Workflow Skill Router v2.0.1

Workflow Skill Router v2.0.1

Why V2

Workflow Skill Router is a runtime-aware Skill-selection layer for Codex. It chooses the smallest verifiable route for a single task, phased work, or a managed Goal while preserving Explicit Skill Lock, consent boundaries, and honest capability reporting. It does not replace Host permissions, approvals, sandboxing, or production orchestration.

Choose your install mode

• Plugin + MCP: install the bundled local control plane when Codex supports Plugins and MCP. It provides durable local planning and typed runtime readiness.
• Skill-only: use the standalone instruction package when the Host cannot run Plugin/MCP. It keeps routing and disclosure policy, but not durable state or verified Host authority.

The historical beta.1 behavior evaluation recorded 36 attempts across 42 model turns. That evidence remains bounded to routing-contract behavior; this patch does not claim verified Skill activation, token reduction, or task-outcome improvement.

Security patch

• Updated the documentation site from Astro 6.4.7 to Astro 7.1.3.
• Updated the documentation-site integration from Starlight 0.40.0 to Starlight 0.41.4.
• A clean npm ci followed by npm audit reports 0 vulnerabilities for the site lockfile. This closes the seven Astro Dependabot alerts that applied to the site dependency tree.

Compatibility and scope

• Starlight 0.41.4 declares astro ^7.0.2; Astro 7.1.3 satisfies that peer requirement.
• Astro 7.1.3 requires Node.js 22.12 or later. The supported Node.js 24 release environment satisfies that requirement.
• The static documentation build completed successfully after the upgrade.
• This patch makes the site dependency tree clean. The Plugin's separate MCP SDK dependency decision remains documented: its stdio-only runtime does not start the affected HTTP listener, and no compatible upstream SDK release currently resolves that transitive finding without introducing worse advisories. See Plugin Dependency Security Decision.
• Router Core routing behavior, MCP tool semantics, persisted schema, and model-evaluation claims are unchanged. This security patch does not relabel historical behavior evidence or claim a new model evaluation.

Verify the release

• Download workflow-skill-router-plugin-v2.0.1.zip or workflow-skill-router-skill-v2.0.1.zip from this release.
• Validate checksums.sha256 before installation.
• Inspect the SBOM at sbom/workflow-skill-router-v2.0.1.spdx.json and provenance/workflow-skill-router-v2.0.1.json for the generated supply-chain records.
• This release is published only after the trusted release workflow has bound the frozen source revision and recorded the required maintainer-attestation.

Full Changelog: v2.0.0...v2.0.1