release-skill 0.1.9 → 0.1.10

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.1.9",
+      "version": "0.1.10",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.1.9.",
+      "Prepare a release plan for version 0.1.10.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.1.10 locale=en baseline=sha256:ec4dbf3f44f1295d9af20e0fbf1ced4341d9b65d0c93598104e228244e33fa2b -->
+## [0.1.10] - 2026-07-24
+
+v0.1.10 fixes the codex marketplace install verification failure caused by the codex CLI materializing a `.codex-plugin/migrated-command-skills/` subtree (commands migrated to skill format) in the plugin install root at install time. That consumer-owned transport metadata is now exempted alongside the root `.git` checkout, and the frozen snapshot exclusion list supports multi-segment relative path prefixes while single-segment root-only behavior is unchanged. The sealed snapshot digest, release plan schema, and prepare-side freezing are unchanged, so already-frozen plans reconcile without re-approval. The npm package name (`release-skill`), publishing identity (`publisher: mzdbxqh`), public repository (`ifoohoo/release-skill`), and corporate maintainer remain unchanged.
+
+### Fixed
+
+- **Codex `migrated-command-skills` transport exemption**: the codex CLI
+  converts plugin `commands/` into skill format at install time and writes the
+  result under `.codex-plugin/migrated-command-skills/` in the install root.
+  That consumer-owned subtree is not part of the published payload, so the
+  whole-tree comparison failed every real codex marketplace install; the
+  codex consumer transport exemptions widen from `['.git']` to
+  `['.git', '.codex-plugin/migrated-command-skills']`. Claude (`.in_use`) and
+  Kimi (`.git`) exemptions are unchanged, and the exemption deliberately
+  never widens to `.codex-plugin/*` or arbitrary extra files. Verified
+  against a real flow-architect install: the installed tree is byte-identical
+  to the frozen snapshot except for the migrated-command-skills directory.
+  Already-frozen plans reconcile unchanged because the sealed digest, plan
+  schema, and prepare-side freezing are untouched.
+- **Multi-segment snapshot exclusions, fail-closed**:
+  `computeFrozenSnapshot`'s `excludeRootEntries` now accepts multi-segment
+  relative path prefixes naming an exact excluded subtree (required for the
+  `.codex-plugin/migrated-command-skills` exemption); single-segment entries
+  keep the historical root-only matching. Malformed entries (non-string,
+  absolute, `..`, backslash) fail closed: a bad exclusion list is a caller
+  bug, not transport metadata.
+- **Regression coverage**: new protocol-level tests cover the root-layout
+  codex execute→observe→verify cycle with the CLI-generated
+  migrated-command-skills tree present, including byte-tamper and extra-file
+  negatives that must still fail closed.
+<!-- release-skill:changelog:end version=0.1.10 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.1.9 locale=en baseline=sha256:409f940c03e2d6fd41d33659b246b3d4b622918b4ac5a3a711d83aa09740ef11 -->
 ## [0.1.9] - 2026-07-23
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.1.9 -->
+<!-- release-skill:release-version: 0.1.10 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -68,7 +68,7 @@ as a version-pinned **manual** install plus trusted observation/attestation:
    default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.1.9
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.1.10
    /plugins reload
    ```
 
@@ -83,10 +83,10 @@ as a version-pinned **manual** install plus trusted observation/attestation:
 {
   "consumer": "kimi",
   "plugin": "release-skill",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "entrySkill": "release-help",
   "repo": "ifoohoo/release-skill",
-  "ref": "release-skill-v0.1.9",
+  "ref": "release-skill-v0.1.10",
   "installPath": "<kimiCodeHome>/plugins/managed/release-skill",
   "planDigest": "<64-hex frozen plan digest>",
   "payloadDigest": "<64-hex frozen snapshot payload digest>",

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.1.9 -->
+<!-- release-skill:release-version: 0.1.10 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -62,7 +62,7 @@ release-skill 把 Kimi 安装建模为“版本钉死的手动安装 + 可信观
    它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.1.9
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.1.10
    /plugins reload
    ```
 
