release-skill 0.2.3 → 0.2.4

package/src/core/baseline.mjs

@@ -172,12 +172,19 @@ async function computeWorkspaceDigest(root) {
 
   // Ask Git for unambiguous NUL-delimited names, then request the patch for
   // each exact argv path. This avoids parsing C-quoted `diff --git` headers.
+  //
+  // Per-file `git diff --binary` can exceed Node.js default ~1 MiB maxBuffer
+  // when generated bundles (e.g. 3.8 MiB) are modified. We use an explicit
+  // 64 MiB upper bound: large enough for any realistic single-file diff, small
+  // enough to fail closed before exhausting memory.
+  const DIFF_MAX_BUFFER = 64 * 1024 * 1024; // 64 MiB
+  const diffOpts = { ...opts, maxBuffer: DIFF_MAX_BUFFER };
   const changedPaths = splitNul(changedOut).filter((p) => !isControlPlanePath(p));
   for (const changedPath of changedPaths) {
     const { stdout: patch } = await execFile(
       'git',
       ['diff', '--no-ext-diff', '--no-textconv', '--binary', '--no-color', '--', changedPath],
-      opts,
+      diffOpts,
     );
     parts.push(`UNSTAGED:${changedPath}\0${patch}`);
   }

package/src/core/checkpoints.mjs

@@ -66,13 +66,14 @@ export const ADAPTER_ACTION_TYPE_MAP = {
  *   `push-snapshot` (the frozen commit must exist on the remote before a tag
  *   or branch tip can point at it). `npm-publish` has no git dependency and is
  *   placed in Tier 1 only for conservative scheduling.
- * - Tier 2 `github-release` and the claude/codex marketplace installs depend
- *   on Tier 1 `create-tag` (release `--verify-tag`; install ref is the tag).
- * - Tier 3 `kimi-marketplace-install` depends on Tier 2 `github-release`
- *   (its install URL points at the Release page). `codebuddy-marketplace-install`
- *   is also a non-automatable human-attestation closure and runs in Tier 3 after
- *   the automated writes (its install is from a unified marketplace, proven by a
- *   human attestation rather than an automated install checkpoint).
+ * - Tier 2 `github-release` depends on Tier 1 `create-tag` (release `--verify-tag`).
+ *
+ * Marketplace actions (claude/codex/kimi/codebuddy-marketplace-install) are
+ * included in the tier table for ADAPTER_ACTION_TYPE_MAP lookup but are
+ * filtered out before tier grouping in both publish and reconcile. They are
+ * recorded as DEFERRED with CONSUMER_VERIFICATION_DEFERRED reason and never
+ * participate in tier execution. Their verification is handled exclusively
+ * by the verify command.
  *
  * Action types not listed in any tier are unknown to the scheduler and fail
  * closed (see groupActionsByTier); they are never silently scheduled.
@@ -146,3 +147,45 @@ export function groupActionsByTier(orderedActions) {
   }
   return { tiers, unknown };
 }
+
+/**
+ * 远端写入动作类型集合。
+ * 这些动作的结果决定 PUBLISHED 状态：全部一致后即可进入 PUBLISHED。
+ */
+export const REMOTE_WRITE_ACTION_TYPES = new Set([
+  'push-commit',
+  'push-snapshot',
+  'set-default-branch',
+  'create-tag',
+  'npm-publish',
+  'github-release',
+]);
+
+/**
+ * 市场安装动作类型集合。
+ * 这些动作的结果记录在 run 中，但不阻止 PUBLISHED 状态。
+ */
+export const MARKETPLACE_ACTION_TYPES = new Set([
+  'claude-marketplace-install',
+  'codex-marketplace-install',
+  'kimi-marketplace-install',
+  'codebuddy-marketplace-install',
+]);
+
+/**
+ * 判断动作类型是否为远端写入动作。
+ * @param {string} actionType - 计划中的动作类型
+ * @returns {boolean}
+ */
+export function isRemoteWriteAction(actionType) {
+  return REMOTE_WRITE_ACTION_TYPES.has(actionType);
+}
+
+/**
+ * 判断动作类型是否为市场安装动作。
+ * @param {string} actionType - 计划中的动作类型
+ * @returns {boolean}
+ */
+export function isMarketplaceAction(actionType) {
+  return MARKETPLACE_ACTION_TYPES.has(actionType);
+}

package/src/core/config.mjs

@@ -346,6 +346,21 @@ export async function loadProjectConfig({ root, configPath } = {}) {
   }
   } // end of contextual prevalidation else block
 
