[sajor2000]

Summary

Generated platform installs and MCP-backed workflows are now safer for real users. Platform installs keep MCP server configs pointed at installed skill files, and MCP tools now write project artifacts into the user project root instead of the installed plugin tree.

The reporting checklist surface is also consolidated around a single canonical schema and registry. New configs use stack_profile.reporting_checklist plus stack_profile.reporting_checklist_extensions, while MCP/read paths keep compatibility with older guidelines_selected and nested checklist shapes.

What Changed

Area	Before	After
MCP project files	Relative config, SAP, data-state, report, and learning paths could resolve under the plugin install/cache directory.	MCP tools resolve user artifacts through explicit project_root, CE_DATASCIENCE_PROJECT_ROOT, or the current git root.
Generated installs	MCP configs could point at source-checkout paths or ship cache artifacts.	Temp-root smoke tests verify installed MCP paths exist for Codex, OpenCode, Pi, Gemini, and Kiro, with cache artifacts excluded.
Reporting checklists	Docs and reviewers mixed legacy boolean/nested config with a smaller advertised guideline set.	A 35-guideline registry is the source of truth, and docs/reviewers use canonical stack-profile fields.
Portability checks	Only a few skill path regressions were covered.	Tests now scan skill/agent content for stale config shapes, installed-cache paths, tracked cache artifacts, and missing skill-local references.

Tests

• python3 -m py_compile plugins/ce-datascience/skills/ce-mcp-server/mcp_server/run.py
• bunx tsc --noEmit
• bun test tests/platform-smoke.test.ts tests/mcp-server.test.ts tests/guideline-registry.test.ts tests/plugin-content-portability.test.ts
• bun test (809 pass)
• bun run release:validate
• Manual temp install inspection for Claude source layout, Codex bridge/standalone, and Gemini MCP config

---