release-skill 0.2.2 → 0.2.4

package/src/core/installation-contract.mjs

@@ -0,0 +1,341 @@
+/**
+ * 安装契约（Installation Contract）。
+ *
+ * 为每个平台构建一个可审计的规范化安装契约对象，并基于其规范 JSON 计算 SHA-256 摘要。
+ * 用于在远端状态未变化时跳过重复验证（NOT_REQUIRED_UNCHANGED）。
+ *
+ * 契约对象包含：
+ * - 算法版本
+ * - distributionType
+ * - 插件 manifest 的实际相对路径
+ * - 规范化后的 manifest 安装内容
+ * - marketplaceSourceType
+ * - 是否纳入市场条目
+ * - 若纳入：所选市场索引的相对路径/来源标识、规范化后的唯一插件条目
+ * - verificationRecipeVersion
+ *
+ * 不纳入契约的字段（做静态一致性校验）：
+ * - 版本号（version）
+ * - 描述（description / shortDescription / longDescription）
+ * - 默认提示词（defaultPrompt）
+ * - 标签（tag）
+ * - 提交信息（commit / commitSha / marketplaceCommitSha / sha）
+ *
+ * @module core/installation-contract
+ */
+
+import { canonicalJson, sha256Hex } from './digest.mjs';
+
+/**
+ * 安装契约摘要算法版本。
+ * 算法变更时递增；版本升级会强制重新验证。
+ */
+export const INSTALLATION_CONTRACT_ALGORITHM_VERSION = 1;
+
+/**
+ * 合法的 marketplaceSourceType 值。
+ */
+const VALID_MARKETPLACE_SOURCE_TYPES = new Set([
+  'bundled-family',
+  'standalone-index',
+]);
+
+/**
+ * 合法的消费端验证结果类型（用于免验判定）。
+ */
+const VALID_CONSUMER_VERIFICATION_STATUSES = new Set([
+  'PASSED_AUTOMATIC',
+  'PASSED_MANUAL',
+  'NOT_REQUIRED_UNCHANGED',
+]);
+
+/**
+ * 需要从规范化对象中递归删除的展示/发布身份校验字段。
+ */
+const DISPLAY_FIELDS_TO_STRIP = new Set([
+  'version',
+  'description',
+  'shortDescription',
+  'longDescription',
+  'defaultPrompt',
+  'tag',
+  'commit',
+  'commitSha',
+  'marketplaceCommitSha',
+  'sha',
+]);
+
+/**
+ * 递归删除对象中的展示字段（深度克隆）。
+ *
+ * @param {Object} obj - 源对象
+ * @returns {Object} 规范化后的对象
+ */
+function stripDisplayFields(obj) {
+  if (obj === null || typeof obj !== 'object') {
+    return obj;
+  }
+
+  if (Array.isArray(obj)) {
+    return obj.map(item => stripDisplayFields(item));
+  }
+
+  const result = {};
+  for (const key of Object.keys(obj)) {
+    if (DISPLAY_FIELDS_TO_STRIP.has(key)) {
+      continue;
+    }
+    result[key] = stripDisplayFields(obj[key]);
+  }
+  return result;
+}
+
+/**
+ * 深度冻结对象（递归）。
+ *
+ * @param {Object} obj - 要冻结的对象
+ * @returns {Object} 冻结后的对象
+ */
+function deepFreeze(obj) {
+  if (obj === null || typeof obj !== 'object') {
+    return obj;
+  }
+
+  Object.freeze(obj);
+
+  if (Array.isArray(obj)) {
+    for (const item of obj) {
+      deepFreeze(item);
+    }
+  } else {
+    for (const value of Object.values(obj)) {
+      deepFreeze(value);
+    }
+  }
+
+  return obj;
+}
+
+/**
+ * 验证路径是否为相对路径。
+ *
+ * @param {string} path - 路径
+ * @param {string} fieldName - 字段名（用于错误信息）
+ */
+function assertRelativePath(path, fieldName) {
+  if (typeof path !== 'string') {
+    throw new Error(`${fieldName} must be a string`);
+  }
+
+  if (path === '') {
+    throw new Error(`${fieldName} must be a non-empty string`);
+  }
+
+  // Unix 绝对路径
+  if (path.startsWith('/')) {
+    throw new Error(`${fieldName} must be a relative path, got absolute path: ${path}`);
+  }
+
+  // Windows 绝对路径
+  if (/^[a-zA-Z]:\\/.test(path) || /^[a-zA-Z]:\//.test(path)) {
+    throw new Error(`${fieldName} must be a relative path, got absolute path: ${path}`);
+  }
+
+  // UNC 路径
+  if (path.startsWith('\\\\')) {
+    throw new Error(`${fieldName} must be a relative path, got UNC path: ${path}`);
+  }
+
+  // 目录穿越检查
+  const segments = path.split('/');
+  for (const seg of segments) {
+    if (seg === '..') {
+      throw new Error(`${fieldName} must not contain ".." traversal, got: ${path}`);
+    }
+    if (seg === '.') {
+      throw new Error(`${fieldName} must not contain "." component, got: ${path}`);
+    }
+  }
+}
+
+/**
+ * 验证摘要格式是否为合法的 64 位十六进制字符串。
+ *
+ * @param {string} digest - 摘要
