@haiyangbg/buildbeat 2.0.0-beta.5 → 2.0.0

package/CHANGELOG.md

@@ -2,9 +2,17 @@
 
 > 本项目吃自己的狗粮(红线④:必更 CHANGELOG)。格式循 Keep a Changelog,倒序。
 
+## v2.0.0 — 2026-09-05（正式版：v2 成为 `latest`）
+
+> **发布状态**：所有者 2026-09-05 授权（「正式发布」）；从 `main` 以稳定 tag `v2.0.0` 发布到 dist-tag `latest`，发布与独立回读证据在发布后回填到 `docs/V2.0.0-RELEASE-EVIDENCE-2026-09-05.md`。
+
+- **内容与 `2.0.0-beta.5` 同源**（迭代 01～09 的全部 v2 运行时、Skill §0.5 驾驶手册、`templates/v2/`、十件套指南、lessons #1–#25），外加 README 中英文的「当前主线是 v2」段与 `docs/CLI.md` 的 2.0.0 状态行。
+- **对拷出项目意味着什么**：v1 文件总线、`buildbeat` 生命周期命令（`doctor` / `init` / `adopt` / `upgrade` / `version`）与安全边界**不变**，schema 仍是 2；`npm install --global @haiyangbg/buildbeat@latest` 现在同时给出 `buildbeat` 与 `buildbeat-v2`。骨架版本仍是 `v1.21`（模板未变，`buildbeat upgrade` 对 1.21 骨架报 up-to-date，不需要 `--major`）；manifest 里的 `cliVersion` 只是记录，不触发升级。v2 运行时是可选叠加：按 [`docs/v2/guide/08-migration-v1.md`](docs/v2/guide/08-migration-v1.md) 建 `delivery/work/` 与 run 配置即可，不动现有 `pm/` 与 `contracts/`。
+- **分发口径**：`latest` 从 1.21.0 切到 2.0.0；`next` 保留给后续预发布；旧 `solobaton` 包不变。
+
 ## v2.0.0-beta.5 — 2026-09-05（迭代 09：预算是刹车、故障分开算、成本看得见）
 
-> **发布状态**：所有者 2026-09-05 授权（「发，并且迭代5轮可以直接切换到线上版本了」）；发布与独立回读证据在发布后回填到 `docs/V2.0.0-BETA.5-RELEASE-EVIDENCE-2026-09-05.md`。
+> **发布状态**：`@haiyangbg/buildbeat@2.0.0-beta.5` 已于 2026-09-05 经 OIDC Trusted Publishing 发布到 dist-tag `next`（run 33972774150，双 job success；所有者授权「发，并且迭代5轮可以直接切换到线上版本了」）；`latest` 保持 v1.21.0。独立回读（直连 npmjs.org）：dist-tag 路由、integrity、attestation、隔离安装、`doctor` 有界 JSON 全过，证据见 [`docs/V2.0.0-BETA.5-RELEASE-EVIDENCE-2026-09-05.md`](docs/V2.0.0-BETA.5-RELEASE-EVIDENCE-2026-09-05.md)。所有者本机 CLI 已从源码链接切回正式包。
 > 来源：试点工作区 2026-09-03～09-05（beta.4 之后）全部驾驶会话、约 60 个 worker 会话与两个子仓 50 个 Run 台账的复盘回灌（迭代 09，lessons #23–#25），以及 2026-09-05 收尾清理回灌。台账数字：50 个 Run 成功 12、作废 16、取消 17、失败 5，支撑 7 次生产发布；所有者问"多久了正常吗"从十余次降到 1 次。
 
 - **预算续批不再死循环，run 配置可覆盖预算（迭代 09 A1）**：预算耗尽停人后批准 `resume-<step>`，内核落 `BUDGET_EXTENDED`（台账事实，可重放）给该步 +1 再跑，不再立刻重问；run 配置 `budgets.maxAttempts.<step>` 覆盖预设（run config > preset > `maxAttemptsPerStep`）；`doctor` 打印每步生效上限与来源。真实事故：两条应用登录 Run 因预设 2 轮改不动且批了没用而以 CANCELLED 收场，候选却已在生产

package/README.en.md

@@ -12,6 +12,8 @@ Requirements, boards, contracts, decisions, status, and verification evidence li
 
 BuildBeat began with one person coordinating four AI sessions across a complex, multi-iteration product. That is its origin, not an audience limit. One Builder can use it, or several Builders can share one Git project and close separate requirement/work packages end to end.
 
