release-skill 0.2.4 → 0.2.6

package/src/commands/verify.mjs

@@ -41,8 +41,10 @@ import {
 import {
   ReleaseError,
   GATE_FAILED,
+  CONFIG_MISSING,
   POST_PUBLISH_VERIFY_FAILED,
 } from '../core/errors.mjs';
+import { verifySourceAuthorityReceipt } from '../core/source-authority.mjs';
 import { assertTransition, PUBLISHED, VERIFIED } from '../core/state-machine.mjs';
 import { resolveUnitScopedPath } from '../snapshot/public-path.mjs';
 import {
@@ -51,6 +53,11 @@ import {
   resolveNpmRegistryAuthToken,
 } from '../adapters/npm.mjs';
 import { runConsumerVerificationGates } from '../core/verification-gates.mjs';
+import {
+  checkSkillResourceClosure,
+  createSkillResourceClosureReceipt,
+  evaluateConsumerSkillResourceClosureReceipts,
+} from '../core/skill-resource-closure.mjs';
 import { isRemoteWriteAction, isMarketplaceAction } from '../core/checkpoints.mjs';
 import {
   shouldSkipVerification,
@@ -216,11 +223,13 @@ export async function runSmokeTest(plan, root, options = {}) {
         skipped: true,
         details: { message: 'No npm distributions in plan; smoke test skipped' },
         gateResults: [],
+        skillResourceClosureReceipts: [],
       };
     }
 
     const results = [];
     const gateResults = [];
+    const skillResourceClosureReceipts = [];
 
     for (const { package: pkgName, registry, targetVersion, unitId, smokeBin, smokeArgs, smokeExpectedJson } of npmDistributions) {
       const packageAtVersion = `${pkgName}@${targetVersion}`;
@@ -285,6 +294,47 @@ export async function runSmokeTest(plan, root, options = {}) {
       }
 
       const pkgRoot = join(installDir, 'node_modules', pkgName);
+      if (plan.skillResourceClosure) {
+        const expectedUnitReceipt = plan.skillResourceClosure.unitReceipts
+          .find((item) => item.unitId === unitId);
+        if (!expectedUnitReceipt) {
+          return {
+            passed: false,
+            details: { error: `Skill resource closure receipt missing for npm unit "${unitId}"` },
+          };
+        }
+        const closureResult = await checkSkillResourceClosure({
+          snapshotDir: pkgRoot,
+          host: 'npm',
+        });
+        if (closureResult.findings.length > 0) {
+          return {
+            passed: false,
+            details: {
+              error: `Skill resource closure failed for ${packageAtVersion}`,
+              findings: closureResult.findings,
+            },
+          };
+        }
+        if (expectedUnitReceipt.skillCount > 0 && closureResult.skillCount === 0) {
+          return {
+            passed: false,
+            details: {
+              error: `Installed npm package ${packageAtVersion} contains no skills`,
+            },
+          };
+        }
+        skillResourceClosureReceipts.push(createSkillResourceClosureReceipt(
+          closureResult,
+          {
+            unitId,
+            distribution: 'npm',
+            host: 'npm',
+            checkedAt: new Date().toISOString(),
+            exitCode: 0,
+          },
+        ));
+      }
       gateResults.push(...await runConsumerVerificationGates({
         plan,
         unitId,
@@ -471,6 +521,7 @@ export async function runSmokeTest(plan, root, options = {}) {
         count: results.length,
       },
       gateResults,
+      skillResourceClosureReceipts,
     };
   } finally {
     await rm(tmpDir, { recursive: true, force: true }).catch(() => {});
@@ -605,6 +656,13 @@ export async function verifyRelease(options) {
     );
   }
   validatePlan(plan);
+  if (plan.production?.mode === 'github-npm-v1' && !plan.sourceAuthority) {
+    throw new ReleaseError(
+      CONFIG_MISSING,
+      'production verify requires a frozen sourceAuthority binding; the release must be re-prepared before publish',
+      { gate: 'source-authority' },
+    );
+  }
 
   // --- Set up directories ---
   const runId = `verify-${Date.now()}`;
@@ -728,6 +786,29 @@ export async function verifyRelease(options) {
     // Validate checkpoint mapping
     validateRunCheckpointMapping(sourceRun, plan.externalActions ?? []);
 
