# SHD MCP plugin release checklist

This repository packages the client-side plugin. The authenticated MCP server
and its OAuth deployment are separate release surfaces.

## Local preflight

Run from the repository root:

```bash
python3 -m unittest discover -s tests -v
sha256sum --check plugins/shd-mcp-plugin/widgets/active-projects/v1/SHA256SUMS
```

The Codex plugin validator is an additional environment check when available:

```bash
python3 /home/vscode/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py \
  plugins/shd-mcp-plugin
```

## Widget changes

The URI `ui://shd/active-projects/v1.html` is a cache key. For a breaking HTML,
JavaScript or CSS change, create `v2/`, update the manifest and backend resource
registration together, then regenerate `SHA256SUMS`. Keep the widget useful
without ChatGPT-specific APIs: the MCP Apps bridge is the baseline and
`window.openai` is only a compatibility extension.

## Publish and deploy gates

1. Commit and push the same reviewed revision to the GitHub and Gitea mirrors.
2. Deploy the backend and ensure the widget artifact is available at the path
   used by `SHD_MCP_WIDGET_ROOT`, or at the repository path documented by the
   backend loader.
3. Run the backend MCP verification and a real authenticated OAuth/tool call.
4. Reconnect the custom ChatGPT app and test the active-projects flow, including
   the plain structured fallback and widget actions.
5. Record the exact revision and any runtime/browser checks. Static tests do
   not prove OAuth, ACLs, production hosting or ChatGPT rendering.

Do not place tokens, cookies, client secrets or private host credentials in this
repository, its marketplace file or its documentation.