+**v2 is the current line** (`@haiyangbg/buildbeat@latest`, 2.0.0): on top of the v1 file bus and human Gates it adds `buildbeat-v2`, a delivery runtime driven by AI sessions — an automatic Build → Verify → Review → Fix loop inside an isolated worktree that stops at the merge decision, with `overview` / `inbox` / `status` answering "where is it, who decides, is it stuck". See [the v2 runtime](#the-v2-runtime-buildbeat-v2-current-line) below and [`docs/v2/guide/`](docs/v2/guide/README.md). Since 2.0.0 `@latest` is v2: the v1 `buildbeat` lifecycle commands are unchanged and `buildbeat-v2` is a second executable in the same package; `@next` is for later pre-releases.
+
 > **Language note:** `SKILL.md`, the scaffold templates, and script output are currently Chinese-first. The delivery protocol is language-independent, and a project can translate its generated scaffold during bootstrap.
 
 ## The problem it solves
@@ -85,6 +87,22 @@ Copied v1.16 legacy projects must not hand-author, copy, or rename a manifest to
 
 The old `solobaton@latest` package stays on the legacy read-only v0 capability and points users to this scoped package; it does not gain project writes or upgrades. A write-enabled first-screen command must use `@haiyangbg/buildbeat`, still shows its plan first, and remains subject to Git, collision, ownership, and human-Gate boundaries.
 
+### The v2 runtime: `buildbeat-v2` (current line)
+
+v2 turns "how a work package goes from accepted to merged to released" into a machine-verifiable Run: once the intent / plan under `delivery/work/<ID>/` are accepted by digest, `buildbeat-v2 start` drives Build → Verify → Review → Fix in an isolated git worktree under the official preset. The candidate is what git reads back, never what a worker claims; the read-only reviewer is enforced by the kernel; exhausted budgets, repeated identical failures and worker-infrastructure failures all stop for a human; merge, push and deploy remain human actions after approval (the kernel has no call path for them). Go-live uses the `release-readback` lane to ledger "read back before → human acts → read back after → observe → human closes the window" as L4 evidence; `observe` runs read-only production health checks; `gc` cleans up; `.buildbeat/notify.yaml` pushes waits to DingTalk or a webhook.
+
+It does not create agents or manage models: a worker is whatever command you put in the run config (Codex, Claude Code, a script); the kernel owns only the ledger, isolation, evidence and gates.
+
+```bash
+npm install --global @haiyangbg/buildbeat@latest # since 2.0.0 latest is v2; pre-releases use @next
+buildbeat-v2 overview --repo .                     # where each work is, what it has cost, who moves next
+buildbeat-v2 inbox --repo .                        # what is waiting on you, and the exact reply
+buildbeat-v2 start --config delivery/work/WORK-X/run-config.yaml --attempt new
+buildbeat-v2 status --repo . --run RUN-X-01        # which step, for how long, typical duration, stalled or not
+```
+
+People driving BuildBeat from an AI session do not need these commands: [`SKILL.md`](SKILL.md) §0.5 is the driving manual the session reads; the user says "progress / start / how is it going / approve / go live / clean up". The one-page user view is [`docs/v2/guide/00-how-to-talk.md`](docs/v2/guide/00-how-to-talk.md), the ten-guide index is [`docs/v2/guide/README.md`](docs/v2/guide/README.md), and migration from the v1 file bus is [`docs/v2/guide/08-migration-v1.md`](docs/v2/guide/08-migration-v1.md) (Chinese). Each beta's content and release evidence is in [`CHANGELOG.md`](CHANGELOG.md) and `docs/V2.0.0-BETA.*-RELEASE-EVIDENCE-*.md`; the real incident behind every mechanism is in [`lessons.md`](lessons.md).
+
 ### Manual installation
 
