ai-delivery-workflow 0.4.0 → 0.5.0

package/skills/ai-delivery-assemble-release/assets/release-git-plan.yaml

@@ -1,9 +1,99 @@
-schema_version: 1
+schema_version: 2
 release_id: "REL-0001"
-source_tag: "version-ready/VER-0005/r1"
-source_commit: "<git-sha>"
-release_branch: "release/REL-0001-short-slug"
+product_id: "PRODUCT-001"
 production_branch: "main"
-line_branch: "line/PRODUCT-001"
-merge_intermediate_tags: false
+release_branch: "release/REL-0001-short-slug"
+release_base:
+  expected_main: "<git-sha>"
+  captured_at: "<RFC3339>"
+  request_artifact: ".workflow/releases/REL-0001/R00-release-request/release-request.yaml"
+target_version:
+  version_id: "VER-0005"
+  source_tag: "version-ready/VER-0005/r1"
+  source_commit: "<git-sha>"
+  source_relation_to_release_base: "incremental: target-descends-from-release-base; same-version-redeploy: target-already-in-release-base"
+candidate_operation:
+  command: "release-git.mjs create-candidate"
+  required_arguments:
+    - "--release-id REL-0001"
+    - "--release-branch release/REL-0001-short-slug"
+    - "--expected-main <git-sha>"
+    - "--source-tag version-ready/VER-0005/r1"
+    - "--source-commit <git-sha>"
+    - "--receipt <path>"
+    - "--apply"
+  merge_strategy: "no-ff-single-version-ready-tag"
+  merge_created: true # False when a same-version target is already in the release base.
+  merge_intermediate_tags: false
+  release_candidate_commit: null
+  receipt_fields:
+    - "operation: create-release-candidate"
+    - "release_base_commit"
+    - "source_ref"
+    - "source_commit"
+    - "candidate_commit"
+    - "status: planned | applied | idempotent"
+  receipt_ref: null
+  status: "pending-controlled-git-operation"
+promotion_operation:
+  command: "release-git.mjs promote"
+  required_arguments:
+    - "--release-id REL-0001"
+    - "--release-branch release/REL-0001-short-slug"
+    - "--expected-main <git-sha>"
+    - "--verified-release-commit <git-sha>"
+    - "--production-verification .workflow/releases/REL-0001/R09-production-verification/production-verification.json"
+    - "--receipt <path>"
+    - "--apply"
+  verified_release_commit: null
+  receipt_fields:
+    - "operation: promote-release-candidate"
+    - "production_verification.path"
+    - "production_verification.sha256"
+    - "old_main_head"
+    - "new_main_head"
+    - "status: planned | applied | idempotent"
+  receipt_ref: null
+  status: "pending-production-verification"
+release_fix_synchronization:
+  line_branch: "line/PRODUCT-001"
+  command: "release-git.mjs sync-release-fix"
+  required_arguments:
+    - "--release-id REL-0001"
+    - "--source-ref release-fix/REL-0001/DEFECT-001"
+    - "--source-commit <git-sha>"
+    - "--verified-release-commit <git-sha>"
+    - "--expected-line <git-sha>"
+    - "--production-verification .workflow/releases/REL-0001/R09-production-verification/production-verification.json"
+    - "--candidate-inventory .workflow/releases/REL-0001/R10-release-archive/candidate-inventory.json"
+    - "--successor-candidate-inventory .workflow/releases/REL-0001/R10-release-archive/candidate-inventory-successor.json"
+    - "--receipt <path>"
+    - "--apply"
+  required_before_archive: true
+  expected_line: "<git-sha>"
+  candidate_inventory_contract:
+    schema_version: 2
+    scope: "product-line"
+    product_id: "PRODUCT-001"
+    line_branch: "line/PRODUCT-001"
+    root_release_id: forbidden
+    candidate_fields:
+      - "candidate_id"
+      - "release_id"
+      - "candidate_commit"
+      - "status"
+    successor_is_immutable: true
+  receipt_fields:
+    - "operation: synchronize-release-fix-to-line"
+    - "old_line_head"
+    - "new_line_head"
+    - "stale_candidate_ids"
+    - "candidate_status_updates"
+    - "production_verification.sha256"
+    - "candidate_inventory.sha256"
+    - "successor_candidate_inventory.path"
+    - "successor_candidate_inventory.sha256"
+    - "successor_candidate_inventory_write.status"
+    - "status: planned | applied | idempotent"
+  receipt_refs: []
 rollback_branch_allowed: false

package/skills/ai-delivery-assemble-release/assets/version-inclusion.csv

@@ -1,2 +1,2 @@
-sequence,version_id,predecessor_version_id,candidate_id,candidate_commit,version_ready_tag,manifest_path,manifest_sha256,inclusion_type
-1,VER-0001,,CAND-0001,<git-sha>,version-ready/VER-0001/r1,.workflow/iterations/VER-0001/06-version-closeout/version-manifest.yaml,<sha256>,dependency-closure
+sequence,version_id,predecessor_version_id,candidate_id,candidate_commit,version_ready_tag,manifest_path,manifest_sha256,inclusion_type,release_code_role
+1,VER-0001,,CAND-0001,<git-sha>,version-ready/VER-0001/r1,.workflow/iterations/VER-0001/06-version-closeout/version-manifest.yaml,<sha256>,dependency-closure,incremental-target-tag-merged-once-or-same-version-already-reachable

package/skills/ai-delivery-assemble-release/references/release-assembly-contract.md

@@ -1,7 +1,21 @@
 # Release Assembly Contract
 
-Treat the target version tag as the only code source for a release candidate. Never assemble code by merging every intermediate tag and never use a movable branch head as the source.
+## Candidate Identity
+
+At R00, freeze the exact request-time production branch head as `expected_main`. A release candidate is not a checkout of the target Tag. For an incremental release, the controlled Git operation creates `release/<release-id>-<slug>` at that exact commit, confirms that `main` still equals it and that it is an ancestor of the selected target, then merges exactly one target `version-ready/<version-id>/rN` Tag with `--no-ff`. The resulting merge commit is the release-candidate identity. For a same-version redeploy, the selected target Tag must already be an ancestor of or equal to `expected_main`; no merge is created and the exact snapshot commit is the release-candidate identity.
+
+The target Tag is immutable and resolves to the target version's `candidate_commit`. Never merge every intermediate Tag, use a movable branch head, or replace the single incremental target merge with cherry-picks. Intermediate versions appear only in the continuous dependency closure and material traceability. If `main` moves after R00 or before candidate acceptance, preserve the abandoned evidence as `stale` and start a new release request/snapshot; do not retarget the existing release branch.
+
+`release-git.mjs create-candidate` receives `--release-id`, `--release-branch`, `--expected-main`, `--source-tag`, the resolved `--source-commit`, `--receipt`, and explicit `--apply`. Its receipt records `operation: create-release-candidate`, `release_id`, production branch, release branch, `release_base_commit`, `source_ref`, `source_commit`, `candidate_commit`, whether a merge was created, merge strategy, and `planned`, `applied`, or `idempotent` status. The candidate commit, not the branch's later head, is what R05 through R09 verify, approve, deploy, Tag, and ultimately promote.
+
+## Materials And Closure
 
 The material index is exhaustive for actual changes and contains stable item ID, category, source version, source artifact ID/path/checksum, target environment, application order, verification, and rollback/recovery action. Do not record secret values.
 
