release-skill 0.2.8 → 0.3.0

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.2.8",
+      "version": "0.3.0",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.2.8.",
+      "Prepare a release plan for version 0.3.0.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.3.0 locale=en baseline=sha256:e3dacdaf9c7f780ccbd530d85cd16994b1a33747146475ac77f21e6f09be1493 -->
+## [0.3.0] - 2026-07-31
+
+v0.3.0 streamlines production releases into a resumable orchestration with reusable hook receipts, consolidated approvals, and stronger consumer-install evidence.
+
+### Added
+
+- **Resumable ship orchestration**: the new `ship` command persists the active release state and resumes prepare, approval, publish, reconcile, and verification without rebuilding authority from conversational context.
+- **Reusable hook receipts**: `hooks validate` executes declared hooks through the same content-bound cache used by prepare, so unchanged checks do not need to run again.
+- **Verified manual attestations**: `attest` validates a reported Kimi or CodeBuddy installation against the exact frozen plugin payload before recording consumer evidence.
+- **Git transport preflight**: production publishing selects one repository-consistent HTTPS or SSH transport before any remote write and blocks conflicting remote identities.
+
+### Changed
+
+- **Consolidated human decisions**: the normal path requires at most one hook-side-effect authorization and one immutable-plan approval; manual consumer requirements are collected before automatic verification.
+- **Parallel consumer verification**: independent consumer checks run concurrently, drain before failure reporting, and produce deterministically ordered evidence.
+- **Automatic release metadata**: successful verification advances each unit's `previousPublicBaseline` to the frozen public commit, tree, and manifest digest.
+- **Compact prepare output**: JSON output references the immutable plan by path and digest instead of embedding the full plan.
+<!-- release-skill:changelog:end version=0.3.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.2.9 locale=en baseline=sha256:22b3d94c5d99fca0e6016334a108e4be5f3419f45507fae795b4d0714ca7ad6d -->
+## [0.2.9] - 2026-07-31
+
+v0.2.9 makes missing expected public-surface configuration visible during assessment and preparation without blocking existing projects.
+
+### Added
+
+- **Adoption warning**: assess reports `PUBLIC_SURFACE_CONFIG_MISSING` for every release unit that has not configured `expectedPublicSurface`.
+
+### Changed
+
+- **Prepare visibility**: prepare records and returns the same non-blocking warning, and the CLI exposes it in both JSON and human-readable output.
+<!-- release-skill:changelog:end version=0.2.9 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.2.8 locale=en baseline=sha256:ad6e8910f1af206463b5decf134b82590787b77f5a88faca3d8985d3686b111b -->
 ## [0.2.8] - 2026-07-30
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.2.8 -->
+<!-- release-skill:release-version: 0.3.0 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -128,7 +128,7 @@ as a version-pinned **manual** install plus trusted observation/attestation:
    frozen version; otherwise do NOT issue an attestation.
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.2.8
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.3.0
    /plugins reload
    ```
 
@@ -140,7 +140,7 @@ as a version-pinned **manual** install plus trusted observation/attestation:
 ```json
 {
   "platform": "kimi",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "planDigest": "<64-hex frozen plan digest>",
   "result": "passed",
   "actor": "<person who confirmed>",
@@ -204,7 +204,7 @@ attestation (the same capability gap and closed loop as Kimi Code):
 ```json
 {
   "platform": "codebuddy",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "planDigest": "<64-hex frozen plan digest>",
   "result": "passed",
   "actor": "<person who confirmed>",

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.2.8 -->
+<!-- release-skill:release-version: 0.3.0 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -112,7 +112,7 @@ release-skill 把 Kimi 安装建模为“版本钉死的手动安装 + 可信观
    必须核实已安装插件清单版本等于冻结版本；否则**不得**出具证明。
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.2.8
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.3.0
    /plugins reload
    ```
 
@@ -124,7 +124,7 @@ release-skill 把 Kimi 安装建模为“版本钉死的手动安装 + 可信观
 ```json
 {
   "platform": "kimi",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "planDigest": "<64 位十六进制冻结计划摘要>",
   "result": "passed",
   "actor": "<确认人>",
@@ -178,7 +178,7 @@ codebuddy CLI 可以添加市场并安装插件，但 **`plugin marketplace add`
 ```json
 {
   "platform": "codebuddy",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "planDigest": "<64 位十六进制冻结计划摘要>",
   "result": "passed",
   "actor": "<确认人>",

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.2.8 -->
+<!-- release-skill:release-version: 0.3.0 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,27 +14,27 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.2.8** (2026-07-30)
+**0.3.0** (2026-07-31)
 
-v0.2.8 adds a project-configurable expected public-surface gate so newly added or omitted release files cannot silently disappear from a frozen snapshot.
+v0.3.0 streamlines production releases into a resumable orchestration with reusable hook receipts, consolidated approvals, and stronger consumer-install evidence.
 
