release-skill 0.2.1 → 0.2.3

package/src/commands/assess.mjs

@@ -129,7 +129,8 @@ function identifyTopology(config) {
   const hasPlugin =
     uniqueDistTypes.includes('claude-plugin') ||
     uniqueDistTypes.includes('codex-plugin') ||
-    uniqueDistTypes.includes('kimi-plugin');
+    uniqueDistTypes.includes('kimi-plugin') ||
+    uniqueDistTypes.includes('codebuddy-plugin');
 
   if (units.length === 0) {
     type = 'no-release-units';
@@ -428,6 +429,54 @@ async function checkPluginManifests(root, config) {
         }
       }
     }
+
+    if (distributionTypes.has('codebuddy-plugin')) {
+      const manifestPath = resolve(unitRoot, '.codebuddy-plugin', 'plugin.json');
+      const displayPath = unitFile(unit, '.codebuddy-plugin/plugin.json');
+      const exists = await fileExists(manifestPath);
+      if (!exists) {
+        gaps.push(
+          createGap({
+            scope: GapScope.PROFILE,
+            category: GapCategory.MANIFEST,
+            severity: Severity.ERROR,
+            code: 'CODEBUDDY_MANIFEST_MISSING',
+            message: `发布单元 "${unit.id}" 缺少 .codebuddy-plugin/plugin.json 插件清单`,
+            file: displayPath,
+          }),
+        );
+      } else {
+        try {
+          const content = await readFile(manifestPath, 'utf8');
+          const manifest = JSON.parse(content);
+          const requiredFields = ['name', 'version', 'description'];
+          const missingFields = requiredFields.filter((f) => !(f in manifest));
+          if (missingFields.length > 0) {
+            gaps.push(
+              createGap({
+                scope: GapScope.PROFILE,
+                category: GapCategory.MANIFEST,
+                severity: Severity.ERROR,
+                code: 'CODEBUDDY_MANIFEST_INCOMPLETE',
+                message: `CodeBuddy 插件清单缺少必填字段: ${missingFields.join(', ')}`,
+                file: displayPath,
+              }),
+            );
+          }
+        } catch {
+          gaps.push(
+            createGap({
+              scope: GapScope.PROFILE,
+              category: GapCategory.MANIFEST,
+              severity: Severity.ERROR,
+              code: 'CODEBUDDY_MANIFEST_INVALID',
+              message: '.codebuddy-plugin/plugin.json 解析失败',
+              file: displayPath,
+            }),
+          );
+        }
+      }
+    }
   }
 
   return gaps;

