release-skill 0.2.3 → 0.2.4

package/src/commands/setup.mjs

@@ -23,6 +23,7 @@ import addFormats from 'ajv-formats';
 
 import { canonicalJson, sha256Hex } from '../core/digest.mjs';
 import { acquireProjectLock } from '../artifacts/project-lock.mjs';
+import { getPlatform, PLATFORMS } from '../platforms/registry.mjs';
 import {
   CONFIG_EXISTS,
   CONFIG_INVALID,
@@ -38,6 +39,57 @@ const SKIP_DIRS = new Set([
   'node_modules', 'dist', 'coverage', 'build', 'out', 'tmp', 'temp',
   'runs', 'test', 'tests', 'test-fixtures', 'fixtures', 'examples',
 ]);
+// Registry-driven discovery: derive marketplace and plugin manifest paths
+// from the platform registry. This replaces hardcoded path checks so that
+// new platforms (e.g. Codex's .agents/plugins/marketplace.json) are
+// automatically discovered without editing setup.mjs.
+const DISCOVERY_MANIFEST_SUFFIXES = new Set(
+  PLATFORMS.flatMap((p) => {
+    const paths = [p.manifestPaths.plugin];
+    if (p.manifestPaths.marketplace) paths.push(p.manifestPaths.marketplace);
+    // Kimi has pluginCandidates (kimi.plugin.json, .kimi-plugin/plugin.json)
+    if (p.manifestPaths.pluginCandidates) paths.push(...p.manifestPaths.pluginCandidates);
+    return paths;
+  }),
+);
+
+// Build a map from manifest path suffix → host platform id(s).
+// For marketplace and plugin files, this allows deterministic host detection
+// without hardcoded path.includes() checks.
+// Multi-value: Claude and CodeBuddy share .claude-plugin/marketplace.json;
+// a single-value Map would overwrite one platform's identity with the other.
+const MANIFEST_SUFFIX_HOST_MAP = new Map();
+for (const platform of PLATFORMS) {
+  const mp = platform.manifestPaths.marketplace;
+  if (mp) {
+    const existing = MANIFEST_SUFFIX_HOST_MAP.get(mp);
+    if (existing) {
+      existing.push(platform.id);
+    } else {
+      MANIFEST_SUFFIX_HOST_MAP.set(mp, [platform.id]);
+    }
+  }
+  const pp = platform.manifestPaths.plugin;
+  if (pp) {
+    const existing = MANIFEST_SUFFIX_HOST_MAP.get(pp);
+    if (existing) {
+      existing.push(platform.id);
+    } else {
+      MANIFEST_SUFFIX_HOST_MAP.set(pp, [platform.id]);
+    }
+  }
+  if (platform.manifestPaths.pluginCandidates) {
+    for (const candidate of platform.manifestPaths.pluginCandidates) {
+      const existing = MANIFEST_SUFFIX_HOST_MAP.get(candidate);
+      if (existing) {
+        existing.push(platform.id);
+      } else {
+        MANIFEST_SUFFIX_HOST_MAP.set(candidate, [platform.id]);
+      }
+    }
+  }
+}
+
 const MAX_JSON_BYTES = 1024 * 1024;
 const schema = JSON.parse((await readTrustedPackageResource(
   'schemas/release-project.schema.json',
@@ -86,12 +138,7 @@ async function walkDiscoveryFiles(root, maxDepth = 8) {
           /^README(?:\.|$)/i.test(child.name) ||
           /^LICENSE(?:\.|$)/i.test(child.name) ||
           /^CHANGELOG(?:\.|$)/i.test(child.name) ||
-          absolute.endsWith('/.claude-plugin/plugin.json') ||
-          absolute.endsWith('/.codex-plugin/plugin.json') ||
-          absolute.endsWith('/.kimi-plugin/plugin.json') ||
-          absolute.endsWith('/.codebuddy-plugin/plugin.json') ||
-          absolute.endsWith('/.claude-plugin/marketplace.json') ||
-          absolute.endsWith('/.codex-plugin/marketplace.json'))
+          [...DISCOVERY_MANIFEST_SUFFIXES].some((suffix) => absolute.endsWith(`/${suffix}`)))
       ) {
         found.push(absolute);
       }
@@ -458,16 +505,25 @@ async function discoverFacts(root) {
   const manifests = [];
   for (const path of [...pluginFiles, ...marketplaceFiles].sort()) {
     const value = await readJsonBounded(path, 'discovered plugin manifest');
-    manifests.push({
-      path: safeRelative(root, path),
-      host: path.includes('/.claude-plugin/') ? 'claude'
-        : path.includes('/.kimi-plugin/') ? 'kimi'
-          : path.includes('/.codebuddy-plugin/') ? 'codebuddy'
-            : 'codex',
-      kind: path.endsWith('/marketplace.json') ? 'marketplace' : 'plugin',
-      name: typeof value.name === 'string' ? value.name : null,
-      version: typeof value.version === 'string' ? value.version : null,
-    });
+    // Registry-driven host detection: find all platforms whose manifest path
+    // suffix matches this file. Falls back to 'codex' for unknown paths
+    // (preserving legacy behavior for edge cases).
+    // Multi-value: Claude and CodeBuddy share .claude-plugin/marketplace.json,
+    // so a single file may be claimed by multiple hosts.
+    let detectedHosts = ['codex'];
+    for (const [suffix, hostIds] of MANIFEST_SUFFIX_HOST_MAP) {
+      if (path.endsWith(`/${suffix}`)) {
+        detectedHosts = hostIds;
+        break;
+      }
+    }
+    const relPath = safeRelative(root, path);
+    const kind = path.endsWith('/marketplace.json') ? 'marketplace' : 'plugin';
+    const name = typeof value.name === 'string' ? value.name : null;
+    const version = typeof value.version === 'string' ? value.version : null;
+    for (const host of detectedHosts) {
+      manifests.push({ path: relPath, host, kind, name, version });
+    }
   }
 
