DailybotHQ · xergioalex · Jul 16, 2026 · Jul 16, 2026
diff --git a/.agents/docs/skills_agents_catalog.md b/.agents/docs/skills_agents_catalog.md
@@ -356,6 +356,7 @@ All skills and agents are adapted for this Astro repository:
 - [DeepWorkPlan skill (dwp-* flows)](../skills/deepworkplan/SKILL.md) — backs `/dwp-create`, `/dwp-execute`, `/dwp-refine`, `/dwp-resume`, `/dwp-status`
 - [Dependency-upgrade add-on](../skills/deepworkplan/addons/dependency-upgrade/SKILL.md) — opt-in maintenance add-on shipped with the `deepworkplan` skill; backs `/lib-upgrade` (package-manager agnostic, validated revertible batches)
 - [Design-system add-on](../skills/deepworkplan/addons/design-system/SKILL.md) — opt-in, frontend-scoped add-on shipped with the `deepworkplan` skill; generates a `docs/DESIGN.md` (indexed from `AGENTS.md`) from the repo's real design tokens so agents produce on-brand UI; default-on when a design system is detected. This repo dogfoods it: see [docs/DESIGN.md](../../docs/DESIGN.md)
-- [Dailybot add-on](../skills/deepworkplan/addons/dailybot/SKILL.md) — opt-in team-visibility add-on shipped with the `deepworkplan` skill; this repo dogfoods it: the official `dailybot` skill ([DailybotHQ/agent-skill](https://github.com/DailybotHQ/agent-skill)) is installed alongside `deepworkplan` under `.agents/skills/` (gitignored), and DWP work emits lifecycle agent updates (kickoff / significant task / blocked / completion milestone) per the addon SPEC — best-effort, never blocking (see AGENTS.md §Shared Agent Coordination)
+- [Dailybot add-on](../skills/deepworkplan/addons/dailybot/SKILL.md) — opt-in team-visibility add-on shipped with the `deepworkplan` skill; this repo dogfoods it: the official `dailybot` skill ([DailybotHQ/agent-skill](https://github.com/DailybotHQ/agent-skill)) is vendored under `.agents/skills/dailybot/` (auto-refreshed on website release), and DWP work emits lifecycle agent updates (kickoff / significant task / blocked / completion milestone) per the addon SPEC — best-effort, never blocking (see AGENTS.md §Shared Agent Coordination)
+- [AI Diff Reviewer add-on](../skills/deepworkplan/addons/ai-diff-reviewer/SKILL.md) — opt-in structured-review add-on; this repo dogfoods **Flow B** (local skill + CI Action): vendored `.agents/skills/ai-diff-reviewer/` (auto-refreshed on website release), `.review/extension.md`, and [`.github/workflows/pr-review.yml`](../../.github/workflows/pr-review.yml). Augments the mandatory Security Review when both the skill and an extension file are present (see AGENTS.md §PR review workflow)
 - [AGENTS.md](../../AGENTS.md) - Main AI agent guidance
 - [docs/STANDARDS.md](../../docs/STANDARDS.md) - Coding standards
diff --git a/.github/docs/WORKFLOWS.md b/.github/docs/WORKFLOWS.md
@@ -144,7 +144,7 @@ Extracts the PR's size label and maps to emoji for the workflow summary.
 |------|------|-------------|
 | 0-0a | Cache | pnpm store, keyed on `pnpm-lock.yaml` |
 | 1 | Setup GitHub Config | Git config |
-| 1a | **Dogfood — refresh vendored agent skills** | Resolves the latest tag of `DailybotHQ/deepworkplan-skill`, `DailybotHQ/agent-skill`, and `DailybotHQ/ai-diff-reviewer` via `gh release view`, and if any is newer than the vendored copy under `.agents/skills/`, runs `npx --yes skills add <repo>@<tag> --skill <name> --force -y`, asserts the version invariant, and commits `chore: dogfood vendored skills to (…)`. **Runs before Step 2** so the dogfood commit lands in the release notes. See "Dogfood step" below for details. |
+| 1a | **Dogfood — refresh addon skills** | Resolves the latest tag of `DailybotHQ/agent-skill` and `DailybotHQ/ai-diff-reviewer` via `gh release view`, and if either is newer than the vendored copy under `.agents/skills/`, runs `npx --yes skills add <repo>@<tag> --skill <name> --force -y`, asserts the version invariant, and commits `chore: dogfood vendored skills to (…)`. **Does not touch `deepworkplan`** (repo-adapted). **Runs before Step 2** so the dogfood commit lands in the release notes. See "Dogfood step" below for details. |
 | 2 | Release notes | Runs `scripts/get_github_release_log.sh` — includes the dogfood commit from Step 1a if it exists |
 | 3 | Prepare release | `corepack pnpm install --frozen-lockfile && corepack pnpm run release` + push tags to main (pushes the dogfood commit alongside the version-bump commit + tag in one atomic push) |
 | 4 | Get release tag | Extract latest tag |
@@ -159,27 +159,29 @@ Extracts the PR's size label and maps to emoji for the workflow summary.
 
