release-skill 0.5.1 → 0.6.1

package/schemas/release-project.schema.json

@@ -613,6 +613,9 @@
           },
           "releaseDocuments": {
             "$ref": "#/definitions/releaseDocuments"
+          },
+          "postPublish": {
+            "$ref": "#/definitions/postPublish"
           }
         },
         "allOf": [
@@ -870,9 +873,305 @@
           },
           "uniqueItems": true,
           "description": "Root-relative globs declaring the hook's full input set (source, scripts, config, lockfiles). The cache key fingerprints the content of every matched file; a glob that matches nothing fails closed. Must cover ALL inputs or the cache can return a false hit."
+        },
+        "testSelection": {
+          "type": "string",
+          "enum": [
+            "full",
+            "incremental"
+          ],
+          "description": "Only meaningful for the test hook: which test selection the hook command runs. Absence or 'full' means the hook runs the full suite, which prepare's built-in full-test freeze gate requires before the plan digest is computed. 'incremental' is reserved for a future preflight mode and is rejected at freeze time ('incremental selection is not allowed at freeze time'). Built-in gate; cannot be disabled by project overlays."
         }
       }
     },
+    "postPublish": {
+      "type": "object",
+      "description": "发布后分发声明：materialize 钩子从冻结 tag 工作树物化载荷，targets 将载荷镜像或渲染市场索引推送到独立 git 远端。分发在 publish 之后由 distribute 命令执行，时序契约禁止读取工作区状态。",
+      "required": [
+        "materialize",
+        "targets",
+        "commitIdentity"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "materialize": {
+          "$ref": "#/definitions/postPublishMaterialize"
+        },
+        "targets": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/definitions/postPublishTarget"
+          }
+        },
+        "commitIdentity": {
+          "type": "object",
+          "description": "分发仓库提交者身份（bot 身份），通过 git -c user.name/-c user.email 注入，绝不读取或修改全局 git 配置",
+          "required": [
+            "name",
+            "email"
+          ],
+          "additionalProperties": false,
+          "properties": {
+            "name": {
+              "type": "string",
+              "minLength": 1
+            },
+            "email": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        },
+        "steps": {
+          "type": "array",
+          "description": "物化之后、推送之前按序执行的只读检查步骤；任一步失败即 fail-closed",
+          "items": {
+            "$ref": "#/definitions/postPublishStep"
+          }
+        },
+        "assertMainVersionAhead": {
+          "type": "boolean",
+          "description": "分发前校验主干版本源仍领先于目标版本，防止在已推进的主干上分发旧版本"
+        }
+      }
+    },
+    "postPublishMaterialize": {
+      "type": "object",
+      "description": "载荷物化钩子：executable+参数数组（禁止 shell 字符串），stdout 中 outputMarker 行之后为载荷目录路径；可选 requireReport 对 stdout 首个 JSON 对象做字段断言",
+      "required": [
+        "command",
+        "outputMarker"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "command": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          }
+        },
+        "cwd": {
+          "type": "string",
+          "pattern": "^(?:\\.$|(?!\\/)(?!\\.\\/)(?!.*\\\\)(?!.*:)(?!\\.\\.(?:\\/|$))(?!.*\\/\\.\\.\\/)(?!.*\\/\\.\\.$)(?!.*\\/\\.\\/)(?!.*\\/\\/)(?!.*\\0)(?!.*\\/\\.$)(?!.*\\/\\/$)(?!.*\\/$).*)$"
+        },
+        "timeoutMs": {
+          "type": "integer",
+          "minimum": 1000,
+          "maximum": 7200000
+        },
+        "envAllowlist": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^(?!.*(?:TOKEN|SECRET|PASSWORD|PASSPHRASE|API_KEY|CREDENTIAL))[A-Z_][A-Z0-9_]*$"
+          },
+          "uniqueItems": true
+        },
+        "outputMarker": {
+          "type": "string",
+          "minLength": 1,
+          "description": "stdout 中标识载荷目录路径的前缀标记（如 \"isolated dir kept: \"）"
+        },
+        "requireReport": {
+          "type": "object",
+          "required": [
+            "parse"
+          ],
+          "additionalProperties": false,
+          "properties": {
+            "parse": {
+              "const": "stdout-first-json",
+              "description": "解析 stdout 中第一个完整 JSON 对象作为报告"
+            },
+            "equals": {
+              "type": "object",
+              "description": "报告字段等值断言；任一字段缺失或不等即 fail-closed"
+            }
+          }
+        }
+      }
+    },
+    "postPublishStep": {
+      "type": "object",
+      "description": "物化后按序执行的检查步骤；executable+参数数组（禁止 shell 字符串）",
+      "required": [
+        "name",
+        "command"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9._-]*$"