package/src/commands/prepare.mjs

@@ -941,6 +941,231 @@ async function buildProductionAssets(
   return assets;
 }
 
+// ---------------------------------------------------------------------------
+// External independent marketplace freeze (production + online only)
+// ---------------------------------------------------------------------------
+
+const EXTERNAL_MARKETPLACE_SHA_RE = /^[0-9a-f]{40}$/;
+
+/**
+ * Parse `git ls-remote --symref <url> HEAD` output into the resolved HEAD
+ * commit sha and the default branch name. Pure: no I/O.
+ *
+ * Expected lines (tab-separated):
+ *   ref: refs/heads/<branch>\tHEAD
+ *   <40-hex sha>\tHEAD
+ *
+ * @param {string} stdout
+ * @returns {{sha:string, defaultBranch:string}|null} null when either is absent.
+ */
+export function parseExternalMarketplaceLsRemote(stdout) {
+  if (typeof stdout !== 'string') return null;
+  const lines = stdout.trim().split('\n').filter((line) => line.length > 0);
+  let defaultBranch = null;
+  let sha = null;
+  for (const line of lines) {
+    const tabIndex = line.indexOf('\t');
+    if (tabIndex < 0) continue;
+    const left = line.slice(0, tabIndex);
+    const right = line.slice(tabIndex + 1);
+    if (right !== 'HEAD') continue;
+    if (left.startsWith('ref: refs/heads/')) {
+      defaultBranch = left.slice('ref: refs/heads/'.length);
+    } else if (EXTERNAL_MARKETPLACE_SHA_RE.test(left)) {
+      sha = left;
+    }
+  }
+  if (!sha || !defaultBranch) return null;
+  return { sha, defaultBranch };
+}
+
+/**
+ * Decode a GitHub contents-API base64 `.content` field and parse it as the
+ * marketplace index JSON. Pure: no I/O.
+ *
+ * @param {string} base64Content
+ * @returns {object|null} parsed index, or null on decode/parse failure.
+ */
+export function decodeExternalMarketplaceIndex(base64Content) {
+  if (typeof base64Content !== 'string') return null;
+  try {
+    const base64 = base64Content.replace(/\s/g, '');
+    const content = Buffer.from(base64, 'base64').toString('utf8');
+    const parsed = JSON.parse(content);
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve an external marketplace repository's current HEAD via
+ * `git ls-remote --symref`, returning both the resolved commit sha and the
+ * default branch name. Read-only: never writes to the remote.
+ *
+ * @param {string} repo - External marketplace repository (owner/name).
+ * @param {object} [opts]
+ * @param {string} [opts.githubHost]
+ * @returns {Promise<{status:string, sha?:string, defaultBranch?:string, error?:string}>}
+ */
+async function defaultObserveExternalMarketplaceHead(repo, { githubHost = 'github.com' } = {}) {
+  try {
+    const { stdout } = await execFile(
+      'git',
+      ['ls-remote', '--symref', `https://${githubHost}/${repo}.git`, 'HEAD'],
+      { shell: false, encoding: 'utf8', timeout: 30000 },
+    );
+    const parsed = parseExternalMarketplaceLsRemote(stdout);
+    if (!parsed) {
+      return { status: 'unknown', error: 'could not resolve HEAD commit sha and default branch from ls-remote --symref output' };
+    }
+    return { status: 'observed', sha: parsed.sha, defaultBranch: parsed.defaultBranch };
+  } catch (error) {
+    return { status: 'unknown', error: error.message };
+  }
+}
+
+/**
+ * Fetch and parse an external marketplace index manifest at a frozen ref via
+ * the GitHub contents API. Read-only: never writes to the remote.
+ *
+ * @param {string} repo - External marketplace repository (owner/name).
+ * @param {string} manifestPath - Platform marketplace manifest path.
+ * @param {string} ref - Frozen commit sha to read the index at.
+ * @param {object} [opts]
+ * @param {string} [opts.githubHost]
+ * @returns {Promise<{status:string, index?:object, error?:string}>}
+ */
+async function defaultFetchExternalMarketplaceIndex(repo, manifestPath, ref, { githubHost = 'github.com' } = {}) {
+  try {
+    const { stdout } = await execFile(
+      'gh',
+      ['api', `repos/${repo}/contents/${manifestPath}?ref=${ref}`, '--jq', '.content'],
+      {
+        shell: false,
+        encoding: 'utf8',
+        timeout: 30000,
+        env: { ...process.env, GH_HOST: githubHost },
+      },
+    );
+    const index = decodeExternalMarketplaceIndex(stdout);
+    if (!index) {
+      return { status: 'unknown', error: 'could not decode external marketplace index content' };
+    }
+    return { status: 'fetched', index };
+  } catch (error) {
+    return { status: 'unknown', error: error.message };
+  }
+}
+
+/**
+ * Freeze the external marketplace HEAD for every claude/codex distribution
+ * that declares `marketplaceRepo` (production + online only). For each such
+ * distribution: resolve the external repository's HEAD commit sha + default
+ * branch name, validate the marketplace index entry at that sha (name match,
+ * exactly one plugin entry, claude-form entry version equals the target
+ * version), then record the add-ref (codex=sha, claude=default branch name)
