Official registry

AgentRig installs official and reviewed registry artifacts from agentrig.ai. The canonical catalog state is the Convex artifact_listings row, and the SDK InstallBundle is the install contract consumed by the CLI.

The agentrig-registry repository is a verified mirror of selected listings. It gives reviewers and users a signed, browseable GitHub history for verified plugins, skills, MCPs, and hooks, but it is not the source the CLI depends on for install resolution.

AgentRig plugin manifests are Agent Plugins 1.0.0 conformant. AgentRig-specific fields live under extensions["ai.agentrig"].

What makes a listing installable

An approved AgentRig submission creates an artifact_listings row with an InstallBundle. Listings with installability: "available" resolve through the agentrig.ai install-bundle endpoint. Listings marked yanked or taken_down do not resolve for new installs.

The public directory and the verified mirror are browseable surfaces. Directory presence can help discovery; mirror presence can help audit; neither one changes whether the CLI can install a listing.

Canonical bundle projection

Catalog promotion validates each SDK InstallBundle before storing it on the immutable listing-version record. source.subdir identifies the package root; every file fetch path is relative to that root and the CLI joins the two exactly once. Plugin listings retain their required category, top-level artifacts use origin: "standalone", and child artifacts use origin: "bundled".

The HTTP endpoint validates and serializes this stored value. It does not normalize it a second time, guess missing metadata, or fall back to an older shape. A nonconforming bundle is not installable; its author must publish a new conforming version. See the InstallBundle reference.

Verified mirror source

Verified mirror PRs are created only when an AgentRig admin explicitly starts the mirror workflow for a listing. The mirror workflow serializes the listing's SDK InstallBundle into deterministic registry files and opens a signed PR against agentrig/agentrig-registry.

This repository is designed for transparency:

• public GitHub review of verified listings
• deterministic mirror output for offline browsing
• source, lock, review, README, and license files beside each mirrored version
• yanked mirror follow-up PRs when an already mirrored listing is later yanked or taken down

Mirror layout

The mirror serializes verified listings into this layout:

• registry.json
• plugins/<namespace>/<plugin>/plugin.json
• plugins/<namespace>/<plugin>/versions/<version>/
• plugins/<namespace>/<plugin>/versions/<version>/plugin.json
• plugins/<namespace>/<plugin>/versions/<version>/AGENTRIG_SOURCE.json
• plugins/<namespace>/<plugin>/versions/<version>/AGENTRIG_LOCK.json
• plugins/<namespace>/<plugin>/versions/<version>/AGENTRIG_REVIEW.json
• plugins/<namespace>/<plugin>/versions/<version>/README.md
• plugins/<namespace>/<plugin>/versions/<version>/LICENSE
• skills/<namespace>/<skill>/skill.json for standalone skill artifacts
• skills/<namespace>/<skill>/versions/<version>/
• mcps/<namespace>/<mcp>/mcp.json and mcps/<namespace>/<mcp>/versions/<version>/
• hooks/<namespace>/<hook>/hook.json and hooks/<namespace>/<hook>/versions/<version>/
• advisories.json

Mirrored plugin ids use:

namespace.plugin

Registry install refs use:

<registryAlias>/<namespace.plugin>

Example:

agentrig/agentrig.core-committer

The unversioned form asks AgentRig for the latest available listing. Append @<version> only for an explicit reproducibility or rollback pin. The CLI records the concrete resolved version, source commit, tree digest, file hashes, and scan digest in its install ledger after resolving the InstallBundle from agentrig.ai.

CLI behavior

The CLI resolves AgentRig registry refs through the agentrig.ai install-bundle endpoint. It verifies the fetched files against the bundle's content-addressed lock and rejects mismatches before writing the install ledger.

The CLI does not use the mirror as a fallback for arbitrary URL, ZIP, or author-repo installs. The mirror exists so users can inspect verified listing history outside the AgentRig app.