 #### Dogfood step (Step 1a)
 
-**Purpose.** Every website release should ship with a current snapshot of the three agent skills it documents. Rather than a scheduled/autonomous refresh, the update happens **exactly when the maintainer decides to cut a release** — no background cron, no drift between "when a skill dropped" and "when someone releases the site".
+**Purpose.** Every website release should ship with a current snapshot of the **addon** skills (`dailybot`, `ai-diff-reviewer`). Rather than a scheduled/autonomous refresh, the update happens **exactly when the maintainer decides to cut a release** — no background cron.
+
+**Intentional exclusion — `deepworkplan`.** The DWP skill under `.agents/skills/deepworkplan/` is **repo-adapted** and is **not** auto-refreshed. A blind `skills add --force` would overwrite local adaptation. Update it only via an explicit, reviewed change that re-adapts it to this repository (see AGENTS.md → Vendored agent skills).
 
 **What runs.**
 
-1. `gh release view --repo <owner/repo> --json tagName -q .tagName` for each of `DailybotHQ/deepworkplan-skill`, `DailybotHQ/agent-skill`, and `DailybotHQ/ai-diff-reviewer` to resolve the latest tag.
-2. Reads the currently vendored versions from `.agents/skills/{deepworkplan,dailybot,ai-diff-reviewer}/SKILL.md` frontmatter.
-3. Per-skill "moved" flag → only installs the skills that actually changed. Commits and PR titles list only the moved skills (no misleading "dogfood to deepworkplan vX, dailybot vY, ai-diff-reviewer vZ" when only one moved).
+1. `gh release view --repo <owner/repo> --json tagName -q .tagName` for `DailybotHQ/agent-skill` and `DailybotHQ/ai-diff-reviewer` to resolve the latest tag.
+2. Reads the currently vendored versions from `.agents/skills/{dailybot,ai-diff-reviewer}/SKILL.md` frontmatter (and reports the pinned `deepworkplan` version in the step summary for visibility only).
+3. Per-skill "moved" flag → only installs the addon skills that actually changed. Commit subjects list only the moved skills.
 4. `npx --yes skills add <repo>@<tag> --skill <name> --force -y` — exact same command any downstream consumer would run. Serves as a live smoke test that the upstream release is installable. Both `--yes` AND `-y` are required — the former covers npm's own proceed prompt, the latter covers the `skills` CLI's agent-picker prompt; dropping either hangs the workflow in a non-TTY runner.
 5. Version invariant: the installed `SKILL.md` frontmatter `version:` MUST equal the requested tag. Fails the release if not — refuses to publish a website tag that misrepresents its vendored skills.
-6. If any files changed, commits `chore: dogfood vendored skills to <list>` locally. Step 3's `git push --follow-tags` sends this commit alongside the version-bump commit and the tag in a single atomic push.
+6. If any files changed, commits `chore: dogfood vendored skills to <list>` locally. Step 3's `git push --follow-tags` sends this commit alongside the version-bump commit and the tag in a single atomic push. Staging paths are limited to `.agents/skills/dailybot`, `.agents/skills/ai-diff-reviewer`, and `skills-lock.json`.
 