   const legacyReleaseConfigs = [];
@@ -657,9 +713,20 @@ function buildCandidates(facts) {
   const gates = [];
   const ids = new Set();
   const knownFiles = new Set(facts.fileDigests.map((file) => file.path));
+  // Extract manifest root from path using registry-driven suffix matching.
+  // This handles all platform paths including Codex's .agents/plugins/marketplace.json,
+  // not just the hardcoded .{platform}-plugin/ pattern.
   const manifestRoots = facts.manifests.map((manifest) => {
-    const match = manifest.path.match(/^(.*?)(?:\/)?(?:\.claude-plugin|\.codex-plugin|\.kimi-plugin|\.codebuddy-plugin)\/(?:plugin|marketplace)\.json$/);
-    return { ...manifest, root: match?.[1] || '.' };
+    let root = '.';
+    for (const suffix of MANIFEST_SUFFIX_HOST_MAP.keys()) {
+      const fullSuffix = `/${suffix}`;
+      const idx = manifest.path.lastIndexOf(fullSuffix);
+      if (idx >= 0) {
+        root = manifest.path.slice(0, idx) || '.';
+        break;
+      }
+    }
+    return { ...manifest, root };
   });
   const manifestOwners = new Map();
   const legacyUnits = facts.legacyReleaseConfigs.flatMap((config) => config.releaseUnits);
@@ -968,6 +1035,17 @@ function buildRecommendedProposal(facts, candidates) {
       };
     }
 