@@ -76,10 +76,10 @@ release-skill 把 Kimi 安装建模为“版本钉死的手动安装 + 可信观
 {
   "consumer": "kimi",
   "plugin": "release-skill",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "entrySkill": "release-help",
   "repo": "ifoohoo/release-skill",
-  "ref": "release-skill-v0.1.9",
+  "ref": "release-skill-v0.1.10",
   "installPath": "<kimiCodeHome>/plugins/managed/release-skill",
   "planDigest": "<64 位十六进制冻结计划摘要>",
   "payloadDigest": "<64 位十六进制冻结快照载荷摘要>",

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.1.9 -->
+<!-- release-skill:release-version: 0.1.10 -->
 Release preparation for Claude Code, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -11,41 +11,41 @@ reviewed artifacts first and publishes those same artifacts later; it does not
 regenerate a README or re-pack the live workspace at the last step.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.1.9** (2026-07-23)
+**0.1.10** (2026-07-24)
 
-v0.1.9 fixes a structural marketplace install verification failure: consumer installs that declare a plugin `source` subdirectory (e.g. `./adapters/claude`) now bind the installed payload to the declared subtree of the sealed whole-unit snapshot, and Claude's root `.in_use` marker is exempted as consumer-owned transport metadata. The sealed snapshot digest, release plan schema, and prepare-side freezing are unchanged, so already-frozen plans reconcile without re-approval. The npm package name (`release-skill`), publishing identity (`publisher: mzdbxqh`), public repository (`ifoohoo/release-skill`), and corporate maintainer remain unchanged.
+v0.1.10 fixes the codex marketplace install verification failure caused by the codex CLI materializing a `.codex-plugin/migrated-command-skills/` subtree (commands migrated to skill format) in the plugin install root at install time. That consumer-owned transport metadata is now exempted alongside the root `.git` checkout, and the frozen snapshot exclusion list supports multi-segment relative path prefixes while single-segment root-only behavior is unchanged. The sealed snapshot digest, release plan schema, and prepare-side freezing are unchanged, so already-frozen plans reconcile without re-approval. The npm package name (`release-skill`), publishing identity (`publisher: mzdbxqh`), public repository (`ifoohoo/release-skill`), and corporate maintainer remain unchanged.
 
 **Fixed**
 
-- **Marketplace payload binding for subdirectory source layouts**: consumer
-  marketplaces may declare a plugin `source` subdirectory such as
-  `./adapters/claude`; the consumer CLI then installs only that subtree while
-  the sealed authority is the whole unit snapshot. Install verification now
-  revalidates the sealed whole-snapshot digest, re-reads the declared source
-  from the marketplace manifest inside the digest-verified snapshot entries,
-  and binds the installed payload to that prefix-stripped subtree. Root
-  layouts and Kimi keep the whole-tree comparison. This resolves the
-  flow-architect v0.4.1 and v0.5.0 PARTIAL marketplace install failures;
-  already-frozen plans reconcile unchanged because the sealed digest, plan
+- **Codex `migrated-command-skills` transport exemption**: the codex CLI
+  converts plugin `commands/` into skill format at install time and writes the
+  result under `.codex-plugin/migrated-command-skills/` in the install root.
+  That consumer-owned subtree is not part of the published payload, so the
+  whole-tree comparison failed every real codex marketplace install; the
+  codex consumer transport exemptions widen from `['.git']` to
+  `['.git', '.codex-plugin/migrated-command-skills']`. Claude (`.in_use`) and
+  Kimi (`.git`) exemptions are unchanged, and the exemption deliberately
+  never widens to `.codex-plugin/*` or arbitrary extra files. Verified
+  against a real flow-architect install: the installed tree is byte-identical
+  to the frozen snapshot except for the migrated-command-skills directory.
+  Already-frozen plans reconcile unchanged because the sealed digest, plan
   schema, and prepare-side freezing are untouched.
-- **Claude `.in_use` transport marker exemption**: the Claude CLI writes an
-  empty `.in_use` marker into the plugin install root; it is now exempted as
-  consumer-owned transport metadata alongside the existing Codex/Kimi `.git`
-  exemption, through a single shared exclusion helper that also backs the
-  observe-time diagnostic fallback. Exemptions remain root-only: nested
-  markers, extra payload, byte tampering, and sealed authority tampering
-  still fail closed.
-- **Regression coverage**: new protocol-level fake-CLI tests cover the
-  subdirectory claude cycle with `.in_use` (including byte-tamper,
-  extra-file, missing-file, `.git`-not-exempt, and nested-marker negatives),
-  fail-closed manifest anomalies (duplicate plugin entry, wrong marketplace
-  name, empty source projection), root-layout claude with `.in_use`, and a
-  codex subdirectory variant.
+- **Multi-segment snapshot exclusions, fail-closed**:
+  `computeFrozenSnapshot`'s `excludeRootEntries` now accepts multi-segment
+  relative path prefixes naming an exact excluded subtree (required for the
+  `.codex-plugin/migrated-command-skills` exemption); single-segment entries
+  keep the historical root-only matching. Malformed entries (non-string,
+  absolute, `..`, backslash) fail closed: a bad exclusion list is a caller
+  bug, not transport metadata.
+- **Regression coverage**: new protocol-level tests cover the root-layout
+  codex execute→observe→verify cycle with the CLI-generated
+  migrated-command-skills tree present, including byte-tamper and extra-file
+  negatives that must still fail closed.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.1.9 is the current release (v0.1.8 previously held
-> published status before the marketplace payload binding fix was added).
+> **Current boundary:** v0.1.10 is the current release (v0.1.9 previously held
+> published status before the codex migrated-command-skills fix was added).
 > v0.1.1 completed a real production release to GitHub and npm — the first
 > production-verified milestone — followed by
 > exact npm installation and Claude/Codex consumer installation verification

package/README.zh-CN.md

@@ -2,37 +2,39 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.1.9 -->
+<!-- release-skill:release-version: 0.1.10 -->
 面向 Claude Code、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它先冻结并供人工审阅，再从同一份冻结产物发布，不会在最后一步重新生成 README、重新打包当前工作区或覆盖人工内容。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.1.9** (2026-07-23)
+**0.1.10** (2026-07-24)
 
-v0.1.9 修复一个结构性的 marketplace 安装校验失败：声明插件 `source` 子目录（如 `./adapters/claude`）的消费者安装现在能把安装载荷绑定到密封整 unit 快照中声明的子树，Claude 根目录 `.in_use` 标记作为消费者所有的传输元数据获得豁免。密封快照摘要、发布计划 schema 与 prepare 冻结均未改动，已冻结计划无需重新审批即可 reconcile。npm 包名（`release-skill`）、发布身份（`publisher: mzdbxqh`）、公开仓库（`ifoohoo/release-skill`）与公司维护主体保持不变。
+v0.1.10 修复 codex marketplace 安装校验失败：codex CLI 安装时会在插件安装根目录生成 `.codex-plugin/migrated-command-skills/` 子树（commands 迁移为 skill 格式的产物）。这部分消费者所有的传输元数据现在与根目录 `.git` 检出一样获得豁免；冻结快照排除清单扩展支持多段相对路径前缀，单段行为保持不变。密封快照摘要、发布计划 schema 与 prepare 冻结均未改动，已冻结计划无需重新审批即可 reconcile。npm 包名（`release-skill`）、发布身份（`publisher: mzdbxqh`）、公开仓库（`ifoohoo/release-skill`）与公司维护主体保持不变。
 
 **修复**
 
-- **子目录 source 布局的 marketplace 载荷绑定**：消费者清单可以声明
-  `./adapters/claude` 这样的插件 `source` 子目录，此时消费者 CLI 只安装该子树，
-  而密封权威是整个 unit 快照。安装校验现在先重验密封整快照摘要，再从摘要已验证
-  的快照条目内部读取清单声明的 source，并把安装载荷绑定到剥离前缀后的子树；
-  根布局与 Kimi 保持整树比较。这解决了 flow-architect v0.4.1 与 v0.5.0 的
-  marketplace 安装 PARTIAL 失败；密封摘要、计划 schema 与 prepare 冻结均未改动，
-  已冻结计划可以不变地 reconcile 收口。
-- **Claude `.in_use` 传输标记豁免**：Claude CLI 会在插件安装根目录写入空的
-  `.in_use` 标记，现在与既有的 Codex/Kimi `.git` 豁免一样作为消费者所有的传输
-  元数据豁免，并统一为单一共享 helper（observe 诊断回退同样复用）。豁免仅限根
-  直接子项：嵌套标记、多余载荷、字节篡改与密封权威篡改仍然失败关闭。
-- **回归覆盖**：新增协议级 fake-CLI 测试覆盖带 `.in_use` 的子目录 claude
-  完整链路（含字节篡改、多余文件、缺失文件、`.git` 不豁免与嵌套标记负例）、
-  失败关闭的清单异常（重复插件条目、marketplace 名不符、空 source 投影）、
-  带 `.in_use` 的根布局 claude，以及 codex 子目录变体。
+- **Codex `migrated-command-skills` 传输豁免**：codex CLI 安装时会把插件
+  `commands/` 转换为 skill 格式并写入安装根目录的
+  `.codex-plugin/migrated-command-skills/`。该消费者所有的子树不属于已发布
+  载荷，导致整树比较在每次真实 codex marketplace 安装中失败；codex 消费者
+  传输豁免从 `['.git']` 扩为 `['.git', '.codex-plugin/migrated-command-skills']`。
+  Claude（`.in_use`）与 Kimi（`.git`）豁免不变，且豁免刻意不扩大为
+  `.codex-plugin/*` 或任意多余文件。flow-architect 真实安装实测验证：除
+  migrated-command-skills 目录外，安装内容与冻结快照逐字节一致。密封摘要、
+  计划 schema 与 prepare 冻结均未改动，已冻结计划可以不变地 reconcile 收口。
+- **多段快照排除，失败关闭**：`computeFrozenSnapshot` 的
+  `excludeRootEntries` 现在接受多段相对路径前缀，命名一个精确排除的子树
+  （`.codex-plugin/migrated-command-skills` 豁免所必需）；单段条目保持历史
+  的根直接子项匹配。畸形条目（非字符串、绝对路径、`..`、反斜杠）失败关闭：
+  错误的排除清单是调用方 bug，不是传输元数据。
+- **回归覆盖**：新增协议级测试覆盖带 CLI 生成 migrated-command-skills 树的
+  根布局 codex execute→observe→verify 完整链路，包含必须仍然失败关闭的字节
+  篡改与多余文件负例。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.1.9 是当前发布版本（v0.1.8 曾处于已发布、待独立验证状态）。
+> **当前边界：** v0.1.10 是当前发布版本（v0.1.9 曾处于已发布、待独立验证状态）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；“当前发布版本”与“首次生产验证里程碑”

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.1.9",
+      "version": "0.1.10",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification"
     }
   ]

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/release-skill.bundle.mjs

@@ -9,7 +9,7 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.9"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.10"});
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -17816,7 +17816,8 @@ var init_baseline = __esm({
       ".release-skill/lock",
       ".release-skill/lock-audit",
       ".release-skill/runs",
-      ".release-skill/transactions"
+      ".release-skill/transactions",
+      ".release-skill/kimi-attestations"
     ];
     RESERVED_CONTROL_PREFIXES = [
       ...CONTROL_PLANE_PREFIXES,
@@ -19013,14 +19014,30 @@ async function computeFrozenSnapshot(snapshotDir, { excludeRootEntries = [] } =
     throw frozenError("frozen snapshot root must be a real directory");
   }
   const entries = [];
-  const excluded = new Set(excludeRootEntries);
+  const excludedRootNames = /* @__PURE__ */ new Set();
+  const excludedPathPrefixes = [];
+  for (const entry of excludeRootEntries) {
+    if (typeof entry !== "string") {
+      throw frozenError("frozen snapshot exclusion entries must be strings");
+    }
+    const segments = entry.split("/").filter((segment) => segment !== "" && segment !== ".");
+    if (segments.length === 0 || entry.startsWith("/") || entry.includes("\\") || segments.some((segment) => segment === "..")) {
+      throw frozenError(`frozen snapshot exclusion entry is not a safe relative path: ${JSON.stringify(entry)}`);
+    }
+    if (segments.length === 1) {
+      excludedRootNames.add(segments[0]);
+    } else {
+      excludedPathPrefixes.push(segments.join("/"));
+    }
+  }
   async function walk(dir) {
     const children = await readdir3(dir, { withFileTypes: true });
     children.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const child of children) {
-      if (dir === root && excluded.has(child.name)) continue;
+      if (dir === root && excludedRootNames.has(child.name)) continue;
       const absolute = join3(dir, child.name);
       const rel = relative7(root, absolute).split("\\").join("/");
+      if (excludedPathPrefixes.some((prefix) => rel === prefix || rel.startsWith(`${prefix}/`))) continue;
       const st = await lstat5(absolute);
       if (st.isSymbolicLink()) {
         throw frozenError(`frozen snapshot contains symlink: ${rel}`);
@@ -76932,7 +76949,8 @@ function transportPayload(entries) {
 }
 function consumerTransportExclusions(consumer) {
   if (consumer === "claude") return [".in_use"];
-  if (consumer === "codex" || consumer === "kimi") return [".git"];
+  if (consumer === "codex") return [".git", ".codex-plugin/migrated-command-skills"];
+  if (consumer === "kimi") return [".git"];
   return [];
 }
 function extractDeclaredPluginSource(consumer, entry) {

package/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.1.9.",
+      "Prepare a release plan for version 0.1.10.",
       "Help me understand the release workflow."
     ]
   }

package/adapters/codex/bin/release-skill.bundle.mjs

@@ -9,7 +9,7 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.9"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.10"});
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -17816,7 +17816,8 @@ var init_baseline = __esm({
       ".release-skill/lock",
       ".release-skill/lock-audit",
       ".release-skill/runs",
-      ".release-skill/transactions"
+      ".release-skill/transactions",
+      ".release-skill/kimi-attestations"
     ];
     RESERVED_CONTROL_PREFIXES = [
       ...CONTROL_PLANE_PREFIXES,
@@ -19013,14 +19014,30 @@ async function computeFrozenSnapshot(snapshotDir, { excludeRootEntries = [] } =
     throw frozenError("frozen snapshot root must be a real directory");
   }
   const entries = [];
-  const excluded = new Set(excludeRootEntries);
+  const excludedRootNames = /* @__PURE__ */ new Set();
+  const excludedPathPrefixes = [];
+  for (const entry of excludeRootEntries) {
+    if (typeof entry !== "string") {
+      throw frozenError("frozen snapshot exclusion entries must be strings");
+    }
+    const segments = entry.split("/").filter((segment) => segment !== "" && segment !== ".");
+    if (segments.length === 0 || entry.startsWith("/") || entry.includes("\\") || segments.some((segment) => segment === "..")) {
+      throw frozenError(`frozen snapshot exclusion entry is not a safe relative path: ${JSON.stringify(entry)}`);
+    }
+    if (segments.length === 1) {
+      excludedRootNames.add(segments[0]);
+    } else {
+      excludedPathPrefixes.push(segments.join("/"));
+    }
+  }
   async function walk(dir) {
     const children = await readdir3(dir, { withFileTypes: true });
     children.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const child of children) {
-      if (dir === root && excluded.has(child.name)) continue;
+      if (dir === root && excludedRootNames.has(child.name)) continue;
       const absolute = join3(dir, child.name);
       const rel = relative7(root, absolute).split("\\").join("/");
+      if (excludedPathPrefixes.some((prefix) => rel === prefix || rel.startsWith(`${prefix}/`))) continue;
       const st = await lstat5(absolute);
       if (st.isSymbolicLink()) {
         throw frozenError(`frozen snapshot contains symlink: ${rel}`);
@@ -76932,7 +76949,8 @@ function transportPayload(entries) {
 }
 function consumerTransportExclusions(consumer) {
   if (consumer === "claude") return [".in_use"];
-  if (consumer === "codex" || consumer === "kimi") return [".git"];
+  if (consumer === "codex") return [".git", ".codex-plugin/migrated-command-skills"];
+  if (consumer === "kimi") return [".git"];
   return [];
 }
 function extractDeclaredPluginSource(consumer, entry) {

