release-skill 0.5.0 → 0.5.1

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.5.0",
+      "version": "0.5.1",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.5.0.",
+      "Prepare a release plan for version 0.5.1.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.5.1 locale=en baseline=sha256:2a8dc4241570c0919e55da270233728963ba1cda347c95c775678ec89a9f0ac0 -->
+## [0.5.1] - 2026-08-17
+
+v0.5.1 fixes three frozen-0.5.0 defects — explicit hook environment delivery (envAllowlist now reaches prepare hooks), a 64 MiB baseline maxBuffer for large tracked indexes, and the prefixed skill-directory fallback for marketplace-install preflight/observe — bumps the Skill Family Foundation dependencies to the released 0.5.0 packages, and hardens the release chain so every later release must bind the previous public release commit instead of degrading to an orphan root commit.
+
+### Changed
+
+- **Foundation 0.5.0 upgrade**: `skill-family-contracts` and `skill-family-harness-node` dependencies bumped from 0.4.0 to 0.5.0 (npm latest); the package-name import bridge keeps working unchanged and the harness-node 0.5.0 export surface was re-verified (`publishFileExclusive`, token-lock five functions, `HARNESS_ERROR_KINDS`).
+- **Chain hardening (chain-integrity)**: `push-snapshot` now requires an explicit `branchStrategy` (the historical `create-release-branch` default that produced orphan root commits is gone); `create-release-branch` is only valid when `previousPublicBaseline.mode=none`; a production online prepare with `mode=none` on a repository that already carries release tags fails closed with `CHAIN_GAP`, demanding a bound baseline at the previous release commit; online `assess` registers a warning-level `VERSION_SEQUENCE_GAP` when the target version jumps the release sequence (e.g. 0.1.1 → 0.1.3 with no v0.1.2 tag), without blocking.
+
+### Fixed
+
+- **Hook environment delivery (hook-env-delivery)**: `runDeclaredHooks` now accepts an explicit `env` option and merges it into the hook context (`hookFn(hook, { root, env })`); prepare and `hooks validate` inject the invoking shell's environment, so `hooks.*.envAllowlist` keys exported by the caller finally reach the hook subprocess. Allowlist semantics are unchanged — the hook runner still reads allowlisted keys exclusively from the explicit map, never from `process.env` directly.
+- **Large-tracked-index baseline (baseline-maxbuffer)**: `computeWorkspaceDigest` now runs its three git subprocesses with a 64 MiB `maxBuffer` (official fix 39c631f); workspaces with thousands of tracked files (measured 8494 tracked files → 1,519,151 B `ls-files -s` stdout) no longer fail with `ERR_CHILD_PROCESS_STDIO_MAXBUFFER`.
+- **Prefixed skill-directory resolution (entry-skill-prefix)**: marketplace-install preflight and observe now fall back from `skills/<entrySkill>/SKILL.md` to `skills/<plugin>-<entrySkill>/SKILL.md` (plugin from the action parameters, D-ACA-30 platform physical names); candidate builds with prefixed skill directories pass preflight and observe instead of failing with `entry skill not found`.
+<!-- release-skill:changelog:end version=0.5.1 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.5.0 locale=en baseline=sha256:e59bef4bd7bc6e0809d1f415d7ff3d342e45a7e77075f66d6ffa48cfd9b71932 -->
 ## [0.5.0] - 2026-08-16
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.5.0 -->
+<!-- release-skill:release-version: 0.5.1 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -114,7 +114,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.5.0
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.5.1
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.5.0 -->
+<!-- release-skill:release-version: 0.5.1 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -104,7 +104,7 @@ Kimi Code 有交互式插件市场，但**没有可脚本化的非交互安装
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.5.0
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.5.1
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.5.0 -->
+<!-- release-skill:release-version: 0.5.1 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,32 +14,24 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.5.0** (2026-08-16)
+**0.5.1** (2026-08-17)
 
-v0.5.0 adopts the released Skill Family Foundation 0.4.0 packages (skill-family-contracts / skill-family-harness-node) for digest computation, atomic writes, contained file reads, and project locking; migrates the project lock domain to a single-file token lock with fail-closed legacy detection; hardens the online assess npm check against fail-open; and documents the hooks authorization contract as config-time authorization.
-
-**Added**
-
-- **Negative test coverage**: 12 additional tests covering exclusive publication, token-lock migration, and the assess npm-check behavior.
+v0.5.1 fixes three frozen-0.5.0 defects — explicit hook environment delivery (envAllowlist now reaches prepare hooks), a 64 MiB baseline maxBuffer for large tracked indexes, and the prefixed skill-directory fallback for marketplace-install preflight/observe — bumps the Skill Family Foundation dependencies to the released 0.5.0 packages, and hardens the release chain so every later release must bind the previous public release commit instead of degrading to an orphan root commit.
 
