release-skill 0.2.4 → 0.2.6

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.2.4",
+      "version": "0.2.6",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.2.4.",
+      "Prepare a release plan for version 0.2.6.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.2.6 locale=en baseline=sha256:ba7fe1d8cbae8ea3a539016c1231acd066f6dbf30b6e1ebb9db50e7c04e69253 -->
+## [0.2.6] - 2026-07-29
+
+v0.2.6 adds a source-authority content gate so a production release cannot succeed while the project workspace's real default branch still exposes stale public files.
+
+### Added
+
+- **Source-authority content closure**: prepare freezes the exact public input paths and executable modes that must exist on the configured source repository's actual default branch.
+- **Pre-publish remote proof**: publish compares the frozen closure with the remote default branch before any external write and records a digest-bound receipt that verify requires.
+
+### Changed
+
+- **Branch topology tolerance**: projects may develop directly on the default branch or use release branches; compliance is based on final content, not merge ancestry or a hard-coded branch name.
+- **Minimal conflict policy**: divergent or conflicting source state fails closed with diagnostics; Release Skill does not auto-merge, rebase, force-push, or create a replacement branch workflow.
+
+### Fixed
+
+- **Stale workspace README after release**: production publishing now blocks when the source workspace's real default branch does not contain the frozen public README and other declared source inputs.
+<!-- release-skill:changelog:end version=0.2.6 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.2.5 locale=en baseline=sha256:8bd4c268f65c72efeb3866ef4bcae7d1fa902e02833e622ca66670b633b124b1 -->
+## [0.2.5] - 2026-07-28
+
+v0.2.5 adds a built-in skill resource-closure release gate. Release Skill now validates the actual frozen and installed plugin projections instead of treating repository-level file presence as proof that every skill can resolve its resources.
+
+### Added
+
+- **Skill resource-closure gate**: recursively discovers nested skills and validates skill-local references, assets, schemas, examples, and private scripts from each skill root.
+- **Frozen and installed receipts**: prepare records closure receipts for every distribution surface, publish rechecks the frozen artifact before external writes, and verify requires matching receipts from real npm and plugin installation roots.
+- **Adversarial path checks**: rejects current-working-directory fallbacks, source-tree backjumps, absolute machine paths, path escape, symbolic links, and non-regular resource targets.
+
+### Changed
+
+- **Shared runtime resolution is explicit**: plugin-level scripts and cross-skill resources must resolve from a validated plugin root; bounded source-only build tools remain auditable exceptions.
+- **Kimi Code and CodeBuddy verification tightened**: consumer verification plans now bind to actual isolated or managed plugin installation paths.
+- **Legacy plan compatibility preserved**: existing frozen plans remain readable, while newly prepared plans require resource-closure evidence.
+
+### Fixed
+
+- **Nested skill blind spot removed**: author, review, repair, and other nested skills are no longer skipped by resource validation.
+- **Public baseline tests synchronized**: migration invariants now track the configured v0.2.4 public baseline commit.
+<!-- release-skill:changelog:end version=0.2.5 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.2.4 locale=en baseline=sha256:b0ad6c897df808a11a2630d1565327ff5092e407dd004dc71bc43b954cbf88a6 -->
 ## [0.2.4] - 2026-07-28
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.2.4 -->
+<!-- release-skill:release-version: 0.2.6 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -128,7 +128,7 @@ as a version-pinned **manual** install plus trusted observation/attestation:
    frozen version; otherwise do NOT issue an attestation.
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.2.4
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.2.6
    /plugins reload
    ```
 
@@ -140,7 +140,7 @@ as a version-pinned **manual** install plus trusted observation/attestation:
 ```json
 {
   "platform": "kimi",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "planDigest": "<64-hex frozen plan digest>",
   "result": "passed",
   "actor": "<person who confirmed>",
@@ -204,7 +204,7 @@ attestation (the same capability gap and closed loop as Kimi Code):
 ```json
 {
   "platform": "codebuddy",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "planDigest": "<64-hex frozen plan digest>",
   "result": "passed",
   "actor": "<person who confirmed>",
@@ -345,7 +345,11 @@ setup; use the mechanically extracted `recommendedAnswers`.
   "projectConfig": {
     "apiVersion": "release-skill/v1",
     "kind": "ReleaseProject",
-    "project": { "name": "my-project", "defaultBranch": "main" },
+    "project": {
+      "name": "my-project",
+      "defaultBranch": "main",
+      "sourceRepository": "owner/my-workspace"
+    },
     "releaseUnits": [{
       "id": "my-project",
       "source": ".",
@@ -428,6 +432,7 @@ kind: ReleaseProject
 project:
   name: my-project
   defaultBranch: main
+  sourceRepository: owner/my-workspace
 
 releaseUnits:
   - id: my-project
@@ -643,6 +648,23 @@ The last two strategies require online production prepare. Any mismatch stops
 for review; update the human-owned config only after inspecting real remote
 state, and never force-push or weaken the baseline.
 