+    // Discover marketplace index candidates for this unit's plugin hosts.
+    //
+    // 单一权威来源：平台注册表的 manifestPaths.marketplace 是默认索引路径；
+    // publicFileMappingCandidates 是该 unit 唯一可发现的公开文件 to 路径集。
+    // 按"等于默认索引路径或以 /<默认索引路径> 精确结尾"筛选候选。
+    // 1 个候选：根布局省略显式路径，嵌套布局写 marketplaceIndexPath；
+    // 0 个候选：产生 MARKETPLACE_ASSET_MISSING；
+    // 多个候选：产生 MARKETPLACE_ASSET_AMBIGUOUS。
+    // Kimi 默认路径为 null，不要求候选；CodeBuddy 复用 Claude 市场索引。
+    const unitPrefix = unit.source === '.' ? '' : `${unit.source}/`;
+    const marketplaceConflicts = [];
     const distributions = unit.distributionCandidates.map((type) => {
       if (type === 'npm') {
         return {
@@ -978,19 +1056,69 @@ function buildRecommendedProposal(facts, candidates) {
         };
       }
       const entrySkill = unit.entrySkillCandidates?.[0];
-      return {
+      const host = type.replace(/-plugin$/, '');
+      const platform = getPlatform(host);
+      const defaultMktPath = platform.manifestPaths.marketplace;
+      const dist = {
         type,
         plugin: unit.id,
         marketplace: unit.id,
         entrySkill,
+        marketplaceSourceType: 'bundled-family',
       };
+      // Kimi 的 manifestPaths.marketplace 为 null，不要求候选
+      if (defaultMktPath !== null) {
+        const mappingCandidates = unit.publicFileMappingCandidates ?? [];
+        const suffix = `/${defaultMktPath}`;
+        const candidates = mappingCandidates.filter((m) => (
+          m.to === defaultMktPath || m.to.endsWith(suffix)
+        ));
+        if (candidates.length === 0) {
+          marketplaceConflicts.push({
+            code: 'MARKETPLACE_ASSET_MISSING',
+            unit: unit.id,
+            platform: host,
+            expectedSuffix: defaultMktPath,
+          });
+          return null;
+        }
+        if (candidates.length > 1) {
+          marketplaceConflicts.push({
+            code: 'MARKETPLACE_ASSET_AMBIGUOUS',
+            unit: unit.id,
+            platform: host,
+            candidates: candidates.map((m) => m.to).sort(),
+          });
+          return null;
+        }
+        // 1 个候选
+        const candidateTo = candidates[0].to;
+        if (candidateTo === defaultMktPath) {
+          // 根布局：marketplace index 在平台默认路径，省略显式 marketplaceIndexPath
+        } else {
+          // 嵌套布局：candidateTo 以 /<defaultMktPath> 精确结尾。
+          // 市场文件仍在同一发布快照内，属于 bundled-family 来源；
+          // marketplaceIndexPath 标记索引在快照内的相对位置。
+          // 不得伪造 marketplaceRepo（那是 standalone-index 独有字段）。
+          dist.marketplaceIndexPath = candidateTo;
+        }
+      }
+      return dist;
     }).filter(Boolean);
 
+    // Marketplace asset conflicts: missing or ambiguous marketplace index
+    if (marketplaceConflicts.length > 0) {
+      return {
+        answers: null,
+        conflicts: marketplaceConflicts,
+        assumptions,
+      };
+    }
+
     // If any distribution failed to construct, bail
     if (distributions.length !== unit.distributionCandidates.length) return null;
 
     const tagTemplate = unit.tagTemplateCandidates[0] ?? 'v{version}';
-    const unitPrefix = unit.source === '.' ? '' : `${unit.source}/`;
     const versionSource = unit.packagePath?.startsWith(unitPrefix)
       ? unit.packagePath.slice(unitPrefix.length)
       : unit.packagePath;

package/src/commands/verify.mjs

@@ -12,8 +12,9 @@
  * @module commands/verify
  */
 
-import { readFile, writeFile, mkdtemp, rm, mkdir, lstat, realpath } from 'node:fs/promises';
-import { dirname, join, relative, isAbsolute, resolve } from 'node:path';
+import { readFile, writeFile, mkdtemp, rm, mkdir, lstat, realpath, readdir } from 'node:fs/promises';
+import { realpathSync } from 'node:fs';
+import { dirname, join, relative, isAbsolute, resolve, basename } from 'node:path';
 import { tmpdir } from 'node:os';
 import { execFile as execFileCb } from 'node:child_process';
 import { promisify } from 'node:util';
@@ -50,11 +51,29 @@ import {
   resolveNpmRegistryAuthToken,
 } from '../adapters/npm.mjs';
 import { runConsumerVerificationGates } from '../core/verification-gates.mjs';
+import { isRemoteWriteAction, isMarketplaceAction } from '../core/checkpoints.mjs';
+import {
+  shouldSkipVerification,
+  INSTALLATION_CONTRACT_ALGORITHM_VERSION,
+} from '../core/installation-contract.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
 
