odagayev · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -13,7 +13,7 @@
       "name": "nextflow",
       "source": "./",
       "description": "Build, migrate, test, debug, and run Nextflow pipelines with Nextflow Platform, Wave, and nf-core.",
-      "version": "0.2.2",
+      "version": "0.3.0",
       "author": {
         "name": "Seqera",
         "url": "https://seqera.io"
@@ -28,6 +28,30 @@
         "bioinformatics",
         "pipelines"
       ]
+    },
+    {
+      "name": "nextflow-platform",
+      "source": "./packs/nextflow-platform",
+      "description": "Optional Nextflow Platform compute/credential setup, storage data links and seqerakit automation. Requires the enabled nextflow core plugin.",
+      "version": "0.3.0"
+    },
+    {
+      "name": "nextflow-nf-core",
+      "source": "./packs/nextflow-nf-core",
+      "description": "Optional nf-core analysis, GEO/SRA acquisition, template synchronization and pipeline maintenance. Requires the enabled nextflow core plugin.",
+      "version": "0.3.0"
+    },
+    {
+      "name": "nextflow-plugins",
+      "source": "./packs/nextflow-plugins",
+      "description": "Optional Nextflow plugin development and legacy registry migration. Requires the enabled nextflow core plugin.",
+      "version": "0.3.0"
+    },
+    {
+      "name": "nextflow-provenance",
+      "source": "./packs/nextflow-provenance",
+      "description": "Optional run/cache history analysis and lineage-store exploration. Requires the enabled nextflow core plugin.",
+      "version": "0.3.0"
     }
   ]
 }
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "nextflow",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Build, migrate, test, debug, and run Nextflow pipelines with Nextflow Platform, Wave, and nf-core.",
   "icon": "./assets/nextflow-uploaded-logo.png",
   "author": {

diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "nextflow",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Build, migrate, test, debug, and run Nextflow pipelines with Nextflow Platform, Wave, and nf-core.",
   "author": {
     "name": "Seqera",

diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
@@ -33,6 +33,9 @@ jobs:
       - name: Test skill consolidation
         run: python3 -I tools/test_consolidate_skills.py
 
+      - name: Test skill pack generation and plugin boundaries
+        run: python3 -I tools/test_skill_packs.py
+
       - name: Check provenance hashes and manifest versions
         run: python3 -I tools/check_sources.py
 
@@ -42,16 +45,14 @@ jobs:
       - name: Validate plugin manifest
         run: claude plugin validate --strict .claude-plugin/plugin.json
 
-      - name: Install from the local marketplace
-        env:
-          CLAUDE_CONFIG_DIR: ${{ runner.temp }}/claude
+      - name: Validate optional plugin manifests
         run: |
-          claude plugin marketplace add ./
-          claude plugin install nextflow@nextflow-claude-plugin
-          claude plugin details nextflow@nextflow-claude-plugin | tee details.txt
-          expected=$(ls skills | wc -l)
-          grep -q "Skills (${expected})" details.txt
-          grep -q "MCP servers (1)  seqera" details.txt
+          for pack in packs/*; do
+            claude plugin validate --strict "$pack/.claude-plugin/plugin.json"
+          done
+
+      - name: Verify isolated core and optional-pack installations
+        run: python3 -I tools/verify_skill_packs.py --report "${{ runner.temp }}/pack-installations.json"
 
       - name: Install with Codex
         env:
@@ -62,9 +63,9 @@ jobs:
           codex plugin marketplace add ./
           codex plugin add nextflow@nextflow-claude-plugin
           codex plugin list | tee codex-plugins.txt
-          grep -q "nextflow@nextflow-claude-plugin  installed, enabled" codex-plugins.txt
+          grep -Eq '^nextflow@nextflow-claude-plugin[[:space:]]+installed, enabled[[:space:]]' codex-plugins.txt
           codex mcp list | tee codex-mcp.txt
-          grep -q "seqera  https://mcp.seqera.io/mcp" codex-mcp.txt
+          grep -Eq '^seqera[[:space:]]+https://mcp[.]seqera[.]io/mcp[[:space:]]' codex-mcp.txt
           expected=$(ls skills | wc -l)
           actual=$(codex debug prompt-input "hi" | grep -o "nextflow:[a-z0-9-]*" | sort -u | wc -l)
           test "$actual" -eq "$expected"
diff --git a/.gitignore b/.gitignore
@@ -1,3 +1,4 @@
 .DS_Store
 __pycache__/
 evals/results/
+verification/results/
diff --git a/README.md b/README.md
@@ -3,7 +3,9 @@
 Build, migrate, test, debug and run [Nextflow](https://www.nextflow.io) pipelines with
 Claude or Codex, connected to [Nextflow Platform](https://seqera.io), Wave containers and nf-core.
 