 Use this path only when you already understand the templates:
@@ -244,7 +262,8 @@ Skill-only, legacy npm v0, and scoped BuildBeat 1.21 are distinct availability s
 
 ## Continue reading
 
-- [`SKILL.md`](SKILL.md): the single complete entry point for the methodology and bootstrap;
+- [`SKILL.md`](SKILL.md): the single complete entry point for the methodology and bootstrap; §0.5 is the v2 driving manual;
+- [`docs/v2/guide/README.md`](docs/v2/guide/README.md): the ten v2 runtime guides (how to talk to a session, quickstart, workflow / policy / adapter / worker contract / evidence / approval / migration from v1 / security boundaries / recovery);
 - [`example/`](example/): the protocol teaching snapshot of a fictional project after one completed iteration (executable scripts still reference the template SSOT);
 - [`lessons.md`](lessons.md): real anti-patterns, root causes, and fixes;
 - [`docs/ROADMAP.md`](docs/ROADMAP.md): the new product direction, design principles, and the CLI execution amendment effective on 2026-08-24;

package/README.md

@@ -12,6 +12,8 @@ BuildBeat（旧称 Solobaton）是一套面向人和 AI 会话的、**file-first
 
 BuildBeat 最初蒸馏自一个人指挥 4 个 AI 会话、持续多期交付复杂产品的实践；这说明了方法的来源，不限定使用人数。一个 Builder 可以使用，多个 Builder 也可以共享同一 Git 项目并按需求/工作包分别闭环。
 
+**当前主线是 v2**（`@haiyangbg/buildbeat@latest`，2.0.0）：在 v1 的文件总线与人工 Gate 之上加了一个由 AI 会话调用的交付运行时 `buildbeat-v2`——隔离 worktree 内 Build → Verify → Review → Fix 自动闭环、停在合并决定，`overview` / `inbox` / `status` 回答「到哪了、谁批、卡没卡」。见下文 [v2 运行时](#v2-运行时buildbeat-v2当前主线) 与 [`docs/v2/guide/`](docs/v2/guide/README.md)。自 2.0.0 起 `@latest` 就是 v2：v1 的 `buildbeat` 生命周期命令原样保留，`buildbeat-v2` 是同一个包里的第二个可执行文件；`@next` 用于后续预发布。
+
 ## 解决什么问题
 
 当一个项目同时打开多个 AI Coding 会话，最容易失控的不是代码生成，而是交付状态：
@@ -83,6 +85,22 @@ npm uninstall --global @haiyangbg/buildbeat       # 只移除全局 CLI 包
 
 旧 `solobaton@latest` 固定在 legacy v0 只读能力，并迁移提示到本 scoped package；它不会获得新的项目写入或升级能力。写入式首屏命令必须使用 `@haiyangbg/buildbeat`，并且仍先展示计划、受 Git/碰撞/所有权检查约束，不能跨人工 Gate。
 
