[MageByte-Zero]

Summary

- manifests / bundled CLI metadata / installation docs: 2.0.1
+ manifests / bundled CLI metadata / installation docs: 2.1.0
+ CHANGELOG: 2.1.0 (2026-10-26)

Prepare the release containing #132, #133, #138 and #139. The maintainer has authorized publication and comments/closure for resolved issues. CatPaw (妙手) remains an import-package preview with client/cloud acceptance pending.

After merge, record the exact source Scanner result, synchronize the external Codex marketplace and verify clean installation before tagging. This PR does not bypass the marketplace release gate.

Evidence

• Before: latest published version and manifests were 2.0.1; fix: 修复安装链路并新增妙手导入预览，准备 v2.1.0 发布 #139's fixes were merged but unreleased.
  After: version consistency and doctor pass at 2.1.0; build and all 950 tests pass.
• Both example validations, raw-package smoke and npm pack dry run pass. The actual tarball runs its CLI/resources in an empty directory. WorkBuddy/Qoder install matching CLI + nine skills; CodeBuddy install/uninstall preserves an unrelated skill. CatPaw preview ZIP carries CLI 2.1.0. Local review documents are excluded from the tarball.
• Windows/Ubuntu Node 20/22 and Plugin Scanner: see this PR's checks before merge.

Merge Danger

Door: two-way until the release tag/npm publication.

Blast Radius: Release

Changes version metadata and release documentation only. No new runtime behavior. CatPaw client/cloud and real model execution are not validated.

[MageByte-Zero]

v2.1.0 is published to GitHub and npm. The maintainer explicitly authorized publication before the external marketplace sync; #141 made marketplace verification advisory while retaining build/test/source-version checks.

• Tag: v2.1.0 → fb5d4d535ed2abcf83615dee9e324b447fbd5875.
• GitHub Release: https://github.com/MageByte-Zero/spec-superflow/releases/tag/v2.1.0. Release notes and spec-superflow-catpaw-v2.1.0.zip are uploaded; downloading the public preview asset and running its CLI confirmed 2.1.0 and nine skills.
• npm: https://www.npmjs.com/package/spec-superflow/v/2.1.0. Public registry confirms version/latest 2.1.0, matching gitHead fb5d4d535ed2abcf83615dee9e324b447fbd5875 and integrity sha512-X07IkVr7wOX9mY0ThtI1N8BkmhPvDNluS+EoBA7srUon5195EwK6q5BLNUg0q/V/EPJ+pmE9F1KssnbdQ+ZX2Q==.
• Post-publication verification: fresh npm cache, public npm CLI version/reference read, actual Qoder and WorkBuddy release-tag clones, nine skills and matching bundled CLI/WorkBuddy registry 2.1.0 all passed. No real user installation was changed by these smoke checks.
• Source checks: ci: decouple release publication from marketplace sync #141's Ubuntu/Windows Node 20/22 checks and exact merged-source CI passed: https://github.com/MageByte-Zero/spec-superflow/actions/runs/40263103633.
• Exact merged-source Scanner: 99/A, policy_pass: true, verify_pass: true; critical/high/medium/low 0/0/0/0, info 13: https://github.com/MageByte-Zero/spec-superflow/actions/runs/40263103634.
• Issues: 安装 到 qoder 失败 #134, bug: workbuddy安装失败 #89 and ssf execution review: report path is double-prefixed for relative <change-dir> (receipts cannot be recorded) #137 are commented and closed; comments now confirm npm availability. 什么时候可以支持CatPawAI平台 #112 links the preview ZIP and remains open for desktop/cloud/model acceptance.
• Marketplace: docs: sync spec-superflow v2.1.0 hashgraph-online/awesome-codex-plugins#579 remains open and references the final tagged source/Scanner. Marketplace delivery and clean marketplace installation await upstream merge/generation.

The tag workflow created the GitHub Release but failed npm publication with registry E404: https://github.com/MageByte-Zero/spec-superflow/actions/runs/40263115826. That failure is preserved. The package was subsequently published from the unchanged tagged source using the existing package-owner login and maintainer browser confirmation. This fallback publication has no CI provenance attestation. CI publication authentication still needs repair for future releases; do not rerun the original release job to overwrite an already-published version or move/delete the tag. No credentials were copied into repository files or GitHub secrets.