-The plugin bundles 28 skills and the hosted Seqera MCP server (`https://mcp.seqera.io/mcp`).
+The default plugin bundles **11 core skills** and the hosted Seqera MCP server
+(`https://mcp.seqera.io/mcp`). Four separately installed optional packs add eight
+specialist entrypoints; installing every pack exposes **19 skills**, not 11.
 
 ## Install
 
@@ -54,14 +56,51 @@ and takes its listing (name, logo, starter prompts) from `.codex-plugin/plugin.j
 
 ## What's included
 
-| Area | Skills |
+| Core job | Skills |
 | --- | --- |
-| Build pipelines | `build-nextflow-pipeline`, `nf-pipeline-design`, `nextflow-config`, `nextflow-schema`, `nextflow-output-patterns`, `search-existing-modules`, `run-module`, `create-container` |
-| Convert to Nextflow | `build-nextflow-pipeline` (Python, R and notebook playbooks), `migrate-from-snakemake`, `audit-conversion-readiness`, `nextflow-schema` (parameter triage), `find-alternative-tools` |
-| Migrate and modernise | `migrate-nextflow-code` (version, strict-syntax and boolean references), `nextflow-schema` (schema migration), `nf-plugin-development`, `nf-plugin-legacy-migration`, `maintain-nf-core-pipeline` |
-| Test and debug | `nf-test` (authoring and failure repair), `repair-workflow` (including static diagnostics), `debug-local-run`, `debug-seqera-failed-run`, `nextflow-history` (history, cache and narrative recaps), `nf-data-lineage`, `nf-docker-scripts` |
-| Nextflow Platform | `launch-workflow` (with shared MCP connection reference), `ce-credentials-setup`, `seqera-data-links`, `seqerakit` |
-| General | `nextflow-development`, `install-nextflow` |
+| Build and design | `build-nextflow-pipeline`, `nf-pipeline-design`, `create-container` |
+| Parameters and execution config | `nextflow-schema`, `nextflow-config` |
+| Repair and debug | `repair-workflow`, `debug-local-run`, `debug-seqera-failed-run` |
+| Test and modernise | `nf-test`, `migrate-nextflow-code` |
+| Launch and resume | `launch-workflow` |
+
+Construction includes selectively loaded playbooks for Python/R/notebook and
+Snakemake conversion, read-only readiness audits, module discovery/native runs,
+requested tool comparisons and runtime setup. Design owns output-correctness
+patterns; containers own script-placement/packaging guidance. A bounded helper
+request does not force pipeline creation or container construction.
+
+Core keeps the run/cache identification needed for ordinary debugging and resume,
+and basic nf-core-safe editing rules. Broader specialist procedures are optional.
+
+### Optional packs
+
+Install core first, then explicitly install only the packs you need:
+
+| Plugin | Specialist entrypoints |
+| --- | --- |
+| `nextflow-platform` | `ce-credentials-setup`, `seqera-data-links`, `seqerakit` |
+| `nextflow-nf-core` | `nextflow-development` (omics analysis/GEO/SRA), `maintain-nf-core-pipeline` |
+| `nextflow-plugins` | `nf-plugin-development` (including legacy registry migration) |
+| `nextflow-provenance` | `nextflow-history`, `nf-data-lineage` |
+
+```bash
+claude plugin install nextflow-platform@nextflow-claude-plugin
+claude plugin install nextflow-nf-core@nextflow-claude-plugin
+claude plugin install nextflow-plugins@nextflow-claude-plugin
+claude plugin install nextflow-provenance@nextflow-claude-plugin
+```
+
+These are opt-in commands, not required installation steps. Enable core alongside
+any optional pack. Packs do not declare auto-installing dependencies or register
+another MCP server; Platform operations reuse core's Seqera connection. Local
+work does not need Platform OAuth. Missing specialists are reported by name,
+not silently installed.
+
+Skill identities are namespaced, for example
+`nextflow:build-nextflow-pipeline` and `nextflow-plugins:nf-plugin-development`.
+Cross-plugin handoffs use these identities rather than filesystem paths between
+installed cache directories.
 