+### v2 运行时：`buildbeat-v2`（当前主线）
+
+v2 把「一个工作包怎么从接受走到合并、上线」做成了机器可核验的 Run：`delivery/work/<ID>/` 里的 intent / plan 被 digest 绑定接受后，`buildbeat-v2 start` 在隔离 git worktree 里按官方预设跑 Build → Verify → Review → Fix，候选由 git 回读而不是 worker 自述，只读 reviewer 由机器强制，超预算、同指纹重复失败、worker 基础设施故障都停下来等人；合并、push、部署永远是人批之后的人类动作（内核没有这些调用路径）。上线用 `release-readback` 车道把「做之前回读 → 人做 → 做之后回读 → 观察 → 人关窗」记成 L4 证据；`observe` 做生产只读体检；`gc` 打扫；`.buildbeat/notify.yaml` 把等待推到钉钉或 webhook。
+
+它不创建 Agent、不管理模型：worker 是你在 run 配置里写的任意命令（Codex / Claude Code / 一段脚本都行），内核只负责台账、隔离、证据和门。
+
+```bash
+npm install --global @haiyangbg/buildbeat@latest # 2.0.0 起 latest 即 v2；预发布用 @next
+buildbeat-v2 overview --repo .                     # 每个 Work 走到哪、花了多少、下一步该谁
+buildbeat-v2 inbox --repo .                        # 谁在等你批，下一句该说什么
+buildbeat-v2 start --config delivery/work/WORK-X/run-config.yaml --attempt new
+buildbeat-v2 status --repo . --run RUN-X-01        # 在跑第几步、跑了多久、历史通常多久、卡没卡
+```
+
+在 AI 会话里用的人不需要记这些命令：[`SKILL.md`](SKILL.md) §0.5 是给会话读的驾驶手册，用户说「当前进度 / 开工 / 怎么样了 / 批准 / 上线 / 打扫卫生」即可。用户视角的一页在 [`docs/v2/guide/00-how-to-talk.md`](docs/v2/guide/00-how-to-talk.md)，十件套指南索引在 [`docs/v2/guide/README.md`](docs/v2/guide/README.md)，从 v1 文件总线迁移见 [`docs/v2/guide/08-migration-v1.md`](docs/v2/guide/08-migration-v1.md)。每个 beta 的内容与发布证据见 [`CHANGELOG.md`](CHANGELOG.md) 与 `docs/V2.0.0-BETA.*-RELEASE-EVIDENCE-*.md`；每条机制背后的真实事故在 [`lessons.md`](lessons.md)。
+
 ### 手动安装
 
 只建议在你已经理解模板含义时使用：
@@ -242,7 +260,8 @@ Skill-only、legacy npm v0 和 scoped BuildBeat 1.21 是三个不同可用面；
 
 ## 继续阅读
 
-- [`SKILL.md`](SKILL.md)：方法论与 Bootstrap 的唯一完整入口；
+- [`SKILL.md`](SKILL.md)：方法论与 Bootstrap 的唯一完整入口，§0.5 是 v2 驾驶手册；
+- [`docs/v2/guide/README.md`](docs/v2/guide/README.md)：v2 运行时十件套指南（怎么和会话说话、快速开始、workflow / policy / adapter / worker 合同 / 证据 / 审批 / 从 v1 迁移 / 安全边界 / 恢复）；
 - [`example/`](example/)：虚构「简账」项目一期收尾的协议教学快照（可执行脚本仍引用模板 SSOT）；
 - [`lessons.md`](lessons.md)：真实反模式、根因与解法；
 - [`docs/ROADMAP.md`](docs/ROADMAP.md)：新版产品方向、设计原则与 2026-08-24 生效的 CLI 执行修订；

package/docs/CLI.md

@@ -1,6 +1,6 @@
 # BuildBeat CLI lifecycle contract
 
-Status: **BuildBeat `1.21.0` independently verified scoped distribution** · canonical package `@haiyangbg/buildbeat` · canonical executable `buildbeat` · legacy package `solobaton@1.16.3` remains the independently verified read-only v0 · Node.js 20+ · zero third-party runtime dependencies. The 1.21 release keeps the verified 1.20 lifecycle command and safety boundaries, and adds the standard domain-response contract to the Skill and managed scaffold. The genuine lifecycle version-increment pilot remains archived in [`PHASE4-V1.20-PILOT-2026-08-25.md`](PHASE4-V1.20-PILOT-2026-08-25.md); exact 1.21 registry and supply-chain evidence is archived in [`V1.21-RELEASE-EVIDENCE-2026-08-25.md`](V1.21-RELEASE-EVIDENCE-2026-08-25.md).
+Status: **BuildBeat `2.0.0` scoped distribution (stable `latest`; the v1 lifecycle CLI `buildbeat` is unchanged, the v2 delivery runtime `buildbeat-v2` ships alongside it — see `docs/v2/guide/`)** · previous independently verified stable `1.21.0` · canonical package `@haiyangbg/buildbeat` · canonical executable `buildbeat` · legacy package `solobaton@1.16.3` remains the independently verified read-only v0 · Node.js 20+ · zero third-party runtime dependencies. The 1.21 release keeps the verified 1.20 lifecycle command and safety boundaries, and adds the standard domain-response contract to the Skill and managed scaffold. The genuine lifecycle version-increment pilot remains archived in [`PHASE4-V1.20-PILOT-2026-08-25.md`](PHASE4-V1.20-PILOT-2026-08-25.md); exact 1.21 registry and supply-chain evidence is archived in [`V1.21-RELEASE-EVIDENCE-2026-08-25.md`](V1.21-RELEASE-EVIDENCE-2026-08-25.md).
 