+  // --- Normalize marketplaceSourceType for old configs ---
+  // Old configs may lack marketplaceSourceType; determine by marketplaceRepo existence.
+  // This runs before schema validation so the required rule passes.
+  if (Array.isArray(config.releaseUnits)) {
+    for (const unit of config.releaseUnits) {
+      if (!unit?.distributions) continue;
+      for (const dist of unit.distributions) {
+        if (dist.type === 'npm') continue;
+        if (dist.marketplaceSourceType === undefined || dist.marketplaceSourceType === null) {
+          dist.marketplaceSourceType = dist.marketplaceRepo ? 'standalone-index' : 'bundled-family';
+        }
+      }
+    }
+  }
+
   // --- Schema validation (using formal JSON schema) ---
   const valid = validateConfig(config);
   if (!valid) {

package/src/core/errors.mjs

@@ -87,6 +87,7 @@ const EXIT_CODE_MAP = Object.freeze({
   RELEASE_DOCS_CONFLICT: 44,
   RELEASE_DOCS_REFRESH_STALE: 45,
   RELEASE_DOCS_STALE: 46,
+  CONSUMER_VERIFICATION_DEFERRED: 47,
 });
 
 // ---- Error code constants ----
@@ -128,6 +129,7 @@ export const RELEASE_DOCS_TRANSLATION_MISSING = 'RELEASE_DOCS_TRANSLATION_MISSIN
 export const RELEASE_DOCS_CONFLICT = 'RELEASE_DOCS_CONFLICT';
 export const RELEASE_DOCS_REFRESH_STALE = 'RELEASE_DOCS_REFRESH_STALE';
 export const RELEASE_DOCS_STALE = 'RELEASE_DOCS_STALE';
+export const CONSUMER_VERIFICATION_DEFERRED = 'CONSUMER_VERIFICATION_DEFERRED';
 
 /**
  * Typed error for release-skill operations.

