[cis2042]

What this adds

Adds ux3-product-design-harness, a skills-only plugin for reviewing product changes before implementation. Its existing joint review/context-pack validator rejects handoffs whose scope differs from the approved execution boundary, so a continue verdict cannot silently expand the authorized work.

The plugin contains one skill, product-design-harness, with the complete 91-file upstream bundle: schemas, examples, prompts, knowledge, Python validators, documentation, both SVG diagrams, and MIT LICENSE. There are no new droids, commands, hooks, MCP servers, global context, tool permissions, or automatically invoked programs.

Source and license

I am the upstream publisher. Every file under plugins/ux3-product-design-harness/skills/product-design-harness/ is byte-identical to cis2042/ux3-product-design-harness at 2ea880647e86ba99c65a334864fff8962bb3034e. That complete skill tree is unchanged from upstream commit 7f9f724c5e31813d1c35767f9f454fe9a1e96891.

The plugin-level LICENSE is a copy of the original MIT license, applying to this contribution. No license is assigned to other marketplace content. The native plugin manifest only supplies name, description, author, and MIT metadata.

The remaining changes are one marketplace entry, a compact root README section, and the required top-level skills/product-design-harness symlink to the real plugin skill folder. Existing entries and workflows are unchanged.

Validation

Candidate: ebf8a65f6010e48214194a44b31607bdd7713643, based on master aa8be50bc07e9f4ec48db9d57929ce8e2214504a.

• Ran the exact original check-skills workflow shell block locally, without modifying it: both the untouched baseline and candidate passed. The extracted local script is not part of this PR.
• Compared all 91 skill files with the fixed upstream source: no missing, extra, or differing files. Original MIT LICENSE is also copied to the plugin root.
• Used existing gh 2.93.0 native skill installation with this exact candidate SHA and the real plugins/ux3-product-design-harness/skills/product-design-harness path into an isolated directory. All 91 files were installed, and all 90 supporting files plus MIT were identical to the candidate. gh's SKILL frontmatter provenance injection and blank-line normalization are installer differences, rather than source modifications.
• From the installed resources, ran the existing joint validator with the live-coding and Quick review/context-pack pairs: both returned ok with exit 0. A separate context-pack copy with an extra unapproved scope action was correctly refused with exit 1. Used an existing Python environment with jsonschema 4.26.0; the helper and original examples were not modified.
• git diff --check passed. No new dependencies or CLI were installed.

Limitations

The exact-head Check skills directory run is awaiting maintainer approval before execution. Its API conclusion is action_required, with no jobs started. The successful local run of the unchanged workflow block is development evidence; it is not a claim that platform CI passed. No approval, rerun, or workflow change was performed to bypass that gate.

Droid is not installed in the validation environment, so native Droid plugin installation, skill discovery, and model execution remain untested. The gh result is portable exact-source installation evidence, not a Droid runtime claim or an already accepted public listing. The proposed Factory commands are clearly marked as available after catalog acceptance in the plugin README.

No inference, optional retrieval service, package publication, or separate CLA/rights grant was performed. Any host/provider usage remains subject to the user's existing environment and authorization. File integrity and deterministic validation do not establish model effectiveness or security certification.