+ * @returns {boolean} 是否合法
+ */
+function isValidDigest(digest) {
+  return typeof digest === 'string' && /^[a-f0-9]{64}$/.test(digest);
+}
+
+/**
+ * 构建可审计的安装契约对象。
+ *
+ * @param {Object} params
+ * @param {string} params.distributionType - 分发类型（如 'claude-plugin', 'kimi-plugin'）
+ * @param {string} params.manifestRelativePath - 插件 manifest 的相对路径
+ * @param {Object} params.manifest - 插件 manifest 对象
+ * @param {string} params.marketplaceSourceType - 市场来源类型
+ * @param {boolean} params.includeMarketplaceEntry - 是否纳入市场条目
+ * @param {string} [params.marketplaceIndexRelativePath] - 市场索引相对路径（includeMarketplaceEntry=true 时必需）
+ * @param {Object} [params.selectedMarketplaceEntry] - 所选市场条目（includeMarketplaceEntry=true 时必需）
+ * @param {string} params.verificationRecipeVersion - 验证配方版本
+ * @returns {Object} 深度冻结的契约对象
+ */
+export function buildInstallationContract({
+  distributionType,
+  manifestRelativePath,
+  manifest,
+  marketplaceSourceType,
+  includeMarketplaceEntry,
+  marketplaceIndexRelativePath,
+  selectedMarketplaceEntry,
+  verificationRecipeVersion,
+} = {}) {
+  // 输入验证
+  if (!distributionType || typeof distributionType !== 'string') {
+    throw new Error('buildInstallationContract: distributionType must be a non-empty string');
+  }
+
+  if (!manifestRelativePath || typeof manifestRelativePath !== 'string') {
+    throw new Error('buildInstallationContract: manifestRelativePath must be a non-empty string');
+  }
+
+  assertRelativePath(manifestRelativePath, 'manifestRelativePath');
+
+  if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) {
+    throw new Error('buildInstallationContract: manifest must be a non-null plain object');
+  }
+
+  if (!marketplaceSourceType || typeof marketplaceSourceType !== 'string') {
+    throw new Error('buildInstallationContract: marketplaceSourceType must be a non-empty string');
+  }
+
+  if (!VALID_MARKETPLACE_SOURCE_TYPES.has(marketplaceSourceType)) {
+    throw new Error(
+      `buildInstallationContract: invalid marketplaceSourceType "${marketplaceSourceType}", ` +
+      `must be one of: ${[...VALID_MARKETPLACE_SOURCE_TYPES].join(', ')}`
+    );
+  }
+
+  if (!verificationRecipeVersion || typeof verificationRecipeVersion !== 'string') {
+    throw new Error('buildInstallationContract: verificationRecipeVersion must be a non-empty string');
+  }
+
+  if (typeof includeMarketplaceEntry !== 'boolean') {
+    throw new Error('buildInstallationContract: includeMarketplaceEntry must be a boolean');
+  }
+
+  // 市场条目验证
+  if (includeMarketplaceEntry) {
+    if (!selectedMarketplaceEntry || typeof selectedMarketplaceEntry !== 'object' || Array.isArray(selectedMarketplaceEntry)) {
+      throw new Error(
+        'buildInstallationContract: selectedMarketplaceEntry is required when includeMarketplaceEntry is true'
+      );
+    }
+
+    if (!marketplaceIndexRelativePath || typeof marketplaceIndexRelativePath !== 'string') {
+      throw new Error(
+        'buildInstallationContract: marketplaceIndexRelativePath is required when includeMarketplaceEntry is true'
+      );
+    }
+
+    assertRelativePath(marketplaceIndexRelativePath, 'marketplaceIndexRelativePath');
+  }
+
+  // 构建契约对象
+  const contract = {
+    algorithmVersion: INSTALLATION_CONTRACT_ALGORITHM_VERSION,
+    distributionType,
+    manifestRelativePath,
+    normalizedManifest: stripDisplayFields(manifest),
+    marketplaceSourceType,
+    includeMarketplaceEntry,
+    verificationRecipeVersion,
+  };
+
+  // 纳入市场条目
+  if (includeMarketplaceEntry) {
+    contract.marketplaceIndexRelativePath = marketplaceIndexRelativePath;
