source-inventory

# Source Inventory Maintain `sources/supported-stores.json` — the single source of truth for which upstream plugin repos the Mall scans. The Mall does NOT keep persistent local clones of source repos. The weekly cron clones each registered source into a workflow temp directory (`$SOURCES_DIR`), scans it, scores it, and discards the clone. The registry file is the only persistent record. ## When to Use - Proposing a new source store (run [store-evaluation](../store-evaluation/SKILL.md) first) - Retiring a source store (run [staleness-discipline](../staleness-discipline/SKILL.md) first; use `/prune-source`) - A weekly cron PR flags a source as unhealthy (broken remote, archived, license drift) - Schema validation after editing `supported-stores.json` ## The registry: `sources/supported-stores.json` ```jsonc { "$schema": "./supported-stores.schema.json", "schema_version": "2.0", "stores": [ { "name": "plugin-mall", // unique kebab-case; matches catalog/stores/<name>.json "remote": "https://github.com/<org>/<repo>", // upstream URL (informational; not cloned for plugin-mall) "pluginDir": "plugins", // where plugins live in the upstream repo "quality": "first-party", // tier tag — see § Quality tiers "provenance": true, // true ONLY for plugin-mall (drives +50 trust signal) "license": "PolyForm-Noncommercial-1.0.0", // SPDX id, or null if unk...