-Require every adjacent version in the full dependency closure through the target, including already produced history, to descend from its predecessor in both the code repository (`candidate_commit`) and workflow repository (`workflow_commit`). Production-to-target reachability alone cannot prove that an intermediate version is included. Repeat the full closure check for same-version redeploy. A production hotfix must first be synchronized into `line/<product-id>`; candidates that do not contain it are `stale`. When current production equals target, emit `same-version-redeploy`, an empty newly included range, and a fresh release identity.
+Require every adjacent version in the full dependency closure through the target, including already produced history, to descend from its predecessor in both the code repository (`candidate_commit`) and workflow repository (`workflow_commit`). Production-to-target reachability alone cannot prove that an intermediate version is included. Repeat the full closure check for same-version redeploy. When current production equals target, emit `same-version-redeploy`, an empty newly included range, and a fresh release identity.
+
+## Release-Fix Reconciliation
+
+Create `release-fix/<release-id>/<defect-id>` only from the active release candidate. After the corrected candidate has passed affected verification and production verification has decided `released`, freeze the R09 `production-verification.json` decision and a schema-2 R10 product-line `candidate-inventory.json` before synchronizing its fix commit into `line/<product-id>` through the protected `sync-release-fix` operation. The inventory has `scope: product-line`, `product_id`, `line_branch`, active candidate ID/commit, and all product-line candidate records. Each record retains its own `release_id`, ID, commit, and status; the root has no release ID. The operation checks that the active and verified records belong to the release being synchronized, derives stale updates instead of accepting a stale-candidate argument, and writes a separate immutable successor inventory rather than updating the source snapshot. Record its JSON receipt with the release ID, source ref/commit, verified release commit, old/new line heads, merge strategy, predecessor/successor inventory evidence bindings, derived stale candidate IDs/status updates, and status.
+
+Invoke it with `--candidate-inventory <predecessor>` and, for `--apply`, a distinct unused `--successor-candidate-inventory <successor>`. If the fix commit is already reachable from the line, `release-git.mjs sync-release-fix` returns `status: idempotent` with unchanged old/new line heads rather than changing history, and only accepts the exact already-written successor on replay. Historical version-ready Tags and manifests remain immutable. The receipt marks every selectable candidate in the product line that does not contain a production-successful fix `stale`; it cannot be selected until recreated from current lineage. Subsequent synchronization begins from that successor inventory.

package/skills/ai-delivery-assemble-release/scripts/plan-release.mjs

@@ -69,6 +69,7 @@ function repositoriesFromWorkspace(workspaceRoot) {
     codeRepo,
     workflowRepo: root,
     repoId,
+    productionBranch: value(codeSection, "default_branch") || "main",
     codeRemote: value(codeSection, "remote"),
     workflowRemote: value(workflowSection, "remote"),
   };
@@ -134,6 +135,72 @@ function validateRemoteTag(remote, tag, expectedCommit) {
   }
 }
 
