release-skill 0.2.1 → 0.2.3

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.2.1 -->
+<!-- release-skill:release-version: 0.2.3 -->
 Release preparation for Claude Code, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -11,21 +11,26 @@ reviewed artifacts first and publishes those same artifacts later; it does not
 regenerate a README or re-pack the live workspace at the last step.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.2.1** (2026-07-25)
+**0.2.3** (2026-07-26)
 
-v0.2.1 adds a fourth platform adapter — workbuddy (CodeBuddy/WorkBuddy plugin) — using a build-only distribution model. The build-adapters generator and platform registry now register workbuddy alongside claude, codex, and kimi, producing a self-contained adapter directory at `adapters/workbuddy/` with a `.codebuddy-plugin/plugin.json` manifest, bundled CLI entry, native prebuilds, schemas, and skills. The sync-public-files and sync-version scripts cover the new manifest, and the adapter-contract standard documents build-only distribution. README and INSTALL (en + zh-CN) register the CodeBuddy installation entry. Installation is manual — the automated marketplace install checkpoint does not cover CodeBuddy yet.
+v0.2.3 is a fix-forward release that addresses platform verification, public artifact, and documentation issues discovered in v0.2.2. The release converges platform fact sources, fixes consumer gate mapping errors, and strengthens attestation validation.
 
-**Added**
+**Changed**
 
-- **WorkBuddy/CodeBuddy build-only distribution adapter**: new fourth platform adapter `workbuddy` registered in the platform registry and build-adapters generator. The generated self-contained adapter directory (`adapters/workbuddy/`) ships a `.codebuddy-plugin/plugin.json` manifest, a bundled CLI entry (`bin/release-skill.bundle.mjs`), native safe-write prebuilds, JSON schemas, and the full skill set. Skills resolve the CLI entry via `${CODEBUDDY_PLUGIN_ROOT}`, which CodeBuddy expands inline.
-- **Build-only distribution model in adapter-contract standard**: both the parent `standards/06-adapter-contract.md` and the public `references/06-adapter-contract.md` now document the build-only distribution scope — the adapter is generated and self-contained, installation is manual, and the automated preflight/execute/observe/verify marketplace checkpoint is not yet wired for CodeBuddy.
-- **sync-public-files and sync-version coverage for `.codebuddy-plugin`**: the `sync-public-files.mjs` script now validates the `.codebuddy-plugin/plugin.json` manifest as a public asset, and `sync-version.mjs` propagates the package version into it. The build-adapters generator produces workbuddy artifacts alongside the existing three platforms.
-- **README and INSTALL registration (en + zh-CN)**: all four public documents (README.md, README.zh-CN.md, INSTALL.md, INSTALL.zh-CN.md) now list the CodeBuddy/WorkBuddy adapter, its manual installation path, and the scope limitation that the automated marketplace install checkpoint does not yet cover CodeBuddy.
+- **Version synchronized to 0.2.3**: all plugin manifests (9 files), package.json, INSTALL.md, INSTALL.zh-CN.md, README.md, and README.zh-CN.md updated.
+
+**Fixed**
+
+- **CodeBuddy marketplace-install distribution mapping**: `verify.mjs` now correctly maps `codebuddy-marketplace-install` to `codebuddy-plugin` distribution (was incorrectly falling back to `kimi-plugin`). The `fixedEnv` for codebuddy now uses only `HOME` without `KIMI_CODE_HOME`.
+- **Unknown consumer fallback removed**: `plugin-marketplace.mjs` now throws an explicit error for unregistered consumer platforms instead of silently falling back to Kimi configuration. Error message includes the unknown consumer id and list of registered platforms.
+- **CodeBuddy attestation baseline exclusion**: `.release-skill/codebuddy-attestations/` is now properly excluded from workspace baseline digest calculation, preventing self-drift when codebuddy attestation files are written during the release lifecycle.
+- **CodeBuddy manifest skills field accepts array**: `normalizeCodeBuddySkillsRel()` now accepts both string and single-element array forms for the `skills` field, matching the real CodeBuddy validator's expected shape. The root `.codebuddy-plugin/plugin.json` now uses array form.
+- **CLI channel attestation path validation**: `validateCodeBuddyAttestation()` now validates that CLI channel `installPath` ends with the well-known `.codebuddy/plugins/marketplaces/<marketplace>/plugins/<plugin>` segment tail, closing a path-escape gap.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.2.1 is the current release (v0.1.9 previously held
-> published status before the codex migrated-command-skills fix was added).