+ * and the frozen marketplaceCommitSha. Any failure fails closed. The remote is
+ * only ever read (git ls-remote / gh api), never written.
+ *
+ * @returns {Promise<Map<string, {repo:string, ref:string, marketplaceCommitSha:string, marketplace:string}>>}
+ *   keyed by `${unitId} ${distributionType}`.
+ */
+export async function resolveExternalMarketplaceFreezes({
+  unitResults,
+  resolvedVersions,
+  offline,
+  evidence,
+  observeHeadFn,
+  fetchIndexFn,
+}) {
+  const freezes = new Map();
+  for (let index = 0; index < unitResults.length; index += 1) {
+    const { unit } = unitResults[index];
+    const version = resolvedVersions[index];
+    const githubHost = unit.production?.githubHost ?? 'github.com';
+    for (const dist of unit.distributions ?? []) {
+      if (dist.marketplaceRepo === undefined || dist.marketplaceRepo === null) continue;
+      const platform = PLATFORMS.find((p) => p.distributionType === dist.type);
+      if (!platform || platform.marketplaceRefForm === null) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" ${dist.type} distribution declares marketplaceRepo but the platform has no marketplace add capability`,
+          { unitId: unit.id, distributionType: dist.type },
+        );
+      }
+      if (offline) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" ${dist.type} external marketplace form requires online production prepare to freeze the marketplace commit sha`,
+          { unitId: unit.id, marketplaceRepo: dist.marketplaceRepo },
+        );
+      }
+      const observed = await observeHeadFn(dist.marketplaceRepo, { githubHost });
+      if (observed.status !== 'observed' || !EXTERNAL_MARKETPLACE_SHA_RE.test(observed.sha ?? '') || !observed.defaultBranch) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" could not freeze external marketplace "${dist.marketplaceRepo}" HEAD: ${observed.error ?? 'unknown'}`,
+          { unitId: unit.id, marketplaceRepo: dist.marketplaceRepo },
+        );
+      }
+      const sha = observed.sha;
+      const manifestPath = platform.manifestPaths.marketplace;
+      const fetched = await fetchIndexFn(dist.marketplaceRepo, manifestPath, sha, { githubHost });
+      if (fetched.status !== 'fetched' || !fetched.index || typeof fetched.index !== 'object') {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" could not read external marketplace index for "${dist.marketplaceRepo}" at ${sha}: ${fetched.error ?? 'unknown'}`,
+          { unitId: unit.id, marketplaceRepo: dist.marketplaceRepo },
+        );
+      }
+      const marketplaceIndex = fetched.index;
+      if (marketplaceIndex.name !== dist.marketplace) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" external marketplace index name "${marketplaceIndex.name}" does not match distribution marketplace "${dist.marketplace}"`,
+          { unitId: unit.id, marketplaceRepo: dist.marketplaceRepo },
+        );
+      }
+      const pluginEntries = Array.isArray(marketplaceIndex.plugins)
+        ? marketplaceIndex.plugins.filter((entry) => entry && entry.name === dist.plugin)
+        : [];
+      if (pluginEntries.length !== 1) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" external marketplace index must contain exactly one plugin entry named "${dist.plugin}", found ${pluginEntries.length}`,
+          { unitId: unit.id, marketplaceRepo: dist.marketplaceRepo },
+        );
+      }
+      if (platform.marketplaceEntryCarriesVersion && pluginEntries[0].version !== version) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `unit "${unit.id}" external marketplace index entry version "${pluginEntries[0].version}" does not match target version "${version}"`,
+          { unitId: unit.id, marketplaceRepo: dist.marketplaceRepo },
+        );
+      }
+      const ref = platform.marketplaceRefForm === 'sha' ? sha : observed.defaultBranch;
+      freezes.set(`${unit.id} ${dist.type}`, {
+        repo: dist.marketplaceRepo,
+        ref,
+        marketplaceCommitSha: sha,
+        marketplace: dist.marketplace,
+      });
+      await evidence.append({
+        phase: 'external-marketplace-freeze',
+        unitId: unit.id,
+        distributionType: dist.type,
+        status: 'completed',
+        marketplaceRepo: dist.marketplaceRepo,
+        marketplaceCommitSha: sha,
+        defaultBranch: observed.defaultBranch,
+        addRef: ref,
+      });
+    }
+  }
+  return freezes;
+}
+
 // ---------------------------------------------------------------------------
 // External actions generation
 // ---------------------------------------------------------------------------
@@ -956,7 +1181,7 @@ async function buildProductionAssets(
  * @param {string} realRoot - The project root for relative path calculation.
  * @returns {object[]} Array of external action descriptors.
  */
-function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
+export function buildExternalActions(unitResults, resolvedVersions, productionAssets, externalFreezes = new Map()) {
   const actions = [];
 