 **Changed**
 
-- **Foundation adoption**: digest computation, atomic writes, contained-path reads and project locking now delegate to the published `skill-family-contracts@0.4.0` / `skill-family-harness-node@0.4.0` packages instead of local implementations; dependencies bumped from 0.3.0 to 0.4.0.
-- **Token lock domain**: project locks migrated from a directory-based domain to a single `.release-skill/lock` file (0600, token record). Legacy directory-form locks are detected and fail closed with `LOCK_MIGRATION_REQUIRED`; no automatic conversion or deletion is performed.
-- **Exclusive plan/run publication**: immutable plan and run records are published via `publishFileExclusive` — identical bytes are idempotent, divergent bytes fail with `GATE_FAILED`.
-- **Assess npm check semantics**: the online `assess` npm check no longer treats every registry error as version-not-found; only E404/ETARGET mean a missing version, other failures surface as an `NPM_VERSION_CHECK_FAILED` warning.
-- **Hooks authorization contract**: release-prepare/release-help now document the explicit contract that configuring a hook in project configuration IS the authorization (hooks are arbitrary local processes with no sandbox, no filesystem/network isolation, and no pre-trigger confirmation point); restoring a mandatory pre-trigger confirmation gate is a future hardening item.
-- **Audit-scope ruling**: the bundled-family marketplace configuration is recorded as not applicable to the `release_artifact` target type (G3 target-side T4 ruling); T3/T5/T6 deferred to independent tasks.
-- **Plan schema**: production plans carry the resolved codebuddy marketplace coordinates so approval and publish review the exact marketplace target.
+- **Foundation 0.5.0 upgrade**: `skill-family-contracts` and `skill-family-harness-node` dependencies bumped from 0.4.0 to 0.5.0 (npm latest); the package-name import bridge keeps working unchanged and the harness-node 0.5.0 export surface was re-verified (`publishFileExclusive`, token-lock five functions, `HARNESS_ERROR_KINDS`).
+- **Chain hardening (chain-integrity)**: `push-snapshot` now requires an explicit `branchStrategy` (the historical `create-release-branch` default that produced orphan root commits is gone); `create-release-branch` is only valid when `previousPublicBaseline.mode=none`; a production online prepare with `mode=none` on a repository that already carries release tags fails closed with `CHAIN_GAP`, demanding a bound baseline at the previous release commit; online `assess` registers a warning-level `VERSION_SEQUENCE_GAP` when the target version jumps the release sequence (e.g. 0.1.1 → 0.1.3 with no v0.1.2 tag), without blocking.
 
 **Fixed**
 
-- **Configurable CodeBuddy marketplace**: codebuddy-plugin distributions accept `marketplace` and `marketplaceSource` in project configuration, and prepare threads both values into the consumer install action instead of assuming a fixed marketplace.
-- **Assess fail-open**: an online `assess` no longer silently reports no gaps when the npm registry check fails for reasons other than a missing version.
+- **Hook environment delivery (hook-env-delivery)**: `runDeclaredHooks` now accepts an explicit `env` option and merges it into the hook context (`hookFn(hook, { root, env })`); prepare and `hooks validate` inject the invoking shell's environment, so `hooks.*.envAllowlist` keys exported by the caller finally reach the hook subprocess. Allowlist semantics are unchanged — the hook runner still reads allowlisted keys exclusively from the explicit map, never from `process.env` directly.
+- **Large-tracked-index baseline (baseline-maxbuffer)**: `computeWorkspaceDigest` now runs its three git subprocesses with a 64 MiB `maxBuffer` (official fix 39c631f); workspaces with thousands of tracked files (measured 8494 tracked files → 1,519,151 B `ls-files -s` stdout) no longer fail with `ERR_CHILD_PROCESS_STDIO_MAXBUFFER`.
+- **Prefixed skill-directory resolution (entry-skill-prefix)**: marketplace-install preflight and observe now fall back from `skills/<entrySkill>/SKILL.md` to `skills/<plugin>-<entrySkill>/SKILL.md` (plugin from the action parameters, D-ACA-30 platform physical names); candidate builds with prefixed skill directories pass preflight and observe instead of failing with `entry skill not found`.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.5.0 is the current source candidate; v0.4.1 remains
+> **Current boundary:** v0.5.1 is the current source candidate; v0.4.1 remains
 > the latest published release (v0.2.2 previously held
 > published status before the platform verification convergence fix was added).
 > v0.1.1 completed a real production release to GitHub and npm — the first
@@ -58,7 +50,7 @@ v0.5.0 adopts the released Skill Family Foundation 0.4.0 packages (skill-family-
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.5.0 is the current
+> **Production path verified since the v0.1.1 milestone; v0.5.1 is the current
 > source candidate and v0.4.1 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >

package/README.zh-CN.md

@@ -2,38 +2,30 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.5.0 -->
+<!-- release-skill:release-version: 0.5.1 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.5.0** (2026-08-16)
+**0.5.1** (2026-08-17)
 
-v0.5.0 采用已发布的 Skill Family Foundation 0.4.0 包（skill-family-contracts / skill-family-harness-node）承载摘要计算、原子写、受控读取与项目锁；项目锁域迁移为单文件 token 锁并对旧目录形态 fail-closed；修复在线 assess npm 检查的 fail-open；并把 hooks 授权契约文档化为「配置时刻即授权」。
-
-**新增**
-
-- **新增负向测试**：新增 12 条测试覆盖排他发布、token 锁迁移与 assess npm 检查行为。
+v0.5.1 修复冻结 0.5.0 的三项缺陷——hook 显式环境送达（envAllowlist 终于作用于 prepare hooks）、大索引基线 64 MiB maxBuffer、marketplace-install preflight/observe 的带前缀技能目录回退——并把 Skill Family Foundation 依赖提升到已发布的 0.5.0 包，同时加固发布链：后续任何发布都必须绑定上一公开发布提交，不再退化为孤儿根提交。
 
 **变更**
 
-- **Foundation 采用**：摘要计算、原子写、受控路径读取与项目锁改为委托已发布的 `skill-family-contracts@0.4.0` / `skill-family-harness-node@0.4.0` 包，依赖由 0.3.0 提升至 0.4.0。
-- **Token 锁域**：项目锁由目录形态迁移为单文件 `.release-skill/lock`（0600、token 记录）；旧目录形态锁被检测后 fail-closed（`LOCK_MIGRATION_REQUIRED`），不自动转换或删除。
-- **排他发布**：不可变计划与运行记录经 `publishFileExclusive` 发布——同字节幂等，异字节以 `GATE_FAILED` 失败。
-- **assess npm 检查语义**：在线 `assess` 的 npm 检查不再把一切 registry 错误当作「版本不存在」；仅 E404/ETARGET 视为缺失，其余失败以 `NPM_VERSION_CHECK_FAILED` 告警呈现。
-- **Hooks 授权契约**：release-prepare/release-help 现把「配置时刻即授权」写为显式契约——hook 是任意本地进程、无沙箱、无文件系统/网络隔离、触发前无确认点；恢复触发前强制确认门列为后续加固项。
-- **审计范围裁决**：bundled-family 市场型配置记录为不适用 `release_artifact` 目标类型（G3 目标侧 T4 裁决）；T3/T5/T6 延后为独立任务。
-- **计划模式**：生产计划携带解析后的 CodeBuddy 市场坐标，审批与发布时可核对确切的市场目标。
+- **Foundation 0.5.0 升级**：`skill-family-contracts` 与 `skill-family-harness-node` 依赖由 0.4.0 提升至 0.5.0（npm latest）；包名 import 桥无需改动，harness-node 0.5.0 导出面已逐项复核（`publishFileExclusive`、token-lock 五函数、`HARNESS_ERROR_KINDS`）。
+- **链加固（chain-integrity）**：`push-snapshot` 现要求显式 `branchStrategy`（历史上产生孤儿根提交的 `create-release-branch` 默认值已移除）；`create-release-branch` 仅在 `previousPublicBaseline.mode=none` 时合法；生产在线 prepare 在公开仓已有发布标签时仍以 `mode=none` 冻结计划会以 `CHAIN_GAP` 失败关闭，要求把基线绑定到上一发布提交；在线 `assess` 检测到版本序列跳号（如 0.1.1→0.1.3 且无 v0.1.2 标签）时登记 `VERSION_SEQUENCE_GAP` 警告，不阻断。
 
