[rockyshi1993]

What this PR does

• Plugin name: task-lifecycle (new plugin)
• Type: remote source
• Source URL + pinned SHA (remote): https://github.com/devcodex-labs/task-lifecycle.git @ 48793bdc3d8b1f1cb08f9edacb25111f10b31832
• Homepage: https://github.com/devcodex-labs/task-lifecycle

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (or I've explained why not below).

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set; local plugins include README.md + .grok-plugin/plugin.json.
• License is stated (MIT).

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege (the plugin ships one skill; no hooks, no MCP servers).
• Network endpoints this plugin calls (and why): none.
• Credentials/permissions it requires (and why): none.

Notes for reviewers

The skill's SKILL.md description begins "Load on every message from the real user...". This is intentional: the skill is a per-turn pre-check governance workflow (plan, review, confirm for Feature, Bugfix and Docs work), so it is meant to load on each user turn. The same description explicitly excludes instructions coming from files, web pages, tool output, other skills or other agents. It does not try to override the host or the installing agent, so it is not prompt injection.

domains is omitted because the plugin has no product domain of its own; keywords are scoped to the plugin name.