diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index acba4f4..e82ed0a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,6 +36,10 @@ jobs:
           MSIX_CERT_PASSWORD: ${{ secrets.MSIX_CERT_PASSWORD }}
           MSIX_SKIP_SIGN: ${{ secrets.MSIX_SKIP_SIGN }}
         run: |
+          $skipSign = "${{ secrets.MSIX_SKIP_SIGN }}"
+          if ([string]::IsNullOrWhiteSpace($skipSign)) { $skipSign = "true" }
+          $env:MSIX_SKIP_SIGN = $skipSign
+
           $version = "${{ github.event.inputs.build_version }}"
           if ([string]::IsNullOrWhiteSpace($version)) { $version = "${{ github.ref_name }}" }
           .\\scripts\\build_msix.ps1 `
diff --git a/.where-agent-progress.md b/.where-agent-progress.md
index 285e783..e872ffa 100644
--- a/.where-agent-progress.md
+++ b/.where-agent-progress.md
@@ -1,6 +1,4 @@
-# Plan: 全链路 Logo 统一
-- [x] 任务栏/安装器图标统一到指定 Logo（ico）
-- [x] 桌面运行时应用图标链路统一（AppUserModelID + QApplication/窗口图标）
-- [x] 前端侧边栏品牌图标替换为同款 Logo
-- [x] 前端 favicon 替换为同款 Logo
-- [x] 完成基础验证（py_compile + 前端组件测试）
+# Plan: 生成 Store 提交用未签名 MSIX
+- [x] 确认现有脚本支持跳过签名
+- [x] 调整 GitHub Actions 默认启用 MSIX_SKIP_SIGN
+- [x] 校验变更并给出 Store 提交流程建议
diff --git a/scripts/build_msix.ps1 b/scripts/build_msix.ps1
index 1af4fad..026a400 100644
--- a/scripts/build_msix.ps1
+++ b/scripts/build_msix.ps1
@@ -209,6 +209,7 @@ if (-not (Test-Path -LiteralPath $certDir)) {
 }
 $certPfx = Join-Path $certDir "ProtoFlow_msix_signing.pfx"
 $certCer = Join-Path $certDir "ProtoFlow_msix_signing.cer"
+$usingSelfSignedCert = $false
 
 if ($env:MSIX_CERT_PFX_BASE64 -and $env:MSIX_CERT_PASSWORD) {
   Write-Host "==> Use provided signing certificate"
@@ -217,6 +218,7 @@ if ($env:MSIX_CERT_PFX_BASE64 -and $env:MSIX_CERT_PASSWORD) {
 }
 else {
   Write-Host "==> Generate self-signed certificate for MSIX"
+  $usingSelfSignedCert = $true
   $cert = New-SelfSignedCertificate -Type Custom `
     -KeyAlgorithm RSA `
     -KeyLength 2048 `
@@ -247,6 +249,18 @@ catch {
 
 Write-Host "==> Verify signature"
 & $signTool verify /pa $msixPath | Out-Host
+$verifyExitCode = $LASTEXITCODE
+if ($verifyExitCode -ne 0) {
+  if ($usingSelfSignedCert) {
+    Write-Warning "SignTool verify failed (exit code $verifyExitCode) because self-signed root is not trusted on this machine. Continue."
+    if (Test-Path -LiteralPath $certCer) {
+      Write-Warning "Install certificate to Trusted Root and Trusted People before local installation: $certCer"
+    }
+  }
+  else {
+    throw "SignTool verify failed with exit code $verifyExitCode. Check certificate chain trust (root/intermediate)."
+  }
+}
 
 Write-Host "MSIX generated: $msixPath"
 if (Test-Path -LiteralPath $certCer) {