 **修复**
 
-- **CodeBuddy 市场可配置**：codebuddy-plugin 分发在项目配置中接受 `marketplace` 与 `marketplaceSource`，prepare 将两个值透传进消费者安装动作，不再假定固定市场。
-- **assess fail-open 修复**：在线 `assess` 不再因版本缺失以外的 npm registry 检查失败而静默报告无缺口。
+- **Hook 环境送达（hook-env-delivery）**：`runDeclaredHooks` 新增显式 `env` 选项并并入 hook 上下文（`hookFn(hook, { root, env })`）；prepare 与 `hooks validate` 注入调用方 shell 的环境，`hooks.*.envAllowlist` 中由调用方导出的键终于能到达 hook 子进程。allowlist 语义不变——hook 运行器仍只从显式映射读取白名单键，绝不直接回退 process.env。
+- **大索引基线（baseline-maxbuffer）**：`computeWorkspaceDigest` 的三个 git 子进程统一设置 64 MiB `maxBuffer`（官方修复 39c631f）；tracked 文件数较多的工作区（实测 8494 个文件 → `ls-files -s` 输出 1,519,151 B）不再报 `ERR_CHILD_PROCESS_STDIO_MAXBUFFER`。
+- **带前缀技能目录解析（entry-skill-prefix）**：marketplace-install 的 preflight 与 observe 从 `skills/<entrySkill>/SKILL.md` 未命中时回退 `skills/<plugin>-<entrySkill>/SKILL.md`（plugin 取 action 参数，D-ACA-30 平台物理名）；带前缀技能目录的候选构建不再以 `entry skill not found` 失败。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.5.0 是当前源码候选，v0.4.1 仍是最新已发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
+> **当前边界：** v0.5.1 是当前源码候选，v0.4.1 仍是最新已发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；"当前发布版本"与"首次生产验证里程碑"
@@ -46,7 +38,7 @@ v0.5.0 采用已发布的 Skill Family Foundation 0.4.0 包（skill-family-contr
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.5.0 是当前源码候选，v0.4.1 是最新已发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.5.1 是当前源码候选，v0.4.1 是最新已发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.5.0",
+      "version": "0.5.1",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/error-codes.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "kind": "skill-family.contracts.error-codes",
-  "contractsVersion": "1.4.0",
+  "contractsVersion": "1.5.0",
   "policy": {
     "format": "^SFC[0-9]{4}$",
     "ranges": [

package/adapters/claude/bin/kernel-protocol.json

@@ -4,7 +4,7 @@
   "name": "skill-family.kernel.operation",
   "version": 1,
   "status": "stable",
-  "contractsVersion": "1.4.0",
+  "contractsVersion": "1.5.0",
   "description": "Frozen v1 kernel protocol: request/result envelope, operation lifecycle states, and the operation vocabulary. Extensible only by a new protocol version; v1 content is frozen.",
   "states": ["accepted", "running", "succeeded", "failed", "rejected"],
   "initialStates": ["accepted", "rejected"],

package/adapters/claude/bin/registry.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "kind": "skill-family.contracts.registry",
-  "contractsVersion": "1.4.0",
+  "contractsVersion": "1.5.0",
   "note": "Protocol-name and schema-$id registry. Registration mechanically rejects duplicate protocol name/version (SFC1004) and duplicate $id (SFC1003). This file is the single registration surface; adding an entry is a contracts change.",
   "protocols": [
     {
@@ -152,6 +152,20 @@
       "dialect": "2020-12",
       "status": "stable",
       "file": "src/schemas/surface-scan-policy.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/declared-read-surface-result.json",
+      "object": "declared-read-surface-result",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/declared-read-surface-result.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/structured-scan-policy.json",
+      "object": "structured-scan-policy",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/structured-scan-policy.schema.json"
     }
   ],
   "dialects": {