 **Added**
 
-- **Expected public surface**: release units can declare physical scan roots with compact `include` and `exclude` globs instead of maintaining a second per-file checker.
-- **Exhaustive classification diagnostics**: prepare reports missing mappings, unexpected mappings, unclassified files, and files that ambiguously match both include and exclude rules.
+- **Resumable ship orchestration**: the new `ship` command persists the active release state and resumes prepare, approval, publish, reconcile, and verification without rebuilding authority from conversational context.
+- **Reusable hook receipts**: `hooks validate` executes declared hooks through the same content-bound cache used by prepare, so unchanged checks do not need to run again.
+- **Verified manual attestations**: `attest` validates a reported Kimi or CodeBuddy installation against the exact frozen plugin payload before recording consumer evidence.
+- **Git transport preflight**: production publishing selects one repository-consistent HTTPS or SSH transport before any remote write and blocks conflicting remote identities.
 
 **Changed**
 
-- **Post-build release gate**: prepare scans the actual workspace after build hooks and blocks before source-authority closure, baseline capture, snapshot construction, or plan creation.
-- **Bounded glob and path safety**: the built-in scanner supports `*`, `?`, and `**`, rejects overlapping or escaping scan roots, and keeps workspace control paths outside the project classification surface.
-
-**Fixed**
-
-- **Silent release-file omission**: a file classified for publication can no longer be absent from `publicFiles` while the release still reaches `PREPARED`.
+- **Consolidated human decisions**: the normal path requires at most one hook-side-effect authorization and one immutable-plan approval; manual consumer requirements are collected before automatic verification.
+- **Parallel consumer verification**: independent consumer checks run concurrently, drain before failure reporting, and produce deterministically ordered evidence.
+- **Automatic release metadata**: successful verification advances each unit's `previousPublicBaseline` to the frozen public commit, tree, and manifest digest.
+- **Compact prepare output**: JSON output references the immutable plan by path and digest instead of embedding the full plan.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.2.8 is the current release (v0.2.2 previously held
+> **Current boundary:** v0.3.0 is the current release (v0.2.2 previously held
 > published status before the platform verification convergence fix was added).
 > v0.1.1 completed a real production release to GitHub and npm — the first
 > production-verified milestone — followed by
@@ -52,7 +52,7 @@ v0.2.8 adds a project-configurable expected public-surface gate so newly added o
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.2.8 is the current
+> **Production path verified since the v0.1.1 milestone; v0.3.0 is the current
 > release.** The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >
@@ -118,6 +118,31 @@ See [INSTALL.md](INSTALL.md) for CodeBuddy, Codex, and Kimi Code commands.
 
 ### Main workflow
 
+For routine releases, use the durable fast path. It persists authoritative
+paths and resumes safely, so a normal run needs at most two authorization
+digests: one for the exact configured hooks and one for the frozen plan. The
+plan approval also authorizes that plan's post-publish verification gates.
+
+```bash
+release-skill ship --root "$PROJECT" --target-version 1.2.3 --json
+release-skill ship --root "$PROJECT" --authorize-hooks <hookDigest> --actor "$ACTOR" --json
+release-skill ship --root "$PROJECT" --approve-plan <planDigest> --actor "$ACTOR" --json
+```
+
+If interactive consumers are required, `ship` returns every Kimi/CodeBuddy
+requirement at once. After installing/reloading, record the human fact without
+editing JSON and rerun `ship`:
+
+```bash
+release-skill attest --root "$PROJECT" --platform kimi --plugin my-plugin \
+  --result passed --actor "$ACTOR" --install-path /actual/managed/plugin/path
+release-skill ship --root "$PROJECT" --json
+```
+
+During development, `release-skill hooks validate
+--acknowledge-hook-side-effects` runs declared hooks and writes the same
+content-bound cache receipts that `prepare` consumes.
+
 Run these steps in order. Steps 1-4 are safe (read-only or local-only);
 steps 5-9 require explicit human gates.
 

package/README.zh-CN.md

@@ -2,33 +2,33 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.2.8 -->
+<!-- release-skill:release-version: 0.3.0 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.2.8** (2026-07-30)
+**0.3.0** (2026-07-31)
 