+/**
+ * 验证已解决结果类型。
+ *
+ * - PASSED_AUTOMATIC: 自动验证通过（adapter.verify 返回 VERIFIED）
+ * - PASSED_MANUAL: 人工验证通过（用户手动确认）
+ * - NOT_REQUIRED_UNCHANGED: 无需验证（远端状态未变化，跳过验证）
+ */
+export const VERIFICATION_RESOLVED_TYPES = Object.freeze({
+  PASSED_AUTOMATIC: 'PASSED_AUTOMATIC',
+  PASSED_MANUAL: 'PASSED_MANUAL',
+  NOT_REQUIRED_UNCHANGED: 'NOT_REQUIRED_UNCHANGED',
+});
+
 /**
  * Map plan action type to adapter ActionType.
  * Must match publish.mjs and reconcile.mjs.
@@ -80,6 +99,16 @@ function defaultClock() {
   return new Date().toISOString();
 }
 
+/**
+ * 验证摘要格式是否为合法的 64 位十六进制字符串。
+ *
+ * @param {string} digest - 摘要
+ * @returns {boolean} 是否合法
+ */
+function isValidDigest(digest) {
+  return typeof digest === 'string' && /^[a-f0-9]{64}$/.test(digest);
+}
+
 // ---------------------------------------------------------------------------
 // Smoke test
 // ---------------------------------------------------------------------------
@@ -519,6 +548,7 @@ const defaultNpmExecutor = {
  * @param {string} [options.root] - Project root for source access.
  * @param {string} [options.runDir] - Evidence directory.
  * @param {() => string} [options.clock] - Clock function returning ISO-8601 strings.
+ * @param {Object} [options.previousVerifyRun] - 上一次验证成功的 verify run 记录，用于安装契约摘要免验。
  *
  * @returns {Promise<{ planPath: string, status: string, adapterChecks: Object[], smokeTest: Object }>}
  *
@@ -536,6 +566,7 @@ export async function verifyRelease(options) {
     npmExecutor,
     verificationGatesAuthorized,
     gateEnv,
+    previousVerifyRun,
   } = options ?? {};
 
   const clockFn = typeof clockOpt === 'function' ? clockOpt : defaultClock;
@@ -697,9 +728,13 @@ export async function verifyRelease(options) {
     // Validate checkpoint mapping
     validateRunCheckpointMapping(sourceRun, plan.externalActions ?? []);
 
-    // All checkpoints must be succeeded or skipped (no failed/pending)
+    // All checkpoints must be succeeded or skipped (no failed/pending),
+    // except marketplace install checkpoints which are re-verified by verify
+    // itself via consumer verification (human attestation or automatic).
+    // Deferred marketplace checkpoints from publish are also allowed through.
     const incompleteCheckpoints = sourceRun.checkpoints.filter(
-      (cp) => cp.status !== 'succeeded' && cp.status !== 'skipped',
+      (cp) => cp.status !== 'succeeded' && cp.status !== 'skipped'
+        && !((cp.status === 'failed' || cp.status === 'deferred') && isMarketplaceAction(cp.actionType)),
     );
     if (incompleteCheckpoints.length > 0) {
       throw new ReleaseError(
@@ -731,13 +766,130 @@ export async function verifyRelease(options) {
 
