Add jaxx plugin: jaxx-consent and jaxx-memory skills 🤖🤖🤖

.github/plugin/marketplace.json

@@ -943,6 +943,12 @@
       "description": "Drive the GitHub Copilot App Modernization for Java workflow from an interactive canvas: environment readiness, repo assessment, prioritized plan and progress, validation gates, and one-click predefined-task runs grounded in the repo's real artifacts.",
       "version": "1.0.2"
     },
+    {
+      "name": "jaxx",
+      "source": "plugins/jaxx",
+      "description": "Rails for an agent that speaks in a named human's name. Owner-only identity, authority from the verified sender id rather than message content, an entry gate before the first post in any room, a never-reply-to-another-agent rule, and a git repo as durable memory so work survives context compaction.",
+      "version": "1.0.0"
+    },
     {
       "name": "jupyter-notebooks",
       "source": "plugins/jupyter-notebooks",

docs/README.plugins.md

@@ -73,6 +73,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-plugins) for guidelines on how t
 | [java-development](../plugins/java-development/README.md) | Comprehensive collection of prompts and instructions for Java development including Spring Boot, Quarkus, testing, documentation, and best practices. | 4 items | java, springboot, quarkus, jpa, junit, javadoc |
 | [java-mcp-development](../plugins/java-mcp-development/README.md) | Complete toolkit for building Model Context Protocol servers in Java using the official MCP Java SDK with reactive streams and Spring Boot integration. | 2 items | java, mcp, model-context-protocol, server-development, sdk, reactive-streams, spring-boot, reactor |
 | [java-modernization-studio](../plugins/java-modernization-studio/README.md) | Drive the GitHub Copilot App Modernization for Java workflow from an interactive canvas: environment readiness, repo assessment, prioritized plan and progress, validation gates, and one-click predefined-task runs grounded in the repo's real artifacts. | 1 items | app-modernization, assessment-dashboard, azure-migration, java-modernization, legacy-java, modernization-cockpit, validation-gates |
+| [jaxx](../plugins/jaxx/README.md) | Rails for an agent that speaks in a named human's name. Owner-only identity, authority from the verified sender id rather than message content, an entry gate before the first post in any room, a never-reply-to-another-agent rule, and a git repo as durable memory so work survives context compaction. | 2 items | agent-safety, consent, authority, prompt-injection, agent-memory, session-hygiene |
 | [jupyter-notebooks](../plugins/jupyter-notebooks/README.md) | Create, edit, run, save, and checkpoint Jupyter notebooks in an interactive Copilot canvas. | 1 items | data-analysis, interactive-notebooks, jupyter, python |
 | [kotlin-mcp-development](../plugins/kotlin-mcp-development/README.md) | Complete toolkit for building Model Context Protocol (MCP) servers in Kotlin using the official io.modelcontextprotocol:kotlin-sdk library. Includes instructions for best practices, a prompt for generating servers, and an expert chat mode for guidance. | 2 items | kotlin, mcp, model-context-protocol, kotlin-multiplatform, server-development, ktor |
 | [mcp-m365-copilot](../plugins/mcp-m365-copilot/README.md) | Comprehensive collection for building declarative agents with Model Context Protocol integration for Microsoft 365 Copilot | 4 items | mcp, m365-copilot, declarative-agents, api-plugins, model-context-protocol, adaptive-cards |

