refactor(grok): install via subdirectory, drop the mirror fallback

.github/workflows/oss-guardrails.yml

@@ -138,45 +138,15 @@ jobs:
   # check never reports and leaves the PR perpetually pending).
   sync-parity:
     name: Plugin skill sync parity
-    permissions:
-      contents: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - name: Refresh sanctioned Grok fallback mirror (master only)
-        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
-        run: |
-          # R5 fallback: Grok's installer needs real files under
-          # plugins/last9/skills/. Automation keeps it in sync so
-          # contributors only ever touch skills/. Regenerate from scratch so
-          # orphans cannot survive, then verify.
-          rm -rf plugins/last9/skills
-          mkdir -p plugins/last9/skills
-          for d in skills/*/; do
-            n=$(basename "$d")
-            mkdir -p "plugins/last9/skills/$n"
-            cp "${d}SKILL.md" "plugins/last9/skills/$n/SKILL.md"
-          done
-          if ! git diff --quiet -- plugins/last9/skills; then
-            git config user.name "last9-bot"
-            git config user.email "bot@last9.io"
-            git add plugins/last9/skills
-            git commit -m "chore(grok): refresh sanctioned fallback mirror from canonical skills/"
-            git push
-          fi
-
       - name: Verify skill distribution
         run: |
           # Repo-as-hub model: skills/ is the single source of truth. This
           # check validates distribution correctness (frontmatter naming,
-          # declared marketplace paths, opencode tarball completeness, and
-          # the sanctioned Grok fallback mirror). On PRs the mirror-parity
-          # leg is skipped: contributors touch only skills/, and the
-          # master-push step above refreshes the mirror after merge. The
-          # gate runs at full strength on master pushes, after that refresh.
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            export SKIP_MIRROR_PARITY=1
-          fi
+          # declared marketplace paths, opencode tarball completeness) and
+          # forbids committed plugin skill copies outright.
           scripts/check-skill-pack.sh
           scripts/check-skill-pack-selftest.sh

CONTRIBUTING.md

@@ -4,7 +4,7 @@ Thanks for contributing! This repo ships AI-agent skills and plugin packages for
 
 ## The canonical-source model
 
-The top-level `skills/` directory is the **single source of truth**. Marketplace manifests for Claude Code and Codex reference it directly, and the OpenCode plugin assembles it into its npm tarball at pack time. One exception: Grok Build’s installer cannot follow root sources, so a mirror under `plugins/last9/skills/` is refreshed automatically by CI after merge — never edit or commit it by hand. Never edit the generated copy under `plugins/opencode-last9/skills/` either (gitignored, regenerated by `prepack`).
+The top-level `skills/` directory is the **single source of truth**. Marketplace manifests for Claude Code and Codex reference it directly, Grok Build installs from the `plugins/last9` subdirectory via `grok plugin install --trust "last9/ai-toolkit#plugins/last9"`, and the OpenCode plugin assembles it into its npm tarball at pack time — no skill copies are committed anywhere else. Never edit generated copies under `plugins/opencode-last9/skills/` (gitignored, regenerated by `prepack`).
 
 When you change or add a skill:
 

README.md

@@ -30,7 +30,11 @@ npx skills add last9/ai-toolkit --skill last9-logs
 npx skills add last9/ai-toolkit -a claude-code
 ```
 
-Claude Code, Codex, and Grok Build users can install through their plugin marketplaces instead — all three read the same root-level manifests (`.claude-plugin/marketplace.json`, `.agents/plugins/marketplace.json`) and resolve skills directly from this repository's canonical `skills/` tree; there are no packaged copies to keep in sync.
+Claude Code and Codex install through their marketplaces, which resolve skills directly from this repository's canonical `skills/` tree. Grok Build installs straight from the plugin subdirectory:
+
+```shell
+grok plugin install --trust "last9/ai-toolkit#plugins/last9"
+```
 
 OpenCode users get MCP registration plus skills from a single plugin: