docs: drop docs/distribution.md; release config is the doc

README.md

@@ -40,6 +40,8 @@ claude plugin marketplace add putdotio/putio-dev-agent-plugin
 claude plugin install putio-dev@putio
 ```
 
+There is no publish pipeline: the marketplace serves `main`.
+
 Codex takes the same marketplace with `codex plugin marketplace add` and
 `codex plugin add`. The root `plugin.json` follows
 [Agent Plugins](https://agent-plugins.org) for other clients that install
@@ -48,7 +50,6 @@ plugins from Git.
 ## Docs
 
 - [Contributing](CONTRIBUTING.md): setup, skill layout rules, and the verify gate
-- [Distribution](docs/distribution.md): consumer ownership and the quality gate
 - [Skill fleet](docs/skill-fleet.md): the put.io skill inventory
 
 ## Security

skills/putio-frontend-dev/evals/repo-verify-delivery/criteria.json

@@ -18,8 +18,8 @@
       "max_score": 2
     },
     {
-      "name": "documents_distribution_contract",
-      "description": "Places release, publishing, or deployment contract details in `docs/distribution.md` with contributor docs linking to it when needed.",
+      "name": "leaves_release_docs_to_config",
+      "description": "Leaves release, publishing, and deployment behavior to the workflows and release config, with no `docs/distribution.md`; only a human-only step or must-not-break rule gets a line in `AGENTS.md` or `CONTRIBUTING.md`.",
       "max_score": 2
     },
     {

skills/putio-frontend-dev/references/delivery.md

@@ -4,7 +4,7 @@ Workflow detail lives in Notion:
 [Release workflow mechanics](https://app.notion.com/p/3fdd546ba2f58124966ce3993500204e),
 [Repo secrets setup](https://app.notion.com/p/3fdd546ba2f5813d8a36fd219d145900),
 and the Delivery pages in [SKILL.md](../SKILL.md#knowledge-base). Each repo's
-`docs/distribution.md` owns its targets, triggers, and gates.
+workflows and release config own its targets, triggers, and gates.
 
 ## Verify
 
@@ -30,8 +30,6 @@ TypeScript repos use Vite+ (`vp`) with `check`, `build`, `test`, and `verify`.
 - Jobs that run project code never use `pull_request_target`.
 - After a delivery change, run the artifact or app smoke check, or record the
   missing one as a repo gap.
-- Update `docs/distribution.md` in the same change when release, cache,
-  provenance, or signing behavior changes.
 
 ## Secrets
 

skills/putio-frontend-dev/references/docs.md

@@ -9,10 +9,12 @@ templates live in Notion:
 - Security reporting follows the
   [org-wide policy](https://github.com/putdotio/.github/blob/main/SECURITY.md);
   a repo adds `SECURITY.md` only when its policy differs.
-- `docs/distribution.md` owns release and publishing; contributor docs link
-  to it. Name the durable handoff (tested output, Release asset, registry
-  package, image digest, provider package), never Actions artifacts.
-- Docs use kebab-case names, such as `docs/distribution.md`. Conventional root
+- No `docs/distribution.md`: workflows and release config document release
+  and publishing. A step a human must take or a rule they must not break that
+  no file states (a store submission, a version pin, a setting outside the
+  repo) gets a line in `AGENTS.md` or `CONTRIBUTING.md` that links the
+  workflow.
+- Docs use kebab-case names, such as `docs/test-harness.md`. Conventional root
   files (`README.md`, `CONTRIBUTING.md`, `LICENSE`, `SECURITY.md`, `AGENTS.md`,
   `CLAUDE.md`) and platform-required names (`.github/pull_request_template.md`,
   `.github/ISSUE_TEMPLATE/`, `CODEOWNERS`, `SKILL.md`) keep theirs.

skills/putio-sdk-dev/references/release.md

@@ -38,5 +38,3 @@ Check live provider settings before claiming a security posture.
   artifact, not an Actions artifact. Verify the published artifact matches
   what you inspected, then promote it without rebuilding, and record the commit SHA, tag, package version, artifact
   digest, workflow run, and published artifact identity.
-- **Docs**: release and publishing behavior lives in the repo's
-  `docs/distribution.md`.