Add NV Metadata Curation plugin (h7r) v2.0.4.0

[h7r]

Summary

Adds NV Metadata Curation (product="nvMetadataCuration", category generic) to plugins.xml — first public release v2.0.4.0 for the PKP Plugin Gallery.

NV Metadata Curation is a sovereignty-friendly metadata curation plugin for OJS journals:

• Keyword autocomplete from open SPARQL thesauri: UNESCO Thesaurus, Rameau (BnF), Eurovoc (EU)
• ORCID/ROR contributor lookup with explicit human validation — no silent auto-fill
• Backoffice metadata audit dashboard for editors
• Trilingual interface: English, Spanish, French (en, es, fr_FR)
• Free and unlimited — no API key, no rate limit, no third-party account
• License: GPL v3

Plugin block

Field	Value
Category	generic
Product	nvMetadataCuration
Version	2.0.4.0
Repo	https://github.com/h7r/ojs-metadata-curation
Tarball	https://github.com/h7r/ojs-metadata-curation/releases/download/v2.0.4.0/nvMetadataCuration-2.0.4.0.tar.gz
MD5	f5a754ca27ff2d24f7b0d9544f7b483f
OJS compat	3.4.0.0 → 3.4.0.10 (verified against github.com/pkp/ojs/tags on 2026-04-26)
PHP min	8.1+

Maintainer

Maintainer is an individual developer with no institutional affiliation, declared as <institution>Independent</institution>.

Validation

• plugins.xml validated locally against plugins.xsd via xmlschema (Python) — PASS
• Tarball install validated end-to-end in OJS 3.4 Docker (pkpofficial/ojs:stable-3_4_0): plugin enables, audit page renders 200 in all 3 locales (en, es, fr_FR), zero raw i18n keys leaked
• *.po files kept in tarball (OJS 3.4 consumes them at runtime for i18n — exclusion would break trilingual UI)
• <certification> deliberately omitted (assigned post-review by PKP)

[asmecher]

Thanks for contributing, @h7r! I have a few suggestions to make...

• You may well need to add |escape modifiers to templates/audit.tpl to avoid XSS risks.
• I'd suggest using Guzzle rather than file_get_contents to interact with external APIs; I also don't recommend using @ to suppress error messages.
• It's better to use semver-style version numbering to indicate plugin compatibility -- e.g. ~3.4.0.0 rather than listing all compatible 3.4.0-x builds.

[h7r]

Thanks for the review, @asmecher, and sorry for the slow reply!

I'll add the |escape modifiers in audit.tpl and switch the compatibility block to semver (~3.4.0.0).

For Guzzle and the @ suppressions: is that required for inclusion in the gallery, or would it be fine to address it in a follow-up release?

[h7r]

Thanks again, @asmecher. I've pushed 2.0.4.1: |escape on every value printed in audit.tpl, and compatibility declared as ~3.4.0.0. The 2.0.4.0 release is replaced in the block. Guzzle and the @ suppressions are still pending your answer: if they're needed for inclusion, I'll ship them before merge, otherwise in the next release.

For transparency, per PKP's AI contribution policy: the plugin's code was written with AI coding assistants (Claude). The idea came from metadata quality issues raised in the scholarly publishing community; I scoped the features, then tested and debugged the plugin end-to-end in OJS 3.4 (Docker).

[asmecher]

Thanks, @h7r! I'll leave this to @bozana to review -- she's taken over reviewing plugin submissions.