     const adapterChecks = [];
     const consumerGateResults = [];
+    const consumerVerificationReceipts = [];
     const actions = plan.externalActions ?? [];
-    const MARKETPLACE_TYPES = new Set([
-      'claude-marketplace-install',
-      'codex-marketplace-install',
-      'kimi-marketplace-install',
-      'codebuddy-marketplace-install',
-    ]);
+
+    // --- 自动发现可信消费端验证收据 ---
+    // 收据选择逻辑（per-action 从所有候选中选最新匹配）：
+    // - 只读取同一权威 .release-skill/runs 的真实直接子目录
+    // - runs 根或候选目录不得是符号链接，不得物理越界
+    // - 候选必须经 loadRun(..., { requireDigest: true })、状态 VERIFIED、合法 finishedAt
+    // - 对当前 action 收集所有可信匹配收据，按 finishedAt 最新选择
+    // - 收据必须是 consumerVerificationReceipts，严格匹配 actionId/unitId/platform
+    // - 收据 planDigest 等于候选 run 自身 planDigest
+    // - 显式注入的 previousVerifyRun 也必须经过同等语义校验
+
+    /** @type {Array<Object>} 所有可信的验证 run 候选 */
+    const trustedVerifyRuns = [];
+
+    // 计算权威 runs 目录路径（基于 plan 的物理位置）
+    const planDir = dirname(planPath);
+    const releaseDir = basename(planDir) === 'plans' ? dirname(planDir) : planDir;
+    const runsDir = resolve(releaseDir, 'runs');
+    let runsDirReal = null;
+    let authorityDirReal = null;
+
+    // 校验并纳入显式注入的 previousVerifyRun
+    // 必须经过完整语义校验：status=VERIFIED、合法 runDigest、合法 finishedAt、
+    // 合法 planDigest、收据身份绑定。不满足则不注入（不参与复用），但不阻断。
+    if (previousVerifyRun) {
+      if (
+        previousVerifyRun.status === 'VERIFIED'
+        && isValidDigest(previousVerifyRun.planDigest)
+        && previousVerifyRun.finishedAt
+        && typeof previousVerifyRun.finishedAt === 'string'
+        && !isNaN(Date.parse(previousVerifyRun.finishedAt))
+      ) {
+        const computedRunDigest = computeRunDigest(previousVerifyRun);
+        if (
+          typeof previousVerifyRun.runDigest === 'string'
+          && previousVerifyRun.runDigest.length > 0
+          && previousVerifyRun.runDigest === computedRunDigest
+        ) {
+          trustedVerifyRuns.push(previousVerifyRun);
+        }
+      }
+    }
+
+    // 自动发现：从同一 .release-skill/runs 权威目录中发现
+    {
+      try {
+        const runsDirStat = await lstat(runsDir);
+        if (runsDirStat.isSymbolicLink()) {
+          // runs 根是符号链接：权威目录身份错误，失败关闭
+          throw new ReleaseError(
+            GATE_FAILED,
+            'runs directory is a symbolic link; authority identity compromised',
+            { runsDir },
+          );
+        }
+        if (!runsDirStat.isDirectory()) {
+          throw new ReleaseError(
+            GATE_FAILED,
+            'runs path is not a directory',
+            { runsDir },
+          );
+        }
+        // 以 plan 的物理权威目录为基准，验证 runs 是其中真实 runs 子目录
+        runsDirReal = realpathSync(runsDir);
+        authorityDirReal = realpathSync(releaseDir);
+        if (!runsDirReal.startsWith(authorityDirReal + '/') && runsDirReal !== authorityDirReal) {
+          throw new ReleaseError(
+            GATE_FAILED,
+            'runs directory is not a real child of the plan authority directory',
+            { runsDir, runsDirReal, authorityDirReal },
+          );
+        }
+      } catch (err) {
+        if (err instanceof ReleaseError) throw err;
+        // runs 目录不存在等非致命情况：跳过自动发现
+        runsDirReal = null;
+      }
+
+      if (runsDirReal) {
+        const entries = await readdir(runsDirReal, { withFileTypes: true });
+        for (const entry of entries) {
+          if (!entry.name.startsWith('verify-')) continue;
+          // 非目录或符号链接：失败关闭
+          if (!entry.isDirectory() || entry.isSymbolicLink()) {
+            throw new ReleaseError(
+              GATE_FAILED,
+              'verify-* candidate is a symbolic link or not a directory; authority identity compromised',
+              { entry: entry.name, runsDir: runsDirReal },
+            );
+          }
+          const candidateDir = resolve(runsDirReal, entry.name);
+          const candidateStat = await lstat(candidateDir).catch(() => null);
+          if (!candidateStat || candidateStat.isSymbolicLink()) {
+            throw new ReleaseError(
+              GATE_FAILED,
+              'verify-* candidate is a symbolic link; authority identity compromised',
+              { candidateDir, runsDir: runsDirReal },
+            );
+          }
+          // realpath 包含性校验：候选必须在权威 runs 目录内
+          const candidateReal = realpathSync(candidateDir);
+          if (!candidateReal.startsWith(runsDirReal + '/') && candidateReal !== runsDirReal) {
+            throw new ReleaseError(
+              GATE_FAILED,
+              'verify-* candidate real path is not contained in authority runs directory',
+              { candidateDir, candidateReal, runsDir: runsDirReal },
+            );
+          }
+          const candidatePath = resolve(candidateDir, 'release-run.json');
+          try {
+            const candidate = await loadRun(candidatePath, { requireDigest: true });
+            if (candidate.status !== 'VERIFIED') continue;
+            if (!candidate.planDigest) continue;
+            if (!candidate.finishedAt || typeof candidate.finishedAt !== 'string') continue;
+            trustedVerifyRuns.push(candidate);
+          } catch {
+            // 真实直接目录里的坏/缺 release-run.json 可忽略
+            continue;
+          }
+        }
+      }
+    }
 