   if (!productionAssets) {
@@ -1026,6 +1251,46 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
         if (!dist) continue;
         const requiresMarketplace = platform.schemaRequiredFields.includes('marketplace');
         const timeoutMs = Number.isInteger(dist.timeoutMs) ? dist.timeoutMs : 300000;
+        // External independent marketplace form: the distribution declares
+        // marketplaceRepo, so the install targets the external marketplace repo
+        // and carries the external payload contract. Non-production prepare does
+        // no online resolution, so it carries the external marker + repo shape
+        // but no frozen ref/marketplaceCommitSha (production-only bindings),
+        // keeping the two loops' shapes aligned for plan completeness.
+        const externalMarketplace = dist.marketplaceRepo !== undefined && dist.marketplaceRepo !== null;
+        // Normalized marketplace form: explicit mutually exclusive declaration.
+        // bundled-family: marketplace and plugin live in the same repo.
+        // standalone-index: external marketplace repo indexes a separate plugin repo.
+        // Non-automatable platforms (kimi, codebuddy) use human-attestation and
+        // carry no marketplace form.
+        const marketplaceForm = requiresMarketplace
+          ? (externalMarketplace ? 'standalone-index' : 'bundled-family')
+          : null;
+        const sourceDescriptor = marketplaceForm === 'standalone-index'
+          ? Object.freeze({
+            form: 'standalone-index',
+            marketplaceRepo: dist.marketplaceRepo,
+            marketplaceEntry: dist.plugin,
+            // pluginRepo is the plugin's own public repo, NOT the external
+            // marketplace repo. The marketplace repo contains the index; the
+            // plugin repo contains the actual plugin code.
+            pluginRepo: unit.publicRepo,
+            sourceType: 'marketplace-entry',
+            // Production-only fields: marketplaceCommitSha and ref are frozen
+            // by resolveExternalMarketplaceFreezes in the production path.
+            marketplaceCommitSha: null,
+            ref: null,
+            payloadDigest: null,
+          })
+          : marketplaceForm === 'bundled-family'
+            ? Object.freeze({
+              form: 'bundled-family',
+              repo: unit.publicRepo,
+              marketplaceEntry: dist.plugin,
+              pluginSubpath: '.',
+              payloadDigest: null,
+            })
+            : null;
         actions.push({
           id: `${platform.actionType}-${unit.id}`,
           type: platform.actionType,
@@ -1035,7 +1300,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
             consumer: platform.id,
             plugin: dist.plugin,
             ...(requiresMarketplace ? { marketplace: dist.marketplace } : {}),
-            repo: unit.publicRepo,
+            repo: externalMarketplace ? dist.marketplaceRepo : unit.publicRepo,
             version,
             entrySkill: dist.entrySkill,
             timeoutMs,
@@ -1043,7 +1308,12 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
             // payload is verified by declared-manifest containment; host-added
             // files are recorded, not failed. Frozen plans without this marker
             // keep the legacy full-tree equality semantics byte-for-byte.
-            payloadContract: 'declared-manifest-v1',
+            // External marketplace form uses the external-marketplace-v1
+            // contract (whole-tree '.' containment; see plugin-marketplace).
+            payloadContract: externalMarketplace ? 'external-marketplace-v1' : 'declared-manifest-v1',
+            ...(externalMarketplace ? { marketplaceLocation: 'external' } : {}),
+            ...(marketplaceForm ? { marketplaceForm } : {}),
+            ...(sourceDescriptor ? { sourceDescriptor } : {}),
           },
           expected: {
             installed: true,
@@ -1051,6 +1321,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
             ...(requiresMarketplace ? { marketplace: dist.marketplace } : {}),
             version,
             entrySkill: dist.entrySkill,
+            ...(externalMarketplace ? { marketplaceLocation: 'external', repo: dist.marketplaceRepo } : {}),
           },
           status: 'PENDING',
         });
@@ -1207,6 +1478,41 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
       if (!dist) continue;
       const requiresMarketplace = platform.schemaRequiredFields.includes('marketplace');
