release-skill 0.3.0 → 0.4.1

package/adapters/workbuddy/schemas/release-plan.schema.json

@@ -988,6 +988,13 @@
       "type": "string",
       "description": "Overall snapshot digest across all units"
     },
+    "humanConsumersStrategy": {
+      "type": "string",
+      "enum": [
+        "manualFollowUps"
+      ],
+      "description": "Human consumer strategy marker. 'manualFollowUps': Kimi/CodeBuddy installations are non-blocking post-release manual tasks; verify returns VERIFIED with manualFollowUps list and does not block on attestation. Absent: legacy attestation closed loop (backward compatibility)."
+    },
     "digest": {
       "type": "string",
       "minLength": 1

package/adapters/workbuddy/schemas/release-run.schema.json

@@ -432,6 +432,49 @@
         }
       }
     },
+    "manualFollowUps": {
+      "type": "array",
+      "description": "Non-blocking manual follow-up tasks for human consumer platforms (Kimi/CodeBuddy) when plan declares humanConsumersStrategy: 'manualFollowUps'",
+      "items": {
+        "type": "object",
+        "required": [
+          "actionId",
+          "platform",
+          "plugin",
+          "verifiedBySystem"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "actionId": {
+            "type": "string",
+            "minLength": 1
+          },
+          "platform": {
+            "type": "string",
+            "enum": [
+              "kimi",
+              "codebuddy"
+            ]
+          },
+          "plugin": {
+            "type": "string"
+          },
+          "version": {
+            "type": "string"
+          },
+          "unitId": {
+            "type": "string"
+          },
+          "verifiedBySystem": {
+            "const": false,
+            "description": "Always false — these tasks are not verified by the system"
+          },
+          "reason": {
+            "type": "string"
+          }
+        }
+      }
+    },
     "skillResourceClosureReceipts": {
       "type": "array",
       "description": "Per-surface skill resource closure verification receipts from verify phase",

package/adapters/workbuddy/skills/release-help/SKILL.md

@@ -35,12 +35,12 @@ description: "Discoverable entry point for release-skill: dependency and environ
 node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" help --json
 node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" setup --root <path> --json
 node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" assess --root <path> --offline --json
-# 日常发布快速路径：最多两个授权摘要，状态文件可恢复
+# 日常发布快速路径：仅在发布前确认一次可读计划摘要，状态文件可恢复
 node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" ship --root <path> --target-version <version> --json
 # 开发阶段执行声明 hooks 并生成 prepare 可复用的内容绑定收据
-node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" hooks validate --root <path> \
-  --acknowledge-hook-side-effects --json
-# Kimi/CodeBuddy 安装完成后记录人工事实，不手改 JSON
+# 命令调用本身即授权执行配置中的 hooks
+node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" hooks validate --root <path> --json
+# 仅旧冻结计划兼容：记录历史 Kimi/CodeBuddy 人工证明
 node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" attest --root <path> \
   --platform <kimi|codebuddy> --plugin <id> --result <passed|failed> --actor <person> --json
 # 发布文档刷新：默认只读演练
@@ -59,7 +59,7 @@ node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" docs refresh --unit <id> \
 - **只读演练**：`docs refresh --unit <id> --json` 输出逐文件相对路径、locale、新旧摘要、`version`、`locales`、`inputDigest`、`refreshDigest` 和 `nextCommand.argv`；候选无变化时 `status: "clean"`。
 - **确认写入**：必须同时提供 `--write`、精确 `--confirm-refresh <refreshDigest>` 和 `--ack-local-document-write`，全部目标作为一个事务提交；成功后立即复演必须为 `clean`。
 
-**授权边界**：本地发布文档写入授权只覆盖声明的本地文档目标，不是 hook、Git 提交、push、publish 或安装的授权。写入后必须审阅、提交，再重新 prepare。
+**授权边界**：本地发布文档写入授权只覆盖声明的本地文档目标，不是 Git 提交、push、publish 或安装的授权。hook/gate 由对应命令调用直接授权。写入后必须审阅、提交，再重新 prepare。
 
 ## 故障路由
 

package/adapters/workbuddy/skills/release-prepare/SKILL.md

@@ -13,9 +13,7 @@ description: Freeze an immutable release plan with local configuration, document
 
 运行项目构建/测试 hook，生成公开快照并扫描泄漏，冻结不可变发布计划。prepare 自身不调用发布 adapter，但会执行用户配置的 hook。hook 是任意本地进程，不受文件系统/网络隔离，可能产生项目目录外的副作用或远端写入。
 
