v2.6.0 — Codex CLI and Gemini CLI get the skills

Codex CLI and Gemini CLI get the skills, and the README works for any stack and
any agent.

Added

• --codex and --gemini install the skills. Both tools now read
  SKILL.md skills, and both document ~/.agents/skills as a user skills
  folder: Codex's only user scope
  (docs), and the Gemini alias
  that takes precedence over ~/.gemini/skills
  (docs). Both pages were read
  2026-10-11. The installer writes one shared copy of this pack's skills there,
  once per run. When Cursor is also a target, the Cursor mirror's copy is
  reused. That mirror copies all of ~/.cursor/skills, your own skills
  included. --dry-run lists each skill, --verify hash-checks
  them, --skill <name> installs one, and --only rules skips them.
  --no-agents-mirror now means nothing goes to ~/.agents/skills, with a
  warning that Codex and Gemini get no skills. AGENTS.md, GEMINI.md, the
  portable commands, and their .bak-<stamp> backups are unchanged. The skill
  routing index is still left out of the merged file.
• scripts/test-install.mjs covers the change:
  • the skill count in ~/.agents/skills;
  • no ~/.gemini/skills;
  • no Cursor builtins;
  • an idempotent re-run with no backups;
  • --verify passes, then fails on a tampered file;
  • --dry-run writes nothing;
  • --only rules, --skill, an unknown --skill (exit 1), and --no-agents-mirror;
  • a foreign skill survives a re-run and a Cursor --clean.
• Workflow chains in frontmatter (ADR-0014).
  Mushi Mushi runs a workflow skill as a pipeline of the skills it calls, but
  it found them by scanning the body for skills/<slug>/SKILL.md paths, which
  the workflows no longer write, so every workflow ran as one step. Each
  workflow that runs other skills now declares them as
  metadata.chain: "a b c", in run order, inside the Agent Skills spec (string
  values only). Optional steps, routers and "see also" mentions stay out.
  validate-skills fails on an unknown or repeated slug.
  • workflow-build-feature: workflow-spec-tdd test-unit test-playwright workflow-pr
  • workflow-fix-and-ship: debug-error test-playwright workflow-pr
  • workflow-quality-gate: test-red-team audit-security audit-bundle-size audit-performance test-unit
  • workflow-launch-ready: enhance-web-seo enhance-pwa audit-bundle-size audit-i18n workflow-quality-gate deploy-verify iterate-post-launch
  • workflow-gtm: the seven-step sequence, plan-gtm through iterate-gtm-weekly
  • workflow-release-prep: audit-code-review workflow-git-commit workflow-pr
• workflow-mobile-native-uiux: the end-to-end native UI/UX run on an
  existing Capacitor, Expo, or React Native app. Baseline screenshots and
  scorecard, then enhance-capacitor-ui (hybrid only) →
  mobile-capacitor-platform (Capacitor only) → enhance-mobile-native-feel →
  audit-accessibility → audit-responsive → mobile-emulator-test →
  workflow-pr, on one branch, ending in one PR that says whether a store
  build is needed.

Changed

• README rewritten for a coder on any stack and any agent. It now has:

  • a three-command quickstart: dry run, install, verify;
  • a support matrix for Claude Code, Cursor, Codex CLI, Gemini CLI, and any
    SKILL.md agent via the skills CLI, with a cited doc for every path;
  • a table of every path the installer writes and what happens when a file
    is already there;
  • what the Stop hook does and how to skip or remove it;
  • which rules assume React, Next.js, or Supabase, and how to leave them out;
  • verify, update, rollback, and manual uninstall steps;
  • troubleshooting for Windows locks and CRLF, existing files, Codex's skill
    listing budget, Codex's removed custom prompts, CODEX_HOME, and Gemini's
    consent prompt and Antigravity CLI notice.

  Removed:

  • the skills.sh install-count badge;
  • unverified model and version claims;
  • every unguarded count. The counts left are the phrases
    check-skill-count rewrites.

• Re-rendered the hero, OG, architecture, and pieces images. They said 160
  skills, and the architecture image showed Codex and Gemini without skills.