+> **Current boundary:** v0.2.3 is the current release (v0.2.2 previously held
+> published status before the platform verification convergence fix was added).
 > v0.1.1 completed a real production release to GitHub and npm — the first
 > production-verified milestone — followed by
 > exact npm installation and Claude/Codex consumer installation verification
@@ -58,6 +63,45 @@ v0.2.1 adds a fourth platform adapter — workbuddy (CodeBuddy/WorkBuddy plugin)
 > specifically requires `prepare --online --production`. Without digest confirmation,
 > no remote preflight or write starts.
 
+## Release workflow overview
+
+release-skill models the release lifecycle as a strict state machine so that every
+stage has explicit entry and exit conditions and no stage can be skipped. The
+normative definition lives in `references/01-state-machine.md`.
+
+```text
+DISCOVERED -> ASSESSED -> PREPARED -> APPROVED -> PUBLISHING -> PUBLISHED -> VERIFIED
+                                   exception states: NEEDS_INPUT / BLOCKED / PARTIAL
+```
+
+Each CLI command maps to one transition:
+
+- `help` checks the environment; `setup` discovers the project and, after digest
+  confirmation, creates the config once.
+- `assess` performs a read-only readiness evaluation (`DISCOVERED -> ASSESSED`).
+- `prepare` runs the verification gates, freezes an immutable release plan, and
+  copies the configured public files into an isolated snapshot
+  (`ASSESSED -> PREPARED`). It writes only under `.release-skill/` and never
+  touches remote services.
+- `approve` records human approval bound to the plan digest with a 24-hour expiry
+  (`PREPARED -> APPROVED`). A changed plan invalidates the approval automatically.
+- `publish` executes the external write checkpoints in order
+  (`APPROVED -> PUBLISHING -> PUBLISHED`).
+- `reconcile` recovers from `PARTIAL`; `verify` performs a fresh consumer-install
+  check in an isolated environment (`PUBLISHED -> VERIFIED`).
+
+`PUBLISHED` is **not** the terminal state. Only a fresh `verify` run that confirms
+remote state and exact consumer installs match the frozen plan reaches `VERIFIED`.
+
+**Publishing checkpoint order.** `publish` runs a read-only global preflight over
+all actions, then executes and observes in this fixed order: public snapshot
+branch -> signed/tracked tag -> npm publish -> GitHub Release -> configured
+Claude/Codex plugin-marketplace install -> run record. Any failure stops subsequent
+checkpoints and the run lands in `PARTIAL`. The system never auto-deletes remote
+tags, unpublishes packages, or restarts from scratch; `reconcile` queries the actual
+remote state, skips already-consistent steps, and retries only safe, incomplete
+actions, while remote conflicts require a human decision.
+
 ## Why this is safe for a hand-edited README
 
 release-skill does not regenerate or rewrite project source files. `prepare` copies
@@ -116,6 +160,29 @@ npx release-skill help
 release-skill help
 ```
 
+**Install as a plugin (Claude Code / CodeBuddy / WorkBuddy / Codex / Kimi Code):**
+
+All four plugin hosts install from the unified marketplace
+`ifoohoo/artifact-skill-set` — for example, in a Claude Code session:
+
+```
+/plugin marketplace add ifoohoo/artifact-skill-set
+/plugin install release-skill@artifact-skill-set
+```
+
+`ifoohoo/artifact-skill-set` is an **external independent marketplace**: the
+plugin repository carries only the plugin manifest, while the marketplace index
+is centralized in the external marketplace repository. When a release unit's
+plugin distribution declares `marketplaceRepo`, `prepare --online --production`
+freezes the external marketplace HEAD (Codex pins the commit sha — strong
+freeze; Claude pins the default branch name — weak freeze) and verifies the
+installed payload against the unit's own frozen snapshot whole-tree. **Release
+ordering:** publish the external marketplace index first — its entry version
+must equal the target release version — before `prepare` can freeze a
+marketplace sha containing that entry. See [INSTALL.md](INSTALL.md) for the
+per-platform commands and `references/06-adapter-contract.md` §2.3/§2.4 for the
+contract and the advanced direct-repository options.