       const timeoutMs = Number.isInteger(dist.timeoutMs) ? dist.timeoutMs : 300000;
+      // External independent marketplace form: the install targets the external
+      // marketplace repo with the add-ref + marketplaceCommitSha frozen online
+      // by resolveExternalMarketplaceFreezes. snapshotPath/manifestDigest still
+      // bind this unit's own frozen snapshot — the payload authority is the unit
+      // snapshot, unchanged. Inline form (no marketplaceRepo) is byte-identical.
+      const externalMarketplace = dist.marketplaceRepo !== undefined && dist.marketplaceRepo !== null;
+      const freeze = externalMarketplace ? externalFreezes.get(`${unit.id} ${dist.type}`) : null;
+      // Normalized marketplace form: explicit mutually exclusive declaration.
+      const marketplaceForm = requiresMarketplace
+        ? (externalMarketplace ? 'standalone-index' : 'bundled-family')
+        : null;
+      const sourceDescriptor = marketplaceForm === 'standalone-index'
+        ? Object.freeze({
+          form: 'standalone-index',
+          marketplaceRepo: dist.marketplaceRepo,
+          marketplaceCommitSha: freeze?.marketplaceCommitSha ?? null,
+          marketplaceEntry: dist.plugin,
+          // pluginRepo is the plugin's own public repo, NOT the external
+          // marketplace repo. The marketplace repo contains the index; the
+          // plugin repo contains the actual plugin code.
+          pluginRepo: unit.publicRepo,
+          sourceType: 'marketplace-entry',
+          ref: freeze?.ref ?? null,
+          payloadDigest: asset.manifestDigest,
+        })
+        : marketplaceForm === 'bundled-family'
+          ? Object.freeze({
+            form: 'bundled-family',
+            repo: unit.publicRepo,
+            commit: asset.commit,
+            marketplaceEntry: dist.plugin,
+            pluginSubpath: '.',
+            payloadDigest: asset.manifestDigest,
+          })
+          : null;
       actions.push({
         id: `${platform.actionType}-${unit.id}`,
         type: platform.actionType,
@@ -1216,8 +1522,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
           consumer: platform.id,
           plugin: dist.plugin,
           ...(requiresMarketplace ? { marketplace: dist.marketplace } : {}),
-          repo: unit.publicRepo,
-          ref: resolvedTag,
+          repo: externalMarketplace ? dist.marketplaceRepo : unit.publicRepo,
+          ref: externalMarketplace ? freeze.ref : resolvedTag,
           version: unitVersion,
           entrySkill: dist.entrySkill,
           snapshotPath: asset.snapshotPath,
@@ -1227,19 +1533,29 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
           // payload is verified by declared-manifest containment; host-added
           // files are recorded, not failed. Frozen plans without this marker
           // keep the legacy full-tree equality semantics byte-for-byte.
-          payloadContract: 'declared-manifest-v1',
+          // External marketplace form uses the external-marketplace-v1
+          // contract (whole-tree '.' containment; see plugin-marketplace).
+          payloadContract: externalMarketplace ? 'external-marketplace-v1' : 'declared-manifest-v1',
+          ...(externalMarketplace ? { marketplaceLocation: 'external', marketplaceCommitSha: freeze.marketplaceCommitSha } : {}),
+          ...(marketplaceForm ? { marketplaceForm } : {}),
+          ...(sourceDescriptor ? { sourceDescriptor } : {}),
+          // 冻结的插件来源提交，用于 sourceDescriptor.commit 交叉校验。
+          // bundled-family: sourceDescriptor.commit 绑定到此值。
+          // standalone-index: 通过此值绑定插件载荷来源。
+          sourceCommit: asset.commit,
         },
         expected: {
           installed: true,
           consumer: platform.id,
           plugin: dist.plugin,
           ...(requiresMarketplace ? { marketplace: dist.marketplace } : {}),
-          repo: unit.publicRepo,
+          repo: externalMarketplace ? dist.marketplaceRepo : unit.publicRepo,
           version: unitVersion,
-          ref: resolvedTag,
+          ref: externalMarketplace ? freeze.ref : resolvedTag,
           entrySkill: dist.entrySkill,
           entrySkillFound: true,
           manifestDigest: asset.manifestDigest,
+          ...(externalMarketplace ? { marketplaceLocation: 'external', marketplaceCommitSha: freeze.marketplaceCommitSha } : {}),
         },
         status: 'PENDING',
       });
@@ -1891,7 +2207,24 @@ export async function prepareRelease(options) {
       };
     });
 