package/adapters/kimi/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/kimi/bin/release-skill.bundle.mjs

@@ -9,7 +9,7 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.9"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.10"});
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -17816,7 +17816,8 @@ var init_baseline = __esm({
       ".release-skill/lock",
       ".release-skill/lock-audit",
       ".release-skill/runs",
-      ".release-skill/transactions"
+      ".release-skill/transactions",
+      ".release-skill/kimi-attestations"
     ];
     RESERVED_CONTROL_PREFIXES = [
       ...CONTROL_PLANE_PREFIXES,
@@ -19013,14 +19014,30 @@ async function computeFrozenSnapshot(snapshotDir, { excludeRootEntries = [] } =
     throw frozenError("frozen snapshot root must be a real directory");
   }
   const entries = [];
-  const excluded = new Set(excludeRootEntries);
+  const excludedRootNames = /* @__PURE__ */ new Set();
+  const excludedPathPrefixes = [];
+  for (const entry of excludeRootEntries) {
+    if (typeof entry !== "string") {
+      throw frozenError("frozen snapshot exclusion entries must be strings");
+    }
+    const segments = entry.split("/").filter((segment) => segment !== "" && segment !== ".");
+    if (segments.length === 0 || entry.startsWith("/") || entry.includes("\\") || segments.some((segment) => segment === "..")) {
+      throw frozenError(`frozen snapshot exclusion entry is not a safe relative path: ${JSON.stringify(entry)}`);
+    }
+    if (segments.length === 1) {
+      excludedRootNames.add(segments[0]);
+    } else {
+      excludedPathPrefixes.push(segments.join("/"));
+    }
+  }
   async function walk(dir) {
     const children = await readdir3(dir, { withFileTypes: true });
     children.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const child of children) {
-      if (dir === root && excluded.has(child.name)) continue;
+      if (dir === root && excludedRootNames.has(child.name)) continue;
       const absolute = join3(dir, child.name);
       const rel = relative7(root, absolute).split("\\").join("/");
+      if (excludedPathPrefixes.some((prefix) => rel === prefix || rel.startsWith(`${prefix}/`))) continue;
       const st = await lstat5(absolute);
       if (st.isSymbolicLink()) {
         throw frozenError(`frozen snapshot contains symlink: ${rel}`);
@@ -76932,7 +76949,8 @@ function transportPayload(entries) {
 }
 function consumerTransportExclusions(consumer) {
   if (consumer === "claude") return [".in_use"];
-  if (consumer === "codex" || consumer === "kimi") return [".git"];
+  if (consumer === "codex") return [".git", ".codex-plugin/migrated-command-skills"];
+  if (consumer === "kimi") return [".git"];
   return [];
 }
 function extractDeclaredPluginSource(consumer, entry) {