+    contract.normalizedSelectedEntry = stripDisplayFields(selectedMarketplaceEntry);
+  }
+
+  // 深度冻结并返回
+  return deepFreeze(contract);
+}
+
+/**
+ * 计算安装契约摘要。
+ *
+ * @param {Object} params - buildInstallationContract 的参数
+ * @returns {string} SHA-256 摘要（64 位十六进制）
+ */
+export function computeInstallationContractDigest(params) {
+  const contract = buildInstallationContract(params);
+  return sha256Hex(canonicalJson(contract));
+}
+
+/**
+ * 判断是否可以跳过验证。
+ *
+ * 以下条件同时成立才返回 NOT_REQUIRED_UNCHANGED：
+ * 1. 当前摘要是合法 64 位十六进制
+ * 2. 上次摘要相同
+ * 3. 上次结果明确是消费端验证已解决类型（PASSED_AUTOMATIC / PASSED_MANUAL / NOT_REQUIRED_UNCHANGED）
+ * 4. 上次收据中记录的算法版本与当前算法版本相同
+ * 5. 上次收据自身绑定相同的 installationContractDigest
+ *
+ * @param {Object} params
+ * @param {string} params.currentDigest - 当前计算的安装契约摘要
+ * @param {string|null} params.previousDigest - 上一成功验证的摘要（可为 null）
+ * @param {Object|null} params.previousReceipt - 上一成功验证的收据（可为 null）
+ * @param {number} params.algorithmVersion - 当前算法版本
+ * @returns {'NOT_REQUIRED_UNCHANGED' | 'REQUIRE_VERIFICATION'}
+ */
+export function shouldSkipVerification({
+  currentDigest,
+  previousDigest,
+  previousReceipt,
+  algorithmVersion,
+} = {}) {
+  // 条件 1：当前摘要必须合法
+  if (!isValidDigest(currentDigest)) {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  // 条件 2：前次摘要必须存在且相同
+  if (!previousDigest || currentDigest !== previousDigest) {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  // 条件 3：前次收据必须存在
+  if (!previousReceipt || typeof previousReceipt !== 'object') {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  // 条件 4：前次收据结果必须是合法的消费端验证结果
+  // 只认 result 字段（schema 定义的正式字段）；新消费端收据此前不存在正式 status，
+  // 仅有 status 无 result 时要求重新验证。
+  if (!VALID_CONSUMER_VERIFICATION_STATUSES.has(previousReceipt.result)) {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  // 条件 5：算法版本必须一致
+  const previousAlgorithmVersion = previousReceipt.algorithmVersion
+    ?? previousReceipt.installationContractAlgorithmVersion;
+  if (previousAlgorithmVersion !== algorithmVersion) {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  // 条件 6：收据自身绑定的摘要必须一致
+  if (!isValidDigest(previousReceipt.installationContractDigest)) {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  if (previousReceipt.installationContractDigest !== currentDigest) {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  // 全部条件满足 => 跳过验证
+  return 'NOT_REQUIRED_UNCHANGED';
+}

package/src/core/plan.mjs

@@ -22,6 +22,7 @@ import addFormats from 'ajv-formats';
 import { canonicalJson, sha256Hex } from './digest.mjs';
 import { ReleaseError, GATE_FAILED } from './errors.mjs';
 import { readTrustedPackageResource } from './trusted-resource.mjs';
+import { computeInstallationContractDigest, INSTALLATION_CONTRACT_ALGORITHM_VERSION } from './installation-contract.mjs';
 // NOTE (T2.2 step 3): plan.mjs and the platform registry form a module cycle
 // (plan -> registry -> platforms/kimi -> plan, because the kimi strategies
 // bind computePlanDigest). PLATFORMS is therefore only ever read inside
@@ -778,17 +779,71 @@ export function validatePlanActionCompleteness(plan, options = {}) {
 
         // External independent marketplace form: the distribution declares
         // marketplaceRepo, so the install targets the external marketplace
-        // repository instead of publicRepo. Only platforms with a marketplace
-        // add capability (marketplaceRefForm !== null: claude=name, codex=sha)
-        // may carry it; kimi/codebuddy fail closed. Inline form (no
-        // marketplaceRepo) keeps every assertion below byte-for-byte.