-    const externalActions = buildExternalActions(unitResults, resolvedVersions, productionAssets);
+    // Freeze external independent marketplace HEADs (production + online only):
+    // for each claude/codex distribution declaring marketplaceRepo, resolve the
+    // external repo's HEAD sha + default branch and validate the marketplace
+    // index entry at that sha before freezing the add-ref. Offline production
+    // with a declared marketplaceRepo fails closed inside the resolver. The
+    // remote is only ever read (git ls-remote / gh api), never written.
+    const externalMarketplaceFreezes = production
+      ? await resolveExternalMarketplaceFreezes({
+          unitResults,
+          resolvedVersions,
+          offline,
+          evidence,
+          observeHeadFn: options.observeExternalMarketplaceHeadFn ?? defaultObserveExternalMarketplaceHead,
+          fetchIndexFn: options.fetchExternalMarketplaceIndexFn ?? defaultFetchExternalMarketplaceIndex,
+        })
+      : new Map();
+
+    const externalActions = buildExternalActions(unitResults, resolvedVersions, productionAssets, externalMarketplaceFreezes);
 
     // Compute overall snapshot digest
     const overallSnapshotDigest = sha256Hex(snapshotDigests.join(':'));

package/src/commands/publish.mjs

@@ -85,6 +85,7 @@ const MARKETPLACE_TYPES = new Set([
   'claude-marketplace-install',
   'codex-marketplace-install',
   'kimi-marketplace-install',
+  'codebuddy-marketplace-install',
 ]);
 
 // ---------------------------------------------------------------------------

package/src/commands/reconcile.mjs

@@ -79,6 +79,7 @@ const MARKETPLACE_TYPES = new Set([
   'claude-marketplace-install',
   'codex-marketplace-install',
   'kimi-marketplace-install',
+  'codebuddy-marketplace-install',
 ]);
 