+function validateRemoteBranch(remote, branch, expectedCommit) {
+  if (!remote) return;
+  const reference = `refs/heads/${branch}`;
+  const result = spawnSync("git", ["ls-remote", "--heads", remote, reference], {
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  if (result.status !== 0) {
+    throw new Error(`Remote branch validation failed for ${branch}: ${result.stderr.trim()}`);
+  }
+  const commits = result.stdout.split(/\r?\n/).filter(Boolean).map((line) => line.split(/\s+/)[0].toLowerCase());
+  if (!commits.length) throw new Error(`Remote is missing production branch ${branch}: ${remote}`);
+  if (!commits.includes(expectedCommit.toLowerCase())) {
+    throw new Error(
+      `Remote production branch ${branch} drifted from the captured main commit ${expectedCommit}; refresh the release request.`,
+    );
+  }
+}
+
+function validateReleaseBase(repo, branch, currentProduction, remote) {
+  const reference = `refs/heads/${branch}`;
+  const commit = git(repo, ["rev-parse", "--verify", `${reference}^{commit}`]);
+  validateRemoteBranch(remote, branch, commit);
+  if (currentProduction) {
+    const result = spawnSync(
+      "git",
+      ["merge-base", "--is-ancestor", currentProduction.candidate_commit, commit],
+      { cwd: repo, encoding: "utf8", windowsHide: true },
+    );
+    if (result.status !== 0) {
+      throw new Error(
+        `Production branch ${branch} is not descended from current production ${currentProduction.version_id}; refusing a divergent release base.`,
+      );
+    }
+  }
+  return commit;
+}
+
+function validateTargetContainsReleaseBase(repo, branch, releaseBase, target) {
+  if (releaseBase.toLowerCase() === String(target.candidate_commit).toLowerCase()) {
+    throw new Error(
+      `Target ${target.version_ready_tag} equals captured production branch ${branch} commit ${releaseBase}; an incremental release target must strictly descend from the R00 main snapshot.`,
+    );
+  }
+  const targetAlreadyReachable = spawnSync(
+    "git",
+    ["merge-base", "--is-ancestor", target.candidate_commit, releaseBase],
+    { cwd: repo, encoding: "utf8", windowsHide: true },
+  );
+  if (targetAlreadyReachable.status === 0) {
+    throw new Error(
+      `Target ${target.version_ready_tag} is already reachable from captured production branch ${branch} commit ${releaseBase}; an incremental release target must strictly descend from the R00 main snapshot.`,
+    );
+  }
+  const result = spawnSync(
+    "git",
+    ["merge-base", "--is-ancestor", releaseBase, target.candidate_commit],
+    { cwd: repo, encoding: "utf8", windowsHide: true },
+  );
+  if (result.status !== 0) {
+    throw new Error(
+      `Captured production branch ${branch} commit ${releaseBase} is not an ancestor of target ${target.version_ready_tag}; recreate the version candidate before release.`,
+    );
+  }
+}
+
 function validateAdjacentAncestry(repo, selected, currentProduction, commitField, label) {
   const chain = currentProduction
     ? [currentProduction, ...selected.filter((version) => version.version_id !== currentProduction.version_id)]
@@ -199,9 +266,21 @@ export function planRelease(lineage, request, options = {}) {
   }
 
   const target = ordered[targetIndex];
+  const sameVersionRedeploy = targetIndex === currentIndex;
   const newlyIncluded = ordered.slice(currentIndex + 1, targetIndex + 1);
-  const releaseEvidence = targetIndex === currentIndex ? [target] : newlyIncluded;
+  const releaseEvidence = sameVersionRedeploy ? [target] : newlyIncluded;
   const dependencyClosure = ordered.slice(0, targetIndex + 1);
+  const productionBranch = options.productionBranch || "main";
+  const currentProduction = currentIndex < 0 ? null : ordered[currentIndex];
+  let releaseBaseCommit = null;
+  if (!sameVersionRedeploy
+    && currentProduction?.candidate_commit
+    && target.candidate_commit
+    && String(currentProduction.candidate_commit).toLowerCase() === String(target.candidate_commit).toLowerCase()) {
+    throw new Error(
+      `Incremental target ${target.version_id} reuses current production ${currentProduction.version_id} candidate commit; use same-version redeploy instead.`,
+    );
+  }
   for (const version of releaseEvidence) {
     if (!ELIGIBLE_STATUSES.has(version.status)) {
       throw new Error(`Version ${version.version_id} is not eligible for release: ${version.status || "missing status"}.`);
@@ -221,6 +300,20 @@ export function planRelease(lineage, request, options = {}) {
   }
 
