diff --git a/.changepacks/changepack_log_agent_skills.json b/.changepacks/changepack_log_agent_skills.json
deleted file mode 100644
index 81e8549a..00000000
--- a/.changepacks/changepack_log_agent_skills.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "changes": {
-    "crates/devup-mcp/Cargo.toml": "Minor"
-  },
-  "note": "devup_skills reports which agent skills this workspace is missing for the code devup-mcp emits, and installs the ones devup-mcp carries. The TSX an export returns is devup-ui code, and on a machine that has devup-mcp and nothing else the receiving agent has never seen devup-ui: it does not know the components are compile-time placeholders, that $token refers to devup.json, or that a style prop takes a responsive array. It guesses, and this server can neither see nor correct the guesses. Returning the rules in a response does not fix that, because a document handed over once is read once; every agent runtime already has a loader that reads SKILL.md from a directory and surfaces it on its own triggers for the rest of that session and every session after it. So the tool reports install state - a concrete gap - and writes the documents rather than the prose. Two origins, handled differently on purpose. devup-ui, vespera and vespertide are DevFive's own, so their canonical SKILL.md is vendored into the binary and installs with no network, which matters because a bare machine is exactly where a download is least likely to work; the manifest records each embedded commit and SHA-256 and the URL of the current revision, because a vendored copy goes stale and scripts/refresh-skills.mjs is how it stops being stale. vercel-react-best-practices and vercel-react-view-transitions are not vendored: vercel-labs/agent-skills publishes no LICENSE file, so its content is not devup-mcp's to redistribute, and they are multi-file anyway - one is a SKILL.md plus an AGENTS.md and some seventy rule files, about 350 KB - so copying them was never the right shape. For those the publisher's own command is handed over and never executed, because a design-to-code server that shells out to a package installer turns one compromised registry entry into arbitrary execution on every machine that ever exported a screen. Skills install project-locally, preferring an existing .claude/skills, .opencode/skill or .agents/skills, through the same OutputPolicy and one OutputTransaction as every other file this server writes, so a skill lands under an allowed write root or not at all. The provenance comment is placed after the YAML frontmatter rather than before it: a SKILL.md opens with --- at byte zero and a comment in front of it leaves a file that is listed as installed and silently never loads, which is worse than no install because nothing shows up to say so. Inducement is deliberately narrow - one line in instructions, kept inside the existing 1,200-byte budget, and a skillGap on devup_ui_validate only when there are violations and the skill is genuinely absent, since telling someone who already has it to install it is the noise that teaches them to skip the field. Verified against the release binary over real stdio on a bare workspace: five reported missing, three written and confirmed on disk, two handed over as commands, the gap closing to three installed and the skillGap disappearing.",
-  "date": "2026-09-14T20:00:00+09:00"
-}
diff --git a/Cargo.lock b/Cargo.lock
index 74cdad96..ddbcea0f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -693,7 +693,7 @@ checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
 
 [[package]]
 name = "devup-mcp"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -722,7 +722,7 @@ dependencies = [
 
 [[package]]
 name = "devup-mcp-devup-ui"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "devup-mcp-figma",
  "insta",
@@ -739,7 +739,7 @@ dependencies = [
 
 [[package]]
 name = "devup-mcp-figma"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -766,7 +766,7 @@ dependencies = [
 
 [[package]]
 name = "devup-mcp-visual"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "image",
diff --git a/Cargo.toml b/Cargo.toml
index a6eb9f36..04cbd1ca 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,7 +8,7 @@ members = [
 resolver = "3"
 
 [workspace.package]
-version = "0.6.0"
+version = "0.7.0"
 edition = "2024"
 rust-version = "1.98"
 license = "MIT"