# Coding-agent workflow

The scaffolded `PLUGIN_TASK.md` is the functional contract. It pins runtime,
permissions, contributions, connections, settings, secret names, mappings,
jobs, synthetic fixtures, versions, schema, template digest, and checks.

Give an agent the complete project plus this exact kit. Do not provide a live
vault, private notes, credentials, real Jira responses, or real CSV data. Use
the synthetic fixture host from `@thortiq/plugin-sdk/testing` and mocked
transports.

Before handoff back to Thortiq:

1. review the exact changed files;
2. run validate, tests, typecheck, build, and package as applicable;
3. confirm no application-internal imports or ambient network/filesystem paths;
4. review permission and origin changes; and
5. install or link only the validated prebuilt output.

Transfer is not installation authority. If an adapter is unavailable, transfer
is cancelled, or the agent stops part-way through, retain the complete local
project and resume from the pinned `PLUGIN_TASK.md`. Revalidate all returned
files before any separate link/install/trust review. See
[development-lifecycle.md](development-lifecycle.md) for the exact recovery and
confirmation boundaries.