   if (!options.skipGit) {
+    releaseBaseCommit = validateReleaseBase(
+      path.resolve(options.repo || process.cwd()),
+      productionBranch,
+      currentProduction,
+      options.codeRemote || null,
+    );
+    if (!sameVersionRedeploy) {
+      validateTargetContainsReleaseBase(
+        path.resolve(options.repo || process.cwd()),
+        productionBranch,
+        releaseBaseCommit,
+        target,
+      );
+    }
     validateGit(
       path.resolve(options.repo || process.cwd()),
       dependencyClosure,
@@ -244,7 +337,7 @@ export function planRelease(lineage, request, options = {}) {
     target_environment: "production",
     current_production_version: currentId,
     target_version: target.version_id,
-    mode: targetIndex === currentIndex ? "same-version-redeploy" : "incremental",
+    mode: sameVersionRedeploy ? "same-version-redeploy" : "incremental",
     newly_included_versions: newlyIncluded.map((version) => version.version_id),
     dependency_closure: dependencyClosure.map((version) => version.version_id),
     target: {
@@ -262,6 +355,29 @@ export function planRelease(lineage, request, options = {}) {
     requires_fresh_verification: true,
     requires_fresh_approval: true,
     rollback_strategy: "previous-immutable-image-digest",
+    release_base: {
+      branch: productionBranch,
+      commit: releaseBaseCommit,
+      status: releaseBaseCommit ? "captured" : "pending-git-validation",
+      target_relation: sameVersionRedeploy
+        ? "target-already-in-release-base"
+        : "target-must-descend-from-release-base",
+    },
+    release_merge: {
+      strategy: sameVersionRedeploy ? "target-already-in-release-base" : "no-ff-single-version-ready-tag",
+      source_tag: target.version_ready_tag,
+      source_commit: target.candidate_commit,
+      merge_commit: null,
+      merge_created: !sameVersionRedeploy,
+      status: "pending-controlled-git-operation",
+    },
+    release_candidate: {
+      commit: sameVersionRedeploy ? releaseBaseCommit : null,
+      identity_source: sameVersionRedeploy
+        ? "release-base-when-target-already-reachable"
+        : "release-branch-head-after-merge",
+      status: "pending-controlled-git-operation",
+    },
   };
 }
 
@@ -270,7 +386,14 @@ function main(argv) {
   const lineageFile = path.resolve(required(options, "--lineage"));
   const configured = options.get("--workspace")
     ? repositoriesFromWorkspace(options.get("--workspace"))
-    : { codeRepo: process.cwd(), workflowRepo: process.cwd(), repoId: null, codeRemote: null, workflowRemote: null };
+    : {
+      codeRepo: process.cwd(),
+      workflowRepo: process.cwd(),
+      repoId: null,
+      productionBranch: "main",
+      codeRemote: null,
+      workflowRemote: null,
+    };
   const result = planRelease(readLineage(lineageFile), {
     release_id: required(options, "--release-id"),
     target_version: required(options, "--target"),
@@ -280,6 +403,7 @@ function main(argv) {
     repo: options.get("--repo") || configured.codeRepo,
     workflowRepo: options.get("--workflow-repo") || configured.workflowRepo,
     repoId: configured.repoId,
+    productionBranch: options.get("--production-branch") || configured.productionBranch || "main",
     codeRemote: configured.codeRemote,
     workflowRemote: configured.workflowRemote,
     skipGit: options.get("--skip-git") === true,

package/skills/ai-delivery-bootstrap/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Bootstrap AI Delivery"
-  short_description: "Inspect project state and route the next workflow action"
+interface:
+  display_name: "Bootstrap AI Delivery"
+  short_description: "Inspect project state and route the next workflow action"
   default_prompt: "Use $ai-delivery-bootstrap to inspect the dual-repository workspace, recover shared checkpoints, or initialize the minimum delivery context."

package/skills/ai-delivery-checkpoint-task/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Checkpoint Delivery Task"
-  short_description: "Persist task checkpoints, hook events, and resume context"
+interface:
+  display_name: "Checkpoint Delivery Task"
+  short_description: "Persist task checkpoints, hook events, and resume context"
   default_prompt: "Use $ai-delivery-checkpoint-task to start, checkpoint, publish, finish, or recover a shared delivery task."

package/skills/ai-delivery-close-version/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Close Planned Version"
-  short_description: "Freeze a verified version as release-ready"
+interface:
+  display_name: "Close Planned Version"
+  short_description: "Freeze a verified version as release-ready"
   default_prompt: "Use $ai-delivery-close-version to bind code Tag, workflow Tag, and manifest checksum without publishing."

package/skills/ai-delivery-define-product/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Define Product"
-  short_description: "Discover requirements and produce an approved product baseline"
-  default_prompt: "Use $ai-delivery-define-product to discover and define the product baseline."
+interface:
+  display_name: "Define Product"
+  short_description: "Discover requirements and produce an approved product baseline"
+  default_prompt: "Use $ai-delivery-define-product to discover and define the product baseline."