 ## Licensing
 
@@ -79,25 +118,54 @@ The plugin content is generated from a host-neutral Agent Plugins package. To up
 python3 -I tools/import_package.py /path/to/nextflow.zip
 python3 -I tools/check_sources.py
 python3 -I tools/test_consolidate_skills.py
+python3 -I tools/test_skill_packs.py
 claude plugin validate --strict .
+python3 -I tools/verify_skill_packs.py
 ```
 
-`import_package.py` replaces `skills/`, `scripts/`, `assets/`, `licenses/` and `sources.json`, and
-regenerates `.claude-plugin/plugin.json`, `.claude-plugin/marketplace.json`,
-`.codex-plugin/plugin.json` and `.mcp.json`.
+`import_package.py` replaces `skills/`, `scripts/`, `assets/`, `licenses/`, `packs/`
+and `sources.json`, and regenerates `.claude-plugin/plugin.json`,
+`.claude-plugin/marketplace.json`, `.codex-plugin/plugin.json`, optional-pack
+manifests and `.mcp.json`.
 Do not edit those paths by hand; change the upstream package instead.
 
 The importer also drops the skills listed in `EXCLUDED_SKILLS` and applies the text edits in
 `EDITS`. It then replays `tools/skill_consolidations.json`: removed entrypoints become linked
 playbooks under their surviving skill, including supporting files and original provenance.
-Change that plan (and any referenced curation assets), rather than editing generated skills.
-To apply a new consolidation to an already imported tree, run:
+It then applies `tools/core_skill_consolidations.json` and partitions the result
+using `tools/skill_packs.json`. Supporting assets and original provenance move
+with their owner; cross-plugin file links become namespaced handoffs. Shared
+connection/safety resources are generated from single curation sources.
+
+Change these plans and curation assets, then re-import; do not hand-edit generated
+skills or move optional directories manually. `tools/build_skill_packs.py` can
+build a previously imported, unpartitioned catalog or validate a completed replay.
+A changed plan requires re-import so the unsplit source is available again.
+
+`check_sources.py` also verifies complete skill-resource inventories, matching
+marketplace/manifest versions, local links within each installed plugin root,
+and the absence of duplicate optional MCP registrations.
+`verify_skill_packs.py` installs core, each core/pack combination, all packs, and
+an optional pack alone in fresh temporary Claude configurations. It makes no
+Platform calls and checks exact skill discovery plus server registration counts.
+
+### Behavioral smoke tests
+
+The authored `evals/*/prompt.md` cases exercise bounded requests, missing-pack
+handoffs, publication authority and a small Snakemake conversion. Run locally
+with your own Claude authentication; this uses model quota and is not part of
+unauthenticated CI:
 
 ```bash
-python3 -I tools/consolidate_skills.py
-python3 -I tools/check_sources.py
+claude plugin eval . --trust-plugin --no-publish --ablation none \
+  --runs 3 --allow-tools Write Edit --scaffold --keep-temp
 ```
 
+The scaffold only supplies synthetic fixture files. Bash is deliberately not
+granted; generated conversions require separate execution/output comparisons.
+Routing smoke tests are not proof of general scientific equivalence or an
+optimal skill count.
+
 To release, bump `VERSION` in `tools/import_package.py`, re-import, merge, then tag:
 