-**Hook 授权门**: 当项目配置含任何 hook 时，prepare 默认失败关闭并展示将执行的 executable/args/cwd。只有显式传入 `--acknowledge-hook-side-effects`（CLI）或 `hooksAuthorized: true`（API）才能执行。授权表示用户接受 hook 风险，不表示 hook 安全。
-
-**Gate 授权门**: 当项目含 `snapshot-verify` gate 时，prepare 同样默认失败关闭。逐项审阅后才可传入 `--acknowledge-gate-side-effects`（CLI）或 `verificationGatesAuthorized: true`（API）；gate 也没有操作系统或网络沙箱。
+**Hook 与 Gate 执行**: 命令调用本身即授权执行已配置的 hook 和 gate，不再设置额外人工授权环节。
 
 **阶段通过规则**: 本阶段的通过只能由 CLI exit code 0 和结构化状态码 `PREPARED` 确认。Agent 无权自行宣布计划冻结成功。
 
@@ -30,9 +28,8 @@ description: Freeze an immutable release plan with local configuration, document
 1. 使用插件根相对路径运行 CLI：`CLI="node ${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs"`
 2. 配置含 `releaseDocuments` 时，先运行只读演练 `${CLI} docs refresh --unit <id> --json`；`status: "changes"` 时展示逐文件路径/语种/版本/`refreshDigest`，取得"本地发布文档写入"明确授权后才执行 `nextCommand.argv` 写入，审阅并提交刷新结果后再继续；`status: "clean"` 时直接进入 prepare
 3. 运行 `${CLI} prepare --root <path> --offline --json`
-4. 若遇到 hook/gate 授权门失败，分别展示命令和风险，获取授权后只增加实际需要的 `--acknowledge-hook-side-effects` / `--acknowledge-gate-side-effects`
-5. 检查 exit code 0，读取 JSON 返回的 immutable `planPath=plans/<planDigest>.json`，再从该文件读取 `status`、`units`、`externalActions`
-6. 向用户展示 targetVersion、externalActions、planDigest 和 planPath；后续 approve/publish 只能使用该 immutable planPath，等待确认后再 approve
+4. 检查 exit code 0，读取 JSON 返回的 immutable `planPath=plans/<planDigest>.json`，再从该文件读取 `status`、`units`、`externalActions`
+5. 向用户展示可读的 `approvalSummary`（版本、仓库/包、branch/tag、外部动作和例外）；`planDigest` 仅作为内部绑定字段，不要求用户复制或确认。后续 approve/publish 只能使用该 immutable planPath，等待确认后再 approve
 