+### Workspace source authority
+
+`project.sourceRepository` is the GitHub `owner/repo` of the workspace that
+owns the human source files; it may differ from every release unit's
+`publicRepo`. `project.defaultBranch` is that repository's actual remote
+default branch and is not assumed to be `main`.
+
+Production prepare freezes a content-and-mode closure of every expanded
+`publicFiles.from` input and each unit's `version.source`. It rejects only
+uncommitted changes inside that closure. Before any publish adapter executes,
+release-skill verifies the same closure on the remote default branch. Commit
+ancestry is intentionally irrelevant: merge, squash, and rebase are accepted
+when the bytes still match, while a reverted or conflict-lost README is
+blocked by path. Resolve differences manually and put the accepted content on
+the default branch; release-skill never merges, switches branches, pushes, or
+creates a PR.
+
 ## Protect Human-Owned Content
 
 README text, slogans, examples, layout, and other manually curated source files
@@ -673,10 +695,12 @@ When an existing public copy has drifted, choose explicitly:
   a release plan.
 - Before production, configure every unit's `previousPublicBaseline`. Use
   `mode: bound` with the exact `repo`, `ref`, and `commit` for an existing
-  public version, then run `"${CLI[@]}" prepare --root <your-project> --online --production`.
+  public version. Also configure the workspace `project.sourceRepository` and
+  its real `project.defaultBranch`, then run
+  `"${CLI[@]}" prepare --root <your-project> --online --production`.
   The default observer proves only the ref-to-commit mapping; remote content is
-  not downloaded. Target branch/tag/Release/npm uniqueness is checked by the
-  publish global preflight before any execute.
+  not downloaded during prepare. Source content authority and target
+  branch/tag/Release/npm uniqueness are checked by publish before any execute.
 - For production commands, use only the immutable `planPath` returned by
   `prepare --json` and immutable `approvalPath` returned by `approve --json`.
   Mutable latest aliases are for convenience and are not production authority.

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.2.4 -->
+<!-- release-skill:release-version: 0.2.6 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -112,7 +112,7 @@ release-skill 把 Kimi 安装建模为“版本钉死的手动安装 + 可信观
    必须核实已安装插件清单版本等于冻结版本；否则**不得**出具证明。
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.2.4
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.2.6
    /plugins reload
    ```
 
@@ -124,7 +124,7 @@ release-skill 把 Kimi 安装建模为“版本钉死的手动安装 + 可信观
 ```json
 {
   "platform": "kimi",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "planDigest": "<64 位十六进制冻结计划摘要>",
   "result": "passed",
   "actor": "<确认人>",
@@ -178,7 +178,7 @@ codebuddy CLI 可以添加市场并安装插件，但 **`plugin marketplace add`
 ```json
 {
   "platform": "codebuddy",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "planDigest": "<64 位十六进制冻结计划摘要>",
   "result": "passed",
   "actor": "<确认人>",
@@ -297,7 +297,11 @@ node -e 'require("node:fs").rmSync(process.argv[1],{recursive:true,force:false})
   "projectConfig": {
     "apiVersion": "release-skill/v1",
     "kind": "ReleaseProject",
-    "project": { "name": "my-project", "defaultBranch": "main" },
+    "project": {
+      "name": "my-project",
+      "defaultBranch": "main",
+      "sourceRepository": "owner/my-workspace"
+    },
     "releaseUnits": [{
       "id": "my-project",
       "source": ".",
@@ -362,6 +366,7 @@ kind: ReleaseProject
 project:
   name: my-project
   defaultBranch: main
+  sourceRepository: owner/my-workspace
 
 releaseUnits:
   - id: my-project
@@ -512,6 +517,19 @@ production:
 
 后两种策略必须在线执行 production prepare。任何不一致都应停止并审阅；只有检查真实远端状态后才能人工更新权威配置，禁止 force push 或弱化基线。
 