+
 **Development install (contributor fallback, from source checkout):**
 
 Set the checkout location and install dependencies:
@@ -894,11 +961,19 @@ Successful reconcile returns `PUBLISHED`, not `VERIFIED`; only the fresh
   Code (no scriptable install API) it emits a version-pinned manual install
   requirement and proves the entry Skill and payload digest only from a trusted
   attestation bound to the frozen plan digest;
+- supports an external independent marketplace for Claude/Codex distributions
+  (`marketplaceRepo`): `prepare --online --production` freezes the external
+  marketplace HEAD (Codex commit sha / Claude default branch name), validates the
+  marketplace index entry at that sha, and verifies the installed payload against
+  the unit's own frozen snapshot whole-tree (`external-marketplace-v1`), while the
+  install-side CLI list observation fails closed on version drift;
 - ships a generated, self-contained CodeBuddy/WorkBuddy adapter
   (`adapters/workbuddy/`, manifest `.codebuddy-plugin/plugin.json`, skills
   rendered with `${CODEBUDDY_PLUGIN_ROOT}`) alongside the Claude/Codex/Kimi
-  adapters; CodeBuddy installation is manual — the automated marketplace
-  install checkpoint does not cover CodeBuddy yet;
+  adapters; because the codebuddy CLI cannot pin a frozen ref there is no
+  automated marketplace install checkpoint, so it emits a manual install
+  requirement and proves the entry Skill and payload digest only from a trusted
+  attestation bound to the frozen plan digest;
 - distinguishes `PUBLISHED` (writes completed) from `VERIFIED` (remote and
   consumer installation evidence completed);
 - stops subsequent checkpoints on failure and writes a separate run record
@@ -985,7 +1060,8 @@ npm publish may never be hooks/gates; they remain controlled plan actions.
   `--force-with-lease=<ref>:` solely as an atomic compare-and-set assertion that
   the ref is absent, while existing branches use an ordinary non-force push;
 - no automated CodeBuddy/WorkBuddy marketplace install checkpoint — the
-  generated `adapters/workbuddy/` distribution adapter is installed manually;
+  codebuddy CLI cannot pin a frozen ref, so installation is a manual step proven
+  by the same attestation closed loop as Kimi Code;
 - no promise of Windows or broad multi-platform native write support;
 - no hidden commit, push, tag, release, or package publication.
 
@@ -1036,6 +1112,29 @@ Conflicts still default to human intervention. The npm-installed `release-skill`
 CLI is the supported user entry after v0.1.1 production publication; source
 checkout remains the development/contributor fallback.
 
+## Platform distribution
+
+One deterministic core engine ships to several targets through build-only adapter
+closures. A release unit declares what reaches users via `distributions`; each
+distribution type maps to a concrete artifact:
+
+| `distributions` type | Physical artifact | Install |
+|---|---|---|
+| `npm` | npm package with CLI entry | `npm install -g release-skill` |
+| `claude-plugin` | self-contained closure under `adapters/claude/` | automated marketplace checkpoint |
+| `codex-plugin` | self-contained closure under `adapters/codex/` | automated marketplace checkpoint |
+| `kimi-plugin` | self-contained closure (no scriptable install API) | manual, attestation-bound |
+| `codebuddy-plugin` | generated `adapters/workbuddy/` with `.codebuddy-plugin/plugin.json` (the codebuddy CLI cannot pin a frozen ref) | manual, attestation-bound |
+
+Each adapter closure bundles its own copy of the CLI bundle, skills, and schemas so
+it runs with no external dependency after installation. The Claude/Codex marketplace
+install checkpoints are automated (preflight, execute, observe, verify); the Kimi
+Code checkpoint fails closed and produces a version-pinned manual install
+requirement; the CodeBuddy/WorkBuddy checkpoint likewise fails closed — because
+the codebuddy CLI cannot pin a frozen ref there is no automated install
+checkpoint — and produces a manual install requirement proven by a trusted
+attestation bound to the frozen plan digest.
+
 ## License
 
 MIT. See [LICENSE](LICENSE).

