[app/plugins] Notion package ships draft lock metadata and stale vendored skills

What version of the Codex App are you using?

26.810.41047 (bundle 6570)

What subscription do you have?

Not relevant to this static package defect; subscription was not inspected.

What platform is your computer?

Darwin 25.5.0 arm64

What issue are you seeing?

The bundled/curated Notion package has internally inconsistent provenance and cannot be mapped to a current public release:

• Installed cache manifest: Notion 0.1.7.
• Installed plugin.lock.json: pluginVersion: 0.1.0, generatedBy: codex plugin pack (draft), and every skill integrity is the literal placeholder sha256-<fill-during-pack>.
• The lock pins all four skills to openai/skills@c207989386b30063bcecaf6b1977d761b244732e.
• Current public openai/plugins@11c74d6ba24d3a6d48f54a194cd00ef3beea18f9 still has the same draft lock, while its manifest is 0.1.5.
• Each vendored Notion skill differs from current openai/skills@49f948faa9258a0c61caceaf225e179651397431.
• Plugin dependency resolution for notion reports no public globally listed release, so there is no supported exact package update path to pick up corrected skills.

What steps can reproduce the bug?

1. Inspect .codex-plugin/plugin.json and plugin.lock.json in the installed Notion package.
2. Compare pluginVersion with the manifest version and inspect the integrity fields.
3. Compare the four vendored skills/notion-* directories with the current .curated/notion-* directories in openai/skills.
4. Ask plugin dependency resolution for notion; it reports no public release.

No Notion workspace content or account data is required.

What is the expected behavior?

The shipped manifest and lock should agree on the plugin version; every vendored skill should have a real integrity digest and resolvable current source ref; and the package should have a supported release/update mapping.

Additional information

Suggested acceptance checks:

• packaging rejects placeholder integrity values;
• lock pluginVersion must equal manifest version;
• every source ref/path resolves and reproduces the vendored tree;
• a published package can be resolved and updated through the supported plugin path.

Related curated-skill content issues: openai/skills#524 and openai/skills#525.

Start with .codex-plugin/plugin.json and plugin.lock.json in the installed Notion package, then compare the vendored skills/notion-* directories with the current .curated/notion-* directories in openai/skills. Inspect plugin dependency resolution for notion. Done means the manifest and lock agree, integrity values and source refs are valid, vendored trees reproduce from their refs, and the package resolves through the supported update path.