diff --git a/.github/workflows/publish-knowledge.yml b/.github/workflows/publish-knowledge.yml
deleted file mode 100644
index 8f6d644..0000000
--- a/.github/workflows/publish-knowledge.yml
+++ /dev/null
@@ -1,86 +0,0 @@
-name: Publish Knowledge
-
-on:
-  workflow_dispatch:
-    inputs:
-      mode:
-        description: "Publish mode"
-        required: true
-        type: choice
-        options:
-          - channel
-          - stable
-      channel:
-        description: "dist-tag (channel mode only, e.g. mcp/plugin/advisor)"
-        required: false
-        type: string
-
-concurrency:
-  group: publish-knowledge-${{ inputs.mode }}-${{ inputs.channel }}
-  cancel-in-progress: false
-
-jobs:
-  publish-stable:
-    if: inputs.mode == 'stable'
-    name: publish stable (with knowledge) to npm + tag
-    runs-on: ubuntu-latest
-    environment: production # Required Reviewers gate
-    permissions:
-      contents: write # push lightweight tag to origin
-      id-token: write # OIDC for npm Trusted Publishing + provenance
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: pnpm/action-setup@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "24"
-          cache: pnpm
-          registry-url: "https://registry.npmjs.org/"
-
-      - name: Install gitleaks
-        run: |
-          set -euo pipefail
-          GITLEAKS_VERSION=8.21.2
-          curl -sSfL \
-            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
-            | sudo tar -xz -C /usr/local/bin gitleaks
-          gitleaks version
-
-      - run: pnpm install --frozen-lockfile
-
-      - name: publish-stable (with knowledge)
-        run: node tools/release/publish-stable.mjs --knowledge
-
-  publish-channel:
-    if: inputs.mode == 'channel'
-    name: publish beta (with knowledge) to npm
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read # no tag, no Release; just publish
-      id-token: write # OIDC for npm Trusted Publishing + provenance
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: pnpm/action-setup@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "24"
-          cache: pnpm
-          registry-url: "https://registry.npmjs.org/"
-
-      - name: Install gitleaks
-        run: |
-          set -euo pipefail
-          GITLEAKS_VERSION=8.21.2
-          curl -sSfL \
-            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
-            | sudo tar -xz -C /usr/local/bin gitleaks
-          gitleaks version
-
-      - run: pnpm install --frozen-lockfile
-
-      - name: publish-channel (with knowledge)
-        run: node tools/release/publish-channel.mjs --knowledge --channel "${{ inputs.channel }}"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index bd91e89..c45f8b4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,6 +3,13 @@ name: Publish
 on:
   workflow_dispatch:
     inputs:
+      package:
+        description: "Which package set to publish"
+        required: true
+        type: choice
+        options:
+          - bailian-cli
+          - knowledge-studio-cli
       mode:
         description: "Publish mode"
         required: true
@@ -16,13 +23,13 @@ on:
         type: string
 
 concurrency:
-  group: publish-${{ inputs.mode }}-${{ inputs.channel }}
+  group: publish-${{ inputs.package }}-${{ inputs.mode }}-${{ inputs.channel }}
   cancel-in-progress: false
 
 jobs:
   publish-stable:
     if: inputs.mode == 'stable'
-    name: publish stable to npm + tag
+    name: publish stable (${{ inputs.package }}) to npm + tag
     runs-on: ubuntu-latest
     environment: production # Required Reviewers gate
     permissions:
@@ -51,11 +58,11 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: publish-stable
-        run: node tools/release/publish-stable.mjs
+        run: node tools/release/publish-stable.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }}
 
   publish-channel:
     if: inputs.mode == 'channel'
-    name: publish beta to npm
+    name: publish channel (${{ inputs.package }}) to npm
     runs-on: ubuntu-latest
     permissions:
       contents: read # no tag, no Release; just publish
@@ -83,4 +90,4 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: publish-channel
-        run: node tools/release/publish-channel.mjs --channel "${{ inputs.channel }}"
+        run: node tools/release/publish-channel.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }} --channel "${{ inputs.channel }}"
diff --git a/tools/release/check.mjs b/tools/release/check.mjs
index 71c4fbd..f5f61a0 100644
--- a/tools/release/check.mjs
+++ b/tools/release/check.mjs
@@ -39,10 +39,8 @@ export async function runCheck(options = {}) {
   log(`bailian-cli-core@${coreJson.version}`);
   log(`bailian-cli@${cliJson.version}`);
 