 若用户明确要求 GitHub+npm 生产发布，加入 `--production`。该模式还会封存独立
 Git commit/tree 和 npm tarball，并把路径、SHA/integrity、branch/tag 写入计划。
@@ -63,24 +60,18 @@ node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" docs refresh --unit <id> \
 node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" prepare --root <path> --offline --json
 # 生产 happy end：bound 基线必须 online；远端目标唯一性仍由 publish 全局预检
 node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" prepare --root <path> --online --production --json
-# 项目含 hook 时需显式授权:
-node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" prepare --root <path> --offline --acknowledge-hook-side-effects --json
-# 项目含 snapshot gate 时另行显式授权:
-node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" prepare --root <path> --offline --acknowledge-gate-side-effects --json
 ```
 
 ## 执行顺序
 
 1. 校验配置 schema → 2. 版本解析与发布文档新鲜度门（只读，RELEASE_DOCS_STALE）→
-3. Hook 授权门 → 4. 运行 hooks 并复检文档新鲜度 → 5. 捕获 Git baseline →
-6. 逐 unit 观察前序公开基线 → 7. 生成快照/扫描/README → 8. 原子写入 plan
+3. 运行 hooks 并复检文档新鲜度 → 4. 捕获 Git baseline →
+5. 逐 unit 观察前序公开基线 → 6. 生成快照/扫描/README → 7. 原子写入 plan
 
 ## 故障路由
 
 | 错误码 | 处理 |
 |---|---|
-| GATE_FAILED (hook 授权) | 向用户展示 hook 命令和风险，获得授权后加 `--acknowledge-hook-side-effects` 重试 |
-| GATE_FAILED (gate 授权) | 向用户展示 snapshot gate 命令和风险，获得授权后加 `--acknowledge-gate-side-effects` 重试 |
 | GATE_FAILED (bound + offline) | 改用 `--online --production`，不得把 unobserved-offline plan 交给 publish |
 | GATE_FAILED (前序基线漂移) | 先取得并比较实际远端内容；人工选择 merge/adopt/reject。merge/adopt 都必须把接受内容落回 human-owned 权威源，并把 `previousPublicBaseline` 更新为接受状态的精确 repo/ref/commit 后重新 online production prepare；reject 停止调查，禁止改 `mode: none` 绕过 |
 | GATE_FAILED (`npm-entry-closure`) | 修复打包内容或入口声明后重新 prepare；不得用 `requiredPublicFiles`/`smokeBin` 缺省绕过 |
@@ -94,4 +85,4 @@ node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" prepare --root <path> --of
 
 ## 后续引导
 
-计划冻结后，读取命令返回的 immutable `planPath` 展示给用户，等待确认后再 approve。`release-plan.json` 等 latest alias 只用于浏览，不得作为生产 authority 传递。
+计划冻结后，读取命令返回的 immutable `planPath` 和 `approvalSummary` 展示给用户，等待确认后再 approve。`planDigest` 由系统自动计算和绑定，不作为人工交互口令。`release-plan.json` 等 latest alias 只用于浏览，不得作为生产 authority 传递。

package/adapters/workbuddy/skills/release-publish/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: release-publish
-description: 从已批准且摘要确认的生产计划发布冻结 Git branch/tag、npm tarball 与 GitHub Release，并执行已配置的 Claude/Codex marketplace 隔离消费者安装检查以达到 PUBLISHED；随后必须路由 release-verify 才可能达到 VERIFIED；遇到冲突或不确定远端状态时失败关闭并要求人工介入
+description: 从已批准的生产计划发布冻结 Git branch/tag、npm tarball 与 GitHub Release，并执行已配置的 Claude/Codex marketplace 隔离消费者安装检查以达到 PUBLISHED；随后必须路由 release-verify 才可能达到 VERIFIED；遇到冲突或不确定远端状态时失败关闭并要求人工介入
 ---
 
 # release-publish
@@ -25,16 +25,15 @@ description: 从已批准且摘要确认的生产计划发布冻结 Git branch/t
 
 ## 授权门
 
-1. 展示 `planDigest`、版本、仓库/包名、branch/tag 和全部 actions。
-2. 必须存在未过期且绑定同一 digest 的 approval record。
-3. 用户必须明确提供 `--confirm-production <planDigest>`；Agent 不得代替用户猜测确认值。
-4. 只有 CLI exit code 0 且结构化状态为 `PUBLISHED` 才算外写阶段通过；随后必须运行 verify，只有 `VERIFIED` 才是完整终态。
+1. 展示可读的 `approvalSummary`：版本、仓库/包名、branch/tag、全部 actions 和例外。
+2. 必须存在未过期且由系统绑定同一内部 digest 的 approval record；批准后不再要求用户复制摘要做二次确认。
+3. 只有 CLI exit code 0 且结构化状态为 `PUBLISHED` 才算外写阶段通过；随后必须运行 verify，只有 `VERIFIED` 才是完整终态。
 
 ## 确定性执行
 
 ```bash
 node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" publish --root <path> --plan <plan-path> \
-  --approval <approval-path> --confirm-production <planDigest> --json
+  --approval <approval-path> --json
 ```
 
 执行顺序：全局只读预检 → 配置的公开分支（按三种 `branchStrategy` 执行）→ 必要时

package/adapters/workbuddy/skills/release-reconcile/SKILL.md

@@ -32,7 +32,7 @@ marketplace 隔离消费者 checkpoint，但只恢复到 `PUBLISHED`；最终 np
 1. 使用插件根相对路径运行 CLI，确认有 `--run` 路径（必需），且源 run 状态为 `PARTIAL`
 2. 运行 `node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" reconcile --root <path> --plan <plan-path> --run <run-path> --json`
 3. 检查 exit code 和结构化状态：`PUBLISHED`（恢复完成，待 verify）/ `PARTIAL`（需重试）/ `BLOCKED`（需人工决策）
-4. 若 PARTIAL 且需重试，加 `--approval`；生产计划还必须加 `--confirm-production <planDigest>`
+4. 若 PARTIAL 且需重试，加 `--approval`；批准记录由系统核验与冻结计划的内部摘要绑定，不再要求二次摘要确认
 
 ## 确定性脚本调用
 
@@ -42,7 +42,7 @@ node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" reconcile --root <path> --
 # verify
 node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" verify --root <path> --plan <plan-path> --run <reconcile-run-path> --json
 # 重试（需 --approval）
-node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" reconcile --root <path> --plan <plan-path> --run <run-path> --approval <approval-path> --confirm-production <planDigest> --json
+node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" reconcile --root <path> --plan <plan-path> --run <run-path> --approval <approval-path> --json
 ```
 
