fix(plugins): materialize plugins as real files instead of symlinks

.cspell.json

@@ -25,6 +25,7 @@
     "CHANGELOG.md",
     "logs/**",
     ".copilot-tracking/**",
+    "plugins/**",
     "docs/docusaurus/build/**",
     "docs/docusaurus/coverage/**",
     "dependency-pinning-artifacts/**",

.github/codeql/codeql-config.yml

@@ -0,0 +1,10 @@
+# Copyright (c) 2026 Microsoft Corporation. All rights reserved.
+# SPDX-License-Identifier: MIT
+name: "HVE Core CodeQL config"
+
+# The plugins/ tree is auto-generated: every file is a verbatim copy of an
+# already-scanned source under .github/ (agents, prompts, instructions,
+# skills, scripts). Scanning the copies only duplicates alerts, so exclude
+# the generated tree from analysis.
+paths-ignore:
+  - plugins

.github/workflows/codeql-analysis.yml

@@ -39,6 +39,7 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           queries: security-extended,security-and-quality
+          config-file: ./.github/codeql/codeql-config.yml
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0

.github/workflows/dependency-review.yml

@@ -37,6 +37,7 @@ jobs:
         if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
         uses: advanced-security/component-detection-dependency-submission-action@31f25a8de68ae5ce2ca274bc28546a78683c15ce # v0.1.4
         with:
+          directoryExclusionList: '**/plugins/**'
           detectorArgs: 'UvLock=EnableIfDefaultOff'
 
       - name: Dependency Review

.github/workflows/plugin-package.yml

@@ -77,6 +77,9 @@ jobs:
                   mkdir -p logs
                   npm run plugin:generate
 
+            - name: Validate generated plugins
+              run: npm run plugin:validate
+
             - name: Package plugin directory
               shell: bash
               run: |
@@ -87,7 +90,16 @@ jobs:
                   fi
 
                   mkdir -p dist/plugins
-                  zip -r "dist/plugins/${{ matrix.id }}.zip" "$plugin_dir"
+                  archive_path="dist/plugins/${{ matrix.id }}.zip"
+                  zip -r "$archive_path" "$plugin_dir"
+
+                  if ! zipinfo -l "$archive_path" | awk '
+                    $1 ~ /^[bcdlps-][rwx-]{9}$/ && $1 !~ /^[-d]/ { invalid = 1 }
+                    END { exit invalid }
+                  '; then
+                    echo "::error::Archive contains a non-regular entry: $archive_path"
+                    exit 1
+                  fi
 
             - name: Upload plugin artifact
               uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/plugin-validation.yml

@@ -41,18 +41,17 @@ jobs:
       - name: Create logs directory
         run: mkdir -p logs
 
-      - name: Validate collection metadata
-        run: npm run lint:collections-metadata
-
-      - name: Validate marketplace manifest
-        run: npm run lint:marketplace
-
       - name: Validate hook manifests
         run: npm run lint:hooks
 
+      - name: Generate plugins
+        run: npm run plugin:generate
+
+      - name: Validate generated plugins
+        run: npm run plugin:validate
+
       - name: Check plugin freshness
         run: |
-          npm run plugin:generate
           if ! git diff --quiet plugins/; then
             echo "::error::Plugins out of date. Run 'npm run plugin:generate' and commit."
             if [ "${{ inputs.soft-fail }}" != "true" ]; then

.github/workflows/pr-validation.yml

@@ -74,7 +74,7 @@ jobs:
           # torch/detoxify stack and runs weekly via weekly-validation.yml,
           # so it is excluded from per-PR Python matrix jobs here.
           $projectList = @(Get-ChildItem -Recurse -Force -Filter pyproject.toml |
-            Where-Object { $_.FullName -notmatch 'node_modules' -and $_.FullName -notmatch 'evals[\\/]+moderation' } |
+            Where-Object { $_.FullName -notmatch 'node_modules' -and $_.FullName -notmatch 'evals[\\/]+moderation' -and $_.FullName -notmatch 'plugins' } |
             ForEach-Object { Resolve-Path -Relative $_.DirectoryName } |
             ForEach-Object { $_ -replace '^\.[\\/]', '' } |
             Sort-Object)

codecov.yml

@@ -46,6 +46,7 @@ coverage:
 ignore:
   - "scripts/tests/**"
   - "logs/**"
+  - "plugins/**"
 
 comment:
   layout: "reach,diff,flags,files"

docs/architecture/ai-artifacts.md

@@ -3,7 +3,7 @@ title: AI Artifacts Architecture
 description: Prompt, agent, and instruction delegation model for Copilot customizations
 sidebar_position: 2
 author: Microsoft
-ms.date: 2026-06-10
+ms.date: 2026-07-10
 ms.topic: concept
 ---
 