package/src/core/installation-contract.mjs

@@ -0,0 +1,341 @@
+/**
+ * 安装契约（Installation Contract）。
+ *
+ * 为每个平台构建一个可审计的规范化安装契约对象，并基于其规范 JSON 计算 SHA-256 摘要。
+ * 用于在远端状态未变化时跳过重复验证（NOT_REQUIRED_UNCHANGED）。
+ *
+ * 契约对象包含：
+ * - 算法版本
+ * - distributionType
+ * - 插件 manifest 的实际相对路径
+ * - 规范化后的 manifest 安装内容
+ * - marketplaceSourceType
+ * - 是否纳入市场条目
+ * - 若纳入：所选市场索引的相对路径/来源标识、规范化后的唯一插件条目
+ * - verificationRecipeVersion
+ *
+ * 不纳入契约的字段（做静态一致性校验）：
+ * - 版本号（version）
+ * - 描述（description / shortDescription / longDescription）
+ * - 默认提示词（defaultPrompt）
+ * - 标签（tag）
+ * - 提交信息（commit / commitSha / marketplaceCommitSha / sha）
+ *
+ * @module core/installation-contract
+ */
+
+import { canonicalJson, sha256Hex } from './digest.mjs';
+
+/**
+ * 安装契约摘要算法版本。
+ * 算法变更时递增；版本升级会强制重新验证。
+ */
+export const INSTALLATION_CONTRACT_ALGORITHM_VERSION = 1;
+
+/**
+ * 合法的 marketplaceSourceType 值。
+ */
+const VALID_MARKETPLACE_SOURCE_TYPES = new Set([
+  'bundled-family',
+  'standalone-index',
+]);
+
+/**
+ * 合法的消费端验证结果类型（用于免验判定）。
+ */
+const VALID_CONSUMER_VERIFICATION_STATUSES = new Set([
+  'PASSED_AUTOMATIC',
+  'PASSED_MANUAL',
+  'NOT_REQUIRED_UNCHANGED',
+]);
+
+/**
+ * 需要从规范化对象中递归删除的展示/发布身份校验字段。
+ */
+const DISPLAY_FIELDS_TO_STRIP = new Set([
+  'version',
+  'description',
+  'shortDescription',
+  'longDescription',
+  'defaultPrompt',
+  'tag',
+  'commit',
+  'commitSha',
+  'marketplaceCommitSha',
+  'sha',
+]);
+
+/**
+ * 递归删除对象中的展示字段（深度克隆）。
+ *
+ * @param {Object} obj - 源对象
+ * @returns {Object} 规范化后的对象
+ */
+function stripDisplayFields(obj) {
+  if (obj === null || typeof obj !== 'object') {
+    return obj;
+  }
+
+  if (Array.isArray(obj)) {
+    return obj.map(item => stripDisplayFields(item));
+  }
+
+  const result = {};
+  for (const key of Object.keys(obj)) {
+    if (DISPLAY_FIELDS_TO_STRIP.has(key)) {
+      continue;
+    }
+    result[key] = stripDisplayFields(obj[key]);
+  }
+  return result;
+}
+
+/**
+ * 深度冻结对象（递归）。
+ *
+ * @param {Object} obj - 要冻结的对象
+ * @returns {Object} 冻结后的对象
+ */
+function deepFreeze(obj) {
+  if (obj === null || typeof obj !== 'object') {
+    return obj;
+  }
+
+  Object.freeze(obj);
+
+  if (Array.isArray(obj)) {
+    for (const item of obj) {
+      deepFreeze(item);
+    }
+  } else {
+    for (const value of Object.values(obj)) {
+      deepFreeze(value);
+    }
+  }
+
+  return obj;
+}
+
+/**
+ * 验证路径是否为相对路径。
+ *
+ * @param {string} path - 路径
+ * @param {string} fieldName - 字段名（用于错误信息）
+ */
+function assertRelativePath(path, fieldName) {
+  if (typeof path !== 'string') {
+    throw new Error(`${fieldName} must be a string`);
+  }
+
+  if (path === '') {
+    throw new Error(`${fieldName} must be a non-empty string`);
+  }
+
+  // Unix 绝对路径
+  if (path.startsWith('/')) {
+    throw new Error(`${fieldName} must be a relative path, got absolute path: ${path}`);
+  }
+
+  // Windows 绝对路径
+  if (/^[a-zA-Z]:\\/.test(path) || /^[a-zA-Z]:\//.test(path)) {
+    throw new Error(`${fieldName} must be a relative path, got absolute path: ${path}`);
+  }
+
+  // UNC 路径
+  if (path.startsWith('\\\\')) {
+    throw new Error(`${fieldName} must be a relative path, got UNC path: ${path}`);
+  }
+
+  // 目录穿越检查
