[DudiPeretz-Orca]

Summary

Codex could not discover this repository's skills through its plugin installer. Add the supported .codex-plugin/plugin.json manifest and a Codex marketplace entry that installs directly from the repository root, sharing the same skills/ tree with Claude and Cursor.

• Remove the redundant plugins/orca-skills copies and legacy .codex/plugin.json, addressing all four review threads.
• Merge current main, preserving all 20 root skills and the separate security-engineer plugin.
• Validate manifests, marketplace sources, version agreement, and skill metadata without a fixed skill count. Run the checks and regression tests on every PR with SHA-pinned GitHub Actions.
• Document Codex installation, OAuth and environment-based token authentication, and a repeatable isolated installation smoke test.

Validation

• npm test: packaging validation and all 16 regression tests pass.
• npm run test:codex: Codex CLI 0.159.0 installs the root plugin, discovers all 20 namespaced skills from its temporary cache, and verifies that all 22 skill/reference files match their sources.
• A separate fresh Git-backed marketplace install from DudiPeretz-Orca/orca-skills --ref codex-compatibility passed at commit 988b73b with the same 20 skills and 22 matching files.
• actionlint .github/workflows/validate-packaging.yml: passes.
• python3 plugins/security-engineer/tools/check_manifests.py: passes; that plugin and its existing workflow match upstream.
• git diff upstream/main --check: passes.

The Codex smoke test exercises installation and discovery without a model call. Live Orca MCP workflows were not exercised.

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[dror-orca]

The packaging work is genuinely good — you diagnosed the Codex gap right, the manifests and token handling check out against OpenAI's current docs, and the stale-manifest cleanup fixes real breakage on main. My one structural ask before merge: the plugins/ copy tree looks unnecessary — all 12 copies are byte-identical to the root skills (your own validator enforces that), and the root .codex-plugin/plugin.json you added already makes ./skills/ a valid Codex plugin. See my comment on marketplace.json: verify the install flow with "path": "./", and if it works we drop plugins/ (~6,375 lines) and the double-edit burden entirely. If Codex genuinely requires the subfolder, show the failure and we keep the copies — but then a CI workflow running npm test on every PR becomes mandatory, since right now nothing enforces the sync.
Remaining inline comments cover the duplicate-manifest ambiguity and deleting the legacy .codex/plugin.json rather than polishing it.