+        // repository instead of publicRepo. All platforms support both
+        // bundled-family and standalone-index source types; the marketplace
+        // add capability (marketplaceRefForm) only constrains the automated
+        // install path, not the static source validation.
         const externalMarketplace = dist.marketplaceRepo !== undefined && dist.marketplaceRepo !== null;
-        if (externalMarketplace && platform.marketplaceRefForm === null) {
+        if (externalMarketplace && dist.marketplaceSourceType && dist.marketplaceSourceType !== 'standalone-index') {
           failures.push(
-            `unit "${unitId}", action "${action.id}": ${platform.distributionType} distribution declares marketplaceRepo but the platform has no marketplace add capability`,
+            `unit "${unitId}", action "${action.id}": ${platform.distributionType} distribution declares marketplaceRepo but marketplaceSourceType is "${dist.marketplaceSourceType}"; marketplaceRepo requires standalone-index`,
           );
         }
 
+        // --- 新版字段组完整性检查 ---
+        // 真正新增的安装契约字段（0.2.3 旧计划不含这些字段）：
+        //   distribution: installationContract、installationContractDigest、marketplaceSourceType
+        //   action: installationContractDigest、algorithmVersion
+        // 0.2.3 已有的 marketplaceForm/sourceDescriptor/sourceCommit 单独存在不能触发新版组，
+        // 否则破坏已发布 0.2.3 冻结计划兼容。
+        // 整组都不存在才按旧计划兼容；出现任意一个但不完整必须失败。
+        const distHasFieldGroup = dist.installationContract !== undefined && dist.installationContract !== null
+          || dist.installationContractDigest !== undefined && dist.installationContractDigest !== null
+          || dist.marketplaceSourceType !== undefined && dist.marketplaceSourceType !== null;
+        const actionHasFieldGroup = action.parameters?.installationContractDigest !== undefined && action.parameters?.installationContractDigest !== null
+          || action.parameters?.algorithmVersion !== undefined && action.parameters?.algorithmVersion !== null;
+        const hasFieldGroup = distHasFieldGroup || actionHasFieldGroup;
+
+        if (hasFieldGroup) {
+          // 检查 distribution 字段完整性
+          if (dist.marketplaceSourceType === undefined || dist.marketplaceSourceType === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": distribution missing marketplaceSourceType; new-version field group requires all fields`);
+          }
+          if (dist.installationContract === undefined || dist.installationContract === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": distribution missing installationContract; new-version field group requires all fields`);
+          }
+          if (dist.installationContractDigest === undefined || dist.installationContractDigest === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": distribution missing installationContractDigest; new-version field group requires all fields`);
+          }
+          // 检查 action 字段完整性
+          if (action.parameters?.marketplaceForm === undefined || action.parameters?.marketplaceForm === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": parameters.marketplaceForm missing; new-version field group requires all fields`);
+          }
+          if (action.parameters?.sourceDescriptor === undefined || action.parameters?.sourceDescriptor === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": parameters.sourceDescriptor missing; new-version field group requires all fields`);
+          }
+          if (action.parameters?.installationContractDigest === undefined || action.parameters?.installationContractDigest === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": parameters.installationContractDigest missing; new-version field group requires all fields`);
+          }
+          if (action.parameters?.algorithmVersion === undefined || action.parameters?.algorithmVersion === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": parameters.algorithmVersion missing; new-version field group requires all fields`);
+          }
+          // sourceCommit 仅生产计划必需
+          if (production && (action.parameters?.sourceCommit === undefined || action.parameters?.sourceCommit === null)) {
+            failures.push(`unit "${unitId}", action "${action.id}": parameters.sourceCommit missing; production plan requires sourceCommit`);
+          }
+          // marketplaceForm、sourceDescriptor.form、distribution 的 marketplaceSourceType 三者一致
+          const mf = action.parameters?.marketplaceForm;
+          const sdForm = action.parameters?.sourceDescriptor?.form;
+          const distSourceType = dist.marketplaceSourceType;
+          if (mf && distSourceType && mf !== distSourceType) {
+            failures.push(`unit "${unitId}", action "${action.id}": marketplaceForm "${mf}" does not match distribution marketplaceSourceType "${distSourceType}"`);
+          }
+          if (sdForm && distSourceType && sdForm !== distSourceType) {
+            failures.push(`unit "${unitId}", action "${action.id}": sourceDescriptor.form "${sdForm}" does not match distribution marketplaceSourceType "${distSourceType}"`);
+          }
+        }
+
         // Parameter checks
         _checkRequired(action, 'parameters.consumer', action.parameters?.consumer, platform.id, unitId, failures);
         _checkRequired(action, 'parameters.plugin', action.parameters?.plugin, plugin, unitId, failures);
@@ -882,6 +937,252 @@ export function validatePlanActionCompleteness(plan, options = {}) {
           }
         }
 
+        // sourceCommit: frozen plugin source commit, binding the marketplace
+        // install action to the unit's frozen snapshot commit. Both forms
+        // require it in production plans; non-production diagnostic plans may
+        // omit it (never冒充生产计划).