     for (const action of actions) {
       const adapterActionType = ADAPTER_ACTION_TYPE_MAP[action.type];
@@ -765,7 +917,7 @@ export async function verifyRelease(options) {
         );
       }
 
-      if (MARKETPLACE_TYPES.has(action.type)) {
+      if (isMarketplaceAction(action.type)) {
         // --- Marketplace: fresh consumer verification in verify's own runDir ---
         // Context: isolatedConsumerWritesAuthorized allows writing to verify's
         // runDir/consumers/ directory; externalWritesAuthorized stays false.
@@ -783,22 +935,105 @@ export async function verifyRelease(options) {
           ...action.parameters,
         };
 
-        // Step 3a: Preflight (validate frozen snapshot, parameters)
+        // --- 安装契约摘要免验检查 ---
+        // 从计划中读取冻结的安装契约摘要。
+        // 新计划在 prepare 阶段计算并冻结 installationContractDigest；
+        // 旧计划（无此字段）跳过免验检查，强制重新验证。
+        const unit = (plan.units ?? []).find((u) => u.id === action.unitId);
+        const typeToDist = {
+          'claude-marketplace-install': 'claude-plugin',
+          'codex-marketplace-install': 'codex-plugin',
+          'kimi-marketplace-install': 'kimi-plugin',
+          'codebuddy-marketplace-install': 'codebuddy-plugin',
+        };
+        const dist = unit?.distributions?.find((d) => d.type === typeToDist[action.type]);
+
+        // Step 3a: Preflight（始终先执行 adapter preflight，完成静态身份、版本、
+        // tag/ref/sha、来源和 payload 校验；只有 preflight 通过后才允许免验）
+        // 必须明确要求 PREFLIGHT_PASSED，其他状态全部失败关闭。
         const preflightResult = await adapter.preflight(actionInput, marketplaceContext);
-        if (preflightResult.status === 'PREFLIGHT_FAILED') {
+        if (preflightResult.status !== 'PREFLIGHT_PASSED') {
           adapterChecks.push({
             actionId: action.id,
             actionType: action.type,
             status: 'FAILED',
-            error: `preflight failed: ${preflightResult.error}`,
+            error: `preflight did not pass: status=${preflightResult.status}, error=${preflightResult.error}`,
           });
           throw new ReleaseError(
             POST_PUBLISH_VERIFY_FAILED,
-            `marketplace preflight failed for action "${action.id}": ${preflightResult.error}`,
+            `marketplace preflight did not pass for action "${action.id}": status=${preflightResult.status}, error=${preflightResult.error}`,
             { actionId: action.id },
           );
         }
 