package/README.zh-CN.md

@@ -2,26 +2,31 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.2.1 -->
+<!-- release-skill:release-version: 0.2.3 -->
 面向 Claude Code、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它先冻结并供人工审阅，再从同一份冻结产物发布，不会在最后一步重新生成 README、重新打包当前工作区或覆盖人工内容。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.2.1** (2026-07-25)
+**0.2.3** (2026-07-26)
 
-v0.2.1 新增第四个平台适配器 workbuddy（CodeBuddy/WorkBuddy 插件），采用 build-only 分发模式。build-adapters 生成器与平台注册表现在将 workbuddy 与 claude、codex、kimi 并列登记，在 `adapters/workbuddy/` 产出包含 `.codebuddy-plugin/plugin.json` 清单、打包 CLI 入口、native 预编译、JSON schemas 与全套技能的自包含适配器目录。sync-public-files 与 sync-version 脚本覆盖新清单，适配器契约标准补充 build-only 分发说明。README 与 INSTALL（中英四份）登记 CodeBuddy 安装入口。安装为手动步骤——自动化 marketplace 安装检查点尚未覆盖 CodeBuddy。
+v0.2.3 是修复版本，解决 v0.2.2 中发现的平台验证、公共生成物和文档问题。本版本收敛平台事实源、修复消费端门禁映射错误并加强证明验证。
 
-**新增**
+**变更**
 
-- **WorkBuddy/CodeBuddy build-only 分发适配器**：新增第四个平台适配器 `workbuddy`，在平台注册表和 build-adapters 生成器中登记。生成的自包含适配器目录（`adapters/workbuddy/`）附带 `.codebuddy-plugin/plugin.json` 清单、打包 CLI 入口（`bin/release-skill.bundle.mjs`）、native safe-write 预编译、JSON schemas 与全套技能。技能通过 `${CODEBUDDY_PLUGIN_ROOT}` 解析 CLI 入口，CodeBuddy 会内联展开该变量。
-- **适配器契约标准补充 build-only 分发模型**：父级 `standards/06-adapter-contract.md` 与公开 `references/06-adapter-contract.md` 均补充 build-only 分发范围说明——适配器由生成器产出且自包含，安装为手动步骤，CodeBuddy 的自动化 preflight/execute/observe/verify marketplace 检查点尚未接入。
-- **sync-public-files 与 sync-version 覆盖 `.codebuddy-plugin`**：`sync-public-files.mjs` 脚本现在将 `.codebuddy-plugin/plugin.json` 清单作为公开资产校验，`sync-version.mjs` 将包版本同步到该清单。build-adapters 生成器将 workbuddy 产物与既有三平台并列生成。
-- **README 与 INSTALL 登记（中英四份）**：四份公开文档（README.md、README.zh-CN.md、INSTALL.md、INSTALL.zh-CN.md）均列出 CodeBuddy/WorkBuddy 适配器、其手动安装路径以及自动化 marketplace 安装检查点尚未覆盖 CodeBuddy 的范围限制。
+- **版本同步到 0.2.3**：所有插件清单（9个文件）、package.json、INSTALL.md、INSTALL.zh-CN.md、README.md 和 README.zh-CN.md 已更新。
+
+**修复**
+
+- **CodeBuddy marketplace-install 分发映射**：`verify.mjs` 现在正确将 `codebuddy-marketplace-install` 映射到 `codebuddy-plugin` distribution（之前错误回落到 `kimi-plugin`）。codebuddy 的 `fixedEnv` 现在只使用 `HOME`，不再包含 `KIMI_CODE_HOME`。
+- **移除未知消费端回落**：`plugin-marketplace.mjs` 现在对未注册的消费端平台抛出明确错误，而非静默回落到 Kimi 配置。错误消息包含未知消费端标识和已注册平台列表。
+- **CodeBuddy 证明基线排除**：`.release-skill/codebuddy-attestations/` 现在正确排除在工作区基线摘要计算之外，防止在发布生命周期中写入 codebuddy 证明文件时产生自漂移。
+- **CodeBuddy 清单 skills 字段支持数组**：`normalizeCodeBuddySkillsRel()` 现在同时支持字符串和单元素数组形式的 `skills` 字段，与真实 CodeBuddy 验证器期望的形状一致。根 `.codebuddy-plugin/plugin.json` 现在使用数组形式。