 **Failure semantics.**
 
 | Failure | Behavior |
 |---------|----------|
-| `gh release view` fails for one upstream repo (rate limit, transient outage) | Warns; skips that skill. The other two skills (and the release) proceed. |
+| `gh release view` fails for one upstream repo (rate limit, transient outage) | Warns; skips that skill. The other auto-refreshed skill (and the release) proceed. |
 | `npx skills add` fails | **Fails the release** — real upstream breakage, must be surfaced. |
 | Version invariant mismatch after install | **Fails the release** — refuses to commit a misrepresented dogfood snapshot. |
-| All three skills already at latest | Clean no-op — no dogfood commit, release proceeds. |
+| Both auto-refreshed addon skills already at latest | Clean no-op — no dogfood commit, release proceeds. |
 
-**Manual refresh outside of a release.** Not supported by design. If a maintainer needs to bump a vendored skill without cutting a full release, do it locally (`npx skills add <repo>@<tag>`) on a PR branch and merge it as a normal `chore:` change — that will trigger a release naturally.
+**Manual refresh outside of a release.** For addons: do it locally (`npx skills add <repo>@<tag>`) on a PR branch and merge as a normal `chore:` change — that will trigger a release naturally. For `deepworkplan`: never rely on release dogfood; re-adapt deliberately on a reviewed PR.
 
 ### Job 3: `cleanup_caches` (depends on: Job 2)
 

diff --git a/.github/workflows/release_and_publish.yml b/.github/workflows/release_and_publish.yml
@@ -97,14 +97,17 @@ jobs:
           git config user.name "deepworkplan-bot"
           git config user.email "bot@deepworkplan.com"
           git config advice.skippedCherryPicks false
-      - name: Step 1a - 🐕 Dogfood — refresh vendored agent skills to latest upstream
-        # Before every website release, bring the three vendored skills under
-        # `.agents/skills/` up to their latest published upstream tags —
+      - name: Step 1a - 🐕 Dogfood — refresh addon skills to latest upstream
+        # Before every website release, bring the two *addon* vendored skills
+        # under `.agents/skills/` up to their latest published upstream tags —
         # so `vX.Y.Z` of this site always ships with a current snapshot of
-        # `deepworkplan`, `dailybot`, and `ai-diff-reviewer`. Mirrors the
-        # "Dogfood" step in DailybotHQ/deepworkplan-skill's own
-        # `auto-release.yml`, adapted to install third-party upstream tags
-        # instead of this repo's own.
+        # `dailybot` and `ai-diff-reviewer`.
+        #
+        # INTENTIONAL EXCLUSION: `deepworkplan` is NOT refreshed here. The
+        # DWP skill in this repo is repo-adapted (onboarded kit + local
+        # wiring); a blind `skills add --force` would overwrite that
+        # adaptation. Update `.agents/skills/deepworkplan/` only via an
+        # explicit, reviewed change that re-adapts it to this repository.
         #
         # This step runs BEFORE Step 2 on purpose: `get_github_release_log.sh`
         # in Step 2 collects commit subjects from the previous release
@@ -119,7 +122,7 @@ jobs:
         #   * `npx skills add` failure OR version-invariant mismatch →
         #     FAIL the release (we should not publish a website tag that
         #     misrepresents which skill versions it vendors).
-        #   * All three skills already at latest → clean no-op, release
+        #   * Both addon skills already at latest → clean no-op, release
         #     proceeds normally without a dogfood commit.
         env:
           GH_TOKEN: ${{ secrets.AUTOMATION_GITHUB_TOKEN }}
@@ -169,7 +172,6 @@ jobs:
             fi
           }
 
-          DWP_TAG=$(resolve DailybotHQ/deepworkplan-skill deepworkplan)
           DB_TAG=$(resolve DailybotHQ/agent-skill dailybot)
           AIDR_TAG=$(resolve DailybotHQ/ai-diff-reviewer ai-diff-reviewer)
 
@@ -180,36 +182,33 @@ jobs:
           # Only install skills that would actually change — no wasted work
           # and no misleading dogfood commit when one skill is at latest
           # and another is not.
-          DWP_MOVED=false
           DB_MOVED=false
           AIDR_MOVED=false
-          [ -n "$DWP_TAG" ] && [ "$DWP_CUR" != "${DWP_TAG#v}" ] && DWP_MOVED=true
           [ -n "$DB_TAG" ] && [ "$DB_CUR" != "${DB_TAG#v}" ] && DB_MOVED=true
           [ -n "$AIDR_TAG" ] && [ "$AIDR_CUR" != "${AIDR_TAG#v}" ] && AIDR_MOVED=true
 
