[acamarata]

Rows

D-0821 (workflows manifest port). free/workflows/plugin.json port and service.port are now 3712, the port the Dockerfile EXPOSE, compose fragment, nginx conf and config default use. 3712 collides with no other plugin or reserved row (ports.sh). No other plugin depends on workflows, so no PLUGIN_WORKFLOWS_INTERNAL_URL line exists and no oracle-deltas entry is needed. New tests/conformance/d0821-test.sh fails on main (both fields 3733) and passes now. registry.json still lists 3733 for workflows: it is a signed, generated release artifact, so it is left for the next registry regeneration.

D-0973 (BuildKit cache). build-from-tarball.sh now runs docker builder prune -f in its exit trap when CI=true, also after a failed build. It never prunes on a developer machine. New tests/conformance/d0973-test.sh uses a stub docker and fails on main (no prune), passes now; CI unset and CI=false never prune.

D-0961 (oracle cannot compare byok): not changed. The condition is gone on main: #255 converted byok to manifest v2 with status experimental. The oracle takes originals from origin/main, where no v1 original is left (all 131 free manifests are v2), so nothing can trigger the unreadable-manifest warning. I ran the released v1.4.12 CLI against byok as it is on main: it installs and plugin list --installed --detailed prints a normal row with no warning. A new delta kind or a warning normaliser would have no input to act on, so none was added.

D-0198 (auth header names). Decision: the canonical header is X-Internal-Token. It is the one name used in both free plugins (post, linkedin, jobs, ai-cli) and bundles, so bundles needs no change for the canonical name; X-Plugin-Secret is only in audit-log and storage here. audit-log and storage now read X-Internal-Token, then fall back to X-Plugin-Secret, X-Internal-Secret, X-Internal-Key; post and linkedin gain the same fallback. A wrong canonical header is never rescued by a right legacy one. audit-log and storage compare in constant time. The storage Go client sends both the canonical and the legacy header for one release, so it still works against an older storage plugin. Storage README updated. Tests added in all four plugins.
Not done here: the callers and servers in the bundles and plugins-pro repos still send or expect their old names. Those keep working through the compatibility read, and their migration to X-Internal-Token must be done in those repos. The legacy fallbacks should be removed once that is done. The paypal, backup and donorbox READMEs name X-Plugin-Secret, but their code reads no such header; left alone.

Commands run

• GOFLAGS=-mod=vendor go vet ./... && go test ./... in free/audit-log, free/storage, free/post, free/linkedin: all pass.
• bash scripts/conformance/check.sh --plugins workflows,audit-log,storage,post,linkedin --rules <all but build>: pass.
• bash tests/conformance/d0821-test.sh, d0973-test.sh, oracle-deltas-test.sh: pass (d0821 and d0973 fail on main).
• python3 scripts/ci/check-file-size.py: pass.
• The build rule and v14-oracle.sh --plugins could not run locally: deterministic-tar.sh needs GNU tar, which this machine lacks (CI has it).

🤖 Generated with Claude Code