+  const segments = path.split('/');
+  for (const seg of segments) {
+    if (seg === '..') {
+      throw new Error(`${fieldName} must not contain ".." traversal, got: ${path}`);
+    }
+    if (seg === '.') {
+      throw new Error(`${fieldName} must not contain "." component, got: ${path}`);
+    }
+  }
+}
+
+/**
+ * 验证摘要格式是否为合法的 64 位十六进制字符串。
+ *
+ * @param {string} digest - 摘要
+ * @returns {boolean} 是否合法
+ */
+function isValidDigest(digest) {
+  return typeof digest === 'string' && /^[a-f0-9]{64}$/.test(digest);
+}
+
+/**
+ * 构建可审计的安装契约对象。
+ *
+ * @param {Object} params
+ * @param {string} params.distributionType - 分发类型（如 'claude-plugin', 'kimi-plugin'）
+ * @param {string} params.manifestRelativePath - 插件 manifest 的相对路径
+ * @param {Object} params.manifest - 插件 manifest 对象
+ * @param {string} params.marketplaceSourceType - 市场来源类型
+ * @param {boolean} params.includeMarketplaceEntry - 是否纳入市场条目
+ * @param {string} [params.marketplaceIndexRelativePath] - 市场索引相对路径（includeMarketplaceEntry=true 时必需）
+ * @param {Object} [params.selectedMarketplaceEntry] - 所选市场条目（includeMarketplaceEntry=true 时必需）
+ * @param {string} params.verificationRecipeVersion - 验证配方版本
+ * @returns {Object} 深度冻结的契约对象
+ */
+export function buildInstallationContract({
+  distributionType,
+  manifestRelativePath,
+  manifest,
+  marketplaceSourceType,
+  includeMarketplaceEntry,
+  marketplaceIndexRelativePath,
+  selectedMarketplaceEntry,
+  verificationRecipeVersion,
+} = {}) {
+  // 输入验证
+  if (!distributionType || typeof distributionType !== 'string') {
+    throw new Error('buildInstallationContract: distributionType must be a non-empty string');
+  }
+
+  if (!manifestRelativePath || typeof manifestRelativePath !== 'string') {
+    throw new Error('buildInstallationContract: manifestRelativePath must be a non-empty string');
+  }
+
+  assertRelativePath(manifestRelativePath, 'manifestRelativePath');
+
+  if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) {
+    throw new Error('buildInstallationContract: manifest must be a non-null plain object');
+  }
+
+  if (!marketplaceSourceType || typeof marketplaceSourceType !== 'string') {
+    throw new Error('buildInstallationContract: marketplaceSourceType must be a non-empty string');
+  }
+
+  if (!VALID_MARKETPLACE_SOURCE_TYPES.has(marketplaceSourceType)) {
+    throw new Error(
+      `buildInstallationContract: invalid marketplaceSourceType "${marketplaceSourceType}", ` +
+      `must be one of: ${[...VALID_MARKETPLACE_SOURCE_TYPES].join(', ')}`
+    );
+  }
+
+  if (!verificationRecipeVersion || typeof verificationRecipeVersion !== 'string') {
+    throw new Error('buildInstallationContract: verificationRecipeVersion must be a non-empty string');
+  }
+
+  if (typeof includeMarketplaceEntry !== 'boolean') {
+    throw new Error('buildInstallationContract: includeMarketplaceEntry must be a boolean');
+  }
+
+  // 市场条目验证
+  if (includeMarketplaceEntry) {
+    if (!selectedMarketplaceEntry || typeof selectedMarketplaceEntry !== 'object' || Array.isArray(selectedMarketplaceEntry)) {
+      throw new Error(
+        'buildInstallationContract: selectedMarketplaceEntry is required when includeMarketplaceEntry is true'
