Package Iris calibration operator 1.0.0

[alanslzrr]

Summary

Adds the installable Iris calibration operator package at version 1.0.0. The repository root now combines one canonical operator skill, the existing remote MCP connection, native manifest overlays, private marketplace catalogs, documentation, and package conformance checks.

Motivation

The repository contained only its initial README and license, so it could not be installed as the combined package defined by the project specification. This change supplies the missing package wiring around the already-operational Iris service and skill without changing server behavior or authentication.

Changes

• Added portable package and MCP manifests with the shared iris server identity and production endpoint.
• Added two native manifest overlays and two private marketplace catalogs that resolve the same repository root.
• Added the canonical calibration-operator skill with package license, version, publisher, and MCP dependency metadata.
• Documented private installation routes, authentication ownership, the server-side security boundary, versioning, and safe artifact production.
• Added a dependency-free consistency and credential scanner plus hosted schema and skill validation.

Architecture and flow

flowchart TD
    Catalogs["Private marketplace catalogs"] --> Root["Repository root package"]
    Root --> Manifests["Portable and native manifests"]
    Root --> Skill["calibration-operator skill"]
    Root --> Binding["iris remote MCP declaration"]
    Skill --> Binding
    Binding --> Service["Existing Iris service"]

Loading

Every installation path resolves the same root, skill copy, logical server name, endpoint, and package version. Authentication and authorization remain owned by the existing service.

Commit breakdown

1. 599a092 — feat(package): add calibration operator package — adds manifests, catalogs, the remote binding, and the canonical skill.
2. 5695aff — docs(package): document installation and security boundaries — documents installation, distribution, security, and versioning.
3. af4633e — ci(package): enforce package conformance — adds repository invariants and hosted validation.

Validation

• python3 scripts/validate_package.py: passed on the working tree and on a clean git archive of HEAD.
• Portable plugin.json and mcp.json: passed Draft 2020-12 validation against the audited Agent Plugins 1.0.0 schemas.
• agentskills validate skills/calibration-operator: passed.
• The current strict native marketplace validator and bundled native manifest validator: passed on the clean archive.
• Both current native marketplace CLIs registered and installed iris-calibration-operator@phoenix-calibration from isolated temporary configurations.
• The installed package reported version 1.0.0; the remote binding resolved to the canonical endpoint; the cached skill hash matched the archive.
• The clean archive excluded Git metadata and ignored development-only files.
• git diff --check main...HEAD: passed.
• No MCP server behavior or OAuth flow was retested because neither implementation changed in this diff.

Risks and review notes

• Local-path marketplace installation copies an entire working directory, including ignored files. Distribution must use the documented Git-backed marketplace source or a clean repository archive.
• Version 1.0.0 is repeated where native formats require it; the consistency check fails if those values drift.
• Current native CLI validators are not available in the generic hosted runner, so they were executed locally against the clean archive; hosted validation covers portable schemas, skill structure, package invariants, paths, and credential patterns.