feat(marketplace): append-only registry w/ per-plugin versions (#42)

- Rename workflow input to snapshot_version (update release caller)
- Enforce immutable manifests for existing plugin versions (diff on mismatch)
- Preserve streamkit.pub in generated registry output
- Add append-only regression test and pass --public-key for isolation

Author: streamer45

.github/workflows/marketplace-build.yml

@@ -7,8 +7,8 @@ name: Marketplace Build (Reusable)
 on:
   workflow_call:
     inputs:
-      version:
-        description: "Marketplace version (e.g., 1.2.3)"
+      snapshot_version:
+        description: "Marketplace snapshot version (not plugin version; used for release naming)"
         required: true
         type: string
       release_tag:
@@ -36,7 +36,7 @@ env:
   RUST_BACKTRACE: 1
   SHERPA_ONNX_VERSION: "1.12.17"
   MINISIGN_DEB_URL: "http://launchpadlibrarian.net/780165111/minisign_0.12-1_amd64.deb"
-  MARKETPLACE_VERSION: ${{ inputs.version }}
+  SNAPSHOT_VERSION: ${{ inputs.snapshot_version }}
   RELEASE_TAG: ${{ inputs.release_tag }}
   REGISTRY_BASE_URL: ${{ inputs.registry_base_url || 'https://streamkit.dev/registry' }}
 
@@ -52,7 +52,7 @@ jobs:
       - name: Install system dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y cmake pkg-config libclang-dev wget libopenblas-dev zstd patchelf python3-yaml
+          sudo apt-get install -y cmake pkg-config libclang-dev wget libopenblas-dev zstd patchelf python3-yaml python3-tomli
 
       - name: Install minisign
         run: |
@@ -146,10 +146,9 @@ jobs:
 
       - name: Build registry artifacts
         run: |
-          VERSION="${MARKETPLACE_VERSION#v}"
           python3 scripts/marketplace/build_registry.py \
             --plugins marketplace/official-plugins.json \
-            --version "${VERSION}" \
+            --existing-registry docs/public/registry \
             --bundle-base-url "https://github.com/${{ github.repository }}/releases/download/${RELEASE_TAG}" \
             --registry-base-url "${REGISTRY_BASE_URL}" \
             --bundles-out dist/bundles \

.github/workflows/marketplace-release.yml

@@ -7,11 +7,11 @@ name: Marketplace Release
 on:
   workflow_dispatch:
     inputs:
-      version:
-        description: "Marketplace version (e.g., 1.2.3)"
+      snapshot_version:
+        description: "Marketplace snapshot version (e.g., 1.2.3, 0.2.0-dev)"
         required: true
       release_tag:
-        description: "Release tag (defaults to marketplace-v<version>)"
+        description: "Release tag (defaults to marketplace-v<snapshot_version>)"
         required: false
       prerelease:
         description: "Mark release as prerelease"
@@ -20,7 +20,7 @@ on:
         default: false
 
 env:
-  RELEASE_TAG: ${{ inputs.release_tag || format('marketplace-v{0}', inputs.version) }}
+  RELEASE_TAG: ${{ inputs.release_tag || format('marketplace-v{0}', inputs.snapshot_version) }}
 
 jobs:
   marketplace:
@@ -30,8 +30,8 @@ jobs:
       pull-requests: write
     secrets: inherit
     with:
-      version: ${{ inputs.version }}
-      release_tag: ${{ inputs.release_tag || format('marketplace-v{0}', inputs.version) }}
+      snapshot_version: ${{ inputs.snapshot_version }}
+      release_tag: ${{ inputs.release_tag || format('marketplace-v{0}', inputs.snapshot_version) }}
 
   create-release:
     name: Create Marketplace Release
@@ -52,11 +52,11 @@ jobs:
         with:
           tag_name: ${{ env.RELEASE_TAG }}
           target_commitish: ${{ github.sha }}
-          name: "Marketplace ${{ inputs.version }}"
+          name: "Marketplace ${{ inputs.snapshot_version }}"
           files: |
             artifacts/**/marketplace-bundles/*.tar.zst
           body: |
-            Marketplace bundles for version `${{ inputs.version }}`.
+            Marketplace bundles for snapshot `${{ inputs.snapshot_version }}`.
           draft: false
           prerelease: ${{ inputs.prerelease }}
         env:

.github/workflows/release.yml

@@ -87,7 +87,7 @@ jobs:
       pull-requests: write
     secrets: inherit
     with:
-      version: ${{ github.ref_name }}
+      snapshot_version: ${{ github.ref_name }}
       release_tag: ${{ github.ref_name }}
 
   create-release:

AGENTS.md

@@ -39,7 +39,7 @@ When making a plugin official and downloadable from the registry, update all of
 the following:
 
 - Plugin source under `plugins/native/<id>/` (crate metadata + README).
-- Plugin metadata in `plugins/native/<id>/marketplace.yml` (id, entrypoint,
+- Plugin metadata in `plugins/native/<id>/plugin.yml` (id, version, entrypoint,
   artifact path, models, licenses, homepage/repo).
 - Generate `marketplace/official-plugins.json` with
   `scripts/marketplace/generate_official_plugins.py` and commit the result.

marketplace/PORTABILITY_REVIEW.md

@@ -3,6 +3,7 @@
     {
       "id": "helsinki",
       "name": "Helsinki",
+      "version": "0.1.0",
       "node_kind": "helsinki",
       "kind": "native",
       "entrypoint": "libhelsinki.so",
@@ -41,6 +42,7 @@
     {
       "id": "kokoro",
       "name": "Kokoro",
+      "version": "0.1.0",
       "node_kind": "kokoro",
       "kind": "native",
       "entrypoint": "libkokoro.so",
@@ -67,6 +69,7 @@
     {
       "id": "matcha",
       "name": "Matcha",
+      "version": "0.1.0",
       "node_kind": "matcha",
       "kind": "native",
       "entrypoint": "libmatcha.so",
@@ -93,6 +96,7 @@
     {
       "id": "nllb",
       "name": "NLLB",
+      "version": "0.1.0",
       "node_kind": "nllb",
       "kind": "native",
       "entrypoint": "libnllb.so",
@@ -118,6 +122,7 @@
     {
       "id": "piper",
       "name": "Piper",
+      "version": "0.1.0",
       "node_kind": "piper",
       "kind": "native",
       "entrypoint": "libpiper.so",
@@ -158,6 +163,7 @@
     {
       "id": "sensevoice",
       "name": "SenseVoice",
+      "version": "0.1.0",
       "node_kind": "sensevoice",
       "kind": "native",
       "entrypoint": "libsensevoice.so",
@@ -198,6 +204,7 @@
     {
       "id": "vad",
       "name": "VAD",
+      "version": "0.1.0",
       "node_kind": "vad",
       "kind": "native",
       "entrypoint": "libvad.so",
@@ -224,6 +231,7 @@
     {
       "id": "whisper",
       "name": "Whisper",
+      "version": "0.1.1",
       "node_kind": "whisper",
       "kind": "native",
       "entrypoint": "libwhisper.so",

marketplace/official-plugins.json

@@ -1,5 +1,6 @@
 id: helsinki
 name: Helsinki
+version: 0.1.0
 node_kind: helsinki
 kind: native
 entrypoint: libhelsinki.so

plugins/native/helsinki/marketplace.yml plugins/native/helsinki/plugin.ymlplugins/native/helsinki/marketplace.yml renamed to plugins/native/helsinki/plugin.yml

@@ -1,5 +1,6 @@
 id: kokoro
 name: Kokoro
+version: 0.1.0
 node_kind: kokoro
 kind: native
 entrypoint: libkokoro.so

plugins/native/kokoro/marketplace.yml plugins/native/kokoro/plugin.ymlplugins/native/kokoro/marketplace.yml renamed to plugins/native/kokoro/plugin.yml

@@ -1,5 +1,6 @@
 id: matcha
 name: Matcha
+version: 0.1.0
 node_kind: matcha
 kind: native
 entrypoint: libmatcha.so

plugins/native/matcha/marketplace.yml plugins/native/matcha/plugin.ymlplugins/native/matcha/marketplace.yml renamed to plugins/native/matcha/plugin.yml

@@ -1,5 +1,6 @@
 id: nllb
 name: NLLB
+version: 0.1.0
 node_kind: nllb
 kind: native
 entrypoint: libnllb.so