+    // --- Source authority receipt verification ---
+    // If the plan declares sourceAuthority, the source publish run must
+    // contain a matching CONSISTENT receipt bound to this planDigest.
+    if (plan.sourceAuthority) {
+      await evidence.append({ phase: 'source-authority-receipt', status: 'started' });
+
+      const receiptResult = verifySourceAuthorityReceipt({ plan, run: sourceRun });
+      if (!receiptResult.passed) {
+        await evidence.append({
+          phase: 'source-authority-receipt',
+          status: 'failed',
+          reason: receiptResult.reason,
+        });
+        throw new ReleaseError(
+          GATE_FAILED,
+          `source authority receipt verification failed: ${receiptResult.reason}`,
+          { reason: receiptResult.reason },
+        );
+      }
+
+      await evidence.append({ phase: 'source-authority-receipt', status: 'passed' });
+    }
+
     // All checkpoints must be succeeded or skipped (no failed/pending),
     // except marketplace install checkpoints which are re-verified by verify
     // itself via consumer verification (human attestation or automatic).
@@ -1002,7 +1083,10 @@ export async function verifyRelease(options) {
             algorithmVersion: INSTALLATION_CONTRACT_ALGORITHM_VERSION,
           });
 
-          if (skipDecision === 'NOT_REQUIRED_UNCHANGED') {
+          // A current-run resource-closure receipt requires a fresh isolated
+          // install. Installation-contract reuse alone cannot prove the
+          // installed Skill resources are reachable.
+          if (skipDecision === 'NOT_REQUIRED_UNCHANGED' && !plan.skillResourceClosure) {
             adapterChecks.push({
               actionId: action.id,
               actionType: action.type,
@@ -1241,6 +1325,103 @@ export async function verifyRelease(options) {
       );
     }
 
+    // =======================================================================
+    // Step 4b: Skill resource closure check on consumer install surfaces
+    // Re-run the closure check on each declared consumer install surface.
+    // If the plan declares skillResourceClosure, every declared host surface
+    // must be checked and pass; undeclared or failed surfaces block VERIFIED.
+    // =======================================================================
+    const skillResourceClosureReceipts = [
+      ...(smokeTest.skillResourceClosureReceipts ?? []),
+    ];
+    if (plan.skillResourceClosure) {
+      await evidence.append({ phase: 'verify', step: 'skill-resource-closure', status: 'started' });
+
+      // Collect install paths from marketplace adapter checks
+      const installSurfaces = [];
+      const actionDistribution = {
+        'claude-marketplace-install': 'claude-plugin',
+        'codex-marketplace-install': 'codex-plugin',
+        'kimi-marketplace-install': 'kimi-plugin',
+        'codebuddy-marketplace-install': 'codebuddy-plugin',
+      };
+      for (const check of adapterChecks) {
+        const distribution = actionDistribution[check.actionType];
+        if (distribution && check.observation?.installPath) {
+          installSurfaces.push({
+            host: distribution.replace('-plugin', ''),
+            distribution,
+            installPath: check.observation.installPath,
+            actionId: check.actionId,
+            unitId: actions.find((a) => a.id === check.actionId)?.unitId,
+          });
+        }
+      }
+
+      for (const surface of installSurfaces) {
+        const closureResult = await checkSkillResourceClosure({
+          snapshotDir: surface.installPath,
+          host: surface.host,
+        });
+
+        if (closureResult.findings.length > 0) {
+          await evidence.append({
+            phase: 'verify',
+            step: 'skill-resource-closure',
+            status: 'failed',
+            host: surface.host,
+            findingCount: closureResult.findings.length,
+            findings: closureResult.findings,
+          });
+          throw new ReleaseError(
+            POST_PUBLISH_VERIFY_FAILED,
+            `skill resource closure check failed for ${surface.host} consumer install: ${closureResult.findings.length} finding(s)`,
+            { host: surface.host, findings: closureResult.findings },
+          );
+        }
+        const expectedUnitReceipt = plan.skillResourceClosure.unitReceipts
+          .find((item) => item.unitId === surface.unitId);
+        if (!expectedUnitReceipt || closureResult.skillCount === 0) {
+          throw new ReleaseError(
+            POST_PUBLISH_VERIFY_FAILED,
+            `skill resource closure installed surface is empty or unbound for ${surface.distribution}`,
+            { unitId: surface.unitId, distribution: surface.distribution },
+          );
+        }
+        skillResourceClosureReceipts.push(createSkillResourceClosureReceipt(
+          closureResult,
+          {
+            host: surface.host,
+            distribution: surface.distribution,
+            actionId: surface.actionId,
+            unitId: surface.unitId,
+            checkedAt: clockFn(),
+            exitCode: 0,
+          },
+        ));
+      }
+
+      const receiptCoverage = evaluateConsumerSkillResourceClosureReceipts(
+        plan,
+        skillResourceClosureReceipts,
+      );
+      if (!receiptCoverage.passed) {
+        throw new ReleaseError(
+          POST_PUBLISH_VERIFY_FAILED,
+          'skill resource closure receipt set does not match declared consumer distributions',
+          receiptCoverage,
+        );
+      }
+
+      await evidence.append({
+        phase: 'verify',
+        step: 'skill-resource-closure',
+        status: 'completed',
+        surfaceCount: installSurfaces.length,
+        receipts: skillResourceClosureReceipts,
+      });
+    }
+
     // =======================================================================
     // All verifications passed — write verify run
     // =======================================================================
@@ -1285,6 +1466,7 @@ export async function verifyRelease(options) {
       }),
       gateResults: consumerGateResults,
       consumerVerificationReceipts,
+      skillResourceClosureReceipts,
       startedAt: clockFn(),
       finishedAt: clockFn(),
     };