+- **CLI 通道证明路径验证**：`validateCodeBuddyAttestation()` 现在验证 CLI 通道的 `installPath` 以已知的 `.codebuddy/plugins/marketplaces/<marketplace>/plugins/<plugin>` 段尾结尾，关闭路径逃逸缺口。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.2.1 是当前发布版本（v0.1.9 曾处于已发布、待独立验证状态）。
+> **当前边界：** v0.2.3 是当前发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；“当前发布版本”与“首次生产验证里程碑”
@@ -48,6 +53,28 @@ v0.2.1 新增第四个平台适配器 workbuddy（CodeBuddy/WorkBuddy 插件）
 > --confirm-production <planDigest>`；`bound` 前序公开基线必须使用
 > `prepare --online --production`。没有摘要确认就不会预检或写远端。
 
+## 发布工作流概览
+
+release-skill 把发布生命周期建模为一个严格状态机，让每个阶段都有明确的进入和退出条件，且任何阶段都不能跳过。规范定义见 `references/01-state-machine.md`。
+
+```text
+DISCOVERED -> ASSESSED -> PREPARED -> APPROVED -> PUBLISHING -> PUBLISHED -> VERIFIED
+                                   异常态：NEEDS_INPUT / BLOCKED / PARTIAL
+```
+
+每个 CLI 命令对应一次状态转换：
+
+- `help` 检查环境；`setup` 发现项目，并在摘要确认后仅首次创建配置。
+- `assess` 执行只读就绪度评估（`DISCOVERED -> ASSESSED`）。
+- `prepare` 运行验证门、冻结一份不可变发布计划，并把配置的公开文件复制进隔离快照（`ASSESSED -> PREPARED`）。它只写入 `.release-skill/` 目录，从不触碰远端服务。
+- `approve` 记录人工批准，绑定到计划摘要并带 24 小时有效期（`PREPARED -> APPROVED`）。计划一旦变化，批准自动失效。
+- `publish` 按顺序执行外部写操作检查点（`APPROVED -> PUBLISHING -> PUBLISHED`）。
+- `reconcile` 从 `PARTIAL` 恢复；`verify` 在全新隔离环境完成消费者安装验证（`PUBLISHED -> VERIFIED`）。
+
+`PUBLISHED` **不是**终态。只有全新运行的 `verify` 确认远端状态和精确消费者安装都与冻结计划一致时，才会到达 `VERIFIED`。
+
+**发布检查点顺序。** `publish` 先对所有动作做只读全局预检，再按固定顺序执行并观察：公开快照 branch → 签名/可追溯 tag → npm 发布 → GitHub Release → 配置的 Claude/Codex 插件市场安装 → 运行记录。任一步骤失败都会停止后续检查点并使运行进入 `PARTIAL`。系统绝不自动删除远端 tag、不 unpublish 包、不从头重跑；`reconcile` 查询实际远端状态，跳过已一致的步骤，只重试安全且未完成的动作，远端冲突则交由人工决策。
+
 ## 为什么人工修改的 README 不会丢失
 
 release-skill 不重新生成、也不回写项目源文件。`prepare` 从当前工作区把每个公开文件复制到隔离的本地快照，并验证复制前后的字节。README 的 slogan、示例、正文、格式，以及后续任何人工修改都会作为完整文件被保留。
@@ -89,6 +116,25 @@ npx release-skill help
 release-skill help
 ```
 
+**安装为插件（Claude Code / CodeBuddy / WorkBuddy / Codex / Kimi Code）：**
+
+四种插件宿主都从统一市场 `ifoohoo/artifact-skill-set` 安装——以 Claude
+Code 会话为例：
+
+```
+/plugin marketplace add ifoohoo/artifact-skill-set
+/plugin install release-skill@artifact-skill-set
+```
+
+`ifoohoo/artifact-skill-set` 是一个**外部独立市场**：插件仓库只含 plugin
+清单，marketplace 索引集中于外部市场仓库。当发布单元的插件 distribution 声明
+`marketplaceRepo` 时，`prepare --online --production` 会冻结外部市场 HEAD
+（Codex 钉 commit sha——强冻结；Claude 钉默认分支名——弱冻结），并以本单元自身
+冻结快照整树校验安装载荷。**发布时序：** 须先发布外部市场索引——其条目版本须
+等于目标发布版本——之后 `prepare` 才能冻结到含该条目的市场 sha。各平台完整命令
+见 [INSTALL.zh-CN.md](INSTALL.zh-CN.md)，契约与进阶直接仓库安装方式见
+`references/06-adapter-contract.md` §2.3/§2.4。
+
 **开发安装（贡献者回退，从源码 checkout）：**
 
 ```bash
@@ -595,7 +641,8 @@ reconcile 成功只返回 `PUBLISHED`，不会返回 `VERIFIED`；只有全新
 - 用计划摘要、有效期和显式 action allowlist 绑定人工批准；
 - 从冻结 Git object 和 npm tarball 发布，并核对远端 commit/tree/tag/integrity；