-          [ "$DWP_MOVED" = "true" ] && install_and_verify DailybotHQ/deepworkplan-skill deepworkplan .agents/skills/deepworkplan "$DWP_TAG"
           [ "$DB_MOVED" = "true" ] && install_and_verify DailybotHQ/agent-skill dailybot .agents/skills/dailybot "$DB_TAG"
           [ "$AIDR_MOVED" = "true" ] && install_and_verify DailybotHQ/ai-diff-reviewer ai-diff-reviewer .agents/skills/ai-diff-reviewer "$AIDR_TAG"
 
           # Stage only the paths the installer is allowed to touch.
+          # deepworkplan is intentionally omitted — see step comment above.
           git add \
-            .agents/skills/deepworkplan \
             .agents/skills/dailybot \
             .agents/skills/ai-diff-reviewer \
             skills-lock.json 2>/dev/null || true
 
           if git diff --cached --quiet; then
-            echo "Vendored skills already at latest — no dogfood commit needed."
+            echo "Addon skills already at latest — no dogfood commit needed."
             {
               echo "## Vendored skills"
               echo ""
-              echo "| Skill | Vendored | Latest upstream | Moved? |"
-              echo "| --- | --- | --- | --- |"
-              echo "| deepworkplan | v${DWP_CUR} | ${DWP_TAG:-_(unresolved)_} | ${DWP_MOVED} |"
-              echo "| dailybot | v${DB_CUR} | ${DB_TAG:-_(unresolved)_} | ${DB_MOVED} |"
-              echo "| ai-diff-reviewer | v${AIDR_CUR} | ${AIDR_TAG:-_(unresolved)_} | ${AIDR_MOVED} |"
+              echo "| Skill | Vendored | Latest upstream | Auto-refreshed? | Moved? |"
+              echo "| --- | --- | --- | --- | --- |"
+              echo "| deepworkplan | v${DWP_CUR} | _(manual — repo-adapted)_ | no | — |"
+              echo "| dailybot | v${DB_CUR} | ${DB_TAG:-_(unresolved)_} | yes | ${DB_MOVED} |"
+              echo "| ai-diff-reviewer | v${AIDR_CUR} | ${AIDR_TAG:-_(unresolved)_} | yes | ${AIDR_MOVED} |"
               echo ""
-              echo "**No dogfood commit** — vendored copies already match the latest upstream releases."
+              echo "**No dogfood commit** — auto-refreshed addon copies already match the latest upstream releases."
             } >> "$GITHUB_STEP_SUMMARY"
             exit 0
           fi
@@ -219,7 +218,6 @@ jobs:
           # so build the joined string by hand to preserve "a, b" (with the
           # space).
           parts=()
-          [ "$DWP_MOVED" = "true" ] && parts+=("deepworkplan ${DWP_TAG}")
           [ "$DB_MOVED" = "true" ] && parts+=("dailybot ${DB_TAG}")
           [ "$AIDR_MOVED" = "true" ] && parts+=("ai-diff-reviewer ${AIDR_TAG}")
           MSG=""
@@ -239,11 +237,11 @@ jobs:
           {
             echo "## Vendored skills"
             echo ""
-            echo "| Skill | Vendored | Latest upstream | Moved? |"
-            echo "| --- | --- | --- | --- |"
-            echo "| deepworkplan | v${DWP_CUR} | ${DWP_TAG:-_(unresolved)_} | ${DWP_MOVED} |"
-            echo "| dailybot | v${DB_CUR} | ${DB_TAG:-_(unresolved)_} | ${DB_MOVED} |"
-            echo "| ai-diff-reviewer | v${AIDR_CUR} | ${AIDR_TAG:-_(unresolved)_} | ${AIDR_MOVED} |"
+            echo "| Skill | Vendored | Latest upstream | Auto-refreshed? | Moved? |"
+            echo "| --- | --- | --- | --- | --- |"
+            echo "| deepworkplan | v${DWP_CUR} | _(manual — repo-adapted)_ | no | — |"
+            echo "| dailybot | v${DB_CUR} | ${DB_TAG:-_(unresolved)_} | yes | ${DB_MOVED} |"
+            echo "| ai-diff-reviewer | v${AIDR_CUR} | ${AIDR_TAG:-_(unresolved)_} | yes | ${AIDR_MOVED} |"
             echo ""
             echo "**Dogfood commit:** \`chore: dogfood vendored skills to ${MSG}\`"
             echo ""