 ## 幂等跳过逻辑

package/adapters/workbuddy/skills/release-setup/SKILL.md

@@ -91,6 +91,12 @@ node -e 'const fs=require("node:fs");const [c,p,a]=process.argv.slice(1).map(x=>
 node -e 'require("node:fs").rmSync(process.argv[1],{recursive:true,force:false})' "$SETUP_SESSION"
 ```
 
+## publisher 字段与个人片段泄漏策略
+
+setup 生成的 `.release-skill/project.yaml` 中 `publisher` 是**已批准的公开发布身份**：它是人工确认的对外发布署名，属于公开面的一部分，而非需要隐藏的私有信息。
+
+若目标仓库用“个人片段”类泄漏策略扫描仓树，而该策略按片段匹配恰好覆盖到 `publisher` 字段，正确做法不是删除或改写策略，而是由贡献者在**本地、gitignore 的个人片段 overlay** 中为该规则声明位置豁免（如 `approvedPlacements`：限定 `publisher` 所在的确切文件路径与行键前缀）。豁免只放行已批准的放置位置，其余出现照常命中；overlay 不入库，个人片段本身不进 committed 策略。
+
 ## 故障路由
 
 - `NEEDS_INPUT`：审阅紧凑摘要；有冲突先修正权威事实并重跑。

package/adapters/workbuddy/skills/release-verify/SKILL.md

@@ -17,7 +17,7 @@ verify 只接受 `PUBLISHED` 状态的源 run；`VERIFIED` 是终态，不会再
 
 ## 职责与边界
 
-验证远端所有 action 的实际状态与冻结计划一致。执行精确 `<package>@<version>` npm 安装到隔离目录，验证包名、版本、静态入口闭包，并在配置时验证 bin 路径安全和 CLI 烟雾输出。对每个声明的 marketplace distribution 执行全新隔离消费者安装验证。
+验证远端所有自动化 action 的实际状态与冻结计划一致。执行精确 `<package>@<version>` npm 安装到隔离目录，验证包名、版本、静态入口闭包，并在配置时验证 bin 路径安全和 CLI 烟雾输出。对 Claude/Codex marketplace distribution 执行全新隔离消费者安装验证。新计划中的 Kimi/CodeBuddy 安装只返回 `manualFollowUps`，明确标记 `verifiedBySystem: false`，不阻塞 `VERIFIED`；缺少该策略字段的旧冻结计划继续走历史 attestation 兼容路径。
 
 **阶段通过规则**: 只有 CLI exit code 0 和结构化状态码 `VERIFIED` 才是完整终态。
 
@@ -28,7 +28,7 @@ verify 只接受 `PUBLISHED` 状态的源 run；`VERIFIED` 是终态，不会再
 ## 正向执行路径
 
 1. 确认有 `--run` 路径（必需），且源 run 状态为 PUBLISHED
-2. 使用插件根相对路径运行 CLI；若存在 consumer gate 或 npm `smokeBin`，先逐项审阅并增加 `--acknowledge-gate-side-effects`
+2. 使用插件根相对路径运行 CLI；命令调用本身即授权执行已配置的 verification gate 和 smoke process
 3. 检查 exit code 和结构化状态：`VERIFIED`（全部通过）/ 失败（具体错误）
 4. 只有 `VERIFIED` 才是 happy end
 
@@ -37,8 +37,6 @@ verify 只接受 `PUBLISHED` 状态的源 run；`VERIFIED` 是终态，不会再
 ```bash
 # 从插件根运行
 node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" verify --root <path> --plan <plan-path> --run <run-path> --json
-# 计划含 consumer gate 或 smokeBin 时：
-node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" verify --root <path> --plan <plan-path> --run <run-path> --acknowledge-gate-side-effects --json
 ```
 
 ## 验证步骤
@@ -47,7 +45,7 @@ node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" verify --root <path> --pla
 2. 加载源 run，验证 planDigest 匹配和 checkpoint 完整性
 3. 对每个 plan action 执行 adapter.verify()（远端状态重检）
 4. 对每个 npm distribution 执行隔离安装烟雾测试
-5. 对每个 marketplace distribution 执行全新隔离消费者安装验证
+5. 对 Claude/Codex marketplace distribution 执行全新隔离消费者安装验证；收集 Kimi/CodeBuddy 的非阻塞 `manualFollowUps`
 6. 全部通过 → `VERIFIED`
 
 ## 烟雾测试
@@ -69,4 +67,4 @@ node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" verify --root <path> --pla
 | 远端状态不匹配 | POST_PUBLISH_VERIFY_FAILED | 停止 |
 | npm 安装失败 | POST_PUBLISH_VERIFY_FAILED | 停止 |
 | CLI 烟雾输出不匹配 | POST_PUBLISH_VERIFY_FAILED | 停止 |
-| consumer gate / smokeBin 未授权 | GATE_FAILED | 展示命令和副作用，人工确认后加 `--acknowledge-gate-side-effects` |
+| consumer gate / smokeBin 执行失败 | GATE_FAILED | 检查失败原因，修复后重试 |

package/bin/release-skill-cli.mjs

@@ -149,14 +149,14 @@ async function performEnvironmentChecks() {
   checks.kimi = {
     ...kimiCheck,
     required: false,
-    usage: '仅当计划声明 kimi-plugin distribution 时用于消费者安装验证',
+    usage: '仅供发布后的人工安装使用；release-skill 不核验 Kimi 安装',
   };
 
   const codebuddyCheck = await checkCodeBuddyDependency();
   checks.codebuddy = {
     ...codebuddyCheck,
     required: false,
-    usage: '仅当计划声明 codebuddy-plugin distribution 时用于消费者安装验证（人工 attestation 闭环；CLI 无法钉死冻结 ref，安装由人工完成并出具 attestation）',
+    usage: '仅供发布后的人工安装使用；release-skill 不核验 CodeBuddy/WorkBuddy 安装',
   };
 
   return checks;
@@ -182,7 +182,7 @@ function getCapabilityMaturity() {
     prepare: {
       available: true,
       mode: 'offline local writes',
-      description: 'Freeze a release plan with snapshots and gates',
+      description: 'Freeze a release plan with snapshots and gates; the command invocation authorizes hook and gate execution',