+        if (production) {
+          _checkRequired(action, 'parameters.sourceCommit', action.parameters?.sourceCommit, frozen?.commit, unitId, failures);
+        }
+
+        // --- sourceDescriptor validation (marketplace source identity contract) ---
+        // Validates that marketplaceForm and sourceDescriptor.form are consistent,
+        // all form-specific fields are present and non-null, pluginRepo !== marketplaceRepo
+        // for standalone-index, and no mixed/extra fields exist.
+        // Only applies to platforms that require marketplace (claude, codex).
+        // Non-automatable platforms (kimi, codebuddy) use human-attestation
+        // and carry no marketplace form or source descriptor.
+        // Legacy plans (pre-sourceDescriptor) with legacyCompatibility are tolerated.
+        if (requiresMarketplace) {
+          const sd = action.parameters?.sourceDescriptor;
+          const mf = action.parameters?.marketplaceForm;
+          if (sd === undefined || sd === null) {
+            if (!options.legacyCompatibility) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.sourceDescriptor is missing; every marketplace install action must carry a complete source descriptor`,
+              );
+            }
+          } else if (typeof sd === 'object') {
+            // 1. marketplaceForm must be present when sourceDescriptor is present
+            if (mf === undefined || mf === null) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.marketplaceForm is missing but sourceDescriptor is present; form must be explicitly declared`,
+              );
+            }
+            // 2. sourceDescriptor.form must match marketplaceForm
+            if (sd.form !== mf) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": sourceDescriptor.form "${sd.form}" does not match parameters.marketplaceForm "${mf}"`,
+              );
+            }
+            // 3. Form-specific field completeness and non-null checks
+            // payloadDigest is allowed to be null in non-production plans
+            // (the frozen manifestDigest is only available after production freeze)
+            const BUNDLED_REQUIRED = ['form', 'repo', 'marketplaceEntry', 'pluginSubpath'];
+            const STANDALONE_REQUIRED = ['form', 'marketplaceRepo', 'marketplaceEntry', 'pluginRepo', 'sourceType'];
+            // Production-only fields that may be null in non-production plans
+            const PROD_ONLY_FIELDS = ['marketplaceCommitSha', 'ref', 'payloadDigest'];
+
+            if (sd.form === 'bundled-family') {
+              // Check bundled-family required fields are present and non-null
+              for (const field of BUNDLED_REQUIRED) {
+                if (sd[field] === undefined || sd[field] === null) {
+                  failures.push(
+                    `unit "${unitId}", action "${action.id}": sourceDescriptor.${field} is missing or null; bundled-family form requires all identity fields to be non-null`,
+                  );
+                }
+              }
+              // commit must be non-null in production plans (frozen from asset)
+              if (production && (sd.commit === undefined || sd.commit === null)) {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": sourceDescriptor.commit is missing or null; production bundled-family plans require a frozen commit`,
+                );
+              }
+              // commit must match frozenSnapshot.commit (production binding)
+              if (production && sd.commit !== undefined && sd.commit !== null &&
+                  frozen?.commit !== undefined && sd.commit !== frozen.commit) {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": sourceDescriptor.commit does not match frozenSnapshot.commit`,
+                );
+              }
+              // payloadDigest must be non-null in production plans
+              if (production && (sd.payloadDigest === undefined || sd.payloadDigest === null)) {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": sourceDescriptor.payloadDigest is missing or null; production plans require a frozen payload digest`,
+                );
+              }
+              // Prohibit standalone-index fields in bundled-family
+              const STANDALONE_ONLY = ['marketplaceRepo', 'pluginRepo', 'sourceType', 'marketplaceCommitSha', 'ref'];
+              for (const field of STANDALONE_ONLY) {
+                if (sd[field] !== undefined) {
+                  failures.push(
+                    `unit "${unitId}", action "${action.id}": sourceDescriptor.${field} is unexpected for bundled-family form; mixed fields are prohibited`,