@@ -379,7 +379,7 @@ Each collection produces two distributable outputs from the same codebase: a VS
 | Installer        | `ise-hve-essentials.hve-installer`        | HVE Core installation and setup                |
 | Experimental     | `ise-hve-essentials.hve-experimental`     | Early-stage artifacts under active iteration   |
 
-The VS Code extension is built with `Prepare-Extension.ps1` and `Package-Extension.ps1`, parameterized by collection manifest. The Copilot CLI plugin is generated by `npm run plugin:generate`, which creates symlink-based plugin structures under `plugins/{collection-id}/`. Both outputs derive their artifact lists from the same `collections/*.collection.yml` source of truth.
+The VS Code extension is built with `Prepare-Extension.ps1` and `Package-Extension.ps1`, parameterized by collection manifest. The Copilot CLI plugin is generated by `npm run plugin:generate`, which copies each declared artifact into a self-contained plugin package under `plugins/{collection-id}/`. Both outputs derive their artifact lists from the same `collections/*.collection.yml` source of truth.
 
 Users install the collection matching their role for a curated experience. The **Core** extension provides the RPI workflow essentials, while the **Full** extension aggregates artifacts from all stable and preview collections.
 

docs/customization/build-system.md

@@ -2,7 +2,7 @@
 title: Build System and Validation
 description: Understand the plugin generation pipeline, schema validation system, npm scripts, and CI checks for customizing and extending HVE Core
 author: Microsoft
-ms.date: 2026-06-27
+ms.date: 2026-07-10
 ms.topic: how-to
 keywords:
   - build system
@@ -36,6 +36,12 @@ npm run plugin:generate
 > Files under `plugins/` are generated output. Do not edit them directly.
 > Changes made to plugin files are overwritten on the next generation run.
 
+Because every file under `plugins/` is a copy of an already-validated source under
+`.github/`, the generated tree is excluded from source-level checks that would otherwise
+re-scan the copies (spell check, CodeQL, Python project discovery for tests, fuzzing, and
+pip-audit, and code coverage). Validation of the generated output is handled by
+`plugin:validate` and `lint:marketplace` instead.
+
 ## Schema Validation System
 
 YAML frontmatter in markdown files is validated against JSON schemas stored in

package.json

@@ -15,7 +15,7 @@
     "lint:ps": "pwsh -File scripts/linting/Invoke-PSScriptAnalyzer.ps1",
     "lint:yaml": "pwsh -File scripts/linting/Invoke-YamlLint.ps1",
     "lint:json": "pwsh -File scripts/linting/Invoke-JsonLint.ps1",
-    "lint:links": "pwsh -NoProfile -Command \"& scripts/linting/Invoke-LinkLanguageCheck.ps1 -ExcludePaths 'scripts/tests/**'\"",
+    "lint:links": "pwsh -NoProfile -Command \"& scripts/linting/Invoke-LinkLanguageCheck.ps1 -ExcludePaths 'scripts/tests/**','plugins/**'\"",
     "lint:md-links": "pwsh -File scripts/linting/Markdown-Link-Check.ps1",
     "lint:frontmatter": "pwsh -NoProfile -Command \"& './scripts/linting/Validate-MarkdownFrontmatter.ps1' -WarningsAsErrors -EnableSchemaValidation\"",
     "lint:adr-consistency": "pwsh -NoProfile -File scripts/linting/Validate-AdrConsistency.ps1 -Paths docs/planning/adrs",
@@ -57,7 +57,7 @@
     "test:node": "node --test",
     "plugin:postprocess": "markdownlint-cli2 \"plugins/**/*.md\" \"collections/*.md\" --fix && markdown-table-formatter \"plugins/**/*.md\" && markdown-table-formatter \"collections/*.md\"",
     "plugin:generate": "pwsh -File scripts/plugins/Generate-Plugins.ps1 && npm run plugin:postprocess",
-    "plugin:validate": "npm run lint:collections-metadata",
+    "plugin:validate": "npm run lint:collections-metadata && npm run lint:marketplace",
     "clean:logs": "pwsh -NoProfile -Command \"Get-ChildItem -Path logs -File -Recurse -Exclude .gitkeep | Remove-Item -Force\"",
     "docs:build": "npm --prefix docs/docusaurus run build",
     "docs:test": "npm --prefix docs/docusaurus test",