+        },
+        "command": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          }
+        },
+        "cwd": {
+          "type": "string",
+          "pattern": "^(?:\\.$|(?!\\/)(?!\\.\\/)(?!.*\\\\)(?!.*:)(?!\\.\\.(?:\\/|$))(?!.*\\/\\.\\.\\/)(?!.*\\/\\.\\.$)(?!.*\\/\\.\\/)(?!.*\\/\\/)(?!.*\\0)(?!.*\\/\\.$)(?!.*\\/\\/$)(?!.*\\/$).*)$"
+        },
+        "timeoutMs": {
+          "type": "integer",
+          "minimum": 1000,
+          "maximum": 7200000
+        },
+        "envAllowlist": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^(?!.*(?:TOKEN|SECRET|PASSWORD|PASSPHRASE|API_KEY|CREDENTIAL))[A-Z_][A-Z0-9_]*$"
+          },
+          "uniqueItems": true
+        }
+      }
+    },
+    "postPublishTarget": {
+      "type": "object",
+      "description": "分发目标 git 远端：payload-mirror 镜像载荷，marketplace-index 渲染市场索引清单；dependsOn 语义（引用、无环）在运行时 fail-closed 校验",
+      "required": [
+        "id",
+        "kind",
+        "remoteUrl",
+        "visibility",
+        "branch"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9._-]*$"
+        },
+        "kind": {
+          "type": "string",
+          "enum": [
+            "payload-mirror",
+            "marketplace-index"
+          ]
+        },
+        "remoteUrl": {
+          "type": "string",
+          "pattern": "^(?:https?|file)://.+\\.git$",
+          "description": "仅允许 http(s) 或 file（测试传输）且以 .git 结尾的远端 URL"
+        },
+        "visibility": {
+          "type": "string",
+          "enum": [
+            "internal",
+            "public"
+          ]
+        },
+        "branch": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]*$"
+        },
+        "dependsOn": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9._-]*$",
+          "description": "消费另一目标（须为 payload-mirror）推送后的 commit sha；运行时校验引用存在且无环"
+        },
+        "marketplace": {
+          "type": "object",
+          "description": "marketplace-index 目标必填：渲染 .claude-plugin/marketplace.json 所用的市场元数据",
+          "required": [
+            "form",
+            "name",
+            "owner"
+          ],
+          "additionalProperties": false,
+          "properties": {
+            "form": {
+              "type": "string",
+              "enum": [
+                "github",
+                "url"
+              ]
+            },
+            "name": {
+              "type": "string",
+              "minLength": 1
+            },
+            "owner": {
+              "type": "string",
+              "minLength": 1
+            },
+            "sourceRepo": {
+              "type": "string",
+              "pattern": "^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$",
+              "description": "可选 owner/repo；github form 缺省时以 owner/name 组装"
+            }
+          }
+        },
+        "staticFiles": {
+          "type": "array",
+          "description": "随目标一起写入的静态文件（from 为源仓库相对路径，to 为目标仓库相对路径）",
+          "items": {
+            "type": "object",
+            "required": [
+              "from",
+              "to"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "from": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "^(?!/)(?!\\.\\/)(?!.*\\\\)(?!.*:)(?!\\.\\.(/|$))(?!\\.$)(?!.*\\/\\.\\.\\/)(?!.*\\/\\.\\.$)(?!.*\\/\\.\\/)(?!.*\\/\\/)(?!.*\\0)(?!.*\\/\\.$)(?!.*\\/$).*$"
+              },
+              "to": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "^(?!/)(?!\\.\\/)(?!.*\\\\)(?!.*:)(?!\\.\\.(/|$))(?!\\.$)(?!.*\\/\\.\\.\\/)(?!.*\\/\\.\\.$)(?!.*\\/\\.\\/)(?!.*\\/\\/)(?!.*\\0)(?!.*\\/\\.$)(?!.*\\/$).*$"
+              }
+            }
+          }
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "kind": {
+                "const": "marketplace-index"
+              }
+            },
+            "required": [
+              "kind"
+            ]
+          },
+          "then": {
+            "required": [
+              "marketplace"
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "kind": {
+                "const": "payload-mirror"
+              }
+            },
+            "required": [
+              "kind"
+            ]
+          },
+          "then": {
+            "not": {
+              "required": [
+                "marketplace"
+              ]
+            }
+          }
+        }
+      ]
+    },
     "releaseDocuments": {
       "type": "object",
       "description": "Optional configuration-driven multilingual release-document refresh for one release unit. Absence preserves legacy behaviour. Lexical layer only; runtime path, locale-membership and collision checks apply additionally.",