     },
     docs: {
       available: true,
@@ -192,7 +192,7 @@ function getCapabilityMaturity() {
     publish: {
       available: true,
       mode: 'controlled production (protocol-tested; no OS/network sandbox)',
-      description: 'Publishes frozen GitHub/npm artifacts and runs configured Claude/Codex/Kimi/CodeBuddy consumer checkpoints (CodeBuddy via human attestation closed loop) with approval and exact digest confirmation',
+      description: 'Publishes frozen GitHub/npm artifacts after one readable-plan approval, runs automated Claude/Codex checkpoints, and emits non-blocking Kimi/CodeBuddy manual follow-ups',
     },
     reconcile: {
       available: true,
@@ -202,7 +202,7 @@ function getCapabilityMaturity() {
     verify: {
       available: true,
       mode: 'fresh consumer verification (protocol-tested; no OS/network sandbox)',
-      description: 'Recheck remote state, exact npm installation, CLI help, and configured Claude/Codex/Kimi/CodeBuddy installs (CodeBuddy via human attestation) before VERIFIED',
+      description: 'Recheck remote state, exact npm installation, CLI help, and automated Claude/Codex installs before VERIFIED; Kimi/CodeBuddy remain unverified manual follow-ups',
     },
   };
 }
@@ -219,11 +219,11 @@ Commands:
   assess     Read-only assessment of project release readiness
   prepare    Freeze a release plan (release-skill output to .release-skill/; hooks may do remote ops)
   approve    Record local approval for a frozen release plan
-  publish    Publish frozen GitHub/npm artifacts after approval and digest confirmation
+  publish    Publish frozen GitHub/npm artifacts after approval
   reconcile  Resume PARTIAL state from evidence; conflicts require a human
   verify     Fresh remote and consumer verification; only this reaches VERIFIED
   ship       Resume one durable prepare -> approve -> publish -> verify flow
-  attest     Record a generated Kimi/CodeBuddy manual result without editing JSON
+  attest     Legacy only: record a Kimi/CodeBuddy result for an old frozen plan
   hooks      Run declared development hooks and populate reusable receipts
   artifacts  Artifact status, inspect, update/apply, resolution, and diagnostics
   docs       Refresh declared release documents (read-only dry-run by default)
@@ -234,7 +234,6 @@ Options:
   --run <path>     Path to the release run file (required for reconcile/verify)
   --approval <path> Path to the approval record
   --production     Prepare immutable Git/npm production artifacts
-  --confirm-production <digest> Confirm the exact production plan digest
   --output <path>  Override prepare/approve output path (non-production only)
   --run-dir <path> Override prepare run directory; production requires one direct child of .release-skill/runs
   --answers <path> Human-reviewed setup answers JSON
@@ -243,16 +242,13 @@ Options:
   --unit <id>      Release unit whose declared release documents are refreshed (docs refresh)
   --confirm-refresh <sha256:...> Confirm the exact dry-run refreshDigest before any document write
   --ack-local-document-write Acknowledge the explicit local release-document write (docs refresh --write)
-  --acknowledge-hook-side-effects Acknowledge unsandboxed legacy hook execution
-  --acknowledge-gate-side-effects Acknowledge unsandboxed local verification gate execution
-  --platform <id>   Manual attestation platform: kimi or codebuddy
+  --platform <id>   Legacy attestation platform: kimi or codebuddy
   --plugin <id>     Plugin id for a generated manual requirement
   --actor <name>    Person confirming an approval or manual result
   --result <value>  Manual result: passed or failed
   --install-path <path> Actual managed plugin path when closure verification requires it
   --install-channel <desktop|cli> CodeBuddy installation channel when required