+                  );
+                }
+              }
+              // repo must match the action's repo (publicRepo for bundled-family)
+              if (sd.repo !== undefined && sd.repo !== null && sd.repo !== publicRepo) {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": sourceDescriptor.repo "${sd.repo}" does not match unit publicRepo "${publicRepo}"`,
+                );
+              }
+              // marketplaceEntry must match action.plugin
+              if (sd.marketplaceEntry !== undefined && sd.marketplaceEntry !== null && sd.marketplaceEntry !== plugin) {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": sourceDescriptor.marketplaceEntry "${sd.marketplaceEntry}" does not match action plugin "${plugin}"`,
+                );
+              }
+              // payloadDigest must match manifestDigest (when both are present)
+              if (production && sd.payloadDigest !== undefined && sd.payloadDigest !== null &&
+                  frozen?.manifestDigest !== undefined && sd.payloadDigest !== frozen.manifestDigest) {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": sourceDescriptor.payloadDigest does not match frozen manifestDigest`,
+                );
+              }
+            } else if (sd.form === 'standalone-index') {
+              // Check standalone-index required fields are present and non-null
+              for (const field of STANDALONE_REQUIRED) {
+                if (sd[field] === undefined || sd[field] === null) {
+                  failures.push(
+                    `unit "${unitId}", action "${action.id}": sourceDescriptor.${field} is missing or null; standalone-index form requires all identity fields to be non-null`,
+                  );
+                }
+              }
+              // Production-only fields: must be non-null in production plans
+              if (production) {
+                for (const field of PROD_ONLY_FIELDS) {
+                  if (sd[field] === undefined || sd[field] === null) {
+                    failures.push(
+                      `unit "${unitId}", action "${action.id}": sourceDescriptor.${field} is missing or null; production standalone-index requires all fields to be non-null`,
+                    );
+                  }
+                }
+              }
+              // Prohibit bundled-family fields in standalone-index
+              const BUNDLED_ONLY = ['repo', 'commit', 'pluginSubpath'];
+              for (const field of BUNDLED_ONLY) {
+                if (sd[field] !== undefined) {
+                  failures.push(
+                    `unit "${unitId}", action "${action.id}": sourceDescriptor.${field} is unexpected for standalone-index form; mixed fields are prohibited`,
+                  );
+                }
+              }
+              // pluginRepo must NOT equal marketplaceRepo
+              if (sd.pluginRepo !== undefined && sd.pluginRepo !== null &&
+                  sd.marketplaceRepo !== undefined && sd.marketplaceRepo !== null &&
+                  sd.pluginRepo === sd.marketplaceRepo) {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": sourceDescriptor.pluginRepo must not equal marketplaceRepo; the plugin repo and marketplace repo are distinct repositories`,
+                );
+              }
+              // marketplaceRepo must match action.repo (for standalone-index, repo is the external marketplace)
+              if (externalMarketplace && sd.marketplaceRepo !== undefined && sd.marketplaceRepo !== null &&
+                  sd.marketplaceRepo !== dist.marketplaceRepo) {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": sourceDescriptor.marketplaceRepo "${sd.marketplaceRepo}" does not match distribution marketplaceRepo "${dist.marketplaceRepo}"`,
+                );
+              }
+              // pluginRepo must match the unit's publicRepo
+              if (sd.pluginRepo !== undefined && sd.pluginRepo !== null && sd.pluginRepo !== publicRepo) {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": sourceDescriptor.pluginRepo "${sd.pluginRepo}" does not match unit publicRepo "${publicRepo}"`,
+                );
+              }
+              // marketplaceEntry must match action.plugin
+              if (sd.marketplaceEntry !== undefined && sd.marketplaceEntry !== null && sd.marketplaceEntry !== plugin) {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": sourceDescriptor.marketplaceEntry "${sd.marketplaceEntry}" does not match action plugin "${plugin}"`,
+                );
+              }
+              // sourceType must be 'marketplace-entry'
