[github-actions]

Closes #1184. Submitted by @CharlieDigital.

Ready for artifact review. The reviewer will resolve the submitted source and complete the registry listing.

Submission: submissions/1184.json.
Git references are optional. Use a supplied reference; otherwise resolve main during review. Git updates are submitted manually.

[paseo-bot]

Agent profile packs approved and merged, @CharlieDigital. I completed the pinned registry record using your overview, description, and both interface images. The public listing is not available yet; nothing else is required from you.

Review data

• Policy: registry main REVIEW.md blob 8da1286fd8870c87ff53767e8644858627b7371f.

• Reviewed PR head: c0b6a196ebc05896a25e47c5babc25d5bb3ba918.

• Artifact: https://github.com/zeeq-ai/paseo-profiles.git, commit b1d6e67550d7b62d01312e19665ab183660bfc1e, repository root. The linked submission and commit author identify CharlieDigital; no tag was supplied. Downloaded archive SHA-256: 1016879bc7f65b99d5d4a5a258117663a853293b701455ae9c8d3d6b5e5eef61. Archive paths were inspected before extraction; no symlinks or submodules were included. The trusted pinning and validation tools independently checked the exact Git commit.

• Inspected both runtime entries, all 23 supporting client/server/shared modules, manifest, package metadata, lockfile, overview and media. Relative runtime imports resolve within the artifact. No translations are supplied.

• Preparation is npm ci --ignore-scripts. The version-3 package lock matches both dependency maps and pins all 396 installed packages to npm registry sources with integrity values. YAML is the runtime dependency; the other declared packages are development/host libraries. Lifecycle scripts are suppressed. No plugin code, build, dependency installation or tests were executed.

• Applying a pack requires a server-held preview followed by confirmation. Use replaces the full profile catalog and optionally the shared prompt; Add preserves unrelated profiles. Recovery snapshots are written before configuration changes, and changed observed configuration invalidates the preview. The disclosed cross-client race remains because the host API has no conditional write.

• Filesystem access covers the chosen library, its history/recovery state, a persistent daemon identity used for an origin hash, and user-selected import/export paths. Exports create new files rather than overwriting existing ones. Deletion is limited to selected library entries and plugin lock/state cleanup.

• Optional Gist transfers invoke installed gh with argument arrays and shell: false, using its existing GitHub authentication. Create sends the selected YAML, including notes and the shared prompt, to GitHub only after the explicit Create gist action and visible disclosure. Reads accept GitHub Gist IDs and parse returned YAML/JSON as data with size/depth limits; they do not execute imported content. No independent telemetry, remote-code execution or runtime software download was found in the inspected production code.

• Listing: added plugins/zeeq-ai/profiles.json and removed submissions/1184.json; retained category utils and submitter attribution. The artifact supplies its English description and OVERVIEW.md, so no registry fallback is needed. Both supplied PNG URLs returned HTTP 200 with image/png and were visually inspected.

• Trusted registry validation passed locally: 385 well-formed records, one changed record matching its pinned artifact. Runtime behavior, dependency internals and live UI/service integration were not executed or exhaustively audited.

• Publication: deployment completed and the deployed registry contains the reviewed record. The primary public listing endpoint still reports “Plugin not found”; public availability is pending.