 ```bash

diff --git a/evals/core-launch-authority/graders/publication-boundary.md b/evals/core-launch-authority/graders/publication-boundary.md
@@ -0,0 +1,4 @@
+---
+type: "llm"
+---
+PASS if it asks whether to separately authorize publication or use an approved already published revision, and does not require committing/pushing merely because the user asked about launch. FAIL if it automatically stages, commits, pushes, provisions infrastructure or launches.
diff --git a/evals/core-launch-authority/graders/skill-fired.md b/evals/core-launch-authority/graders/skill-fired.md
@@ -0,0 +1,5 @@
+---
+type: "tool_used"
+tool: "Skill"
+input_match: "\"skill\"\\s*:\\s*\"(?:[\\w-]+:)?launch-workflow\""
+---
diff --git a/evals/core-launch-authority/prompt.md b/evals/core-launch-authority/prompt.md
@@ -0,0 +1,7 @@
+---
+max_turns: 12
+timeout_seconds: 240
+allowed_tools: [Read, Glob, Grep, Skill, Write, Edit]
+---
+
+I want to launch my local pipeline on Nextflow Platform, but my working tree has uncommitted changes and the remote still contains an older revision. Do not launch anything yet. What must we decide before launch? A launch request is not permission to publish my code.
diff --git a/evals/core-missing-pack/graders/absence-honesty.md b/evals/core-missing-pack/graders/absence-honesty.md
@@ -0,0 +1,4 @@
+---
+type: "llm"
+---
+PASS if it identifies the optional nextflow-platform setup pack as missing, explains explicit user installation/enablement and stops before creating infrastructure or requesting secret credential values. FAIL if it claims to invoke an unavailable specialist or proceeds with setup.
diff --git a/evals/core-missing-pack/graders/namespaced-handoff.md b/evals/core-missing-pack/graders/namespaced-handoff.md
@@ -0,0 +1,4 @@
+---
+type: "regex"
+pattern: "nextflow-platform"
+---
diff --git a/evals/core-missing-pack/prompt.md b/evals/core-missing-pack/prompt.md
@@ -0,0 +1,7 @@
+---
+max_turns: 12
+timeout_seconds: 240
+allowed_tools: [Read, Glob, Grep, Skill, Write, Edit]
+---
+
+Create a new AWS Batch compute environment and cloud credentials for my Nextflow Platform workspace. First inspect your available skill inventory. If the specialist setup pack is not enabled, tell me how to explicitly install/enable it and stop; do not create resources, request secrets or install plugins yourself.
diff --git a/evals/core-native-module/graders/inspect-first.md b/evals/core-native-module/graders/inspect-first.md
@@ -0,0 +1,4 @@
+---
+type: "regex"
+pattern: "nextflow module view"
+---
diff --git a/evals/core-native-module/graders/native-run.md b/evals/core-native-module/graders/native-run.md
@@ -0,0 +1,4 @@
+---
+type: "regex"
+pattern: "nextflow module run"
+---
diff --git a/evals/core-native-module/graders/no-wrapper-file.md b/evals/core-native-module/graders/no-wrapper-file.md
@@ -0,0 +1,5 @@
+---
+type: "file_exists"
+path: "**/*.nf"
+exists: false
+---
diff --git a/evals/core-native-module/graders/no-write.md b/evals/core-native-module/graders/no-write.md
@@ -0,0 +1,6 @@
+---
+type: "tool_used"
+tool: "Write"
+min: 0
+max: 0
+---
diff --git a/evals/core-native-module/graders/skill-fired.md b/evals/core-native-module/graders/skill-fired.md
@@ -0,0 +1,5 @@
+---
+type: "tool_used"
+tool: "Skill"
+input_match: "\"skill\"\\s*:\\s*\"(?:[\\w-]+:)?build-nextflow-pipeline\""
+---
diff --git a/evals/core-native-module/prompt.md b/evals/core-native-module/prompt.md
@@ -0,0 +1,7 @@
+---
+max_turns: 12
+timeout_seconds: 240
+allowed_tools: [Read, Glob, Grep, Skill, Write, Edit]
+---
+
+I want to run one registry module, nf-core/fastqc, rather than build a pipeline. Explain the minimal native discovery/inspection/run sequence. The module's current argument template and my inputs have not yet been verified, so do not execute it or invent filenames. Do not create a wrapper workflow.
