ci(release): stop auto-overwriting repo-adapted deepworkplan dogfood [skip release]

[xergioalex]

Summary

• Stop auto-release.yml from running npx skills add into .agents/skills/deepworkplan/ — that copy is repo-adapted for contributors (Dailybot + AI Diff Reviewer wiring) and must not be blindly overwritten on every release.
• Keep a temp-directory install smoke test so each published tag still proves it installs cleanly for consumers.
• Continue auto-refreshing only the addon dogfoods: dailybot and ai-diff-reviewer.
• Document the new policy in AGENTS.md, CONTRIBUTING.md, .github/docs/WORKFLOWS.md, .review/extension.md, and scripts/refresh-dogfood-skill.sh (the supported way to sync the deepworkplan dogfood from skills/deepworkplan/).

Test plan

• Review auto-release.yml: deepworkplan step is temp-dir smoke only; dailybot + ai-diff-reviewer dogfood steps unchanged
• Confirm bash scripts/refresh-dogfood-skill.sh still syncs skills/deepworkplan → .agents/skills/deepworkplan
• After merge, next release: smoke step passes; no chore(release): dogfood vendored deepworkplan commit; addon dogfood commits still appear when upstream moves

Made with Cursor

[github-actions]

AI review for 0ed4817 — ✅ done

View review →

Highest severity: warning

Strictness gate: ✅ highest severity warning ≤ critical threshold

1 inline comment(s) attached.

Iteration-Aware Review: gen 1, round 2, policy=first-pass-exhaustive (same_generation) — 1 surfaced.

[github-actions]

Solid CI/policy change — preserves consumer install smoke while stopping blind overwrite of the repo-adapted deepworkplan dogfood. One warning on skills-lock drift; otherwise ready.

Methodology integrity (CI/docs-only PR — M5–M6 skim)

#	Check	Result
M1	Long-horizon loop intact	N/A (core create/execute/resume untouched)
M2	.dwp/ durability	N/A
M3	Atomic task contract	N/A
M4	Gate discipline	N/A
M5	Mandatory finals	Pass — no new/reordered final tasks; addon dogfood unchanged
M6	Zero-addon baseline	Pass — release smoke is temp-dir only; core still has no addon requirement
M7	Interruptibility	N/A
M8	Spec ↔ guide ↔ create/execute	N/A

Findings table

#	Severity	File	Summary
1	⚠️ warning	scripts/refresh-dogfood-skill.sh:8	Refresh path does not update skills-lock.json for deepworkplan

Notes (not inlined)

• Verified the new temp-dir smoke path: npx skills add … --force -y into a bare mktemp project installs at .agents/skills/deepworkplan/SKILL.md and version assertion would work.
• Both --yes and -y are preserved on smoke + addon dogfood steps (hang contract intact).
• Docs in AGENTS.md, CONTRIBUTING.md, .github/docs/WORKFLOWS.md, and .review/extension.md are aligned with the new policy.
• Outside the diff (please follow up): .agents/README.md (lines ~15–22, ~30) still says deepworkplan is fetched via npx skills add and refreshed by auto-release / "never hand-edit" / "bot-managed". Contributors reading the kit README will get the old contract. Same class of drift as the warning below.
• Stale comment in auto-release.yml dailybot step still says "same rationale as the deepworkplan dogfood step" — rename to "smoke step" when convenient (nit).

Recommendation: comment-only

[github-actions]

The old self-dogfood step also refreshed skills-lock.json so restore/update flows stayed accurate. This script is now the only supported refresh path, but it only cp -Rs skills/deepworkplan → .agents/skills/deepworkplan and never updates the deepworkplan entry in skills-lock.json.

Failure mode: after a release (or a manual refresh), the lock hash/source pin for deepworkplan goes stale. A later npx skills update / restore-from-lock can overwrite the repo-adapted dogfood — reintroducing the exact clobber this PR is trying to prevent. AGENTS.md still says all three skills are pinned via skills-lock.json.

Either have this script recompute/update the deepworkplan lock entry after sync, or document that the deepworkplan lock row is advisory and must not be used for restore/update (and stop implying lock-pin parity for all three).