Task: Install the server child-friendly replies plugin by default

Identity

Task ID: 20260928-default-child-replies-0108dd01
Mode: Feature
Branch: codex/20260928-default-child-replies-0108dd01-default-child-replies
Worktree: D:\Datas\OthersProjects.codex-worktrees\makelore\20260928-default-child-replies-0108dd01
Base commit: efff238a75
Owner: codex
Status: Ready for Integration

Ship the original child-friendly Skill inside MakeLore 2.0.2 as code-owned bundled plugin version 1.0.1, with default account acquisition and no separate package download or signature requirement.

On 2026-09-29 the user explicitly chose “改成客户端内置，默认安装”, superseding the earlier server-only package requirement. Follow the project-scaffold bundled path; keep project enablement separate, preserve account opt-out, and leave other downloaded-package signature verification unchanged.
Official check/start/status passed for the isolated feature Identity. Planning Gate passed after own task, entry/memory, positioning/current-state/decisions/architecture/domain/success/evidence and 135 peer coordination records. Positioning still includes template text; AGENTS/README and current source establish product meaning. Old Marketplace tasks overlap paths but preserve the same contracts; no semantic conflict found. Primary main remains owned by integration task 20260928-merge-teacher-cards-a09c07f3 and is untouched.
User-provided no-subagent constraint honored. Feature code and mandatory task record only; canonical docs remain unchanged. WS companion task 20260928-default-child-replies-06693309 owns readiness repair.

Original Skill and openai.yaml are preserved byte-for-byte under resources/coding-plugins/child-friendly-replies; package-local LF attributes retain those bytes. Registered the fixed root, code-owned release ...0605 and project-wide Skill semantics alongside project-scaffold. Existing packaging includes the entire resources tree.
Default Library refresh now acquires the exact bundled release; it never calls Package Store download/resolve or requires a plugin signature. Account operation serialization, binding checks, failure retry and persistent removal remain. Already acquired entries are reused. Existing installed Artifact files cannot shadow code-owned definitions.
New bundled Skill is activated by the existing project enablement control without requiring per-Agent assignment; disabled projects and removed accounts do not receive it. Renderer uses the same bundled Installed-tab projection as other official plugins, without a fake download receipt.
Client version is 2.0.2 to match the new server compatibility floor; README and Electron fixture describe the current bundled behavior. No installer packaging, update-feed publication or installed app mutation occurred.

Red: five default bundled-acquisition tests failed before replacing the signed-download implementation. Final focused run: 113 unit tests passed across default acquisition, manifest parsing, effective Skill materialization, workspace command boundaries, composition, facade, routes and Marketplace client.
The real packaged Skill parser/materializer test proves project enablement yields the original Skill without assignment and account removal stops it. Cases also cover unsigned/no-signature bundled metadata, old Artifact deferral, acquisition retry, account switch and removal during acquisition.
Standard typecheck, changed-file ESLint and production Vite build passed. Electron default Installed-tab/optional acquisition scenario passed with no Package Store installation row and no child-plugin download/install request; the fixture covers UI, not a live deployment.
Direct byte comparison proves original Skill and openai.yaml unchanged. Companion server run: 24 passed, including old-client rejection, signature-free bundled Resolve and retained legacy release/account history. Task-aware drift check completes documentation before commit.

Integrate both verified sources, migrate Works Square to 20260929_0098 and release MakeLore 2.0.2. Local main merge permission and ownership handoff were already granted; no push, deployment or installed-client update is claimed. Retain source worktrees pending explicit cleanup consent.

Target current-state: replace prior server-download/default-signing guidance with code-owned bundled 1.0.1 in client 2.0.2, default acquisition, persistent opt-out and normal project enablement. User explicitly confirmed the delivery change. Evidence: parser/materializer tests, 113 related unit cases, build and Electron UI. Source task records remain read-only during integration.

Bundled check/start/status verified the same feature identity and worktree. Reused previously loaded entry, memory index, positioning, decisions, architecture/domain/evidence and 135 peer scopes at unchanged source baseline; own task refreshed. Both feature planning gates passed. Existing primary integration owner is now 20260928-merge-default-child-b4d62e81 under prior user authorization. No subagents or foreign-document edits.