Add oh-my-grok-build plugin

[duarbdhks]

What this PR does

Adds one new remote-source entry for oh-my-grok-build, a content-only plugin that layers a plan → execute → independently-verify discipline on top of Grok Build's native plan mode, subagents, worktrees, and workflows. It ships seven skills (/ogb-interview, /ogb-plan, /ogb-start, /ogb-ultrawork, /ogb-verify, /ogb-workflow, /ogb-doctor) and six role agents.

• Plugin name: oh-my-grok-build
• Type: remote source
• Source URL + pinned SHA: https://github.com/duarbdhks/oh-my-grok-build.git @ d41356cdbd0a8ddf01c0788626612ddaaa1ef9ba (subdirectory plugins/oh-my-grok-build)
• Homepage: https://github.com/duarbdhks/oh-my-grok-build

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (or I've explained why not below).

This is an independent community plugin, not a branded product, so there is no official org behind it. See "Notes for reviewers".

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set.
• License is stated (MIT, LICENSE at the repo root).

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.

• No reading/exfiltration of secrets, tokens, .env, or env vars.

• Hooks and MCP scope are least-privilege.

• Network endpoints this plugin calls (and why): none. The plugin is Markdown only.

• Credentials/permissions it requires (and why): none.

The plugin ships no hooks, no .mcp.json, no .lsp.json, no binaries, and no npm runtime dependencies. Its own CI asserts those absences on every commit, and its AGENTS.md forbids adding them without an accepted architecture decision. The only executable in the repo is a dependency-free Node validator under scripts/, which is never installed or run by the plugin — it is repository tooling.

ogb-doctor reads configuration to report readiness and is explicitly instructed never to print secret values. All skills default to read-only and never commit, push, or open PRs without an explicit user request.

Notes for reviewers

Why a personal-account source. oh-my-grok-build is an independent community plugin in the oh-my-* tradition, not a branded product from a company, so there is no official org to publish it under. It claims no affiliation with xAI; NOTICE.md states this and the README repeats it. If sourcing from a personal account is disqualifying, I'm happy to close this and keep it as a third-party marketplace.

Pin history. Latest bump: d41356c — records live Grok evidence for the three remaining /ogb-ultrawork scheduling scenarios in English and Korean: serial execution for integration tests sharing one file-backed database and TCP port, one six-executor worktree wave for isolated subsystem tasks, and native-workflow selection for eight repetitive tasks. It also documents the observed unattended headless auto permission limitation and the successful explicitly approved bounded retry. No runtime component or dependency was added.

Verification performed. Every skill was exercised in a live Grok Build 0.2.112 session:

Skill	Evidence
/ogb-doctor	Full readiness table; all skills and six agents resolved
/ogb-plan	Planner → Architect (REVISE) → Critic (APPROVE) consensus loop
/ogb-ultrawork	Scenario C: 3 parallel explorers; A: 3 independent worktree executors; D: two passing shared-database/port tests serialized with timestamp proof; E: 6 isolated worktree executors launched in one wave and integrated; F: native workflow selected instead of direct 8-agent fan-out, validate_only passed, and 8/8 logical agents completed with agent_budget=8
/ogb-start	Two worktree executors; runtime acceptance evidence; no commit or push
/ogb-verify	Independent verifier plus bundled check-work; zero files modified
/ogb-workflow	Minimal Rhai workflow live-ran successfully (complete, agents_used=1, OGB_LIVE_OK) and its missing args.target branch blocked before dispatch (agents_used=0) with an actionable pause message
/ogb-interview	Two headless runs against a throwaway Express app; explored the repo before asking, one question per turn, working tree untouched

The chain from /ogb-interview through /ogb-verify was also run continuously inside one session, which covers the handoffs between skills rather than each skill alone.

Still unverified (recorded in docs/validation.md): worktree merge conflict handling, session-boundary plan restore messaging, saved workflow loading through script_path, budget-exhaustion and parallel-slot workflow branches, scheduling scenarios B/B2, and a command-level non-blocking shell primitive.

Static checks: npm test (176 checks) and grok plugin validate both pass. The new scheduling evidence also passed Ralph architectural review and an UltraQA matrix covering repeated validators, documentation assertions, prompt-injection resistance, bounded fan-out, false-success detection, and cleanup. CI runs the repository validator on every push.

Prior art. The workflow discipline is inspired by oh-my-claudecode (MIT), but this is a clean-room implementation for Grok Build's native extension interfaces. No upstream runtime, hooks, state engine, or prompts were vendored. NOTICE.md records the attribution.