package/schemas/release-run.schema.json

@@ -41,7 +41,9 @@
         "PUBLISHED",
         "VERIFIED",
         "PARTIAL",
-        "BLOCKED"
+        "BLOCKED",
+        "DISTRIBUTING",
+        "DISTRIBUTED"
       ],
       "description": "Current status of the run"
     },
@@ -52,7 +54,8 @@
         "prepare",
         "publish",
         "reconcile",
-        "verify"
+        "verify",
+        "distribute"
       ],
       "description": "The command that initiated this run"
     },
@@ -128,7 +131,9 @@
               "codex-marketplace-install",
               "kimi-marketplace-install",
               "codebuddy-marketplace-install",
-              "set-default-branch"
+              "set-default-branch",
+              "distribute-probe",
+              "distribute-mirror"
             ],
             "description": "Type of external action"
           },
@@ -143,9 +148,10 @@
               "deferred",
               "PASSED_AUTOMATIC",
               "PASSED_MANUAL",
-              "NOT_REQUIRED_UNCHANGED"
+              "NOT_REQUIRED_UNCHANGED",
+              "NO_CHANGE"
             ],
-            "description": "Result status of this checkpoint (uncertain = started, result unknown; deferred = marketplace action postponed to verify phase; PASSED_AUTOMATIC/PASSED_MANUAL/NOT_REQUIRED_UNCHANGED 为验证阶段专用状态)"
+            "description": "Result status of this checkpoint (uncertain = started, result unknown; deferred = marketplace action postponed to verify phase; PASSED_AUTOMATIC/PASSED_MANUAL/NOT_REQUIRED_UNCHANGED 为验证阶段专用状态; NO_CHANGE = distribute 目标暂存差异为空，未产生 commit/tag/push)"
           },
           "preObserve": {
             "type": "string",
@@ -206,6 +212,7 @@
                   "GATE_FAILED",
                   "AUTH_MISSING",
                   "REMOTE_CONFLICT",
+                  "REMOTE_UNAVAILABLE",
                   "HOOK_TIMEOUT",
                   "PARTIAL_RELEASE",
                   "POST_PUBLISH_VERIFY_FAILED"
@@ -223,6 +230,51 @@
           "phase": {
             "type": "string",
             "description": "Phase identifier for deferred checkpoints (e.g. post-publish-verification)"
+          },
+          "remoteUrl": {
+            "type": "string",
+            "description": "distribute 目标远端 URL"
+          },
+          "branch": {
+            "type": "string",
+            "description": "distribute 目标分支"
+          },
+          "tag": {
+            "type": "string",
+            "description": "distribute 分发 tag"
+          },
+          "tagCommit": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{40}$",
+            "description": "冻结的 create-tag 预期 commit"
+          },
+          "previousHead": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{40}$",
+            "description": "执行前目标分支 tip"
+          },
+          "pushedCommit": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{40}$",
+            "description": "实际推送的 commit（与 ls-remote 交叉核对）"
+          },
+          "mode": {
+            "type": "string",
+            "enum": [
+              "pushed",
+              "no-change",
+              "dry-run"
+            ],
+            "description": "distribute 执行模式"
+          },
+          "executor": {
+            "type": "string",
+            "description": "执行者标识"
+          },
+          "payloadFileCount": {
+            "type": "integer",
+            "minimum": 0,
+            "description": "写入目标的载荷文件数"
           }
         }
       }
@@ -568,7 +620,8 @@
           "command": {
             "enum": [
               "reconcile",
-              "verify"
+              "verify",
+              "distribute"
             ]
           }
         },