+      );
+    }
+
+    if (!marketplaceIndexRelativePath || typeof marketplaceIndexRelativePath !== 'string') {
+      throw new Error(
+        'buildInstallationContract: marketplaceIndexRelativePath is required when includeMarketplaceEntry is true'
+      );
+    }
+
+    assertRelativePath(marketplaceIndexRelativePath, 'marketplaceIndexRelativePath');
+  }
+
+  // 构建契约对象
+  const contract = {
+    algorithmVersion: INSTALLATION_CONTRACT_ALGORITHM_VERSION,
+    distributionType,
+    manifestRelativePath,
+    normalizedManifest: stripDisplayFields(manifest),
+    marketplaceSourceType,
+    includeMarketplaceEntry,
+    verificationRecipeVersion,
+  };
+
+  // 纳入市场条目
+  if (includeMarketplaceEntry) {
+    contract.marketplaceIndexRelativePath = marketplaceIndexRelativePath;
+    contract.normalizedSelectedEntry = stripDisplayFields(selectedMarketplaceEntry);
+  }
+
+  // 深度冻结并返回
+  return deepFreeze(contract);
+}
+
+/**
+ * 计算安装契约摘要。
+ *
+ * @param {Object} params - buildInstallationContract 的参数
+ * @returns {string} SHA-256 摘要（64 位十六进制）
+ */
+export function computeInstallationContractDigest(params) {
+  const contract = buildInstallationContract(params);
+  return sha256Hex(canonicalJson(contract));
+}
+
+/**
+ * 判断是否可以跳过验证。
+ *
+ * 以下条件同时成立才返回 NOT_REQUIRED_UNCHANGED：
+ * 1. 当前摘要是合法 64 位十六进制
+ * 2. 上次摘要相同
+ * 3. 上次结果明确是消费端验证已解决类型（PASSED_AUTOMATIC / PASSED_MANUAL / NOT_REQUIRED_UNCHANGED）
+ * 4. 上次收据中记录的算法版本与当前算法版本相同
+ * 5. 上次收据自身绑定相同的 installationContractDigest
+ *
+ * @param {Object} params
+ * @param {string} params.currentDigest - 当前计算的安装契约摘要
+ * @param {string|null} params.previousDigest - 上一成功验证的摘要（可为 null）
+ * @param {Object|null} params.previousReceipt - 上一成功验证的收据（可为 null）
+ * @param {number} params.algorithmVersion - 当前算法版本
+ * @returns {'NOT_REQUIRED_UNCHANGED' | 'REQUIRE_VERIFICATION'}
+ */
+export function shouldSkipVerification({
+  currentDigest,
+  previousDigest,
+  previousReceipt,
+  algorithmVersion,
+} = {}) {
+  // 条件 1：当前摘要必须合法
+  if (!isValidDigest(currentDigest)) {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  // 条件 2：前次摘要必须存在且相同
+  if (!previousDigest || currentDigest !== previousDigest) {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  // 条件 3：前次收据必须存在
+  if (!previousReceipt || typeof previousReceipt !== 'object') {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  // 条件 4：前次收据结果必须是合法的消费端验证结果
+  // 只认 result 字段（schema 定义的正式字段）；新消费端收据此前不存在正式 status，
+  // 仅有 status 无 result 时要求重新验证。
+  if (!VALID_CONSUMER_VERIFICATION_STATUSES.has(previousReceipt.result)) {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  // 条件 5：算法版本必须一致
+  const previousAlgorithmVersion = previousReceipt.algorithmVersion
+    ?? previousReceipt.installationContractAlgorithmVersion;
+  if (previousAlgorithmVersion !== algorithmVersion) {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  // 条件 6：收据自身绑定的摘要必须一致
+  if (!isValidDigest(previousReceipt.installationContractDigest)) {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  if (previousReceipt.installationContractDigest !== currentDigest) {
+    return 'REQUIRE_VERIFICATION';
+  }
+
+  // 全部条件满足 => 跳过验证
+  return 'NOT_REQUIRED_UNCHANGED';
+}

