feat: Skill 镜像分身与选仓序号；卸掉 Ubuntu Bridge/MCP

.github/workflows/ci.yml

@@ -79,15 +79,25 @@ jobs:
           smoke_root="$(mktemp -d)"
           cd "$smoke_root"
           uv run python -m venv "$smoke_root/wheel-venv"
-          "$smoke_root/wheel-venv/bin/pip" install /tmp/dyro-dist/dyro-*.whl
+          wheel_artifact="$(find /tmp/dyro-dist -maxdepth 1 -name 'dyro-*.whl' -print -quit)"
+          "$smoke_root/wheel-venv/bin/pip" install "${wheel_artifact}"
           "$smoke_root/wheel-venv/bin/python" -c "import experiments.local_agent_dispatch"
           "$smoke_root/wheel-venv/bin/python" -I -c "import dyro.continuation"
           "$smoke_root/wheel-venv/bin/python" -I -c "from dyro.console.assets import validate_assets; validate_assets()"
+          "$smoke_root/wheel-venv/bin/python" -I -c "from importlib.resources import files; root=files('dyro.integrations').joinpath('assets'); assert root.joinpath('dyro-control-plane','SKILL.md').is_file(); assert root.joinpath('dyro-control-plane','agents','openai.yaml').is_file(); assert not root.joinpath('dyro-readonly').is_dir()"
+          test -x "$smoke_root/wheel-venv/bin/dyro"
+          test ! -e "$smoke_root/wheel-venv/bin/dyro-bridge"
+          test ! -e "$smoke_root/wheel-venv/bin/dyro-mcp"
           DYRO_LOCAL_AGENT_DISPATCH_HOME="$smoke_root/wheel-dispatch-home" "$smoke_root/wheel-venv/bin/dyro" dispatch doctor >"$smoke_root/dispatch-doctor.json"
           uv run python -m venv "$smoke_root/sdist-venv"
-          "$smoke_root/sdist-venv/bin/pip" install /tmp/dyro-dist/dyro-*.tar.gz
+          sdist_artifact="$(find /tmp/dyro-dist -maxdepth 1 -name 'dyro-*.tar.gz' -print -quit)"
+          "$smoke_root/sdist-venv/bin/pip" install "${sdist_artifact}"
           "$smoke_root/sdist-venv/bin/python" -I -c "import dyro.continuation"
           "$smoke_root/sdist-venv/bin/python" -I -c "from dyro.console.assets import validate_assets; validate_assets()"
+          "$smoke_root/sdist-venv/bin/python" -I -c "from importlib.resources import files; root=files('dyro.integrations').joinpath('assets'); assert root.joinpath('dyro-control-plane','SKILL.md').is_file(); assert root.joinpath('dyro-control-plane','agents','openai.yaml').is_file(); assert not root.joinpath('dyro-readonly').is_dir()"
+          test -x "$smoke_root/sdist-venv/bin/dyro"
+          test ! -e "$smoke_root/sdist-venv/bin/dyro-bridge"
+          test ! -e "$smoke_root/sdist-venv/bin/dyro-mcp"
 
   windows-dispatch-import:
     name: Windows dispatch import / fail-closed smoke

.github/workflows/pypi-publish.yml

@@ -11,6 +11,7 @@ on:
         type: string
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
@@ -44,6 +45,40 @@ jobs:
           git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
           python tools/verify_release_source.py --release-tag "$RELEASE_TAG" --trusted-ref origin/main
 