package/bin/release-skill.bundle.mjs

@@ -9,7 +9,7 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.9"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.10"});
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -17816,7 +17816,8 @@ var init_baseline = __esm({
       ".release-skill/lock",
       ".release-skill/lock-audit",
       ".release-skill/runs",
-      ".release-skill/transactions"
+      ".release-skill/transactions",
+      ".release-skill/kimi-attestations"
     ];
     RESERVED_CONTROL_PREFIXES = [
       ...CONTROL_PLANE_PREFIXES,
@@ -19013,14 +19014,30 @@ async function computeFrozenSnapshot(snapshotDir, { excludeRootEntries = [] } =
     throw frozenError("frozen snapshot root must be a real directory");
   }
   const entries = [];
-  const excluded = new Set(excludeRootEntries);
+  const excludedRootNames = /* @__PURE__ */ new Set();
+  const excludedPathPrefixes = [];
+  for (const entry of excludeRootEntries) {
+    if (typeof entry !== "string") {
+      throw frozenError("frozen snapshot exclusion entries must be strings");
+    }
+    const segments = entry.split("/").filter((segment) => segment !== "" && segment !== ".");
+    if (segments.length === 0 || entry.startsWith("/") || entry.includes("\\") || segments.some((segment) => segment === "..")) {
+      throw frozenError(`frozen snapshot exclusion entry is not a safe relative path: ${JSON.stringify(entry)}`);
+    }
+    if (segments.length === 1) {
+      excludedRootNames.add(segments[0]);
+    } else {
+      excludedPathPrefixes.push(segments.join("/"));
+    }
+  }
   async function walk(dir) {
     const children = await readdir3(dir, { withFileTypes: true });
     children.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const child of children) {
-      if (dir === root && excluded.has(child.name)) continue;
+      if (dir === root && excludedRootNames.has(child.name)) continue;
       const absolute = join3(dir, child.name);
       const rel = relative7(root, absolute).split("\\").join("/");
+      if (excludedPathPrefixes.some((prefix) => rel === prefix || rel.startsWith(`${prefix}/`))) continue;
       const st = await lstat5(absolute);
       if (st.isSymbolicLink()) {
         throw frozenError(`frozen snapshot contains symlink: ${rel}`);
@@ -76932,7 +76949,8 @@ function transportPayload(entries) {
 }
 function consumerTransportExclusions(consumer) {
   if (consumer === "claude") return [".in_use"];
-  if (consumer === "codex" || consumer === "kimi") return [".git"];
+  if (consumer === "codex") return [".git", ".codex-plugin/migrated-command-skills"];
+  if (consumer === "kimi") return [".git"];
   return [];
 }
 function extractDeclaredPluginSource(consumer, entry) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/src/adapters/plugin-marketplace.mjs

@@ -50,12 +50,18 @@ function transportPayload(entries) {
 
 // Consumer-owned transport metadata written into the plugin install root
 // that is not part of the published payload. Codex checks out the
-// repository (root `.git` metadata); Claude marks in-use plugin checkouts
-// with an empty root `.in_use` marker. Exclusions apply to root entries
-// only; all payload paths keep the fail-closed file checks.
+// repository (root `.git` metadata) and materializes migrated command
+// skills under `.codex-plugin/migrated-command-skills/` (the CLI converts
+// plugin commands/ into skill format at install time); Claude marks in-use
+// plugin checkouts with an empty root `.in_use` marker. Single-segment
+// exclusions apply to root entries only; the multi-segment exclusion names
+// the exact CLI-generated subtree. All other payload paths keep the
+// fail-closed file checks — the exemption must never widen to
+// ".codex-plugin/*" or arbitrary extra files.
 function consumerTransportExclusions(consumer) {
   if (consumer === 'claude') return ['.in_use'];
-  if (consumer === 'codex' || consumer === 'kimi') return ['.git'];
+  if (consumer === 'codex') return ['.git', '.codex-plugin/migrated-command-skills'];
+  if (consumer === 'kimi') return ['.git'];
   return [];
 }
 