package/src/core/errors.mjs

@@ -88,6 +88,12 @@ const EXIT_CODE_MAP = Object.freeze({
   RELEASE_DOCS_REFRESH_STALE: 45,
   RELEASE_DOCS_STALE: 46,
   CONSUMER_VERIFICATION_DEFERRED: 47,
+  CONFIG_MISSING: 48,
+  REMOTE_UNAVAILABLE: 49,
+  REF_MISSING: 50,
+  NOT_DEFAULT: 51,
+  CONTENT_MISMATCH: 52,
+  DIRTY_SOURCE_INPUT: 53,
 });
 
 // ---- Error code constants ----
@@ -130,6 +136,12 @@ export const RELEASE_DOCS_CONFLICT = 'RELEASE_DOCS_CONFLICT';
 export const RELEASE_DOCS_REFRESH_STALE = 'RELEASE_DOCS_REFRESH_STALE';
 export const RELEASE_DOCS_STALE = 'RELEASE_DOCS_STALE';
 export const CONSUMER_VERIFICATION_DEFERRED = 'CONSUMER_VERIFICATION_DEFERRED';
+export const CONFIG_MISSING = 'CONFIG_MISSING';
+export const REMOTE_UNAVAILABLE = 'REMOTE_UNAVAILABLE';
+export const REF_MISSING = 'REF_MISSING';
+export const NOT_DEFAULT = 'NOT_DEFAULT';
+export const CONTENT_MISMATCH = 'CONTENT_MISMATCH';
+export const DIRTY_SOURCE_INPUT = 'DIRTY_SOURCE_INPUT';
 
 /**
  * Typed error for release-skill operations.

package/src/core/plan.mjs

@@ -165,6 +165,35 @@ export function validatePlan(plan) {
       );
     }
   }
+
+  if (plan.skillResourceClosure) {
+    const receipts = plan.skillResourceClosure.unitReceipts ?? [];
+    const receiptUnitIds = receipts.map((item) => item.unitId);
+    if (
+      new Set(receiptUnitIds).size !== receiptUnitIds.length
+      || JSON.stringify([...receiptUnitIds].sort()) !== JSON.stringify([...unitsById.keys()].sort())
+    ) {
+      throw new ReleaseError(
+        GATE_FAILED,
+        'skill resource closure receipts must cover every release unit exactly once',
+      );
+    }
+    const totals = {
+      totalSkillCount: receipts.reduce((sum, item) => sum + item.skillCount, 0),
+      totalReferenceCount: receipts.reduce((sum, item) => sum + item.referenceCount, 0),
+      totalSourceOnlyCount: receipts.reduce((sum, item) => sum + item.sourceOnlyCount, 0),
+      totalFindingCount: receipts.reduce((sum, item) => sum + item.findingCount, 0),
+    };
+    for (const [field, expected] of Object.entries(totals)) {
+      if (plan.skillResourceClosure[field] !== expected) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `skill resource closure ${field} does not match unit receipts`,
+          { expected, observed: plan.skillResourceClosure[field] },
+        );
+      }
+    }
+  }
 }
 
 /**