+      - name: Require successful exact-SHA CI
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          release_sha="$(git rev-parse HEAD)"
+          for attempt in $(seq 1 30); do
+            row="$(gh api --method GET \
+              "repos/${GITHUB_REPOSITORY}/actions/workflows/ci.yml/runs" \
+              -f "head_sha=${release_sha}" -f event=push -f per_page=100 \
+              --jq '.workflow_runs | sort_by(.created_at) | last | if . == null then ["missing","missing","missing","missing","missing"] else [.status, (.conclusion // "pending"), .head_sha, (.id | tostring), .html_url] end | @tsv')"
+            IFS=$'\t' read -r status conclusion observed_sha run_id run_url <<<"${row}"
+            if [[ "${observed_sha}" != "missing" && "${observed_sha}" != "${release_sha}" ]]; then
+              echo "CI run SHA mismatch: expected ${release_sha}, got ${observed_sha}" >&2
+              exit 1
+            fi
+            if [[ "${status}" == "completed" ]]; then
+              if [[ "${conclusion}" != "success" ]]; then
+                echo "Exact-SHA CI did not succeed: ${conclusion} ${run_url}" >&2
+                exit 1
+              fi
+              printf '%s\t%s\t%s\n' \
+                "${release_sha}" "${run_id}" "${run_url}" \
+                > ci-gate-run.tsv
+              break
+            fi
+            if [[ "${attempt}" -eq 30 ]]; then
+              echo "No completed successful ci.yml push run for ${release_sha}" >&2
+              exit 1
+            fi
+            sleep 10
+          done
+
       - name: Verify locked release environment
         run: |
           uv lock --check
@@ -82,12 +117,22 @@ jobs:
           "$smoke_root/wheel-venv/bin/pip" install "$GITHUB_WORKSPACE"/dist/dyro-*.whl
           "$smoke_root/wheel-venv/bin/python" -c "import experiments.local_agent_dispatch"
           "$smoke_root/wheel-venv/bin/python" -I -c "from dyro.console.assets import validate_assets; validate_assets()"
+          "$smoke_root/wheel-venv/bin/python" -I -c "from importlib.resources import files; root=files('dyro.integrations').joinpath('assets'); assert root.joinpath('dyro-control-plane','SKILL.md').is_file(); assert root.joinpath('dyro-control-plane','agents','openai.yaml').is_file()"
+          "$smoke_root/wheel-venv/bin/python" -I -c "import importlib.util; assert importlib.util.find_spec('dyro.bridge') is None"
+          test -x "$smoke_root/wheel-venv/bin/dyro"
+          test ! -e "$smoke_root/wheel-venv/bin/dyro-bridge"
+          test ! -e "$smoke_root/wheel-venv/bin/dyro-mcp"
           DYRO_LOCAL_AGENT_DISPATCH_HOME="$smoke_root/wheel-dispatch-home" "$smoke_root/wheel-venv/bin/dyro" dispatch doctor >"$smoke_root/wheel-doctor.json"
           uv run python -c "import json; json.load(open('$smoke_root/wheel-doctor.json'))"
           uv run python -m venv "$smoke_root/sdist-venv"
           "$smoke_root/sdist-venv/bin/pip" install "$GITHUB_WORKSPACE"/dist/dyro-*.tar.gz
           "$smoke_root/sdist-venv/bin/python" -c "import experiments.local_agent_dispatch"
           "$smoke_root/sdist-venv/bin/python" -I -c "from dyro.console.assets import validate_assets; validate_assets()"
+          "$smoke_root/sdist-venv/bin/python" -I -c "from importlib.resources import files; root=files('dyro.integrations').joinpath('assets'); assert root.joinpath('dyro-control-plane','SKILL.md').is_file(); assert root.joinpath('dyro-control-plane','agents','openai.yaml').is_file()"
+          "$smoke_root/sdist-venv/bin/python" -I -c "import importlib.util; assert importlib.util.find_spec('dyro.bridge') is None"
+          test -x "$smoke_root/sdist-venv/bin/dyro"
+          test ! -e "$smoke_root/sdist-venv/bin/dyro-bridge"
+          test ! -e "$smoke_root/sdist-venv/bin/dyro-mcp"
           DYRO_LOCAL_AGENT_DISPATCH_HOME="$smoke_root/sdist-dispatch-home" "$smoke_root/sdist-venv/bin/dyro" dispatch doctor >"$smoke_root/sdist-doctor.json"
           uv run python -c "import json; json.load(open('$smoke_root/sdist-doctor.json'))"
 
@@ -115,6 +160,7 @@ jobs:
           path: |
             release-build-requirements.txt
             distribution-sha256sums.txt
+            ci-gate-run.tsv
           retention-days: 90
 
   publish-to-pypi:

CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.6.3 - 2026-08-12
+
+- Keep the shipping surface as CLI + Skill only. PyPI releases through 0.6.2
+  never exposed `dyro-bridge` / `dyro-mcp` entry points or the optional `[mcp]`
+  extra; those remain out of the wheel. Historical ADR/design/evidence docs stay
+  in the repository as archive only. Upgraders from interim git builds that had
+  those entry points should expect them to be absent after upgrading.
+- Install the cross-platform Skill as a Dyro-owned **mirror** under
+  `DYRO_HOME/skills/dyro-control-plane`, with per-host **avatars** (symlinks /
+  Windows junctions) for detected agent homes (Codex, Claude, Agents, Cursor).
+  After upgrading, preview then install with
+  `dyro integration install skill --dry-run` / `dyro integration install skill --yes`
+  (or the `codex` alias). The Skill uses read-only `dyro` CLI commands
+  (`workspace list` / `status`, `objective list|status|plan`).
+- Migrate legacy whole-directory Codex Skill installs to mirror+avatar on the
+  next owned install, but only when the legacy target is a detected host avatar
+  whose content matches the packaged Skill assets (fail closed otherwise).
+- Let interactive line/hotfix repository picks accept list indices and/or
+  repository IDs; when a token matches a repository ID exactly (including
+  pure-numeric IDs), the ID wins over index interpretation.
+
 ## 0.6.2 - 2026-08-05
 
 - Extend interactive `dyro setup` and Profile onboarding with a single,

MANIFEST.in

@@ -6,3 +6,4 @@ include docs/updates.md
 include docs/workspace-blueprints.md
 include examples/blueprints/acme-platform.toml
 recursive-include src/dyro/console/assets *
+recursive-include src/dyro/integrations/assets *

README.md

@@ -283,6 +283,10 @@ To upgrade later, run `pipx upgrade dyro`. If your team manages Python packages
 python3 -m pip install --user --upgrade dyro
 ```
 
+Optional: after upgrading, attach the Dyro control-plane Skill to detected agent
+homes with `dyro integration install skill --dry-run`, then
+`dyro integration install skill --yes` (alias: `codex`).
+
 Interactive `dyro`, `dyro home`, and `dyro start` launches check the official
 PyPI endpoint at most once per local day. A failed or slow check never blocks
 workspace entry. Updates remain confirmation-first by default:

README.zh-CN.md

@@ -281,6 +281,9 @@ dyro --version
 python3 -m pip install --user --upgrade dyro
 ```
 
+可选：升级后用 `dyro integration install skill --dry-run` 预览，再执行
+`dyro integration install skill --yes`（别名 `codex`），把控制面 Skill 挂到已检测到的 Agent 宿主目录。
+
 交互运行 `dyro`、`dyro home` 或 `dyro start` 时，Dyro 每个本地自然日最多访问一次官方 PyPI；断网、超时或状态目录不可写都不会阻塞进入工作区。默认仍由用户确认更新：
 
 ```bash