package/skills/ai-delivery-deploy-production/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Deploy Production"
-  short_description: "Deploy one approved immutable iteration version to production"
+interface:
+  display_name: "Deploy Production"
+  short_description: "Deploy one approved immutable iteration version to production"
   default_prompt: "Use $ai-delivery-deploy-production to deploy the approved immutable package and record facts in the workflow repository."

package/skills/ai-delivery-design-experience/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Design Managed Prototypes"
-  short_description: "Select tools and manage reviewable prototypes"
-  default_prompt: "Use $ai-delivery-design-experience to select a prototype tool, manage pages and canvases, and close review before handoff."
+interface:
+  display_name: "Design Managed Prototypes"
+  short_description: "Select tools and manage reviewable prototypes"
+  default_prompt: "Use $ai-delivery-design-experience to select a prototype tool, manage pages and canvases, and close review before handoff."

package/skills/ai-delivery-develop-iteration/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Develop Iteration"
-  short_description: "Orchestrate dynamic technical work packages with TDD"
+interface:
+  display_name: "Develop Iteration"
+  short_description: "Orchestrate dynamic technical work packages with TDD"
   default_prompt: "Use $ai-delivery-develop-iteration to implement the current vertical slice in the configured code repository."

package/skills/ai-delivery-evolve-workflow/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "自进化工作流"
-  short_description: "持续记录反馈、评估信号并安全演进项目级交付工作流扩展能力"
+interface:
+  display_name: "自进化工作流"
+  short_description: "持续记录反馈、评估信号并安全演进项目级交付工作流扩展能力"
   default_prompt: "使用 $ai-delivery-evolve-workflow 记录当前意见并在安全点评估可验证的项目级扩展。"

package/skills/ai-delivery-execute-test/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Execute Test Work"
-  short_description: "Execute one risk-based independent test work package"
-  default_prompt: "Use $ai-delivery-execute-test to execute the assigned independent test work package."
+interface:
+  display_name: "Execute Test Work"
+  short_description: "Execute one risk-based independent test work package"
+  default_prompt: "Use $ai-delivery-execute-test to execute the assigned independent test work package."

package/skills/ai-delivery-execute-work-package/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Execute Technical Work"
-  short_description: "Implement one architecture-constrained technical work package"
-  default_prompt: "Use $ai-delivery-execute-work-package to implement the assigned technical work package."
+interface:
+  display_name: "Execute Technical Work"
+  short_description: "Implement one architecture-constrained technical work package"
+  default_prompt: "Use $ai-delivery-execute-work-package to implement the assigned technical work package."

package/skills/ai-delivery-manage-git/SKILL.md

@@ -27,7 +27,7 @@ Write every Git decision, transition record, scope declaration, and workflow doc
 - `line/<product-id>`: latest verified cumulative development lineage, which may remain ahead of production;
 - `version/<version-id>-<slug>`: one planned cumulative version;
 - `work/<version-id>/<task-id>-<slug>`: one dynamic technical work package;
-- `release/<release-id>-<slug>`: one explicit user-requested release candidate;
+- `release/<release-id>-<slug>`: one explicit user-requested release candidate, created from the frozen `main` snapshot and, for incremental release, integrated with exactly one target `version-ready` Tag;
 - `release-fix/<release-id>/<defect-id>`: one isolated release-candidate correction;
 - `hotfix/<hotfix-id>-<slug>`: urgent correction from the current production Tag.
 
