Add Codex discovery and invocation metadata for pstack

[MaxFabian25]

Summary

Codex can discover pstack's skills, but Cursor's disable-model-invocation flags do not preserve their manual-only behavior in Codex. Add a Codex manifest and invocation metadata alongside the existing Cursor package.

pstack/
├── .cursor-plugin/plugin.json   existing Cursor package
├── .codex-plugin/plugin.json    Codex package: pstack-plugin
└── skills/*/agents/openai.yaml  51 explicit-only policies

All 52 skill instructions in pstack 0.15.17 stay unchanged. setup-pstack remains automatic; the other 51, including ketchup, retain their explicit-only intent. The guide explains installation and the limits of this packaging support: it does not port Cursor-specific tools, hooks, or agent orchestration.

Evidence

• Before: the package has no Codex policy sidecars for the 51 skills marked disable-model-invocation: true.
• After: python3 pstack/scripts/check-codex-package.py passes with 52 skills: 51 explicit-only and 1 automatic. It also checks manifest version parity and excludes undeclared runtime integrations. The check failed on both the version mismatch and missing ketchup policy before this update.
• Codex 0.162.0-alpha.17.2 plugin/read discovers all 52 skills under pstack-plugin from an isolated local marketplace, without installing the proposal.
• git diff --check passes. Cursor manifest and all SKILL.md contents are unchanged. Full pstack workflows were not executed; this evidence covers discovery and metadata, not cross-host workflow compatibility.

Merge Danger

Door: two-way. Reverting removes the added Codex metadata.

Blast Radius: packaging. Existing Cursor manifests and skill instructions are unchanged; Codex consumers gain an explicit package namespace and policy sidecars.

---

Note

Low Risk
Packaging and metadata only; Cursor manifests and skill bodies are unchanged, with no runtime or auth/data-path changes.

Overview
Adds Codex packaging for pstack alongside the existing Cursor plugin: a new .codex-plugin/plugin.json registers the same skills/ tree as pstack-plugin (version aligned with .cursor-plugin), without registering Cursor-only agents, hooks, or MCP.

50 skills that use Cursor’s disable-model-invocation: true now get matching agents/openai.yaml sidecars with allow_implicit_invocation: false, so Codex keeps them explicit-only instead of auto-invoking them. setup-pstack stays the lone skill that can be invoked implicitly.

Documentation and guardrails: README points to docs/guide/codex-packaging.md (marketplace install example and scope limits), and scripts/check-codex-package.py asserts manifest parity and that each skill’s Codex policy matches its Cursor flag.

^{Reviewed by Cursor Bugbot for commit 6452c61. Bugbot is set up for automated code reviews on this repo. Configure here.}