+              if (sd.sourceType !== undefined && sd.sourceType !== null && sd.sourceType !== 'marketplace-entry') {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": sourceDescriptor.sourceType "${sd.sourceType}" is unexpected; standalone-index sourceType must be "marketplace-entry"`,
+                );
+              }
+              // payloadDigest must match manifestDigest (when both are present)
+              if (production && sd.payloadDigest !== undefined && sd.payloadDigest !== null &&
+                  frozen?.manifestDigest !== undefined && sd.payloadDigest !== frozen.manifestDigest) {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": sourceDescriptor.payloadDigest does not match frozen manifestDigest`,
+                );
+              }
+            } else {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": sourceDescriptor.form "${sd.form}" is unknown; expected "bundled-family" or "standalone-index"`,
+              );
+            }
+          }
+        }
+
+        // --- installationContractDigest 重新计算验证 ---
+        // 不能只比较两个可一起篡改的字符串；必须重新由 distribution 的 installationContract 计算并验证
+        if (hasFieldGroup && dist.installationContract) {
+          // 从 distribution 的 installationContract 重新计算摘要
+          const recomputedDigest = sha256Hex(canonicalJson(dist.installationContract));
+          const actionDigest = action.parameters?.installationContractDigest;
+          const distDigest = dist.installationContractDigest;
+
+          // 重算值必须同时等于 distribution 摘要和 action 摘要
+          if (distDigest && recomputedDigest !== distDigest) {
+            failures.push(
+              `unit "${unitId}", action "${action.id}": recomputed installationContractDigest "${recomputedDigest.slice(0, 16)}..." does not match distribution digest "${(distDigest ?? '').slice(0, 16)}..."; contract may have been tampered`,
+            );
+          }
+          if (actionDigest && recomputedDigest !== actionDigest) {
+            failures.push(
+              `unit "${unitId}", action "${action.id}": recomputed installationContractDigest "${recomputedDigest.slice(0, 16)}..." does not match action digest "${(actionDigest ?? '').slice(0, 16)}..."; contract may have been tampered`,
+            );
+          }
+          // algorithmVersion 必须等于当前算法版本
+          if (action.parameters?.algorithmVersion !== undefined && action.parameters?.algorithmVersion !== INSTALLATION_CONTRACT_ALGORITHM_VERSION) {
+            failures.push(
+              `unit "${unitId}", action "${action.id}": algorithmVersion is "${action.parameters?.algorithmVersion}", expected "${INSTALLATION_CONTRACT_ALGORITHM_VERSION}"`,
+            );
+          }
+        }
+
+        // --- standalone-index 审计字段校验 ---
+        // 仅 production === true 且来源为 standalone-index 时，要求 action 完整携带
+        // 非空 marketplaceIndexPath / marketplaceName / selectedEntry。
+        // 非生产计划不得要求这三个字段存在（未冻结时无真实值可用），
+        // 也不得接受"用 null 表示存在"的方案。
+        if (production && externalMarketplace && dist.marketplaceSourceType === 'standalone-index') {
+          const params = action.parameters;
+          if (params) {
+            if (!params.marketplaceIndexPath) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.marketplaceIndexPath is required for production standalone-index`,
+              );
+            }
+            if (!params.marketplaceName) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.marketplaceName is required for production standalone-index`,
+              );
+            }
+            if (!params.selectedEntry) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.selectedEntry is required for production standalone-index`,
+              );
+            }
+          }
+        }
+
+        // --- bundled-family 禁止混入 standalone 字段 ---
+        if (!externalMarketplace && dist.marketplaceSourceType === 'bundled-family') {
+          const params = action.parameters;
+          if (params) {
+            const STANDALONE_ONLY = ['marketplaceIndexPath', 'marketplaceName', 'selectedEntry'];
+            for (const field of STANDALONE_ONLY) {
+              if (params[field] !== undefined) {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": parameters.${field} is unexpected for bundled-family form; mixed fields are prohibited`,
+                );
+              }
+            }
+          }
+        }
+
         // Expected checks. Marketplace identity is bound only on platforms
         // whose schema requires it (MINOR-1): a non-marketplace platform's
         // observation never binds a marketplace.