 The CLI does not replace `SKILL.md`. The Skill owns code-aware reasoning, minimal questions, project semantics, and human Gates. The CLI owns deterministic inspection, scaffold mechanics, manifest/hash bookkeeping, and bounded mechanical upgrade in the current scoped distribution. Synchronous file-bus checks remain authoritative in the project-local scripts specified by [`CHECKS.md`](CHECKS.md).
 
@@ -47,6 +47,7 @@ The target command whitelist is intentionally small:
 |---|---|---|
 | legacy `solobaton@1.16.3` | `doctor`, `init --dry-run`, `adopt --dry-run`, `version` | independently verified read-only v0; deprecated distribution ID after scoped migration |
 | BuildBeat `1.21.0` | `doctor`, `init`, `adopt`, `upgrade`, `version` | unchanged Phase 0–3 command set; writes remain bounded by the transaction and human-Gate contracts below |
+| BuildBeat `2.0.0` | same `buildbeat` command set; second executable `buildbeat-v2` (run / overview / inbox / status / approve / observe / gc …) | `buildbeat` lifecycle and safety boundaries unchanged; `buildbeat-v2` is the v2 runtime documented in [`v2/guide/README.md`](v2/guide/README.md) and never merges, pushes, deploys or publishes (invariant 20); the managed scaffold version stays `v1.21` (templates unchanged), so `upgrade` reports up-to-date for 1.21 scaffolds; the manifest `cliVersion` is a record, not an upgrade trigger |
 
 `help`, `--help`, and `--version` are meta entry points. `diff` and `uninstall` stay reserved and return `command_not_available`; `gate`, `adr`, `standards`, `check`, and other workflow commands are outside the approved CLI scope. HELP text and regression tests must lock this boundary.
 
@@ -128,7 +129,7 @@ Schema 2 is the first write-capable shape targeted by Wave 1:
 {
   "schemaVersion": 2,
   "scaffoldVersion": "v1.21",
-  "cliVersion": "2.0.0-beta.5",
+  "cliVersion": "2.0.0",
   "layout": "default",
   "installedAt": "2026-08-24T00:00:00.000Z",
   "files": {

package/docs/RELEASING.md

@@ -2,7 +2,7 @@
 
 This runbook governs BuildBeat's public npm distribution. The canonical package is `@haiyangbg/buildbeat` in `HaiYangBG1/BuildBeat`; the canonical executable is `buildbeat`, while `solobaton` remains an executable alias. The old `solobaton` npm package is a frozen legacy distribution ID and must not receive the scoped write/upgrade command surface.
 