-v0.2.8 新增项目可配置的期望发布面门禁，防止新增或漏声明的发布文件静默消失在冻结快照之外。
+v0.3.0 将生产发布收敛为可恢复总编排，通过复用钩子收据、合并人工授权并加强消费者安装证据，缩短发布链路。
 
 **新增**
 
-- **期望发布面**：发布单元可以通过精简的 `include`、`exclude` glob 声明物理扫描根，无需再维护第二份逐文件检查器。
-- **穷举分类诊断**：prepare 会报告缺失映射、多余映射、未分类文件，以及同时命中包含和排除规则的歧义文件。
+- **可恢复的 ship 总编排**：新增 `ship` 命令持久化当前发布状态，可连续恢复 prepare、审批、publish、reconcile 与 verify，不依赖对话上下文重建发布权限。
+- **可复用钩子收据**：`hooks validate` 通过与 prepare 相同的内容绑定缓存执行项目钩子，输入未变化时无需重复运行。
+- **可验证的人工证明**：`attest` 在记录 Kimi 或 CodeBuddy 消费者证据前，会把申报的安装目录与精确冻结插件载荷进行核验。
+- **Git 传输预检**：任何远端写入前，生产发布会在全部仓库间选择一致可用的 HTTPS 或 SSH 传输，并阻断远端身份冲突。
 
 **变更**
 
-- **构建后发布门禁**：prepare 在 build hook 后扫描真实工作区，并在源码权威闭集、基线捕获、快照构建和计划写入前阻断失败。
-- **有界 glob 与路径安全**：内建扫描器支持 `*`、`?`、`**`，拒绝重叠或逃逸的扫描根，并将工作区控制面排除在项目分类范围之外。
-
-**修复**
-
-- **发布文件静默漏项**：已归类为应发布的文件如果缺少 `publicFiles` 映射，发布将无法再进入 `PREPARED`。
+- **合并人工决策**：普通路径最多只需一次钩子副作用授权和一次不可变计划审批；人工消费者要求会在自动验证前集中生成。
+- **并行消费者验证**：相互独立的消费者检查并行执行，全部收敛后再报告失败，并确定性排序证据。
+- **自动推进发布元数据**：验证成功后，各发布单元的 `previousPublicBaseline` 自动更新为冻结的公开 commit、tree 与 manifest digest。
+- **精简 prepare 输出**：JSON 结果改为通过路径和摘要引用不可变计划，不再内嵌完整计划。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.2.8 是当前发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
+> **当前边界：** v0.3.0 是当前发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；"当前发布版本"与"首次生产验证里程碑"
@@ -41,7 +41,7 @@ v0.2.8 新增项目可配置的期望发布面门禁，防止新增或漏声明
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.2.8 是当前发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.3.0 是当前发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
@@ -105,6 +105,29 @@ CodeBuddy、Codex 和 Kimi Code 的完整命令见 [INSTALL.zh-CN.md](INSTALL.zh
 
 ### 主流程
 
+日常发布优先使用可恢复的快速路径。它会持久化所有权威文件路径，正常流程最多
+只需确认两个摘要：一次绑定当前配置与 hooks，一次绑定冻结计划；计划审批同时
+授权该计划的发布后验证门禁。
+
+```bash
+release-skill ship --root "$PROJECT" --target-version 1.2.3 --json
+release-skill ship --root "$PROJECT" --authorize-hooks <hookDigest> --actor "$ACTOR" --json
+release-skill ship --root "$PROJECT" --approve-plan <planDigest> --actor "$ACTOR" --json
+```
+
+如果存在交互式消费者，`ship` 会一次列出全部 Kimi/CodeBuddy 人工事项。安装并
+reload 后，用命令记录人工事实，不再手改 JSON，然后续跑 `ship`：
+
+```bash
+release-skill attest --root "$PROJECT" --platform kimi --plugin my-plugin \
+  --result passed --actor "$ACTOR" --install-path /actual/managed/plugin/path
+release-skill ship --root "$PROJECT" --json
+```
+
+开发阶段可运行 `release-skill hooks validate
+--acknowledge-hook-side-effects`；它会执行声明的 hooks，并写入 `prepare`
+可复用的内容绑定收据。
+
 按以下顺序执行。步骤 1-4 是安全默认（只读或仅本地）；步骤 5-9 需要显式人工门禁。
 
 ```bash

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.2.8",
+      "version": "0.3.0",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification"
     }
   ]

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"