@@ -45,13 +45,15 @@ Reject environment branches (`dev`, `sit`, `staging`, `production`), `rollback-*
 ## Release Operations
 
 1. At planned-version closeout, create immutable code `version-ready/<version-id>/rN`, fast-forward code `line/<product-id>`, commit workflow materials, then create workflow `workflow-ready/<version-id>/rN`; stop without changing code `main`.
-2. Serialize production release transitions only after explicit user release intent.
-3. Create `release/<release-id>-<slug>` from the selected target's exact version-ready Tag. Never merge each intermediate Tag or build from a movable line/version branch head.
-4. Apply any release-only correction on `release-fix/*`, create a new release candidate, and repeat impacted verification.
-5. Freeze and Tag the exact tested release commit before production deployment. Never move or reuse a release Tag.
+2. Serialize production release transitions only after explicit user release intent. At R00, record the exact `main` commit as the production-base snapshot and hold that snapshot for the whole candidate.
+3. Create `release/<release-id>-<slug>` at the recorded `main` snapshot. At R04, for incremental release merge exactly one selected target `version-ready` Tag with `--no-ff`; the resulting merge commit is the release candidate. For same-version redeploy, require the target Tag to be already reachable from the snapshot and use the snapshot itself as the candidate without a new merge. Never merge intermediate Tags or build from a movable line/version branch head.
+4. During candidate assembly, verification, approval, and deployment, any change to `main` makes the candidate stale. Stop, preserve its evidence, and recreate the release branch and candidate from a new `main` snapshot.
+5. Apply any release-only correction on `release-fix/*` from the active candidate, merge it into a new candidate, and repeat impacted verification. Freeze and Tag the exact tested candidate before production deployment; never move or reuse a release Tag.
 6. Promote the same artifact digest through environments; Git branches do not select environment state.
-7. After successful production verification, fast-forward `main` to the exact deployed commit. Same-version redeploy may leave `main` unchanged.
-8. After failed deployment and image rollback, keep `main` unchanged and preserve failed release and version Tags.
+7. After successful production verification, fast-forward `main` to the exact deployed release candidate commit. Before R10 archive, synchronise every deployed `release-fix` commit into `line/<product-id>` through the protected Git operation and record a sync receipt; if the commit is already reachable from line, record an explicit no-op receipt. Candidates that omit a production-successful fix are stale.
+8. Same-version redeploy may leave `main` unchanged when it already names the deployed commit. After failed deployment or image rollback, keep `main` and `line` unchanged, preserve failed release/version Tags, and do not create a rollback branch.
+
+Use the package-delivered `scripts/release-git.mjs` interface for these protected transitions. `create-candidate` requires `--release-id`, `--release-branch`, `--expected-main`, one `--source-tag`, its `--source-commit`, `--receipt`, and `--apply`. `promote` additionally requires `--production-verification <R09-production-verification/production-verification.json>`; the JSON must bind the release ID, `decision: released`, R00 main commit, verified candidate commit, and deployed commit. `sync-release-fix` requires that same `--production-verification`, a schema-2 product-line `--candidate-inventory <predecessor-R10 JSON>`, and, with `--apply`, a distinct unused `--successor-candidate-inventory <new-R10 JSON>`. The inventory binds `product_id`, `line_branch`, the active candidate, and every candidate's own `release_id`, commit, and status. The script, not a caller-supplied stale list, derives product-line-wide `stale_candidate_ids` and `candidate_status_updates` for selectable candidates that omit the successful fix, then writes the immutable successor inventory and binds both inventory paths and checksums in its receipt. Every action returns a structured JSON receipt; omitting `--apply` produces a zero-write plan, and an already-reconciled fix returns an explicit idempotent receipt rather than silently succeeding.
 
 ## Hotfix Operations
 

package/skills/ai-delivery-manage-git/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Manage Delivery Git"
-  short_description: "Manage iteration branches, worktrees, tags, and release locks"
+interface:
+  display_name: "Manage Delivery Git"
+  short_description: "Manage iteration branches, worktrees, tags, and release locks"
   default_prompt: "Use $ai-delivery-manage-git to perform the required transition in the correct workflow or code repository."

package/skills/ai-delivery-manage-git/references/git-policy.md

@@ -23,15 +23,19 @@ Use stable delivery IDs, not human names or dynamic AI roles.
 