+        // Preflight 通过后，检查是否可以免验
+        if (dist?.installationContractDigest) {
+          const currentDigest = dist.installationContractDigest;
+          const currentPlatform = action.parameters?.consumer ?? action.type.replace('-marketplace-install', '');
+
+          // 紧邻可信公开基线：只检查最近一个 VERIFIED run 的收据。
+          // 不能从任意更老历史中捞出相同摘要来免验。
+          // 若最近 run 无该 action/platform 的收据，则 REQUIRE_VERIFICATION。
+          let previousActionCheck = null;
+          if (trustedVerifyRuns.length > 0) {
+            // 按 finishedAt 降序排序，取最近一个
+            const sorted = [...trustedVerifyRuns].sort((a, b) => {
+              const ta = Date.parse(a.finishedAt) || 0;
+              const tb = Date.parse(b.finishedAt) || 0;
+              return tb - ta;
+            });
+            const latest = sorted[0];
+            const matchingReceipt = (latest.consumerVerificationReceipts ?? []).find(
+              (r) => r.actionId === action.id
+                && r.unitId === action.unitId
+                && r.platform === currentPlatform
+                && r.planDigest === latest.planDigest,
+            );
+            if (matchingReceipt) {
+              previousActionCheck = { ...matchingReceipt, _runFinishedAtTime: Date.parse(latest.finishedAt) };
+            }
+          }
+          const previousDigest = previousActionCheck?.installationContractDigest ?? null;
+
+          const skipDecision = shouldSkipVerification({
+            currentDigest,
+            previousDigest,
+            previousReceipt: previousActionCheck,
+            algorithmVersion: INSTALLATION_CONTRACT_ALGORITHM_VERSION,
+          });
+
+          if (skipDecision === 'NOT_REQUIRED_UNCHANGED') {
+            adapterChecks.push({
+              actionId: action.id,
+              actionType: action.type,
+              status: VERIFICATION_RESOLVED_TYPES.NOT_REQUIRED_UNCHANGED,
+              installationContractDigest: currentDigest,
+              reason: '安装契约摘要未变化，跳过验证',
+            });
+
+            consumerVerificationReceipts.push({
+              actionId: action.id,
+              unitId: action.unitId,
+              platform: action.parameters?.consumer ?? action.type.replace('-marketplace-install', ''),
+              result: VERIFICATION_RESOLVED_TYPES.NOT_REQUIRED_UNCHANGED,
+              installationContractDigest: currentDigest,
+              algorithmVersion: INSTALLATION_CONTRACT_ALGORITHM_VERSION,
+              planDigest: plan.digest,
+              verifiedAt: clockFn(),
+            });
+
+            await evidence.append({
+              phase: 'verify-marketplace',
+              actionId: action.id,
+              actionType: action.type,
+              status: VERIFICATION_RESOLVED_TYPES.NOT_REQUIRED_UNCHANGED,
+              installationContractDigest: currentDigest,
+            });
+
+            continue;
+          }
+        }
+
         // Step 3b: Execute (install to isolated consumer directory)
         const executeResult = await adapter.execute(actionInput, marketplaceContext);
         if (executeResult.status !== 'EXECUTED') {
@@ -821,15 +1056,39 @@ export async function verifyRelease(options) {
           marketplaceContext,
         );
 