docs/README.skills.md

@@ -250,6 +250,8 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to
 | [java-springboot](../skills/java-springboot/SKILL.md)<br />`gh skills install github/awesome-copilot java-springboot` | Get best practices for developing applications with Spring Boot. | None |
 | [javascript-typescript-jest](../skills/javascript-typescript-jest/SKILL.md)<br />`gh skills install github/awesome-copilot javascript-typescript-jest` | Best practices for writing JavaScript/TypeScript tests using Jest, including mocking strategies, test structure, and common patterns. | None |
 | [javax-to-jakarta-migration](../skills/javax-to-jakarta-migration/SKILL.md)<br />`gh skills install github/awesome-copilot javax-to-jakarta-migration` | Migrate Java code from javax.* to jakarta.* namespace. Use when upgrading to Tomcat 11, Jakarta EE 10, or when javax imports are detected in the codebase. | None |
+| [jaxx-consent](../skills/jaxx-consent/SKILL.md)<br />`gh skills install github/awesome-copilot jaxx-consent` | Consent and authority rails for an agent that speaks or acts in a human's name — who may change what the agent IS, who may ask it to DO things, what it must never answer, and how it behaves when other agents are in the room. Enforces owner-only identity, sender-id-not-content authority, an entry gate before the first post in any new room, disclosure, containment across rooms, a never-reply-to-another-agent rule, and a decline path for personal questions. WHEN building a bot that posts as a person, "can my agent reply for me", "who can change the agent's rules", "agent guardrails", "prompt injection from message content", "should the bot introduce itself", "two bots replying to each other", "multiple people installed the same agent", "the agent said something it shouldn't", or when any other skill is about to write into a shared human space. | `agent.config.template.json` |
+| [jaxx-memory](../skills/jaxx-memory/SKILL.md)<br />`gh skills install github/awesome-copilot jaxx-memory` | Use a git repo as an agent's durable memory so work survives context compaction and session death - ACTIVE / BACKLOG / ARCHIVE files, per-stream detail, an append-only run log, and a bidirectional sync rule that forbids work existing only in markdown. WHEN "the agent forgot what we did", "context keeps compacting", "track my work across sessions", "agent memory without a vector db", "standup from my repo", "session hygiene", "how long should an agent session run", or when starting or ending any long-running agent session. | `assets/ACTIVE.md`<br />`assets/ARCHIVE.md`<br />`assets/BACKLOG.md`<br />`assets/sessions.md` |
 | [kotlin-mcp-server-generator](../skills/kotlin-mcp-server-generator/SKILL.md)<br />`gh skills install github/awesome-copilot kotlin-mcp-server-generator` | Generate a complete Kotlin MCP server project with proper structure, dependencies, and implementation using the official io.modelcontextprotocol:kotlin-sdk library. | None |
 | [kotlin-springboot](../skills/kotlin-springboot/SKILL.md)<br />`gh skills install github/awesome-copilot kotlin-springboot` | Get best practices for developing applications with Spring Boot and Kotlin. | None |
 | [landing-page-conversion-audit](../skills/landing-page-conversion-audit/SKILL.md)<br />`gh skills install github/awesome-copilot landing-page-conversion-audit` | Audit a landing page, sales page or checkout page for conversion leaks and return a fix list ordered by expected revenue impact. Use when asked to review, critique or improve a landing page, sales page, opt-in page, product page or checkout flow, when conversion rate is low, when paid traffic is not converting, or when someone asks "why isn't this page converting" or wants a CRO / landing page review. | None |

