diff --git a/.github/scripts/check-pr-test-coverage.mjs b/.github/scripts/check-pr-test-coverage.mjs
index 27731dd7..f57ac725 100644
--- a/.github/scripts/check-pr-test-coverage.mjs
+++ b/.github/scripts/check-pr-test-coverage.mjs
@@ -9,8 +9,8 @@
 import { fileURLToPath } from 'node:url';
 
 const TEST_PATTERNS = [
-  /\.test\.(ts|js|tsx|jsx)$/,
-  /\.spec\.(ts|js|tsx|jsx)$/,
+  /\.test\.(ts|js|tsx|jsx|mjs|cjs)$/,
+  /\.spec\.(ts|js|tsx|jsx|mjs|cjs)$/,
   /(?:^|\/)tests?\//,
   /\/__tests__\//,
 ];
diff --git a/.github/scripts/tests/check-pr-test-coverage.test.mjs b/.github/scripts/tests/check-pr-test-coverage.test.mjs
index a76a71b2..b211cd14 100644
--- a/.github/scripts/tests/check-pr-test-coverage.test.mjs
+++ b/.github/scripts/tests/check-pr-test-coverage.test.mjs
@@ -15,6 +15,14 @@ test('passes when .spec.js file is changed', () => {
   assert.equal(checkTestCoverage(makeFiles(['src/bar.spec.js']), 'fix: bug').passed, true);
 });
 
+test('passes when .test.mjs file is changed', () => {
+  assert.equal(checkTestCoverage(makeFiles(['scripts/foo.test.mjs', 'scripts/foo.mjs']), 'fix: bug').passed, true);
+});
+
+test('passes when .test.cjs file is changed', () => {
+  assert.equal(checkTestCoverage(makeFiles(['scripts/bar.test.cjs']), 'fix: bug').passed, true);
+});
+
 test('passes when file under tests/ is changed', () => {
   assert.equal(checkTestCoverage(makeFiles(['tests/unit/baz.ts']), 'fix: bug').passed, true);
 });
diff --git a/scripts/release-package-manifest.json b/scripts/release-package-manifest.json
index 66e53e16..9f851297 100644
--- a/scripts/release-package-manifest.json
+++ b/scripts/release-package-manifest.json
@@ -62,12 +62,12 @@
   {
     "dir": "packages/skills-catalog",
     "name": "@paperclipai/skills-catalog",
-    "publishFromCi": false
+    "publishFromCi": true
   },
   {
     "dir": "packages/teams-catalog",
     "name": "@paperclipai/teams-catalog",
-    "publishFromCi": false
+    "publishFromCi": true
   },
   {
     "dir": "packages/db",
@@ -82,7 +82,7 @@
   {
     "dir": "packages/plugins/plugin-workspace-diff",
     "name": "@paperclipai/plugin-workspace-diff",
-    "publishFromCi": false
+    "publishFromCi": true
   },
   {
     "dir": "server",
@@ -132,12 +132,12 @@
   {
     "dir": "packages/plugins/sandbox-providers/kubernetes",
     "name": "@paperclipai/plugin-kubernetes",
-    "publishFromCi": false
+    "publishFromCi": true
   },
   {
     "dir": "packages/plugins/sandbox-providers/novita",
     "name": "@paperclipai/plugin-novita-sandbox",
-    "publishFromCi": false
+    "publishFromCi": true
   },
   {
     "dir": "ui",
diff --git a/scripts/release-package-map.mjs b/scripts/release-package-map.mjs
index a990b88e..12ed0124 100644
--- a/scripts/release-package-map.mjs
+++ b/scripts/release-package-map.mjs
@@ -79,6 +79,45 @@ function loadReleaseManifest() {
   });
 }
 
+// Sections whose @paperclipai workspace deps are rewritten to the calver release
+// version by replaceWorkspaceDeps() and that consumers resolve at install time.
+const RESOLVED_DEP_SECTIONS = ["dependencies", "optionalDependencies", "peerDependencies"];
+
+// A publishFromCi:true package gets republished at the unified calver version every
+// release, and every @paperclipai/* workspace: dep it declares is rewritten to that
+// same calver version. If the target is NOT publishFromCi:true it never gets a calver
+// publish, so the rewritten spec points at a version that will never exist on npm and
+// the package becomes uninstallable. Detect those edges so the release fails fast
+// instead of shipping a broken canary (e.g. server -> skills-catalog from #8327).
+function findUnpublishableWorkspaceEdges(packages) {
+  const publishFromCiByName = new Map(packages.map((pkg) => [pkg.name, pkg.publishFromCi]));
+  const problems = [];
+
+  for (const pkg of packages) {
+    if (!pkg.publishFromCi) continue;
+
+    for (const section of RESOLVED_DEP_SECTIONS) {
+      const deps = pkg.pkg[section];
+      if (!deps) continue;
+
+      for (const [depName, spec] of Object.entries(deps)) {
+        if (!depName.startsWith("@paperclipai/")) continue;
+        if (typeof spec !== "string" || !spec.startsWith("workspace:")) continue;
+        if (publishFromCiByName.get(depName) === true) continue;
+
+        problems.push(
+          `${pkg.name} (${pkg.dir}) is publishFromCi:true but declares a "${section}" workspace dependency on ${depName}, ` +
+            `which is not publishFromCi:true. The release version rewrite would point ${depName} at the calver version, ` +
+            `but that version is never published, so installs of ${pkg.name} would fail to resolve. ` +
+            `Enable publishFromCi for ${depName} (bootstrap its first npm publish if needed) or drop the workspace dependency.`,
+        );
+      }
+    }
+  }
+
+  return problems;
+}
+
 function buildReleasePackagePlan() {
   const discoveredPackages = discoverPublicPackages();
   const manifestEntries = loadReleaseManifest();
@@ -124,6 +163,11 @@ function buildReleasePackagePlan() {
     publishFromCi: manifestByDir.get(pkg.dir).publishFromCi,
   }));
 