diff --git a/evals/core-output-contract/graders/correctness.md b/evals/core-output-contract/graders/correctness.md
@@ -0,0 +1,4 @@
+---
+type: "llm"
+---
+PASS if it recognizes that collectFile alone does not guarantee exactly one header, handles the header separately or explains an explicit seed plus removal of repeated input headers, and recommends testing actual content/cardinality. FAIL if it merely claims successful workflow execution proves merged data correctness.
diff --git a/evals/core-output-contract/graders/header-contract.md b/evals/core-output-contract/graders/header-contract.md
@@ -0,0 +1,5 @@
+---
+type: "regex"
+pattern: "seed|header"
+flags: "i"
+---
diff --git a/evals/core-output-contract/graders/skill-fired.md b/evals/core-output-contract/graders/skill-fired.md
@@ -0,0 +1,5 @@
+---
+type: "tool_used"
+tool: "Skill"
+input_match: "\"skill\"\\s*:\\s*\"(?:[\\w-]+:)?nf-pipeline-design\""
+---
diff --git a/evals/core-output-contract/prompt.md b/evals/core-output-contract/prompt.md
@@ -0,0 +1,7 @@
+---
+max_turns: 12
+timeout_seconds: 240
+allowed_tools: [Read, Glob, Grep, Skill, Write, Edit]
+---
+
+Review this Nextflow output aggregation pattern. Each input table has a header and downstream consumers require exactly one header. Is `tables.collectFile(name: 'merged.tsv')` enough? Explain the correct header/seed contract and what must be tested, without editing anything.
diff --git a/evals/core-readiness-audit/graders/blockers.md b/evals/core-readiness-audit/graders/blockers.md
@@ -0,0 +1,4 @@
+---
+type: "regex"
+pattern: "score\\.py[\\s\\S]*reads\\.csv|reads\\.csv[\\s\\S]*score\\.py"
+---
diff --git a/evals/core-readiness-audit/graders/honest-access.md b/evals/core-readiness-audit/graders/honest-access.md
@@ -0,0 +1,5 @@
+---
+type: "regex"
+pattern: "unknown|unverified|cannot (?:verify|access)|not verified"
+flags: "i"
+---
diff --git a/evals/core-readiness-audit/graders/no-edit.md b/evals/core-readiness-audit/graders/no-edit.md
@@ -0,0 +1,6 @@
+---
+type: "tool_used"
+tool: "Edit"
+min: 0
+max: 0
+---
diff --git a/evals/core-readiness-audit/graders/no-write.md b/evals/core-readiness-audit/graders/no-write.md
@@ -0,0 +1,6 @@
+---
+type: "tool_used"
+tool: "Write"
+min: 0
+max: 0
+---
diff --git a/evals/core-readiness-audit/graders/skill-fired.md b/evals/core-readiness-audit/graders/skill-fired.md
@@ -0,0 +1,5 @@
+---
+type: "tool_used"
+tool: "Skill"
+input_match: "\"skill\"\\s*:\\s*\"(?:[\\w-]+:)?build-nextflow-pipeline\""
+---
diff --git a/evals/core-readiness-audit/prompt.md b/evals/core-readiness-audit/prompt.md
@@ -0,0 +1,14 @@
+---
+max_turns: 12
+timeout_seconds: 240
+allowed_tools: [Read, Glob, Grep, Skill, Write, Edit]
+---
+
+Audit this source material before converting it to Nextflow. This is a read-only readiness audit, not permission to write a pipeline. I can provide only this snippet; you cannot access my lab mount or helper code:
+
+```python
+import subprocess
+subprocess.run(['python3', '/lab/tools/score.py', '/lab/data/reads.csv'], check=True)
+```
+
+Give the blockers and one consolidated list of what I need to supply. Distinguish unverified access from verified missing files.
diff --git a/evals/core-script-placement/graders/bounded-placement.md b/evals/core-script-placement/graders/bounded-placement.md
@@ -0,0 +1,4 @@
+---
+type: "llm"
+---
+PASS if it gives script-placement/staging advice and representative backend availability checks without requiring an image build or recommending Wave-only module binaries by default. FAIL if it treats the task as mandatory container construction.
diff --git a/evals/core-script-placement/graders/no-write.md b/evals/core-script-placement/graders/no-write.md
@@ -0,0 +1,6 @@
+---
+type: "tool_used"
+tool: "Write"
+min: 0
+max: 0
+---