Package BCQuality as an installable plugin (experiment) (#84)

* Package BCQuality as an installable plugin (experiment)

Adds a marketplace + plugin manifest and a bridge review skill that drives the existing Entry protocol from a plugin host. No changes to knowledge or routing logic.

* Bridge skill: make enabled-layers configurable; note layer-pruning limit and manifest choice

Addresses PR #84 review (JesperSchulz): #2 layer policy has no hook in the plugin path -> expose BCQUALITY_ENABLED_LAYERS and document that it narrows discovery only, not a hard deny; #3 document the .claude-plugin manifest choice (verified on Copilot CLI).

---------

Co-authored-by: wenjiefan <wenjiefan@microsoft.com>

.claude-plugin/marketplace.json

@@ -0,0 +1,15 @@
+{
+  "name": "bcquality",
+  "owner": {
+    "name": "microsoft/BCQuality",
+    "url": "https://github.com/microsoft/BCQuality"
+  },
+  "plugins": [
+    {
+      "name": "bcquality",
+      "source": "./",
+      "description": "Business Central AL quality knowledge base and review skills, packaged as an installable plugin. Ships the entire BCQuality tree (skills, knowledge, tools) so the Entry routing protocol runs against the installed clone.",
+      "version": "0.1.0"
+    }
+  ]
+}

.claude-plugin/plugin.json

@@ -0,0 +1,9 @@
+{
+  "name": "bcquality",
+  "description": "Quality skills and knowledge for Business Central development. Exposes a review bridge skill that drives the BCQuality Entry protocol over the installed knowledge base.",
+  "version": "0.1.0",
+  "author": {
+    "name": "microsoft/BCQuality",
+    "url": "https://github.com/microsoft/BCQuality"
+  }
+}

skills/bcquality-al-review/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: bcquality-al-review
+description: Review Business Central AL code changes using the BCQuality knowledge base. Use when reviewing an AL pull request, a working-tree diff, or a single AL file, and you want findings backed by BCQuality's curated, BC-specific quality rules.
+---
+
+# BCQuality AL review
+
+This skill drives the BCQuality **Entry protocol** over the knowledge base that ships
+inside this plugin. It is the plugin entry point for consumers (orchestrators, CLIs)
+that do not already know BCQuality's internal conventions — the only convention they
+need is "invoke this skill for an AL review."
+
+BCQuality itself is orchestrator-agnostic content: knowledge files plus routing and
+action skills. This bridge is the thin consumer glue that lets a plugin host run that
+content without hardcoding BCQuality's layout.
+
+## When to use
+
+- Reviewing an AL pull request or an uncommitted working-tree diff.
+- Reviewing a single AL file.
+- Any task whose goal is "review Business Central / AL code for quality issues."
+
+Do **not** use this skill to *generate* AL code — it only reviews.
+
+## Plugin root
+
+Resolve `PLUGIN_ROOT` to the directory that contains this plugin's
+`.claude-plugin/plugin.json`. This skill lives at
+`PLUGIN_ROOT/skills/bcquality-al-review/SKILL.md`, so `PLUGIN_ROOT` is two levels up
+from this file. All paths below are relative to `PLUGIN_ROOT`. If the host exposes a
+plugin-root environment variable, prefer it.
+
+## Steps
+
+1. **Refresh the knowledge index (best effort).** If `pwsh` is available, run
+   `pwsh PLUGIN_ROOT/tools/Build-KnowledgeIndex.ps1` from `PLUGIN_ROOT` to (re)generate
+   `PLUGIN_ROOT/knowledge-index.json` over the installed tree. This is a discovery
+   accelerator only — if `pwsh` is missing or the build fails, continue; the review
+   skills fall back to path-based discovery.
+
+2. **Run Entry.** Read `PLUGIN_ROOT/skills/entry.md` and execute it against a
+   task context describing the review:
+
+   ```yaml
+   task-context:
+     goal: "Review the AL changes for quality issues"
+     inputs-available: [pr-diff]        # or [file-path] for single-file review
+     technologies: [al]
+     enabled-layers: [microsoft, community, custom]   # see "Layer selection" below
+   ```
+
+   **Layer selection.** `enabled-layers` defaults to all three layers. A host can
+   narrow it by setting the `BCQUALITY_ENABLED_LAYERS` environment variable to a
+   comma-separated subset (e.g. `microsoft` or `microsoft,community`); when set, pass
+   exactly those layers instead of the default. This is the plugin path's only knob
+   for layer policy — see the limitation in Notes.
+
+   Fill `bc-version`, `countries`, and `application-area` only when the caller
+   supplies them; omit them otherwise (an omitted dimension is unconstrained).
+
+3. **Follow the dispatch record.** Entry returns a dispatch record naming the action
+   skill(s) to invoke — for a PR review this is normally
+   `microsoft/skills/review/al-code-review.md`. For each dispatched skill, read the
+   file and execute its Source → Relevance → Worklist → Action steps, reading
+   `PLUGIN_ROOT/skills/read.md` and `PLUGIN_ROOT/skills/do.md` on demand.
+
+4. **Emit findings.** Produce the rolled-up findings report in the DO output contract
+   (`outcome`, `findings`, `references`, `confidence`, `suppressed`). Do not invent a
+   different shape; downstream consumers parse the DO contract without skill-specific
+   logic.
+
+If Entry returns `no-match` or `failed`, return the dispatch record unchanged so the
+caller can log the reason.
+
+## Notes
+
+- This skill adds nothing to BCQuality's knowledge or routing logic; it only bootstraps
+  the existing Entry protocol from a plugin host. Knowledge and skill changes belong in
+  the layers under `PLUGIN_ROOT/microsoft/`, `PLUGIN_ROOT/community/`, and
+  `PLUGIN_ROOT/custom/`, not here.
+- **Layer pruning is coarser than the URL/clone model.** In the clone model a consumer
+  prunes its checkout to policy *before* the agent runs, and the knowledge index is
+  rebuilt over the pruned tree, so a denied layer can never leak into discovery. A
+  plugin install ships the whole tree, so this bridge can only *narrow discovery* via
+  `enabled-layers` (`BCQUALITY_ENABLED_LAYERS`) — the denied layers' files still exist on
+  disk. Treat `enabled-layers` as a selection filter, not a hard security boundary. A
+  future revision could add a genuine deny mechanism (e.g. pruning the installed tree).
+- **Manifest location.** This plugin uses `.claude-plugin/plugin.json`, which both
+  Claude Code and Copilot CLI accept (verified with Copilot CLI: `plugin install`
+  reports the bridge skill loaded). Copilot CLI also accepts a root `plugin.json`; if a
+  future host only reads the root form, dual-home the manifest.