-Release evidence at source package version `@haiyangbg/buildbeat@2.0.0-beta.5` (pending publication verification); latest independently verified BuildBeat npm distribution `@haiyangbg/buildbeat@2.0.0-beta.4` (dist-tag `next`; `latest` remains `1.21.0`), anchored by annotated tag `v2.0.0-beta.4` at commit `02d1f5a`, workflow run [33460544343](https://github.com/HaiYangBG1/BuildBeat/actions/runs/33460544343), and archived in [`V2.0.0-BETA.3-RELEASE-EVIDENCE-2026-09-01.md`](V2.0.0-BETA.3-RELEASE-EVIDENCE-2026-09-01.md). The beta.2 chain stays archived in [`V2.0.0-BETA.2-RELEASE-EVIDENCE-2026-08-28.md`](V2.0.0-BETA.2-RELEASE-EVIDENCE-2026-08-28.md); the beta.1 chain stays archived in [`V2.0.0-BETA.1-RELEASE-EVIDENCE-2026-08-28.md`](V2.0.0-BETA.1-RELEASE-EVIDENCE-2026-08-28.md). The latest stable distribution stays `@haiyangbg/buildbeat@1.21.0`, anchored by annotated tag `v1.21.0` at commit `ce69a05`, workflow run [32864438692](https://github.com/HaiYangBG1/BuildBeat/actions/runs/32864438692), and the matching [GitHub Release](https://github.com/HaiYangBG1/BuildBeat/releases/tag/v1.21.0). Exact registry identity, provenance, signatures, isolated-install readback, Environment approval, and immutable-artifact boundary are archived in [`V1.21-RELEASE-EVIDENCE-2026-08-25.md`](V1.21-RELEASE-EVIDENCE-2026-08-25.md). First-scoped-release bootstrap behavior and legacy deprecation remain archived in [`WP4.3-RELEASE-EVIDENCE-2026-08-25.md`](WP4.3-RELEASE-EVIDENCE-2026-08-25.md). The legacy distribution remains `solobaton@1.16.3`; all three published legacy versions are retained and deprecated toward the scoped package.
+Release evidence at source package version `@haiyangbg/buildbeat@2.0.0` (pending publication verification); latest independently verified BuildBeat npm distribution `@haiyangbg/buildbeat@2.0.0-beta.5` (dist-tag `next`; `latest` remains `1.21.0`), anchored by annotated tag `v2.0.0-beta.5` at commit `1d6553d`, workflow run [33972774150](https://github.com/HaiYangBG1/BuildBeat/actions/runs/33972774150), and archived in [`V2.0.0-BETA.5-RELEASE-EVIDENCE-2026-09-05.md`](V2.0.0-BETA.5-RELEASE-EVIDENCE-2026-09-05.md). The beta.4 chain stays archived in [`V2.0.0-BETA.4-RELEASE-EVIDENCE-2026-09-03.md`](V2.0.0-BETA.4-RELEASE-EVIDENCE-2026-09-03.md); the beta.3 chain in [`V2.0.0-BETA.3-RELEASE-EVIDENCE-2026-09-01.md`](V2.0.0-BETA.3-RELEASE-EVIDENCE-2026-09-01.md). The beta.2 chain stays archived in [`V2.0.0-BETA.2-RELEASE-EVIDENCE-2026-08-28.md`](V2.0.0-BETA.2-RELEASE-EVIDENCE-2026-08-28.md); the beta.1 chain stays archived in [`V2.0.0-BETA.1-RELEASE-EVIDENCE-2026-08-28.md`](V2.0.0-BETA.1-RELEASE-EVIDENCE-2026-08-28.md). The latest stable distribution stays `@haiyangbg/buildbeat@1.21.0`, anchored by annotated tag `v1.21.0` at commit `ce69a05`, workflow run [32864438692](https://github.com/HaiYangBG1/BuildBeat/actions/runs/32864438692), and the matching [GitHub Release](https://github.com/HaiYangBG1/BuildBeat/releases/tag/v1.21.0). Exact registry identity, provenance, signatures, isolated-install readback, Environment approval, and immutable-artifact boundary are archived in [`V1.21-RELEASE-EVIDENCE-2026-08-25.md`](V1.21-RELEASE-EVIDENCE-2026-08-25.md). First-scoped-release bootstrap behavior and legacy deprecation remain archived in [`WP4.3-RELEASE-EVIDENCE-2026-08-25.md`](WP4.3-RELEASE-EVIDENCE-2026-08-25.md). The legacy distribution remains `solobaton@1.16.3`; all three published legacy versions are retained and deprecated toward the scoped package.
 