-  step("build library packages (core, runtime, commands)");
-  // `bailian-cli^...` = all workspace dependencies of bailian-cli, in topological
-  // order, excluding bailian-cli itself. generate:reference imports their dist.
-  run("pnpm", ["--filter", "bailian-cli^...", "run", "build"]);
+  step("build bailian-cli-core");
+  run("pnpm", ["--filter", "bailian-cli-core", "run", "build"]);
 
   step(
     channel
diff --git a/tools/release/lib/packages.mjs b/tools/release/lib/packages.mjs
index 86f89ed..d7118f5 100644
--- a/tools/release/lib/packages.mjs
+++ b/tools/release/lib/packages.mjs
@@ -4,17 +4,13 @@ import { fileURLToPath } from "url";
 
 export const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
 
-// Dependency order: core ← runtime ← commands ← cli.
-// Consumers rely on this ordering for build/publish (dependencies first).
 export const PACKAGES = [
   { key: "core", dir: "packages/core", name: "bailian-cli-core" },
-  { key: "runtime", dir: "packages/runtime", name: "bailian-cli-runtime" },
-  { key: "commands", dir: "packages/commands", name: "bailian-cli-commands" },
   { key: "cli", dir: "packages/cli", name: "bailian-cli" },
 ];
 
 // knowledge-studio-cli shares the same library deps as bailian-cli.
-// Published via a separate workflow (publish-knowledge.yml) with --knowledge flag.
+// Published via publish.yml with package=knowledge-studio-cli (passes --knowledge flag).
 export const KSCLI_PACKAGE = { key: "kscli", dir: "packages/kscli", name: "knowledge-studio-cli" };
 export const ALL_PACKAGES = [...PACKAGES, KSCLI_PACKAGE];
 
diff --git a/tools/release/lib/validate.mjs b/tools/release/lib/validate.mjs
index d860355..bb0fe92 100644
--- a/tools/release/lib/validate.mjs
+++ b/tools/release/lib/validate.mjs
@@ -31,19 +31,17 @@ export function loadAndValidatePackages({ packages } = {}) {
   }
 
   const coreJson = jsonByKey.get("core");
+  const cliJson = jsonByKey.get("cli");
   const version = coreJson.version;
 
   for (const pkg of pkgs) {
     const json = jsonByKey.get(pkg.key);
-    // All packages release in lockstep, so every version must match.
     if (json.version !== version) {
       throw new Error(
         `all package versions must match ${version} (bailian-cli-core), ` +
           `but ${pkg.name} is ${json.version}.`,
       );
     }
-    // Any runtime dependency on a sibling workspace package must be "workspace:*"
-    // so `pnpm publish` rewrites it to the concrete release version.
     for (const [dep, range] of Object.entries(json.dependencies ?? {})) {
       if (internalNames.has(dep) && range !== "workspace:*") {
         throw new Error(`${pkg.name} dependency on ${dep} must be "workspace:*", got ${range}.`);
@@ -51,7 +49,7 @@ export function loadAndValidatePackages({ packages } = {}) {
     }
   }
 
-  return { coreJson, cliJson: jsonByKey.get("cli") };
+  return { coreJson, cliJson };
 }
 
 const RESERVED_CHANNELS = new Set(["latest", "beta", "alpha", "next", "rc", "canary", "dev"]);
diff --git a/tools/release/publish-channel.mjs b/tools/release/publish-channel.mjs
index bf5edca..9c24f49 100644
--- a/tools/release/publish-channel.mjs
+++ b/tools/release/publish-channel.mjs
@@ -65,8 +65,6 @@ try {
     json.version = betaVersion;
     writePackageJson(pkg, json);
   }
-  // pnpm pack resolves `workspace:*` to the in-tree version, so each tarball
-  // will depend on its siblings at <betaVersion> after this bump.
 
   await runCheck({ channel: true, knowledge });
 
@@ -80,7 +78,7 @@ try {
   if (packages.every((pkg) => published.get(pkg.key))) {
     log("\nall packages already published; nothing to do.");
   } else {
-    // Publish in dependency order (core → runtime → commands → cli [→ kscli]).
+    // Publish in dependency order.
     for (const pkg of packages) {
       if (published.get(pkg.key)) continue;
       step(`publish ${pkg.name}@${betaVersion} (tag=${channel}, provenance)`);
diff --git a/tools/release/publish-stable.mjs b/tools/release/publish-stable.mjs
index 16bb15a..13c6359 100644
--- a/tools/release/publish-stable.mjs
+++ b/tools/release/publish-stable.mjs
@@ -4,7 +4,7 @@ import { parseArgs } from "util";
 import { runCheck } from "./check.mjs";
 import { createTag, currentBranch, isWorkingTreeClean, pushTag, tagExists } from "./lib/git.mjs";
 import { npmViewExists, pnpmPublish } from "./lib/npm.mjs";
-import { ALL_PACKAGES, PACKAGES } from "./lib/packages.mjs";
+import { ALL_PACKAGES, findPackage, PACKAGES } from "./lib/packages.mjs";
 
 function log(msg = "") {
   process.stdout.write(`${msg}\n`);
@@ -58,7 +58,7 @@ try {
     process.exit(0);
   }
 
-  // Publish in dependency order (core → runtime → commands → cli [→ kscli]).
+  // Publish in dependency order.
   for (const pkg of packages) {
     if (published.get(pkg.key)) continue;
     step(`publish ${pkg.name}@${version} (tag=latest, provenance)`);