package/src/core/plan.mjs

@@ -22,6 +22,7 @@ import addFormats from 'ajv-formats';
 import { canonicalJson, sha256Hex } from './digest.mjs';
 import { ReleaseError, GATE_FAILED } from './errors.mjs';
 import { readTrustedPackageResource } from './trusted-resource.mjs';
+import { computeInstallationContractDigest, INSTALLATION_CONTRACT_ALGORITHM_VERSION } from './installation-contract.mjs';
 // NOTE (T2.2 step 3): plan.mjs and the platform registry form a module cycle
 // (plan -> registry -> platforms/kimi -> plan, because the kimi strategies
 // bind computePlanDigest). PLATFORMS is therefore only ever read inside
@@ -778,17 +779,71 @@ export function validatePlanActionCompleteness(plan, options = {}) {
 
         // External independent marketplace form: the distribution declares
         // marketplaceRepo, so the install targets the external marketplace
-        // repository instead of publicRepo. Only platforms with a marketplace
-        // add capability (marketplaceRefForm !== null: claude=name, codex=sha)
-        // may carry it; kimi/codebuddy fail closed. Inline form (no
-        // marketplaceRepo) keeps every assertion below byte-for-byte.
+        // repository instead of publicRepo. All platforms support both
+        // bundled-family and standalone-index source types; the marketplace
+        // add capability (marketplaceRefForm) only constrains the automated
+        // install path, not the static source validation.
         const externalMarketplace = dist.marketplaceRepo !== undefined && dist.marketplaceRepo !== null;
-        if (externalMarketplace && platform.marketplaceRefForm === null) {
+        if (externalMarketplace && dist.marketplaceSourceType && dist.marketplaceSourceType !== 'standalone-index') {
           failures.push(
-            `unit "${unitId}", action "${action.id}": ${platform.distributionType} distribution declares marketplaceRepo but the platform has no marketplace add capability`,
+            `unit "${unitId}", action "${action.id}": ${platform.distributionType} distribution declares marketplaceRepo but marketplaceSourceType is "${dist.marketplaceSourceType}"; marketplaceRepo requires standalone-index`,
           );
         }
 
+        // --- 新版字段组完整性检查 ---
+        // 真正新增的安装契约字段（0.2.3 旧计划不含这些字段）：
+        //   distribution: installationContract、installationContractDigest、marketplaceSourceType
+        //   action: installationContractDigest、algorithmVersion
+        // 0.2.3 已有的 marketplaceForm/sourceDescriptor/sourceCommit 单独存在不能触发新版组，
+        // 否则破坏已发布 0.2.3 冻结计划兼容。
+        // 整组都不存在才按旧计划兼容；出现任意一个但不完整必须失败。
+        const distHasFieldGroup = dist.installationContract !== undefined && dist.installationContract !== null
+          || dist.installationContractDigest !== undefined && dist.installationContractDigest !== null
+          || dist.marketplaceSourceType !== undefined && dist.marketplaceSourceType !== null;
+        const actionHasFieldGroup = action.parameters?.installationContractDigest !== undefined && action.parameters?.installationContractDigest !== null
+          || action.parameters?.algorithmVersion !== undefined && action.parameters?.algorithmVersion !== null;
+        const hasFieldGroup = distHasFieldGroup || actionHasFieldGroup;
+
+        if (hasFieldGroup) {
+          // 检查 distribution 字段完整性
+          if (dist.marketplaceSourceType === undefined || dist.marketplaceSourceType === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": distribution missing marketplaceSourceType; new-version field group requires all fields`);
+          }
+          if (dist.installationContract === undefined || dist.installationContract === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": distribution missing installationContract; new-version field group requires all fields`);
+          }
+          if (dist.installationContractDigest === undefined || dist.installationContractDigest === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": distribution missing installationContractDigest; new-version field group requires all fields`);
+          }
+          // 检查 action 字段完整性
+          if (action.parameters?.marketplaceForm === undefined || action.parameters?.marketplaceForm === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": parameters.marketplaceForm missing; new-version field group requires all fields`);
+          }
+          if (action.parameters?.sourceDescriptor === undefined || action.parameters?.sourceDescriptor === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": parameters.sourceDescriptor missing; new-version field group requires all fields`);
+          }
+          if (action.parameters?.installationContractDigest === undefined || action.parameters?.installationContractDigest === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": parameters.installationContractDigest missing; new-version field group requires all fields`);
+          }
+          if (action.parameters?.algorithmVersion === undefined || action.parameters?.algorithmVersion === null) {
+            failures.push(`unit "${unitId}", action "${action.id}": parameters.algorithmVersion missing; new-version field group requires all fields`);
+          }
+          // sourceCommit 仅生产计划必需
+          if (production && (action.parameters?.sourceCommit === undefined || action.parameters?.sourceCommit === null)) {
+            failures.push(`unit "${unitId}", action "${action.id}": parameters.sourceCommit missing; production plan requires sourceCommit`);
+          }
+          // marketplaceForm、sourceDescriptor.form、distribution 的 marketplaceSourceType 三者一致
+          const mf = action.parameters?.marketplaceForm;
+          const sdForm = action.parameters?.sourceDescriptor?.form;
+          const distSourceType = dist.marketplaceSourceType;
+          if (mf && distSourceType && mf !== distSourceType) {
+            failures.push(`unit "${unitId}", action "${action.id}": marketplaceForm "${mf}" does not match distribution marketplaceSourceType "${distSourceType}"`);
+          }
+          if (sdForm && distSourceType && sdForm !== distSourceType) {
+            failures.push(`unit "${unitId}", action "${action.id}": sourceDescriptor.form "${sdForm}" does not match distribution marketplaceSourceType "${distSourceType}"`);
+          }
+        }
+
         // Parameter checks
         _checkRequired(action, 'parameters.consumer', action.parameters?.consumer, platform.id, unitId, failures);
         _checkRequired(action, 'parameters.plugin', action.parameters?.plugin, plugin, unitId, failures);
@@ -1060,6 +1115,74 @@ export function validatePlanActionCompleteness(plan, options = {}) {
           }
         }
 
