[PurpleCHOIms]

External coding agents currently find the Decepticon skill under an integration-specific path and receive MCP-first instructions even though the launcher already supports status, diagnostics, engagement listing, transcript replay, attach and cancellation. Move the canonical bundle to skills/decepticon/SKILL.md and teach the installed CLI first, with MCP retained as an optional reference.

Changes

• Preserve the standard name/description frontmatter and separate the host wrapper from runtime Skillogy knowledge.
• Document persistent terminal interaction, scope, resume, background preparation, Blue Cell and evidence handling using actual commands.
• Update source install examples, version-pinned download paths, release checksum generation and CI path selection together.
• Record compatibility notes in CHAGELOG.md and verification evidence.

Intent and blast radius

Requested OSS structure/CLI skill cleanup. MCP APIs, runtime knowledge, authorization gates and released tags are preserved. Tier-supply-chain review is required for the narrowly coupled skill release/installer paths; this PR only changes the external skill distribution surface and its documentation. No release or deployment is requested.

Why this touches a supply-chain surface

The checksum manifest and installer must agree on the new source path in the same revision. Downloads remain pinned to the installed launcher version and require SHA-256 verification. Previously released binaries/tags retain their original bundle paths. Existing local modifications still require explicit force and are backed up.

End-to-end verification

Built the launcher and invoked skill install --from <source>/skills/decepticon --client both in a temporary child-process home: both bundles matched source byte-for-byte, reinstall was idempotent, local edits were refused, and force preserved a backup. Actual status --json, doctor --json and engagements exited 0 against the local installation. Verified documented command help, skill frontmatter, the exact release checksum command and actionlint workflow validation. All go test ./... launcher packages passed. The updated release fixture was observed failing before the installer path change and passing afterward; commits retain that sequence.

No active engagement was started for a prose-only instruction exercise. Independent host-agent discovery/PTY execution and downloading the future published manifest remain unverified; executable installer and checksum paths were exercised locally. Full make quality/make smoke were not run for this external-wrapper change.

Review

Please review before merging. Runtime changes fit the line budget; moved skill content is maintained in one canonical directory. The sibling legacy-removal PR is independently based on remote main and may require the usual CHAGELOG reconciliation when merged.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T14:33:31.988690Z	0ea3045	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.