• Installer output:

  • the --verify hint names the targets you installed;
  • the skill/command name-clash note prints only for Cursor and Claude Code;
  • Gemini's hint uses /memory reload and /skills reload, the commands its
    docs name.

• GETTING-STARTED, DISTRIBUTION, and MODEL-AND-EFFORT describe the Codex and
  Gemini install as it is now.

• Mobile skills checked against 2026 primary sources (Apple HIG, Android 15
  and 16 behavior changes, Google Play target-SDK policy, Capacitor 8 docs and
  changelog, WCAG 2.2, MDN compat data, Expo SDK 54–58 changelogs; read
  2026-10-08). Each skill now owns one job and points to the others:

  • mobile-capacitor-platform owns the shell plumbing: a Native shell
    plumbing table (SystemBars and safe-area CSS, dead StatusBar config,
    keyboard resize, splash, Android back, haptics defaults, large screens),
    each row with a device probe and a done line; Capacitor 8, targetSdk 36,
    and Xcode 26 floors with their dates.
  • enhance-mobile-native-feel: Android back is part of the chrome step and a
    scorecard gate; Expo edge-to-edge is mandatory from SDK 54 (was "SDK 53+
    default"); Capacitor's impact() defaults to Heavy; Liquid Glass stays
    in the control layer; the Capacitor edge-to-edge block moved to its owner.
  • design-mobile-first: the WCAG 2.2 rules it lacked — 2.5.8 target-size
    floor (24 px) under the 44 px goal, 2.5.7 tap alternatives for every drag,
    2.4.11 scroll-padding under fixed bars; dvh sheets with a close button;
    a probe table replaces the one-line validation.
  • audit-accessibility claimed WCAG 2.2 AA but checked none of the AA
    criteria new in 2.2. It now probes 2.4.11, 2.5.7, 2.5.8, and 3.3.8 and
    reports them.
  • plan-mobile-readiness: a thin web-view app is a Guideline 4.2
    rejection and app-generator output is 4.2.6, not 2.5.2 (downloaded
    code, now in plan-capacitor-hardening's OTA pillar). The "25%" figure
    is now cited (Apple Newsroom, May 2025: over 1.9 M of 7.7 M rejected in 2024). Adds targetSdk 36 (Play,
    2026-08-31), the Xcode 26 upload floor (2026-04-28), and age-rating answers.
  • "Capacitor 8.3.2+" was replaced everywhere: SystemBars exists since 8.0.0
    and its inset fixes continued through 8.5.2, so the skills now say "latest 8.x".
  • audit-responsive adds phone-landscape and tablet cells for native apps
    (Android 16 ignores orientation locks at ≥ 600dp); mobile-emulator-test
    gains adb probes for back, font scale, reduce motion, large screen, and nav
    mode.

Fixed

• --clean no longer wipes all of ~/.agents/skills. The Cursor mirror
  deleted the whole folder, with no backup, before copying. That folder is
  shared with Codex, Gemini, and other installers such as npx skills add -g.
  A --clean now removes only the skill folders this pack ships.
• --codex and --gemini stamped "this tool has no skills loader" into the
  generated AGENTS.md and GEMINI.md. The header now points at
  ~/.agents/skills. Existing installs get one .bak-<stamp> copy on their
  next run.
• --skill <name> --codex printed "no skills loader" and did nothing. It
  now installs that skill, and an unknown name exits 1, as it does for Cursor
  and Claude Code.
• scripts/shorten-skill-descriptions.mjs clipped mid-quote. A clip inside
  a quoted trigger or a parenthetical left it open ("tidy.), and trailing
  / or → survived (Motion /.). It now drops the dangling opener and those
  separators; --self-test runs in validate.yml.
• plan-rls-audit's description again carries the service_role key and
  security-advisor triggers its body and the cheatsheet promise, at no listing
  cost.
• Review copy fixes: .env.example lost its orphaned fal.ai note, the
  DISTRIBUTION clone one-liner is copy-pasteable, mcp/README.md names
  SUPABASE_PROJECT_REF, the trigger cheatsheet lists each skill once, and
  llms.txt calls plan-* planning skills, not audit skills.