package/scripts/build-bundle.mjs

@@ -21,6 +21,7 @@ import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
+import { computeBundleSourceDigest } from '../src/core/bundle-freshness.mjs';
 
 const CHECK_MODE = process.argv.includes('--check');
 
@@ -38,7 +39,12 @@ const OUTFILE = join(PKG_ROOT, 'bin', 'release-skill.bundle.mjs');
 // dependency: the Claude and Codex adapter closures ship the bundle at a
 // different depth with no package.json next to it, while the npm closure does.
 // Reading package.json here (build input) keeps the output deterministic.
-function buildBanner(pkgIdentity) {
+//
+// __bundleSourceDigest is the build-time digest of the bundle's source inputs
+// (src/, skills-src/, bin/release-skill-cli.mjs, package.json — algorithm in
+// src/core/bundle-freshness.mjs). prepare's BUNDLE_STALE gate recomputes the
+// digest and fails closed on any mismatch (2026-08-18 investigation §4.2).
+function buildBanner(pkgIdentity, sourceDigest) {
   return `\
 // --- release-skill bundle (deterministic build) ---
 // Compute package root from the bundle's own file location (import.meta.url).
@@ -51,6 +57,8 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
 const __bundlePkg = Object.freeze(${JSON.stringify(pkgIdentity)});
+// Build-time source digest for the BUNDLE_STALE freshness gate (see above).
+const __bundleSourceDigest = "${sourceDigest}";
 `;
 }
 
@@ -164,7 +172,8 @@ async function buildBundle() {
   }
 
   const pkgJson = JSON.parse(await readFile(join(PKG_ROOT, 'package.json'), 'utf-8'));
-  const banner = buildBanner({ name: pkgJson.name, version: pkgJson.version });
+  const sourceDigest = await computeBundleSourceDigest(PKG_ROOT);
+  const banner = buildBanner({ name: pkgJson.name, version: pkgJson.version }, sourceDigest);
 
   const identity = Object.freeze({ name: pkgJson.name, version: pkgJson.version });
 

package/scripts/sync-public-files.mjs

@@ -232,6 +232,9 @@ async function collectEntries(packageRoot) {
   //                           a distribution artifact; the shipped bundle
   //                           inlines the adopted capability — matches the npm
   //                           pack closure contract)
+  //    - .release-skill/     (local release runtime state — runs, plans, locks;
+  //                           not in the package.json files whitelist, so it is
+  //                           never part of the npm pack closure)
   const baseFiles = allFiles.filter((f) => {
     if (f.startsWith('adapters/')) return false;
     if (f.startsWith('test/')) return false;
@@ -240,6 +243,7 @@ async function collectEntries(packageRoot) {
     if (f.startsWith('native/') && f.includes('/build/')) return false;
     if (f.startsWith('scripts/')) return false;
     if (f.startsWith('vendor/')) return false;
+    if (f.startsWith('.release-skill/')) return false;
     return true;
   });
 