 ## Release invariants
 

package/docs/V2.0.0-BETA.5-RELEASE-EVIDENCE-2026-09-05.md

@@ -0,0 +1,10 @@
+# v2.0.0-beta.5 发布证据（2026-09-05）
+
+> 授权：所有者会话内「发，并且迭代5轮可以直接切换到线上版本了」（发布 + `npm-publish` 环境审批 + 发布后把本机 CLI 从源码链接切回正式包）；流程与 [beta.4](V2.0.0-BETA.4-RELEASE-EVIDENCE-2026-09-03.md) 完全一致。
+
+- 内容：迭代 09「预算是刹车、故障分开算、成本看得见」——预算耗尽后批准 `resume-<step>` 落 `BUDGET_EXTENDED` 多给一次、run 配置 `budgets:` 覆盖预设；worker 基础设施故障（timeout / crashed / invalid-output / exit 75）判 `infra` 停人、不派 fixer、不扣预算，无转移边的失败也停人；`overview` 每个 Work 一行 `cost:`、`budgets.reviewRoundsPerWork` 跨 Run 累计；overview 真相修正（MERGED 压过 CANCELLED、release 车道 `RELEASED`）；`doctor` 读 start 第一道门；`resume --adopt <sha>`；起跑被仓锁挡住时说清在等谁；模板与指南（gitignore 排除运行时/工作树、worker 环境事实、通知询问）；lessons #23–#25。明细见 [`CHANGELOG.md`](../CHANGELOG.md)。
+- 候选：`1d6553d`（`v2` tip），annotated tag `v2.0.0-beta.5`；本地候选门全过：`bash -n` / shellcheck / actionlint、`check:docs`（170 文件）、`test-scripts` 228 断言、pilot 15、plugin 7、skill-only、node 205/205、`pack:check`、`npm publish --dry-run`、gitleaks 无泄漏、`git diff --check`（工作树与 `795190e...HEAD` 区间均干净；上一提交 `69bce32` 曾因 lessons.md 末尾空行让 CI 的 whitespace 检查失败，本批已改掉）；CI run [33972673951](https://github.com/HaiYangBG1/BuildBeat/actions/runs/33972673951) success。发布前回读：registry `next` 仍为 `2.0.0-beta.4`、无 `2.0.0-beta.5`；tag ruleset `Protect release tags` = active。
+- 发布：workflow run [33972774150](https://github.com/HaiYangBG1/BuildBeat/actions/runs/33972774150)（`workflow_dispatch` from `v2`，tag `v2.0.0-beta.5`）双 job success（`Publish v2.0.0-beta.5 to npm` + `Verify v2.0.0-beta.5 from npm`）；`npm-publish` 环境审批按会话授权以所有者 gh 凭据落章，备注引用授权原文。
+- 本地独立回读（直连 registry.npmjs.org，不经镜像）：dist-tags `{bootstrap: 0.0.0, latest: 1.21.0, next: 2.0.0-beta.5}`（`latest` 未动）；`dist.integrity = sha512-BepG2UYo5ZsPwXqY4AntszoSE9lJQETqqnXqyonoHXt9ZJ9TOG2ncPLz1YNzaTWKB61eEulk4aZ2z57lLyi0FQ==`；`dist.attestations.url` 存在；隔离前缀安装 `buildbeat --version = 2.0.0-beta.5`，`buildbeat-v2` usage 含 `resume … --adopt`，`src/v2/runtime/` 含 `work-cost.js`；临时项目 `npm audit signatures` = 1 package has a verified attestation；`buildbeat doctor <空目录> --json` 返回有界 JSON（`cliVersion 2.0.0-beta.5`，`not-installed`），零写入。
+- 切换：所有者本机全局 `buildbeat-v2` 由源码 `npm link` 切回正式包（`npm i -g @haiyangbg/buildbeat@next`），`readlink` 指向全局 `node_modules/@haiyangbg/buildbeat/bin/buildbeat-v2.js`，`buildbeat --version = 2.0.0-beta.5`。
+- 未做：`latest` 仍指 v1.21.0（v2 仍是预发布）；GitHub Release 页未建（与前几个 beta 一致，npm 面为准）。

package/example/.buildbeat/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "scaffoldVersion": "v1.21",
-  "cliVersion": "2.0.0-beta.5",
+  "cliVersion": "2.0.0",
   "layout": "default",
   "installedAt": "2026-08-25T00:00:00.000Z",
   "files": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haiyangbg/buildbeat",
-  "version": "2.0.0-beta.5",
+  "version": "2.0.0",
   "description": "BuildBeat: a Git-based, human-gated engineering delivery protocol for humans and AI sessions.",
   "type": "module",
   "bin": {