+  const edgeProblems = findUnpublishableWorkspaceEdges(packages);
+  if (edgeProblems.length > 0) {
+    throw new Error(`release package manifest validation failed:\n- ${edgeProblems.join("\n- ")}`);
+  }
+
   return packages;
 }
 
@@ -280,6 +324,7 @@ export {
   buildReleasePackagePlan,
   checkConfiguration,
   discoverPublicPackages,
+  findUnpublishableWorkspaceEdges,
   getReleasePackages,
   loadReleaseManifest,
 };
diff --git a/scripts/release-package-map.test.mjs b/scripts/release-package-map.test.mjs
index 704dd3dd..b632b92e 100644
--- a/scripts/release-package-map.test.mjs
+++ b/scripts/release-package-map.test.mjs
@@ -4,9 +4,14 @@ import test from "node:test";
 import {
   buildReleasePackagePlan,
   checkConfiguration,
+  findUnpublishableWorkspaceEdges,
   getReleasePackages,
 } from "./release-package-map.mjs";
 
+function pkg(name, { publishFromCi, ...deps } = {}) {
+  return { name, dir: name, publishFromCi, pkg: { name, ...deps } };
+}
+
 test("release package manifest covers all public packages with explicit CI enrollment", () => {
   const packages = buildReleasePackagePlan();
   assert.ok(packages.length > 0);
@@ -22,3 +27,78 @@ test("release package list only contains CI-enrolled packages", () => {
 test("release package configuration validates successfully", () => {
   assert.doesNotThrow(() => checkConfiguration());
 });
+
+test("guard flags a publishFromCi:true package depending on a publishFromCi:false package", () => {
+  const problems = findUnpublishableWorkspaceEdges([
+    pkg("@paperclipai/server", {
+      publishFromCi: true,
+      dependencies: { "@paperclipai/skills-catalog": "workspace:*" },
+    }),
+    pkg("@paperclipai/skills-catalog", { publishFromCi: false }),
+  ]);
+
+  assert.equal(problems.length, 1);
+  assert.match(problems[0], /@paperclipai\/server/);
+  assert.match(problems[0], /@paperclipai\/skills-catalog/);
+});
+
+test("guard inspects optional and peer dependency sections too", () => {
+  const problems = findUnpublishableWorkspaceEdges([
+    pkg("@paperclipai/server", {
+      publishFromCi: true,
+      optionalDependencies: { "@paperclipai/opt": "workspace:^" },
+      peerDependencies: { "@paperclipai/peer": "workspace:*" },
+    }),
+    pkg("@paperclipai/opt", { publishFromCi: false }),
+    pkg("@paperclipai/peer", { publishFromCi: false }),
+  ]);
+
+  assert.equal(problems.length, 2);
+});
+
+test("guard treats a workspace dep on an unknown @paperclipai package as unpublishable", () => {
+  const problems = findUnpublishableWorkspaceEdges([
+    pkg("@paperclipai/server", {
+      publishFromCi: true,
+      dependencies: { "@paperclipai/private-internal": "workspace:*" },
+    }),
+  ]);
+
+  assert.equal(problems.length, 1);
+});
+
+test("guard allows true->true workspace edges", () => {
+  const problems = findUnpublishableWorkspaceEdges([
+    pkg("@paperclipai/server", {
+      publishFromCi: true,
+      dependencies: { "@paperclipai/shared": "workspace:*" },
+    }),
+    pkg("@paperclipai/shared", { publishFromCi: true }),
+  ]);
+
+  assert.deepEqual(problems, []);
+});
+
+test("guard ignores non-workspace specs, non-internal deps, and edges from off-train packages", () => {
+  const problems = findUnpublishableWorkspaceEdges([
+    pkg("@paperclipai/server", {
+      publishFromCi: true,
+      dependencies: {
+        "@paperclipai/pinned": "0.3.1",
+        zod: "^3.0.0",
+      },
+    }),
+    pkg("@paperclipai/pinned", { publishFromCi: false }),
+    pkg("@paperclipai/offtrain", {
+      publishFromCi: false,
+      dependencies: { "@paperclipai/also-off": "workspace:*" },
+    }),
+    pkg("@paperclipai/also-off", { publishFromCi: false }),
+  ]);
+
+  assert.deepEqual(problems, []);
+});
+
+test("the live release manifest has no unpublishable workspace edges", () => {
+  assert.deepEqual(findUnpublishableWorkspaceEdges(buildReleasePackagePlan()), []);
+});