package/src/core/baseline.mjs

@@ -17,6 +17,16 @@ const execFile = promisify(execFileCb);
  * use reserved prefixes; immutable plans and approvals use exact digest-shaped
  * paths so arbitrary files under similarly named directories remain visible.
  *
+ * `kimi-attestations` holds Kimi's closure-protocol lifecycle artifacts:
+ * the manual installation requirement that publish/reconcile itself emits
+ * for a PARTIAL kimi checkpoint, and the human-written attestation that is
+ * the designed closure input (independently bound to planDigest,
+ * payloadDigest, exact version/tag, install path, responsible person, and
+ * expiry). Neither is publishable source or project configuration — they
+ * never enter the frozen snapshot — so excluding them keeps reconcile's own
+ * requirement output and the flow-required attestation from invalidating
+ * the baseline of every subsequent reconcile.
+ *
  * `project.yaml` is intentionally **not** listed — changes to project
  * configuration must always cause a baseline drift.
  */
@@ -27,6 +37,7 @@ const CONTROL_PLANE_PREFIXES = [
   '.release-skill/lock-audit',
   '.release-skill/runs',
   '.release-skill/transactions',
+  '.release-skill/kimi-attestations',
 ];
 const RESERVED_CONTROL_PREFIXES = [
   ...CONTROL_PLANE_PREFIXES,

package/src/snapshot/frozen.mjs

@@ -83,9 +83,14 @@ async function readStableRegularFile(filePath, displayPath) {
  *
  * `excludeRootEntries` is reserved for consumer-owned transport metadata
  * that is not part of the published payload: Codex's root `.git` checkout
- * metadata and Claude's root `.in_use` in-use plugin marker. Exclusions
- * only apply to direct children of the root; all payload paths retain the
- * normal fail-closed file checks.
+ * metadata, Codex's CLI-generated `.codex-plugin/migrated-command-skills/`
+ * subtree, and Claude's root `.in_use` in-use plugin marker. Single-segment
+ * entries only match direct children of the root (historical behavior);
+ * multi-segment entries name an exact relative path whose subtree is
+ * skipped. Every other payload path retains the normal fail-closed file
+ * checks — the exemption must never widen to whole directories or
+ * arbitrary extra files. Malformed entries (absolute, "..", backslash)
+ * fail closed: a bad exclusion list is a caller bug, not transport metadata.
  */
 export async function computeFrozenSnapshot(snapshotDir, { excludeRootEntries = [] } = {}) {
   const root = await realpath(snapshotDir);
@@ -95,14 +100,33 @@ export async function computeFrozenSnapshot(snapshotDir, { excludeRootEntries =
   }
 
   const entries = [];
-  const excluded = new Set(excludeRootEntries);
+  const excludedRootNames = new Set();
+  const excludedPathPrefixes = [];
+  for (const entry of excludeRootEntries) {
+    if (typeof entry !== 'string') {
+      throw frozenError('frozen snapshot exclusion entries must be strings');
+    }
+    const segments = entry.split('/').filter((segment) => segment !== '' && segment !== '.');
+    if (
+      segments.length === 0 || entry.startsWith('/') || entry.includes('\\') ||
+      segments.some((segment) => segment === '..')
+    ) {
+      throw frozenError(`frozen snapshot exclusion entry is not a safe relative path: ${JSON.stringify(entry)}`);
+    }
+    if (segments.length === 1) {
+      excludedRootNames.add(segments[0]);
+    } else {
+      excludedPathPrefixes.push(segments.join('/'));
+    }
+  }
   async function walk(dir) {
     const children = await readdir(dir, { withFileTypes: true });
     children.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
     for (const child of children) {
-      if (dir === root && excluded.has(child.name)) continue;
+      if (dir === root && excludedRootNames.has(child.name)) continue;
       const absolute = join(dir, child.name);
       const rel = relative(root, absolute).split('\\').join('/');
+      if (excludedPathPrefixes.some((prefix) => rel === prefix || rel.startsWith(`${prefix}/`))) continue;
       const st = await lstat(absolute);
       if (st.isSymbolicLink()) {
         throw frozenError(`frozen snapshot contains symlink: ${rel}`);