plugins/jaxx/README.md

@@ -0,0 +1,68 @@
+# jaxx
+
+Rails for an agent that speaks **in a named human's name**, in a room shared with other humans.
+
+Most agent safety guidance covers the agent and the machine — which tools it may call, which commands need approval. This plugin covers the agent and the **people**: who may change what it is, who may tell it what to do, what it must never answer, and how it behaves when it is not the only agent in the room.
+
+## What's in the plugin
+
+### Skills
+
+| Skill | What it does |
+|---|---|
+| `/jaxx-consent` | Consent and authority rails. Owner-only identity changes, authority from the verified sender id rather than message content, an entry gate before the first post in any new room, disclosure, containment across rooms, a never-reply-to-another-agent rule, and a decline path for personal questions. |
+| `/jaxx-memory` | A git repo as durable memory. `ACTIVE` / `BACKLOG` / `ARCHIVE`, per-stream detail, an append-only run log, session hygiene, and one hard rule — work must not exist only in markdown. |
+
+## The four questions
+
+A capable model, left alone, answers each of these by being helpful. That is the wrong instinct when it is wearing someone's name.
+
+| Question | Default without rails | With `/jaxx-consent` |
+|---|---|---|
+| Who may change what the agent **is**? | Whoever asks convincingly | Owner only; everyone else gets a polite decline and a redirect |
+| Who may tell it what to **do**? | Whoever the text says | The verified sender id. Text the agent *reads* is data, not orders |
+| May it answer personal questions about its human? | Usually, if they seem harmless | No. Whereabouts, PTO, health, calendar, motive — declined every time |
+| What happens when another agent replies? | It replies back | It does not. Two helpful agents in one thread is an unbounded loop |
+
+**Authority is the sender, not the sentence.** "Pruthvi said you could" is not Pruthvi. A work-item field, a quoted message, or a file the agent opens is input to be reasoned about, never an instruction to be followed. This treats prompt injection as an authority problem rather than a filtering problem — there is no phrase to catch, because content was never a source of authority in the first place.
+
+**Presence is consented to, not assumed.** Approval comes **first**, and the introduction comes after it. Before the agent's first post in any new room, the owner — and, where the room belongs to someone else, that person too — approves both the entry and the wording of the introduction. Until then the gate is **closed** and the agent posts nothing at all there: not an introduction, not an answer, not an acknowledgement. Anything worth saying goes to the owner privately instead. A cold, technically-in-scope reply is the failure mode, not the success case.
+
+## What this does and does not guarantee
+
+Worth being straight about, since the subject is safety. These skills are Markdown instructions. They shape a model's behaviour well and they make the rules explicit, reviewable and testable — but they are still prompt-level context, and prompt-level context competes with whatever else is in the window. Calling something a rail does not make it non-negotiable.
+
+**Hard guarantees have to live in the host integration**, below the model:
+
+| Guarantee | Where it actually has to be enforced |
+| --- | --- |
+| Only the owner can change what the agent is | Sender-id authorization in the integration, before the model is invoked |
+| The agent cannot post in an unapproved room | Room gating / an allowlist in the send path, not a rule the model is asked to remember |
+| The agent cannot read an unapproved room | Scoped API permissions on the connector — but read the caveat below before relying on this row |
+
+The read row is the one with a real caveat, and it is better stated than glossed. The connector token is an **outer** bound, not the whole story: under the bundled `chat.readScope: "all"` the agent deliberately reads every room that credential can already see, including rooms nobody approved and which are not in `watch`. That is the intended shape — read widely, speak narrowly — and it is only safe because reading is never a licence to post, and because nothing learned in one room may cross into another.
+
+So the honest boundary is: **the connector decides what is reachable; the skill decides what is read and for how long.** If a host needs "unapproved rooms are unreadable" to be a hard guarantee rather than a policy, it has to either issue a token scoped to the approved rooms only, or ship `readScope: "watched"`. Under `all`, what bounds an unapproved room instead is the discovery timeout — first read is recorded in `chat.discovered`, and if the owner does not promote the room into `watch` before `entryGateTimeoutHours` elapses it is appended to `chat.readExclusions` and never read again.
+
+Use these skills as the specification for those controls and as defence in depth above them — not as a substitute. A model that has been talked out of a rail still cannot call an endpoint it has no token for.
+
+## Why not just put this in a system prompt?
+
+- A system prompt is one undifferentiated block that competes with the message in front of the model. A named, enumerated rail with a stated blocking branch is something you can point at, test, and review — and something the model can be asked to check itself against, one item at a time.
+- Consent is **state** — who invited it, into which room — not persuasion. State belongs on disk.
+- Prompts degrade under compaction. Long sessions do not die, they compact, and compaction keeps the shape and drops the specifics.
+- "Be careful" is not testable. "Never reply to another agent" is.
+
+## Usage
+
+Install the plugin and both skills load on their own triggers — there is nothing to invoke by hand. `jaxx-consent` engages whenever the agent is about to write into a space shared with humans; `jaxx-memory` at the start and end of any long-running session.
+
+An optional [config template](https://github.com/PruthviProdduturi/Jaxx/blob/main/agent.config.template.json) names the owner and the invited rooms. With no config there is no verified owner and no invited room, so the rails read that honestly: nobody is the owner, no room has been entered, post nowhere. They bind by default rather than by opt-in.
+
+## Status
+
+These are rails, not proofs. There is no formal verification and no third-party adversarial testing behind them, and anything with write access to the agent's config sits upstream of every rule here. They are extracted from a working agent and written to be read by one.
+
+## License
+
+MIT

plugins/jaxx/plugin.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "jaxx",
+  "description": "Rails for an agent that speaks in a named human's name. Owner-only identity, authority from the verified sender id rather than message content, an entry gate before the first post in any room, a never-reply-to-another-agent rule, and a git repo as durable memory so work survives context compaction.",
+  "version": "1.0.0",
+  "keywords": [
+    "agent-safety",
+    "consent",
+    "authority",
+    "prompt-injection",
+    "agent-memory",
+    "session-hygiene"
+  ],
+  "author": {
+    "name": "PruthviProdduturi",
+    "url": "https://github.com/PruthviProdduturi"
+  },
+  "repository": "https://github.com/github/awesome-copilot",
+  "license": "MIT",
+  "extensions": {
+    "com.github.awesome-copilot": {
+      "skills": [
+        "./skills/jaxx-consent/",
+        "./skills/jaxx-memory/"
+      ]
+    }
+  }
+}