+### Workspace 源码权威
+
+`project.sourceRepository` 是承载人工源文件的 workspace GitHub
+`owner/repo`，可以与各 release unit 的 `publicRepo` 不同。
+`project.defaultBranch` 是该仓库真实的远端默认分支，不假设一定为 `main`。
+
+生产 prepare 冻结所有 `publicFiles.from` 展开输入和各 unit
+`version.source` 的内容与 Git mode，只拒绝这个闭包内的未提交变化。publish 在任何
+adapter execute 前从远端默认分支比较同一闭包。判定不依赖 commit ancestry，因此
+merge、squash、rebase 后字节仍一致即可通过；README 被 revert 或冲突解决丢失时按路径
+阻断。差异必须由人工处理并把接受内容放入默认分支；release-skill 不自动 merge、切分支、
+push 或创建 PR。
+
 ## 保护人工维护内容
 
 README 文案、slogan、示例、排版及其他人工源文件始终是权威。release-skill 只按 `publicFiles` 映射做快照，不重新生成或覆盖源 README。每次人工编辑后重新 prepare，并批准新的不可变计划；不得编辑冻结快照或复用旧批准绕过变化。
@@ -528,5 +546,9 @@ README 文案、slogan、示例、排版及其他人工源文件始终是权威
 - 缺少配置时运行 `"${CLI[@]}" setup --root <your-project> --json`，在人工决策完成前保持默认 dry-run。
 - 运行 `"${CLI[@]}" assess --root <your-project> --offline` 检查发布就绪度。
 - 运行 `"${CLI[@]}" prepare --root <your-project> --offline` 生成发布计划；release-skill 自身只做本地写入，但项目 hook 可能执行远端操作。
-- 生产前为每个 unit 配置 `previousPublicBaseline`。已有公开版本必须使用 `mode: bound`，绑定精确 `repo`、`ref` 和 `commit`，再运行 `"${CLI[@]}" prepare --root <your-project> --online --production`。
+- 生产前为每个 unit 配置 `previousPublicBaseline`。已有公开版本必须使用 `mode: bound`，
+  绑定精确 `repo`、`ref` 和 `commit`；同时配置 workspace 的
+  `project.sourceRepository` 与真实 `project.defaultBranch`，再运行
+  `"${CLI[@]}" prepare --root <your-project> --online --production`。prepare 不下载源码
+  内容；publish 会在任何 execute 前检查源码权威闭包与目标唯一性。
 - 生产命令只使用 `prepare --json` 返回的不可变 `planPath`，以及 `approve --json` 返回的不可变 `approvalPath`。

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.2.4 -->
+<!-- release-skill:release-version: 0.2.6 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,28 +14,27 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.2.4** (2026-07-28)
+**0.2.6** (2026-07-29)
 
-v0.2.4 is a documentation and marketplace-source remediation release. It corrects the default marketplace source to the bundled-family repository (ifoohoo/release-skill), eliminates stale v0.1.9 residuals, improves README bilingual consistency and navigation, and strengthens anti-regression gates for version drift.
+v0.2.6 adds a source-authority content gate so a production release cannot succeed while the project workspace's real default branch still exposes stale public files.
+
+**Added**
+
+- **Source-authority content closure**: prepare freezes the exact public input paths and executable modes that must exist on the configured source repository's actual default branch.
+- **Pre-publish remote proof**: publish compares the frozen closure with the remote default branch before any external write and records a digest-bound receipt that verify requires.
 
 **Changed**
 
-- **Default marketplace source corrected**: all installation documentation now uses the bundled-family repository `ifoohoo/release-skill` instead of the external marketplace `ifoohoo/artifact-skill-set`. Claude Code install command is now `/plugin marketplace add ifoohoo/release-skill` with `release-skill@release-skill`.
-- **README restructured for readability**: both EN and ZH READMEs now include a table of contents, Documentation navigation section, and reorganized chapter flow (Quick start moved before preservation contract). Significantly shorter than before.
-- **Positioning sentences completed**: README and root workspace README now list all supported platforms (Claude Code, CodeBuddy, WorkBuddy, Codex, Kimi Code).
-- **Anti-regression gate expanded**: `sync-version.mjs` TEXT_TARGETS now covers the safe-first-command version statement in both EN and ZH READMEs, preventing future v0.1.9-type drift.
+- **Branch topology tolerance**: projects may develop directly on the default branch or use release branches; compliance is based on final content, not merge ancestry or a hard-coded branch name.
+- **Minimal conflict policy**: divergent or conflicting source state fails closed with diagnostics; Release Skill does not auto-merge, rebase, force-push, or create a replacement branch workflow.
 
