[thesprockee]

PR 1 of 3 of Spritz's order for echo-mods (schema, then AGENTS.md and CI gates, then README).

What

A listed mod becomes one file, mods/<id>.json, with a schema and a validator.

• schema/entry.schema.json: what the author files (repo, license, description, media, contact, credits) and what a maintainer records (the EchoTools fork, per version the tag, commit, attested asset digests, signer status, signed digests, pulled).
• scripts/validate_entries.py: applies the schema, then the rules a schema can't say (file is <id>.json, tag is v<version>, asset names, versions unique and newest first, a signed digest differs from the attested one, fork is not the author's repo). One JSON record per entry on stdout (file, sha256, id, ok, errors), --log appends them to a file. Exit 1 invalid, 2 can't run.
• .github/workflows/validate-entries.yml: runs the tests and the validator on every PR and push to main, read-only token, actions pinned by SHA, records kept 90 days as an artifact.
• docs/entry-format.md, tests/ (34 tests, each rule has a negative control), mods/ (empty until the first approval).

Aligned with the plugin-release spec

The release fields follow release-signer docs/plugin-release.md (PR #25 at 642888d): tag v<semver>, commit, exactly the three assets and their sha256 (the signer's pin). Only the signer block (status, record, signed digests) is not in the spec and stays provisional; #10 stays open for it. Versions are now ordered by semver precedence, strictly descending (the signer refuses a tag at or below one already signed). Mutant: >= -> > in that comparison fails test_same_precedence_fails; restored tree 34 tests OK.

Not in this PR

The submission form is unchanged, so media and credits are not collected there yet, and nothing writes mods/*.json yet (approval is still by hand). Issues: closes #9; the provisional release fields are tracked in #10 (stays open); the form change is #13.

Closes #9
Refs #10

Commands run (clean venv, jsonschema==4.26.0, Python 3.14.8)

$ python -I -m unittest discover -s tests   # CI run 40322193046 on the tip 4e42a9f: green
..............................
Ran 34 tests in 4.488s
OK
$ python -I scripts/validate_entries.py --log /tmp/validate.jsonl
{"at": "2026-10-26T12:22:27Z", "entries": 0, "event": "validate_entries.done", "invalid": 0}
exit=0
$ python3 scripts/validate_entries.py tests/fixtures/valid/*.json
... "id": "example-mod", "ok": true ...
... "id": "minimal-mod", "ok": true ...
{"entries": 2, "event": "validate_entries.done", "invalid": 0}

Co-Authored-By: Andrew Bates a@sprock.io