 ## Cumulative Version Policy
 
-Create every next planned version from the current product line head. Close a verified version by creating immutable `version-ready/<version-id>/rN` and fast-forwarding `line/<product-id>` to it. Historical version tags and manifests never change. A correction after closeout normally becomes the next planned version.
+`product-id` is the stable product-line identity established when the project is bootstrapped. Create `line/<product-id>` once, from the current `main`, when the product begins its first planned version. Create every later planned version from the current line head. Close a verified version by creating immutable `version-ready/<version-id>/rN` and fast-forwarding `line/<product-id>` to it. Historical version tags and manifests never change. A correction after closeout normally becomes the next planned version.
 
 `main` represents current successful production, while `line/<product-id>` represents the latest verified cumulative development. The line may advance through any number of release-ready versions without changing production.
 
 ## Release Policy
 
-Create a release branch only after explicit user release intent. Build it from the exact target version-ready Tag. Verify every adjacent code and workflow commit edge from current production through the target; a direct production-to-target check does not prove the middle versions. Use intermediate versions for lineage and material closure, not repeated code merges.
+Create a release branch only after explicit user release intent. At R00, capture the exact current `main` head as the immutable `expected_main` base. Verify every adjacent code and workflow commit edge from current production through the target; a direct production-to-target check does not prove the middle versions. The captured main commit must still be the production head. In an incremental release it must be an ancestor of the exact target immutable version-ready Tag; in a same-version redeploy the target Tag must already be an ancestor of or equal to the captured main commit.
 
-After successful production verification, fast-forward `main` to the deployed release commit. For same-version redeploy, record a new release ID and Tag while allowing `main` to remain unchanged.
+At R04, create `release/<release-id>-<slug>` from `expected_main`. For incremental release, merge exactly one target Tag with `--no-ff` and bind all later verification, approval, deployment, and release Tags to that result merge commit. For same-version redeploy, when the target Tag is already contained by `expected_main`, bind them to the snapshot itself and record no new merge. Use intermediate versions for lineage and material closure, not repeated code merges. A main change during candidate work makes the candidate stale; preserve it and start a new R00 request rather than changing its base.
+
+After successful production verification, fast-forward `main` only from the recorded `expected_main` to the exact deployed candidate commit. `promote` must receive the immutable R09 `production-verification.json` decision, whose `schema_version` is `1`, `operation` is `production-verification-decision`, `release_id` is exact, `decision` is `released`, and `expected_main_commit`, `verified_release_commit`, and `deployed_commit` are full immutable object IDs. The promotion receipt retains the evidence path and SHA-256. For same-version redeploy, record a new release ID and Tag while allowing `main` to remain unchanged only when it already equals the exact candidate. A failed or rolled-back release does not advance `main`.
+
+Create a release-fix only from the active candidate. When its deployed candidate has passed production verification, synchronize the exact fix commit into `line/<product-id>` before R10 archive through the protected operation. Supply the released R09 decision and a schema-2 immutable candidate inventory scoped to that product line: `scope: product-line`, `product_id`, `line_branch`, active candidate ID/commit, and a unique `candidates` list whose records each retain `candidate_id`, `release_id`, `candidate_commit`, and `status`. The root has no `release_id`; the active and verified candidate records must belong to the operation's release ID. The operation derives, rather than accepts, stale candidates across the product-line inventory: it emits `candidate_status_updates` with `status: stale` for selectable candidates that do not contain the fix, while already `stale` or `released` candidates are not rewritten. With `--apply`, provide a distinct `--successor-candidate-inventory` path. The operation writes that successor without changing its predecessor, records its path/checksum in the receipt, and updates the successor's statuses and active candidate pointer. A later fix starts from the latest immutable successor. Record the release ID, source ref/commit, verified release commit, old/new line heads, merge strategy, evidence hashes, predecessor/successor inventories, derived stale candidate IDs/status updates, and result. If the line already contains the fix, record an explicit idempotent no-op receipt and require the exact same successor inventory.
 
 ## Environment And Rollback Policy