package/skills/release-config/SKILL.md

@@ -0,0 +1,140 @@
+---
+name: release-config
+description: "Config-only workflow profile: route confirms config-only diff, assess with schema validation, prepare --workflow config (code-class gates trimmed), workflowDecision records publish path (public bytes unchanged → no publish path; changed → lightchain prepare→approve→publish→verify)"
+---
+
+# release-config
+
+## 触发
+
+用户询问或执行纯配置变更的发布流程。包含 `.release-skill/project.yaml`、配置 schema 等配置文件的修改，且无代码、文档或 marketplace 变更。
+
+## 当前状态
+
+`release-config` 是工作流配置文件 (§4) 定义的独立工作流之一，专门处理仅配置变更的场景。它遵循简化生命周期，专注于配置验证和发布路径决策分支。
+
+**机械实现**: `prepare --workflow config` 确定性地裁剪代码类门禁（H5），并比较当前
+per-unit `snapshotDigest` 与最新冻结 plan——公开字节未变 → `publishPath:
+'no-publish-needed'`（externalActions 被移除，无 publish 路径）；字节变化或无对比
+plan → `publishPath: 'publish-needed'`（fail-safe）。决策以 `workflowDecision` 绑定
+进 plan digest，不可篡改。**不存在** `NO_PUBLISH_NEEDED`/`REPORTED` 虚构状态：
+prepare 的真实输出是 plan 内的 `workflowDecision`。
+
+**边界**: 跳过代码类 gates（declared hooks、snapshot-verify gates、source-authority
+closure、skill-resource-closure）。保留 baseline/snapshots/plan freeze/docs
+freshness。consumer-verify 仅在触发生效发布时参与。
+
+## 职责与边界
+
+- **步骤① diff 确认 config-only**: 调用 `release-skill route` command 确认仅有配置变更
+- **步骤② assess with schema validation**: 执行配置结构验证、schema 检查、contract 一致性
+- **步骤③ prepare --workflow config**: 本地 freeze 检查，生成只读计划；输出 `workflowDecision`
+- **步骤④ decision branch**（来自 plan.workflowDecision）:
+  - 场景 A：`publishPath === 'no-publish-needed'`（公开字节未变化）→ 记录决策并结束，
+    无 publish 路径，不运行 approve/publish/verify
+  - 场景 B：`publishPath === 'publish-needed'`（公开 surface 变化或不可判定）→ 运行
+    轻链 (approve→publish→verify)
+
+**授权边界**: 命令调用本身即授权执行配置的 hooks/gates。config-only 工作流的远程写操作受标准 approval 机制约束，不 bypass 安全 gate。
+
+**阶段通过规则**:
+- 场景 A: prepare 输出 `workflowDecision.decision === 'public-bytes-unchanged'`（无 publish 路径）
+- 场景 B: `status === 'VERIFIED'` + CLI exit code 0
+
+## 正向执行路径
+
+1. 运行 `release-skill route --root <path> --json` 获取 diff 分类
+2. 若推荐 `workflowKind === 'config-only'`，则使用本技能
+3. 执行步骤②：运行 `release-skill assess --root <path> --offline --json` 进行 schema validation
+4. 执行步骤③：运行 `release-skill prepare --offline --workflow config --target-version <ver> --json`
+5. 读取输出中的 `workflowDecision`：
+   - **A**: `publishPath === 'no-publish-needed'` → 记录决策（plan 已冻结，无
+     externalActions），结束。无需 approve/publish/verify
+   - **B**: `publishPath === 'publish-needed'` → 继续 approve → publish → verify 链条
+6. (场景 B 续) 执行步骤⑥：运行 `release-skill approve --plan <path> --actor <name>`
+7. (场景 B 续) 执行步骤⑦：运行 `release-skill publish --plan <path> --approval <path>`
+8. (场景 B 续) 执行步骤⑧：运行 `release-skill verify --plan <path> --run <path>`
+
+## 确定性脚本调用
+
+```bash
+# Step 1: Diff classification confirmation (config-only)
+node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" route --root <path> --json
+
+# Step 2: Assess with schema validation
+node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" assess --root <path> --offline --json
+