 // ---------------------------------------------------------------------------

package/src/commands/setup.mjs

@@ -89,6 +89,7 @@ async function walkDiscoveryFiles(root, maxDepth = 8) {
           absolute.endsWith('/.claude-plugin/plugin.json') ||
           absolute.endsWith('/.codex-plugin/plugin.json') ||
           absolute.endsWith('/.kimi-plugin/plugin.json') ||
+          absolute.endsWith('/.codebuddy-plugin/plugin.json') ||
           absolute.endsWith('/.claude-plugin/marketplace.json') ||
           absolute.endsWith('/.codex-plugin/marketplace.json'))
       ) {
@@ -461,7 +462,8 @@ async function discoverFacts(root) {
       path: safeRelative(root, path),
       host: path.includes('/.claude-plugin/') ? 'claude'
         : path.includes('/.kimi-plugin/') ? 'kimi'
-          : 'codex',
+          : path.includes('/.codebuddy-plugin/') ? 'codebuddy'
+            : 'codex',
       kind: path.endsWith('/marketplace.json') ? 'marketplace' : 'plugin',
       name: typeof value.name === 'string' ? value.name : null,
       version: typeof value.version === 'string' ? value.version : null,
@@ -487,7 +489,8 @@ async function discoverFacts(root) {
         host: relPath.includes('/adapters/claude/') ? 'claude'
           : relPath.includes('/adapters/codex/') ? 'codex'
             : relPath.includes('/adapters/kimi/') ? 'kimi'
-              : 'shared',
+              : relPath.includes('/adapters/workbuddy/') ? 'codebuddy'
+                : 'shared',
       };
     })
     .filter((item) => item.name)
@@ -655,7 +658,7 @@ function buildCandidates(facts) {
   const ids = new Set();
   const knownFiles = new Set(facts.fileDigests.map((file) => file.path));
   const manifestRoots = facts.manifests.map((manifest) => {
-    const match = manifest.path.match(/^(.*?)(?:\/)?(?:\.claude-plugin|\.codex-plugin|\.kimi-plugin)\/(?:plugin|marketplace)\.json$/);
+    const match = manifest.path.match(/^(.*?)(?:\/)?(?:\.claude-plugin|\.codex-plugin|\.kimi-plugin|\.codebuddy-plugin)\/(?:plugin|marketplace)\.json$/);
     return { ...manifest, root: match?.[1] || '.' };
   });
   const manifestOwners = new Map();
@@ -703,6 +706,7 @@ function buildCandidates(facts) {
     if (pluginHosts.includes('claude')) distributions.push('claude-plugin');
     if (pluginHosts.includes('codex')) distributions.push('codex-plugin');
     if (pluginHosts.includes('kimi')) distributions.push('kimi-plugin');
+    if (pluginHosts.includes('codebuddy')) distributions.push('codebuddy-plugin');
     if (pkg.private && matchingLegacyUnits.length === 0 && facts.legacyReleaseConfigs.length > 0) continue;
     if (pkg.private && distributions.length === 0) continue;
 

package/src/commands/verify.mjs

@@ -69,6 +69,7 @@ const ADAPTER_ACTION_TYPE_MAP = {
   'claude-marketplace-install': 'claude-marketplace-install',
   'codex-marketplace-install': 'codex-marketplace-install',
   'kimi-marketplace-install': 'kimi-marketplace-install',
+  'codebuddy-marketplace-install': 'codebuddy-marketplace-install',
 };
 
 // ---------------------------------------------------------------------------
@@ -735,6 +736,7 @@ export async function verifyRelease(options) {
       'claude-marketplace-install',
       'codex-marketplace-install',
       'kimi-marketplace-install',
+      'codebuddy-marketplace-install',
     ]);
 
     for (const action of actions) {
@@ -847,7 +849,9 @@ export async function verifyRelease(options) {
           ? 'claude-plugin'
           : action.type === 'codex-marketplace-install'
             ? 'codex-plugin'
-            : 'kimi-plugin';
+            : action.type === 'codebuddy-marketplace-install'
+              ? 'codebuddy-plugin'
+              : 'kimi-plugin';
         const installPath = verifyResult.observation?.installPath;
         consumerGateResults.push(...await runConsumerVerificationGates({
           plan,
@@ -866,10 +870,14 @@ export async function verifyRelease(options) {
                   HOME: resolve(runDir, 'consumers', `codex-${action.parameters.plugin}`),
                   CODEX_HOME: resolve(runDir, 'consumers', `codex-${action.parameters.plugin}`),
                 }
-              : {
-                  HOME: resolve(runDir, 'consumers', `kimi-${action.parameters.plugin}`),
-                  KIMI_CODE_HOME: resolve(runDir, 'consumers', `kimi-${action.parameters.plugin}`),
-                },
+              : action.type === 'codebuddy-marketplace-install'
+                ? {
+                    HOME: resolve(runDir, 'consumers', `codebuddy-${action.parameters.plugin}`),
+                  }
+                : {
+                    HOME: resolve(runDir, 'consumers', `kimi-${action.parameters.plugin}`),
+                    KIMI_CODE_HOME: resolve(runDir, 'consumers', `kimi-${action.parameters.plugin}`),
+                  },
         }));
       } else {
         // --- Non-marketplace: read-only adapter.verify() ---