 **Fixed**
 
-- **v0.1.9 residual eliminated**: the safe-first-command block in both READMEs now correctly references the current version (was stuck at v0.1.9).
-- **Stale counting removed**: replaced fragile 'All four plugin hosts' / '四种插件宿主' with 'All supported plugin hosts' / '各插件宿主'.
-- **Root README boundary corrected**: clarified that README/INSTALL/CHANGELOG are human-maintained source files, while references/schemas/adapters/skills are generated artifacts.
-- **CONTRIBUTING updated**: added 'Do not edit generated files' section documenting the authority source and regeneration workflow for references/, schemas/, adapters/, and skills/.
-- **AGENTS.md language rule adjusted**: governance rules file may use English; user-facing documentation remains Chinese.
+- **Stale workspace README after release**: production publishing now blocks when the source workspace's real default branch does not contain the frozen public README and other declared source inputs.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.2.4 is the current release (v0.2.2 previously held
+> **Current boundary:** v0.2.6 is the current release (v0.2.2 previously held
 > published status before the platform verification convergence fix was added).
 > v0.1.1 completed a real production release to GitHub and npm — the first
 > production-verified milestone — followed by
@@ -53,7 +52,7 @@ v0.2.4 is a documentation and marketplace-source remediation release. It correct
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.2.4 is the current
+> **Production path verified since the v0.1.1 milestone; v0.2.6 is the current
 > release.** The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >
@@ -261,6 +260,15 @@ again; it never rebuilds from a template. Only files listed in `publicFiles` are
 copied. `prepare` never refreshes or rewrites human docs — maintainers update
 README, INSTALL, and CHANGELOG first, then prepare, review, and approve.
 
+**Workspace source authority:** production config names the workspace source
+repository with `project.sourceRepository` and its real remote default branch
+with `project.defaultBranch`. Prepare binds the content and Git mode of every
+expanded `publicFiles.from` input plus each `version.source`; publish compares
+that frozen closure with the remote default branch before the first adapter
+write. The check accepts merge, squash, and rebase when the bytes still match,
+but blocks a lost or reverted README by path. It never merges, switches
+branches, pushes, or creates a PR.
+
 **Write safety:** `setup` is read-only by default (create-once after digest
 confirmation). `prepare` writes only under `.release-skill/`. `publish` is the
 production write entry, requiring both approval and the current plan digest.
@@ -291,6 +299,7 @@ kind: ReleaseProject
 project:
   name: my-project
   defaultBranch: main
+  sourceRepository: owner/my-workspace
 releaseUnits:
   - id: my-project
     source: .
@@ -331,6 +340,7 @@ kind: ReleaseProject
 project:
   name: my-workspace
   defaultBranch: main
+  sourceRepository: owner/my-workspace
 releaseUnits:
   - id: my-app
     source: packages/app
@@ -388,7 +398,11 @@ and binding the same id in `selectedGateIds`:
   "projectConfig": {
     "apiVersion": "release-skill/v1",
     "kind": "ReleaseProject",
-    "project": { "name": "my-project", "defaultBranch": "main" },
+    "project": {
+      "name": "my-project",
+      "defaultBranch": "main",
+      "sourceRepository": "owner/my-workspace"
+    },
     "releaseUnits": [{
       "id": "my-project",
       "source": ".",

package/README.zh-CN.md

@@ -2,34 +2,33 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.2.4 -->
+<!-- release-skill:release-version: 0.2.6 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.2.4** (2026-07-28)
+**0.2.6** (2026-07-29)
 
-v0.2.4 是文档与市场来源整改版本。将默认市场来源纠正为 bundled-family 仓库（ifoohoo/release-skill），消除过时的 v0.1.9 残留，改善 README 双语一致性与导航，并强化版本漂移的防复发门禁。
+v0.2.6 新增源码权威内容门，避免生产发布完成后，项目工作区的真实默认分支仍对外展示旧 README 等公开文件。
+
+**新增**
+
+- **源码权威内容闭包**：prepare 冻结必须出现在所配置源码仓真实默认分支上的公开输入路径、内容与可执行位。
+- **发布前远端证明**：publish 在任何外部写入前对比冻结闭包与远端默认分支，并生成摘要绑定的收据；verify 必须消费该收据。
 
