[intel352]

Adds a portable Workflow Assistant under example/workflow-agent-plugin: three skills configure apps, diagnose configuration/compatibility failures, and produce evidence tied to the exact sanitized snapshot and observed release. It calls existing wfctl mcp directly; no new server, hooks, shell tool, private infrastructure, telemetry or Compute expansion.

Validation remains distinct from application runtime acceptance. The skills account for basic-validation gaps, unresolved imports and absent declared plugin prerequisites, and use discovered argument schemas instead of stale reference examples.

Verification

• Go 1.27.2 standalone consumer/tests; Python was a convenience choice, not an official tooling requirement, and is fully removed from the package. Existing pinned public schema/ECMA-regex dependencies only; runnable consumer uses stdlib.
• 22 substantive Go tests plus helper pass with race detection; vet and actual root CI integration test pass. All prior assertions retained; UTF-8 identity, notification, cancellation and teardown regressions have mutation proof.
• Final committed ZIP independently extracted and tested with downloads disabled; real checksum-verified wfctl v0.86.2 smoke passes (33 tools), with unchanged six fixture hashes.
• Codex CLI 0.163.0 loaded the plugin and public Autodev 6.6.3 in a disposable offline home: 3 Workflow skills, 27 Autodev skills, no collisions/errors, host-discovered 33 tools/5 resources. No model turn/authentication or shared session used.
• Independent final review: SHIP-IT for bounded draft source. Package/privacy audit and installed Autodev selected-file snapshot pass. Fixtures use .yaml.txt to exclude intentional failures from runnable examples. Workflow trust policy remains unchanged.

Build evidence, independent review, Go decision.

Terminal CI and remaining acceptance

Final source: 83eef8712f39fe5918401aa9a0a3284aff5e9b1c. All source checks are terminal. Native CI and security/policy checks passed; the informational neutral result and scheduled-scan skip are expected. The benchmark is the sole failed check. The native CI run passed, including full Go tests and corrected lint. No submitted reviews, comments or inline threads remain.

The benchmark check failed before comparison: its strict listing parser rejects the existing Sonic warning that Go 1.27 falls back to encoding/json. Artifact says comparison:not-run, diagnostic or unsupported Go listing output. No performance-regression claim is made; no unrelated benchmark/dependency policy was changed.

Source closure: exact-head independent review passed, and every GitHub-required check (Build, Go Mod Tidy, Go Tests, UI Tests) passes. Performance Benchmarks is not required; the user explicitly accepts this pre-existing harness diagnostic as nonblocking. No workflow trust manifest, branch protection, or benchmark implementation was changed. The source PR is ready for ordinary review/merge eligibility; this is not a customer/host-certified release. Full model-driven skill behavior, ChatGPT desktop and application runtime remain untested. The package tree and tested ZIP are unchanged by the root-wrapper lint correction. ZIP SHA256: 92e8801631248015cf80bdccdc1c456ec459cb1791e99d0bf07d7956b8396ce1 (35,686 bytes, 24 files).

Public GitHub distribution does not establish Plugin Directory eligibility. No directory submission, remote service, credential setup, live plugin/session installation, deployment or visibility change. Shared MCP SDK/protocol modernization has a separately reviewed plan and is excluded from this PR.