package/src/core/baseline.mjs

@@ -38,11 +38,24 @@ const CONTROL_PLANE_PREFIXES = [
   '.release-skill/runs',
   '.release-skill/transactions',
   '.release-skill/kimi-attestations',
+  // codebuddy-attestations: same rationale as kimi-attestations above.
+  // Holds CodeBuddy's closure-protocol lifecycle artifacts: manual install
+  // requirements and human attestations bound to planDigest, payloadDigest,
+  // version, install path, responsible person, and expiry. Neither is
+  // publishable source or project configuration — they never enter the frozen
+  // snapshot — so excluding them keeps reconcile's own requirement output and
+  // the flow-required attestation from invalidating the baseline.
+  '.release-skill/codebuddy-attestations',
   // T3.2 incremental hook cache: a pure local optimisation written by prepare.
   // Excluding it keeps cache records from destabilising workspaceDigest on
   // every prepare (and hook-cache.mjs also skips this prefix when fingerprinting
   // inputs, so records never hash themselves).
   '.release-skill/cache',
+  // waivers: exception records with reason, responsible person, and expiry.
+  // Like attestations, they are runtime closure artifacts — not publishable
+  // source or project configuration — so excluding them keeps waiver writes
+  // from invalidating the workspace baseline.
+  '.release-skill/waivers',
 ];
 const RESERVED_CONTROL_PREFIXES = [
   ...CONTROL_PLANE_PREFIXES,

package/src/core/checkpoints.mjs

@@ -33,6 +33,7 @@ export const CHECKPOINT_ORDER = [
   'claude-marketplace-install',
   'codex-marketplace-install',
   'kimi-marketplace-install',
+  'codebuddy-marketplace-install',
 ];
 
 /**
@@ -52,6 +53,7 @@ export const ADAPTER_ACTION_TYPE_MAP = {
   'claude-marketplace-install': 'claude-marketplace-install',
   'codex-marketplace-install': 'codex-marketplace-install',
   'kimi-marketplace-install': 'kimi-marketplace-install',
+  'codebuddy-marketplace-install': 'codebuddy-marketplace-install',
 };
 
 /**
@@ -67,7 +69,10 @@ export const ADAPTER_ACTION_TYPE_MAP = {
  * - Tier 2 `github-release` and the claude/codex marketplace installs depend
  *   on Tier 1 `create-tag` (release `--verify-tag`; install ref is the tag).
  * - Tier 3 `kimi-marketplace-install` depends on Tier 2 `github-release`
- *   (its install URL points at the Release page).
+ *   (its install URL points at the Release page). `codebuddy-marketplace-install`
+ *   is also a non-automatable human-attestation closure and runs in Tier 3 after
+ *   the automated writes (its install is from a unified marketplace, proven by a
+ *   human attestation rather than an automated install checkpoint).
  *
  * Action types not listed in any tier are unknown to the scheduler and fail
  * closed (see groupActionsByTier); they are never silently scheduled.
@@ -76,7 +81,7 @@ export const TIER_TABLE = [
   ['push-commit', 'push-snapshot'],                                              // Tier 0
   ['set-default-branch', 'create-tag', 'npm-publish'],                          // Tier 1
   ['github-release', 'claude-marketplace-install', 'codex-marketplace-install'], // Tier 2
-  ['kimi-marketplace-install'],                                                 // Tier 3
+  ['kimi-marketplace-install', 'codebuddy-marketplace-install'],                // Tier 3
 ];
 
 /** Fast reverse lookup: action type -> tier index (-1 when unknown). */