-  --authorize-hooks <digest> Authorize the exact ship hook/config digest
-  --approve-plan <digest> Approve the exact ship plan and its verification gates
+  --approve         Approve the ship plan (boolean; plan digest is auto-resolved)
   --state <path>    Override the durable ship state file
   --no-hook-cache  Force every prepare hook to run in full; neither read nor write the hook cache
   --json           Output results as JSON
@@ -261,14 +257,16 @@ Options:
 
 Safety:
   Safe default: help -> setup (when config is absent) -> assess -> prepare --offline -> human review.
-  Production happy end: prepare --production -> approve -> publish -> verify.
+  Production happy end: ship --target-version <ver> -> ship --approve --actor <name>.
+  The ship command runs configured hooks and gates automatically; the only human gate is plan approval.
+  Kimi/CodeBuddy installations are non-blocking manual follow-up tasks (not verified by system).
   prepare copies current public files into a local snapshot; it does not rewrite source files.
   - Default mode is offline (release-skill pipeline does no remote writes)
   - prepare output goes to .release-skill/ directory only
   - User-configured hooks may write anywhere and perform remote operations
   - To ensure zero remote writes, disable hooks or audit them separately
   - docs refresh --write rewrites only declared README managed regions and the current CHANGELOG entry after exact refreshDigest confirmation; it never commits, pushes, tags, publishes, or installs.
-  - publish requires explicit approval and an exact plan-digest confirmation
+  - publish requires explicit approval; plan digest is auto-read from the plan file
   - publish consumes frozen Git/npm artifacts, never the live workspace
   - existing remote objects and uncertain checks stop for human intervention
   - production-equivalent protocol sandbox is verified; a real remote canary is not
@@ -355,8 +353,8 @@ if (!command || command === 'help') {
           conditionalConsumers: {
             claude: '声明 claude-plugin distribution 时必须可用',
             codex: '声明 codex-plugin distribution 时必须可用',
-            kimi: '声明 kimi-plugin distribution 时必须可用',
-            codebuddy: '声明 codebuddy-plugin distribution 时用于人工 attestation 闭环（CLI 无法钉死冻结 ref，安装由人工完成并出具 attestation）',
+            kimi: '发布后人工安装待办；不影响生产发布就绪度，系统不核验',
+            codebuddy: '发布后人工安装待办；不影响生产发布就绪度，系统不核验',
           },
         },
       },
@@ -365,12 +363,12 @@ if (!command || command === 'help') {
       maturity: {
         setup: 'read-only by default; create-once requires answers plus exact setupDigest confirmation',
         assess: 'read-only (default); --output writes local report',
-        prepare: 'offline local writes; configured hooks/gates require their explicit side-effect acknowledgements',
+        prepare: 'offline local writes; the command invocation authorizes configured hook and gate execution',
         docs: 'read-only dry-run by default; write requires --write, exact --confirm-refresh, and --ack-local-document-write; never commits, pushes, or publishes',
         onlinePrepare: 'previous-public-baseline observation available; production mode freezes publish artifacts and fails closed on drift or unknown state',
-        publish: 'GitHub/npm plus configured Claude/Codex/Kimi/CodeBuddy consumer checkpoints are protocol-tested without an OS/network sandbox (CodeBuddy via human attestation closed loop); approval and exact digest confirmation required',
+        publish: 'GitHub/npm plus automated Claude/Codex consumer checkpoints are protocol-tested without an OS/network sandbox; one approval is required and the internal plan digest is checked automatically',
         reconcile: 'PARTIAL recovery is protocol-tested without an OS/network sandbox; remote conflicts require human intervention',