+# Step 3: Prepare --workflow config (local freeze + publish-path decision)
+node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" prepare --offline \
+  --workflow config --target-version <version> --json
+# Output (JSON): { workflowKind: 'config',
+#   workflowDecision: { decision: 'public-bytes-unchanged'|'public-bytes-changed'|'indeterminable',
+#     publishPath: 'no-publish-needed'|'publish-needed', comparedPlan: '<digest>.json' } }
+
+# Decision Branch A (no-publish-needed): plan frozen with zero externalActions;
+# the decision is bound into the plan digest. No publish commands run.
+
+# Decision Branch B (publish-needed): light chain execution
+node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" approve \
+  --plan <path> --actor <person-name>
+node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" publish \
+  --plan <path> --approval <path>
+node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" verify \
+  --plan <path> --run <path> --json
+```
+
+## 故障路由
+
+| 场景 | 状态 | 处理 |
+|------|------|------|
+| 非纯配置变更（mixed=true） | full-happy-end | 路由到 `release-skill ship` 完整工作流 |
+| schema validation 失败 | CONFIG_SCHEMA_INVALID | 修正 project.yaml 或 schemas 结构错误后重试 step② |
+| contract verification 失败 | CONFIG_CONFLICT | 解决配置冲突后重试 step② |
+| prepare 检测到基线漂移 | BASELINE_DRIFT_DETECTED | 人工审查 drift 后决定是否继续或回滚 |
+| workflowDecision 不可判定（无对比 plan） | indeterminable | fail-safe 到 publish-needed，走场景 B |
+| approval expired | APPROVAL_EXPIRED | 重新执行 approve，digest 必须匹配 |
+| remote conflict at publish | REMOTE_CONFLICT | 人工决策：force override 或 cancel |
+
+## 决策树 (Step 4)
+
+```
+┌─────────────────────────────────────────┐
+│  prepare --workflow config completed    │
+└──────────────────┬──────────────────────┘
+                   │
+        ┌──────────┴──────────┐
+        │                     │
+        ▼                     ▼
+┌───────────────┐   ┌───────────────────┐
+│ public bytes  │   │ public bytes      │
+│ unchanged     │   │ changed /         │
+│ (or no plan   │   │ indeterminable    │
+│  → fail-safe  │   │                   │
+│  → publish    │   │                   │
+│  needed)      │   │                   │
+└───────┬───────┘   └────────┬──────────┘
+        │                    │
+        ▼                    ▼
+┌───────────────┐   ┌───────────────────┐
+│ no-publish    │   │ light chain       │
+│ needed:       │   │ approve→publish   │
+│ decision      │   │ →verify           │
+│ recorded in   │   │                   │
+│ plan digest   │   │                   │
+└───────────────┘   └───────────────────┘
+```
+
+## 与其他工作流的关系
+
+- **docs-only**: 纯文档变更时使用 `release-docs`
+- **marketplace-only**: 仅 marketplace 变更时使用独立工作流
+- **full-happy-end**: 混合变更（code+config+docs）时降级到此完整路径
+
+## 关联技能
+
+- `release-skill route`: 快速入门决策路由（§4.3）
+- `release-assess`: 配置 schema/contract 验证入口
+- `release-prepare`: 离线冻结检查（`--workflow config` 输出 publish-path 决策）
+- `release-approve`: Plan approval（仅场景 B）
+- `release-publish`: 制品发布（仅在 public surface 变化时执行）
+- `release-verify`: 消费者验证（场景 B 的最终验证门）