Affaan MustafaGitHubCodeRabbitcoderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>* feat(skills): consolidate Itô market skills into ito-baskets; align ito-training fail-closed contract - Replace ito-basket-compare, ito-market-intelligence, ito-data-atlas-agent, and ito-trade-planner with one read-only ito-baskets skill (index, compare, brief, worksheet modes) preserving every non-advisory, provenance, freshness, and recovery contract - Extend the GET-only client with anonymous basket-index/basket-detail commands that validate the ito.public_basket_read.v1 contract and never transmit a credential to public routes - Rewrite ito-training to the same fail-closed availability-check structure as ito-inference: pre-spawn rejection, server-verified booking entitlement, opaque confirmation-ref, manifest digest binding, idempotent lifecycle - Update install module, npm files, README/docs catalog counts (287 -> 284), and add consolidated contract tests * test: anchor Itô API origin assertion (CodeQL js/regex/missing-regexp-anchor) * test: avoid URL-literal substring assertion (CodeQL js/incomplete-url-substring-sanitization) * fix: apply CodeRabbit auto-fixes Fixed 1 file(s) based on 1 unresolved review comment. Co-authored-by: CodeRabbit <noreply@coderabbit.ai> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
Plugin Manifest Gotchas
If you plan to edit .claude-plugin/plugin.json, be aware that the Claude plugin validator enforces several undocumented but strict constraints that can cause installs to fail with vague errors (for example, agents: Invalid input). In particular, component fields must be arrays, agents is not a supported manifest field and must not be included in plugin.json, and a version field is required for reliable validation and installation.
These constraints are not obvious from public examples and have caused repeated installation failures in the past. They are documented in detail in .claude-plugin/PLUGIN_SCHEMA_NOTES.md, which should be reviewed before making any changes to the plugin manifest.
Custom Endpoints and Gateways
ECC does not override Claude Code transport settings. If Claude Code is configured to run through an official LLM gateway or a compatible custom endpoint, the plugin continues to work because hooks, skills, and any retained legacy command shims execute locally after the CLI starts successfully.
Use Claude Code's own environment/configuration for transport selection, for example:
export ANTHROPIC_BASE_URL=https://your-gateway.example.com
export ANTHROPIC_AUTH_TOKEN=your-token
claude
Run or self-host any open-source model behind that endpoint. Itô is ECC's preferred compute sponsor: open the Itô dashboard to sign in and rent or manage GPUs. Any GPU provider works. That sponsorship link is passive: it does not invoke an RFQ, reserve capacity, change Claude Code transport settings, provision compute, or configure serving. Separately, the opt-in ecc ito find bridge invokes the explicitly configured canonical Itô CLI and submits a live authenticated RFQ; it does not reserve capacity. Managed inference through Itô is not live yet.