-        verify: 'fresh exact npm and Claude/Codex/Kimi/CodeBuddy consumer installation checks are protocol-tested without an OS/network sandbox (CodeBuddy via human attestation); configured consumer processes require explicit acknowledgement; success reaches VERIFIED',
+        verify: 'fresh exact npm and Claude/Codex consumer installation checks are protocol-tested without an OS/network sandbox; Kimi/CodeBuddy are unverified manual follow-ups; command invocation authorizes configured gates',
       },
       recommendations: [],
     };
@@ -406,13 +404,8 @@ if (!command || command === 'help') {
       output.recommendations.push('Install Codex CLI before releasing a configured codex-plugin distribution');
     }
 
-    if (!checks.kimi.available) {
-      output.recommendations.push('Install Kimi Code CLI before releasing a configured kimi-plugin distribution');
-    }
-
-    if (!checks.codebuddy.available) {
-      output.recommendations.push('Install WorkBuddy (bundled codebuddy CLI) before releasing a configured codebuddy-plugin distribution; the install is a manual attestation closed loop because the CLI cannot pin a frozen ref');
-    }
+    // Kimi/CodeBuddy are post-release manual follow-ups. Their local CLI
+    // availability is informational and never blocks release readiness.
 
     console.log(JSON.stringify(output, null, 2));
     process.exit(readiness.status === 'READY' ? 0 : 1);
@@ -527,6 +520,7 @@ if (command === 'hooks') {
     const { validateDeclaredHooks } = await import('../src/commands/hooks.mjs');
     const result = await validateDeclaredHooks({
       root,
+      // --acknowledge-hook-side-effects is accepted as a no-effect compatibility input
       hooksAuthorized: args.includes('--acknowledge-hook-side-effects'),
       hookCache: !args.includes('--no-hook-cache'),
     });
@@ -582,7 +576,7 @@ if (command === 'ship') {
       root,
       statePath: value('--state'),
       targetVersion: value('--target-version') ?? value('--version'),
-      hookAuthorizationDigest: value('--authorize-hooks'),
+      approve: args.includes('--approve'),
       planApprovalDigest: value('--approve-plan'),
       actor: value('--actor'),
       adapterRegistry,
@@ -592,11 +586,11 @@ if (command === 'ship') {
     } else {
       console.log(`Ship status: ${result.status}`);
       console.log(`State: ${result.statePath}`);
-      if (result.hookAuthorizationDigest && result.status === 'NEEDS_HOOK_AUTHORIZATION') {
-        console.log(`Authorize hooks: --authorize-hooks ${result.hookAuthorizationDigest}`);
-      }
       if (result.planDigest && result.status === 'NEEDS_PLAN_APPROVAL') {
-        console.log(`Approve plan and verification gates: --approve-plan ${result.planDigest} --actor <person>`);
+        console.log(`Approve plan: ship --approve --actor <person>`);
+      }
+      for (const followUp of result.manualFollowUps ?? []) {
+        console.log(`Manual follow-up [${followUp.platform}] ${followUp.plugin}: not verified by system`);
       }
       for (const requirement of result.requirements ?? []) {
         console.log(`Manual requirement [${requirement.platform}]: ${requirement.requirementPath}`);
@@ -763,8 +757,8 @@ if (command === 'approve') {
   const outputIdx = args.indexOf('--output');
   const outputPath = outputIdx !== -1 && args[outputIdx + 1] ? resolve(args[outputIdx + 1]) : undefined;
 
-  if (!planPath || !expectedDigest || !actor) {
-    const msg = 'approve requires --plan <path>, --digest <sha256>, and --actor <name>';
+  if (!planPath || !actor) {
+    const msg = 'approve requires --plan <path> and --actor <name>';
     if (hasJson) {
       console.log(JSON.stringify({ error: 'MISSING_PARAMETERS', message: msg, exitCode: 1 }));
     } else {
@@ -775,13 +769,24 @@ if (command === 'approve') {
 
   try {
     const { approvePlan } = await import('../src/commands/approve.mjs');
+    const { computePlanDigest } = await import('../src/core/plan.mjs');