 - 从冻结 Git ref 安装配置的 Claude/Codex 插件，证明入口 Skill 和安装载荷摘要；对 Kimi Code（无可脚本化安装接口）产出版本钉死的手动安装要求，仅依据绑定到冻结计划摘要的可信证明来确认入口 Skill 和载荷摘要；
-- 随 Claude/Codex/Kimi 适配器一并提供生成的自包含 CodeBuddy/WorkBuddy 适配器（`adapters/workbuddy/`，清单 `.codebuddy-plugin/plugin.json`，技能以 `${CODEBUDDY_PLUGIN_ROOT}` 渲染）；CodeBuddy 安装为手动步骤——自动化 marketplace 安装检查点尚未覆盖 CodeBuddy；
+- 为 Claude/Codex distribution 支持外部独立市场（`marketplaceRepo`）：`prepare --online --production` 冻结外部市场 HEAD（Codex commit sha / Claude 默认分支名），校验该 sha 处的市场索引条目，并以本单元自身冻结快照整树校验安装载荷（`external-marketplace-v1`），安装侧 CLI list 观察在版本漂移时失败关闭；
+- 随 Claude/Codex/Kimi 适配器一并提供生成的自包含 CodeBuddy/WorkBuddy 适配器（`adapters/workbuddy/`，清单 `.codebuddy-plugin/plugin.json`，技能以 `${CODEBUDDY_PLUGIN_ROOT}` 渲染）；因 codebuddy CLI 无法钉死冻结 ref 而无自动化 marketplace 安装检查点，故产出手动安装要求，仅依据绑定到冻结计划摘要的可信证明来确认入口 Skill 和载荷摘要；
 - 明确区分 `PUBLISHED`（外写完成）与 `VERIFIED`（远端和消费者安装证据完成）；
 - 中途失败停止后续动作，记录独立 run；不修改冻结 plan，不自动撤销已成功动作。
 
@@ -647,7 +694,7 @@ push、tag、默认分支修改、GitHub Release 和 npm publish 不能放进 ho
 - 不声称已经替项目完成真实生产 canary；
 - `prepare --online` 只观察 bound 前序基线；目标唯一性由 publish 全局预检完成；
 - 不覆盖已有 branch/tag/Release，不 unpublish npm；
-- 不提供自动化 CodeBuddy/WorkBuddy marketplace 安装检查点——生成的 `adapters/workbuddy/` 分发适配器需手动安装；
+- 不提供自动化 CodeBuddy/WorkBuddy marketplace 安装检查点——codebuddy CLI 无法钉死冻结 ref，安装为手动步骤，经与 Kimi Code 相同的可信证明闭环确认；
 - 不承诺 Windows 或广泛的跨平台原生写入；
 - 不会隐藏地 commit、push、打 tag、创建 Release 或发布包。
 
@@ -687,6 +734,20 @@ push、tag、默认分支修改、GitHub Release 和 npm publish 不能放进 ho
 - `release-reconcile`：基于证据恢复 PARTIAL；冲突时人工介入。
 - `release-verify`：发布后验证；只有 `VERIFIED` 才是 happy end。
 
+## 平台分发
+
+同一个确定性核心引擎通过 build-only 适配器闭包分发到多个目标。发布单元用 `distributions` 声明要发布给谁；每种分发类型对应一个具体产物：
+
+| `distributions` 类型 | 物理产物 | 安装方式 |
+|---|---|---|
+| `npm` | 带 CLI 入口的 npm 包 | `npm install -g release-skill` |
+| `claude-plugin` | `adapters/claude/` 下的自包含闭包 | 自动化 marketplace 检查点 |
+| `codex-plugin` | `adapters/codex/` 下的自包含闭包 | 自动化 marketplace 检查点 |
+| `kimi-plugin` | 自包含闭包（无可脚本化安装接口） | 手动，需可信证明 |
+| `codebuddy-plugin` | 生成的 `adapters/workbuddy/`，带 `.codebuddy-plugin/plugin.json`（codebuddy CLI 无法钉死冻结 ref） | 手动，需可信证明 |
+
+每个适配器闭包都自带一份 CLI bundle、skills 和 schemas 的副本，安装后无需外部依赖即可运行。Claude/Codex 的 marketplace 安装检查点是自动化的（preflight、execute、observe、verify）；Kimi Code 检查点失败关闭，并产出版本钉死的手动安装要求；CodeBuddy/WorkBuddy 检查点同样失败关闭——因 codebuddy CLI 无法钉死冻结 ref 而无自动化安装检查点——并产出经绑定冻结计划摘要的可信证明确认的手动安装要求。
+
 ## 许可证
 
 MIT，见 [LICENSE](LICENSE)。

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.2.1",
+      "version": "0.2.3",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification"
     }
   ]

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"