you by microsoft/hve-core" attribution footers.

Verification performed locally (branch checked out; nothing committed)

Check	Result
npm run lint:core-manifest	✅ pass (1 benign warning: memory.agent.md handoff /clear is a builtin)
npm run verify:collection-projection	✅ 559/559 plugin files byte-for-byte; 577 total reproduced
npm run plugin:generate → git status	✅ idempotent — 0 changes
npm run extension:prepare + :prerelease	✅ both idempotent — 0 changes
Pester: collections / plugins / extension	✅ 242 / 128 / 353 pass (1 skip)
lint:collections-metadata, validate:skills, lint:marketplace	✅ 9 collections, 0 errors; marketplace 9 plugins OK

The build mechanics are solid: manifest validation, projection parity, and all three regenerators reproduce committed output deterministically. The findings below are cleanup items, not correctness blockers. Three are attached as inline comments (vally-tests SKILL.md, base-frontmatter.schema.json, the stray extension/manifest-review/ artifact); the remainder are below where the diff doesn't cleanly anchor.

---

General comments

⚠️ Residual attribution propagated into generated output. The accessibility-planner agent description still ends with Brought to you by microsoft/hve-core., and that text flows through into generated, in-diff READMEs:

• Source: .github/agents/accessibility/accessibility-planner.agent.md (Line 7, multi-line description)
• Generated: plugins/project-planning/README.md (Line 22)
• Generated: plugins/hve-core-all/README.md (Line 33)

Fix the source description, then re-run npm run plugin:generate and npm run extension:prepare / :prerelease so the regenerated READMEs drop the suffix.

💡 Body-footer attribution remaining in skill docs. These > Brought to you by microsoft/hve-core body footers remain. The first is in a file this PR already modifies (in scope); the others are untouched and may be deferred:

• .github/skills/project-planning/adr-author/SKILL.md (Line 179) — file modified by this PR
• .github/skills/accessibility/accessibility/SKILL.md (Line 120) — not otherwise touched
• .github/skills/hve-core/documentation/SKILL.md (Line 66) — not otherwise touched
• .github/skills/hve-core/architecture-diagrams/SKILL.md (Line 232) — not otherwise touched

Note: the Brought to you by Microsoft ISE HVE Essentials lines in extension/README.* are a separate, intentional marketplace footer and are out of scope.

💡 PR description accuracy. The description's "Changes" list and "Strip ... footer lines from 67 files" claim read as a complete attribution sweep, but several artifacts above still carry the attribution. Please reconcile the description with what actually landed — either finish the sweep or scope the claim to the files actually cleaned.

ℹ️ New frontmatter fields are currently unused (informational). base-frontmatter.schema.json adds optional maturity and collections properties, but no source artifact populates either field yet (membership/maturity live in the manifest). This reads as a forward-looking addition (relates to #2141 / #1319). Fine to merge as-is; flagging only so it isn't mistaken for a wired-up control.

---

Summary by category

• Attribution cleanup: 3 (vally-tests inline, propagated READMEs, body footers)
• Maintainability: 1 (stray extension/manifest-review/ artifact, inline)
• Conventions: 1 (schema trailing newline, inline)
• Documentation: 1 (description accuracy)
• Schema: 1 (informational)
• Security: 0

Instruction compliance

• ✅ Packaging workflows correctly switch off the deleted *.collection.yml glob to Find-CollectionManifests.ps1; plugin-validation.yml adds core-manifest + asset-sync + marketplace freshness checks.
• ✅ New lint:core-manifest and verify:collection-projection are chained into both lint:all and plugin:validate.
• ⚠️ Attribution removal partially applied; residual suffixes remain (see above).

Related issues (post-merge follow-up)

#1701 (implemented — close/link), #1699 (parent tracker), #2046/#2047 (verify auto-close), #2141 + #1319 (maturity decoupling/standardization — addressed), #1598 (prerelease maturity desc — addressed), #1707/#1317 (docs/Docusaurus), #2078/#1869/#2031 (collections.md count touch-ups).

Recommendation

Approve with minor changes. Engineering is green and reproducible. Requested before merge: finish the attribution sweep, remove the stray extension/manifest-review/hve-core/ artifact, add the schema trailing newline, and reconcile the PR description.

[katriendg]

⚠️ This PR rewrites this description line but leaves the - Brought to you by microsoft/hve-core suffix in place, which is inconsistent with the attribution-removal goal of this PR. The suffix also propagates into generated marketplace/README output.

Suggested:

description: 'Authors Vally conformance tests for prompts, instructions, agents, and skills, with explicit refusal of jailbreak, prompt-injection, harmful-elicitation, TOS, CoC, model-refusal-elicitation, and PII-extraction stimuli'

[katriendg]

💡 Nit: this edited schema file has no trailing newline (\ No newline at end of file in the diff). Other JSON files in the repo terminate with a newline — please add one for consistency.

Note (informational, no action needed): the new maturity and collections properties are not yet populated by any source artifact (membership/maturity currently live in core-manifest.yml), so this reads as a forward-looking addition.

[katriendg]

⚠️ This file (and its .md sibling) looks like a stray commit of a CI build artifact. extension/manifest-review/<id>/ is generated per-collection during packaging and uploaded by extension-package.yml as an ephemeral artifact (30-day retention, continue-on-error). Only the hve-core collection's files are committed here (asymmetric — no other collection has them), the path isn't in .gitignore, and they're renamed from the now-deleted collections/hve-core.collection.*.

Suggested: remove these two files and add extension/manifest-review/ to .gitignore. If a committed reference snapshot is intended, generate it for all collections consistently instead.