+    const { readFile: readFileFs } = await import('node:fs/promises');
+
+    // Auto-read digest from plan when --digest is omitted
+    let resolvedDigest = expectedDigest;
+    if (!resolvedDigest) {
+      const planRaw = await readFileFs(resolve(planPath), 'utf8');
+      const planObj = JSON.parse(planRaw);
+      resolvedDigest = computePlanDigest(planObj);
+    }
+
     const resolvedPlanPath = resolve(planPath);
     const planDir = dirname(resolvedPlanPath);
-    const releaseDir = basename(planDir) === 'plans' && basename(resolvedPlanPath) === `${expectedDigest}.json`
+    const releaseDir = basename(planDir) === 'plans' && basename(resolvedPlanPath) === `${resolvedDigest}.json`
       ? dirname(planDir)
       : planDir;
     const approvalPath = outputPath ?? join(releaseDir, 'approval-record.json');
-    const record = await approvePlan({ planPath, expectedDigest, actor, outputPath: approvalPath });
+    const record = await approvePlan({ planPath, expectedDigest: resolvedDigest, actor, outputPath: approvalPath });
 
     if (hasJson) {
       console.log(JSON.stringify(record, null, 2));
@@ -819,10 +824,6 @@ if (command === 'reconcile') {
   const runPath = runIdx !== -1 && args[runIdx + 1] ? resolve(args[runIdx + 1]) : undefined;
   const approvalIdx = args.indexOf('--approval');
   const approvalPath = approvalIdx !== -1 && args[approvalIdx + 1] ? resolve(args[approvalIdx + 1]) : undefined;
-  const confirmationIdx = args.indexOf('--confirm-production');
-  const productionConfirmation = confirmationIdx !== -1 && args[confirmationIdx + 1]
-    ? args[confirmationIdx + 1]
-    : undefined;
 
   if (!planPath || !runPath) {
     const msg = 'reconcile requires --plan <path> and --run <path>';
@@ -841,6 +842,7 @@ if (command === 'reconcile') {
     const { createPluginMarketplaceAdapter } = await import('../src/adapters/plugin-marketplace.mjs');
     const { createPushSnapshotAdapter } = await import('../src/adapters/push-snapshot.mjs');
     const { createAdapterRegistry } = await import('../src/adapters/contract.mjs');
+
     const registry = createAdapterRegistry([
       createGitGithubAdapter(),
       createNpmAdapter(),
@@ -854,7 +856,6 @@ if (command === 'reconcile') {
       approvalPath,
       adapterRegistry: registry,
       root,
-      productionConfirmation,
     });
 
     if (hasJson) {
@@ -960,13 +961,9 @@ if (command === 'publish') {
   const planPath = planIdx !== -1 && args[planIdx + 1] ? resolve(args[planIdx + 1]) : undefined;
   const approvalIdx = args.indexOf('--approval');
   const approvalPath = approvalIdx !== -1 && args[approvalIdx + 1] ? resolve(args[approvalIdx + 1]) : undefined;
-  const confirmationIdx = args.indexOf('--confirm-production');
-  const productionConfirmation = confirmationIdx !== -1 && args[confirmationIdx + 1]
-    ? args[confirmationIdx + 1]
-    : undefined;
 
-  if (!planPath || !approvalPath || !productionConfirmation) {
-    const msg = 'publish requires --plan <path>, --approval <path>, and --confirm-production <plan-digest>';
+  if (!planPath || !approvalPath) {
+    const msg = 'publish requires --plan <path> and --approval <path>';
     if (hasJson) {
       console.log(JSON.stringify({ error: 'MISSING_PARAMETERS', message: msg, exitCode: 1 }));
     } else {
@@ -982,6 +979,7 @@ if (command === 'publish') {
     const { createPluginMarketplaceAdapter } = await import('../src/adapters/plugin-marketplace.mjs');
     const { createPushSnapshotAdapter } = await import('../src/adapters/push-snapshot.mjs');
     const { createAdapterRegistry } = await import('../src/adapters/contract.mjs');
+
     const registry = createAdapterRegistry([
       createGitGithubAdapter(),
       createNpmAdapter(),
@@ -995,7 +993,6 @@ if (command === 'publish') {
       adapterRegistry: registry,
       root,
       productionMode: true,
-      productionConfirmation,
     });
 
     if (hasJson) {