 **变更**
 
-- **默认市场来源纠正**：所有安装文档现使用 bundled-family 仓库 `ifoohoo/release-skill`，而非外部市场 `ifoohoo/artifact-skill-set`。Claude Code 安装命令改为 `/plugin marketplace add ifoohoo/release-skill`，安装名为 `release-skill@release-skill`。
-- **README 结构优化**：中英文 README 均增加目录、文档导航章节，并重组章节流程（快速开始移至保存契约之前）。相较此前显著缩短。
-- **定位句补全**：README 和根工作区 README 现列出所有支持平台（Claude Code、CodeBuddy、WorkBuddy、Codex、Kimi Code）。
-- **防复发门禁扩展**：`sync-version.mjs` TEXT_TARGETS 现覆盖中英文 README 的 safe-first-command 版本陈述，防止未来 v0.1.9 类漂移。
+- **兼容不同分支拓扑**：项目既可直接在默认分支迭代，也可使用发布分支；是否合规只看最终内容，不依赖合并祖先关系或写死的分支名。
+- **最小冲突策略**：分叉或冲突状态失败关闭并给出诊断；Release Skill 不自动 merge、rebase、force-push，也不引入替代性的分支工作流。
 
 **修复**
 
-- **消除 v0.1.9 残留**：两个 README 的 safe-first-command 块现正确引用当前版本（之前停留在 v0.1.9）。
-- **移除易漂移计数**：将 'All four plugin hosts' / '四种插件宿主' 替换为 'All supported plugin hosts' / '各插件宿主'。
-- **根 README 边界修正**：明确 README/INSTALL/CHANGELOG 是人工维护的源文件，references/schemas/adapters/skills 是生成产物。
-- **CONTRIBUTING 更新**：新增'不要直接编辑生成物'章节，说明 references/、schemas/、adapters/、skills/ 的权威来源和再生命令。
-- **AGENTS.md 语言规则调整**：治理规则文件可使用英文；面向用户的文档仍使用中文。
+- **修复发布后工作区 README 陈旧**：当源码工作区真实默认分支缺少冻结后的 README 或其他声明输入时，生产发布会在外部写入前阻断。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.2.4 是当前发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
+> **当前边界：** v0.2.6 是当前发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；"当前发布版本"与"首次生产验证里程碑"
@@ -42,7 +41,7 @@ v0.2.4 是文档与市场来源整改版本。将默认市场来源纠正为 bun
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.2.4 是当前发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.2.6 是当前发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
@@ -233,6 +232,13 @@ DISCOVERED -> ASSESSED -> PREPARED -> APPROVED -> PUBLISHING -> PUBLISHED -> VER
 
 **写入安全：** `setup` 默认只读（摘要确认后仅首次创建配置）。`prepare` 只写 `.release-skill/`。`publish` 是生产写入入口，需要同时提供批准和当前计划摘要。项目 hook 和 gate 是已确认的本地进程，没有操作系统沙箱。
 
+**Workspace 源码权威：** 生产配置使用 `project.sourceRepository` 指定 workspace
+源仓库，并用 `project.defaultBranch` 指定其真实远端默认分支。prepare 冻结所有
+`publicFiles.from` 展开文件及各 `version.source` 的内容与 Git mode；publish 在第一个
+adapter 写入前与远端默认分支比较。普通 merge、squash、rebase 后内容仍一致即可通过；
+README 被冲突解决或 revert 丢失时会精确到路径阻断。系统不会自动合并、切分支、push
+或创建 PR。
+
 ## 文档导航
 
 | 文档 | 说明 |
@@ -257,6 +263,7 @@ kind: ReleaseProject
 project:
   name: my-project
   defaultBranch: main
+  sourceRepository: owner/my-workspace
 releaseUnits:
   - id: my-project
     source: .
@@ -295,6 +302,7 @@ kind: ReleaseProject
 project:
   name: my-workspace
   defaultBranch: main
+  sourceRepository: owner/my-workspace
 releaseUnits:
   - id: my-app
     source: packages/app
@@ -351,7 +359,11 @@ releaseUnits:
   "projectConfig": {
     "apiVersion": "release-skill/v1",
     "kind": "ReleaseProject",
-    "project": { "name": "my-project", "defaultBranch": "main" },
+    "project": {
+      "name": "my-project",
+      "defaultBranch": "main",
+      "sourceRepository": "owner/my-workspace"
+    },
     "releaseUnits": [{
       "id": "my-project",
       "source": ".",

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.2.4",
+      "version": "0.2.6",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification"
     }
   ]

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"