+        // --- installationContractDigest 重新计算验证 ---
+        // 不能只比较两个可一起篡改的字符串；必须重新由 distribution 的 installationContract 计算并验证
+        if (hasFieldGroup && dist.installationContract) {
+          // 从 distribution 的 installationContract 重新计算摘要
+          const recomputedDigest = sha256Hex(canonicalJson(dist.installationContract));
+          const actionDigest = action.parameters?.installationContractDigest;
+          const distDigest = dist.installationContractDigest;
+
+          // 重算值必须同时等于 distribution 摘要和 action 摘要
+          if (distDigest && recomputedDigest !== distDigest) {
+            failures.push(
+              `unit "${unitId}", action "${action.id}": recomputed installationContractDigest "${recomputedDigest.slice(0, 16)}..." does not match distribution digest "${(distDigest ?? '').slice(0, 16)}..."; contract may have been tampered`,
+            );
+          }
+          if (actionDigest && recomputedDigest !== actionDigest) {
+            failures.push(
+              `unit "${unitId}", action "${action.id}": recomputed installationContractDigest "${recomputedDigest.slice(0, 16)}..." does not match action digest "${(actionDigest ?? '').slice(0, 16)}..."; contract may have been tampered`,
+            );
+          }
+          // algorithmVersion 必须等于当前算法版本
+          if (action.parameters?.algorithmVersion !== undefined && action.parameters?.algorithmVersion !== INSTALLATION_CONTRACT_ALGORITHM_VERSION) {
+            failures.push(
+              `unit "${unitId}", action "${action.id}": algorithmVersion is "${action.parameters?.algorithmVersion}", expected "${INSTALLATION_CONTRACT_ALGORITHM_VERSION}"`,
+            );
+          }
+        }
+
+        // --- standalone-index 审计字段校验 ---
+        // 仅 production === true 且来源为 standalone-index 时，要求 action 完整携带
+        // 非空 marketplaceIndexPath / marketplaceName / selectedEntry。
+        // 非生产计划不得要求这三个字段存在（未冻结时无真实值可用），
+        // 也不得接受"用 null 表示存在"的方案。
+        if (production && externalMarketplace && dist.marketplaceSourceType === 'standalone-index') {
+          const params = action.parameters;
+          if (params) {
+            if (!params.marketplaceIndexPath) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.marketplaceIndexPath is required for production standalone-index`,
+              );
+            }
+            if (!params.marketplaceName) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.marketplaceName is required for production standalone-index`,
+              );
+            }
+            if (!params.selectedEntry) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.selectedEntry is required for production standalone-index`,
+              );
+            }
+          }
+        }
+
+        // --- bundled-family 禁止混入 standalone 字段 ---
+        if (!externalMarketplace && dist.marketplaceSourceType === 'bundled-family') {
+          const params = action.parameters;
+          if (params) {
+            const STANDALONE_ONLY = ['marketplaceIndexPath', 'marketplaceName', 'selectedEntry'];
+            for (const field of STANDALONE_ONLY) {
+              if (params[field] !== undefined) {
+                failures.push(
+                  `unit "${unitId}", action "${action.id}": parameters.${field} is unexpected for bundled-family form; mixed fields are prohibited`,
+                );
+              }
+            }
+          }
+        }
+
         // Expected checks. Marketplace identity is bound only on platforms
         // whose schema requires it (MINOR-1): a non-marketplace platform's
         // observation never binds a marketplace.