+        // 正确分类：人工确认 -> PASSED_MANUAL，其他自动通路 -> PASSED_AUTOMATIC
+        const isHumanConfirmed = verifyResult.observation?.humanConfirmed === true;
+        const resolvedStatus = verifyResult.status === 'VERIFIED'
+          ? (isHumanConfirmed
+            ? VERIFICATION_RESOLVED_TYPES.PASSED_MANUAL
+            : VERIFICATION_RESOLVED_TYPES.PASSED_AUTOMATIC)
+          : 'FAILED';
+
         const check = {
           actionId: action.id,
           actionType: action.type,
-          status: verifyResult.status === 'VERIFIED' ? 'PASSED' : 'FAILED',
+          status: resolvedStatus,
           observation: verifyResult.observation,
           error: verifyResult.error,
+          ...(dist?.installationContractDigest ? { installationContractDigest: dist.installationContractDigest } : {}),
         };
         adapterChecks.push(check);
 
+        // 持久化消费端验证收据
+        // 旧计划无摘要时可不生成"安装契约复用收据"，但不得写非法空字符串
+        if (resolvedStatus !== 'FAILED' && dist?.installationContractDigest && /^[a-f0-9]{64}$/.test(dist.installationContractDigest)) {
+          consumerVerificationReceipts.push({
+            actionId: action.id,
+            unitId: action.unitId,
+            platform: action.parameters?.consumer ?? action.type.replace('-marketplace-install', ''),
+            result: resolvedStatus,
+            installationContractDigest: dist.installationContractDigest,
+            algorithmVersion: INSTALLATION_CONTRACT_ALGORITHM_VERSION,
+            planDigest: plan.digest,
+            verifiedAt: clockFn(),
+          });
+        }
+
         await evidence.append({
           phase: 'verify-marketplace',
           actionId: action.id,
@@ -841,7 +1100,13 @@ export async function verifyRelease(options) {
           throw new ReleaseError(
             POST_PUBLISH_VERIFY_FAILED,
             `marketplace verification failed for action "${action.id}": ${verifyResult.error}`,
-            { actionId: action.id, observation: verifyResult.observation },
+            {
+              actionId: action.id,
+              actionType: action.type,
+              verificationResult: check.status,
+              observation: verifyResult.observation,
+              expected: action.expected,
+            },
           );
         }
 
@@ -901,7 +1166,7 @@ export async function verifyRelease(options) {
         const check = {
           actionId: action.id,
           actionType: action.type,
-          status: verifyResult.status === 'VERIFIED' ? 'PASSED' : 'FAILED',
+          status: verifyResult.status === 'VERIFIED' ? VERIFICATION_RESOLVED_TYPES.PASSED_AUTOMATIC : 'FAILED',
           observation: verifyResult.observation,
           error: verifyResult.error,
         };
@@ -919,7 +1184,13 @@ export async function verifyRelease(options) {
           throw new ReleaseError(
             POST_PUBLISH_VERIFY_FAILED,
             `adapter verification failed for action "${action.id}": ${verifyResult.error}`,
-            { actionId: action.id, observation: verifyResult.observation },
+            {
+              actionId: action.id,
+              actionType: action.type,
+              verificationResult: check.status,
+              observation: verifyResult.observation,
+              expected: action.expected,
+            },
           );
         }
       }
@@ -994,13 +1265,26 @@ export async function verifyRelease(options) {
       status: VERIFIED,
       checkpoints: actions.map((a) => {
         const check = adapterChecks.find((c) => c.actionId === a.id);
+        let status;
+        if (check?.status === 'SKIPPED') {
+          status = 'skipped';
+        } else if (check?.status === VERIFICATION_RESOLVED_TYPES.PASSED_AUTOMATIC) {
+          status = 'succeeded';
+        } else if (check?.status === VERIFICATION_RESOLVED_TYPES.PASSED_MANUAL) {
+          status = 'succeeded';
+        } else if (check?.status === VERIFICATION_RESOLVED_TYPES.NOT_REQUIRED_UNCHANGED) {
+          status = 'skipped';
+        } else {
+          status = 'succeeded';
+        }
         return {
           actionId: a.id,
           actionType: a.type,
-          status: check?.status === 'SKIPPED' ? 'skipped' : 'succeeded',
+          status,
         };
       }),
       gateResults: consumerGateResults,
+      consumerVerificationReceipts,
       startedAt: clockFn(),
       finishedAt: clockFn(),
     };