release-skill 0.6.0 → 0.6.1

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.6.0",
+      "version": "0.6.1",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.6.0.",
+      "Prepare a release plan for version 0.6.1.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.6.1 locale=en baseline=sha256:dd7c991244d72db1247dda808057fda060b1e7bb03ff866aae691841828e6239 -->
+## [0.6.1] - 2026-08-18
+
+v0.6.1 closes the four root causes of the 0.6.0 self-bootstrap release cycle, in which 22 of 25 runs failed and nearly all wall-clock time was spent in diagnose-repair loops or on external interference: hook failures are no longer silent, stale bundles fail closed at the earliest gate, the freeze path can never skip the full test suite, and a machine-readable frozen marker now tells sibling governance tasks to keep out of a repository mid-release.
+
+### Added
+
+- **Hook failure output passthrough (R1)**: when a prepare hook exits non-zero, the run evidence now carries bounded `stderrTail` / `stdoutTail` projections (last 50 lines, capped at 8 KiB) and the CLI echoes the stderr tail, so failures such as a bare `exit=13` are diagnosable immediately instead of by blind retry. Exit-code semantics are unchanged.
+- **Bundle freshness gate (R2)**: every rebuilt bundle embeds a frozen digest of its source tree, and prepare compares source against bundle right after the config phase; any mismatch fails closed as `BUNDLE_STALE` (error code 54) with the rebuild command in the message, before hooks, snapshots, or network checks run. No workflow path is exempt.
+- **Full-test freeze gate (R3)**: plan digests can no longer be computed unless the full test suite ran in this prepare; the gate sits before `computePlanDigest`, the `testSelection` value is validated against a schema enum in project and plan schemas, and no overlay switch can waive the freeze-path requirement.
+- **Frozen-release marker (R4)**: a successful prepare writes `.release-skill/FROZEN` carrying `planDigest`, `targetVersions` (unit → version), `createdAt`, and `runId`; the marker is removed only when verify reaches `VERIFIED`, giving sibling repositories and governance tasks a machine-readable signal to skip a repository mid-release.
+<!-- release-skill:changelog:end version=0.6.1 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.6.0 locale=en baseline=sha256:1942e4534cc9ab36065168471875ba8c4648c73328a20ef3ee6a7a53eb1f1b7d -->
 ## [0.6.0] - 2026-08-18
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.6.0 -->
+<!-- release-skill:release-version: 0.6.1 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -114,7 +114,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.6.0
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.6.1
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.6.0 -->
+<!-- release-skill:release-version: 0.6.1 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -104,7 +104,7 @@ Kimi Code 有交互式插件市场，但**没有可脚本化的非交互安装
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.6.0
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.6.1
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.6.0 -->
+<!-- release-skill:release-version: 0.6.1 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,19 +14,20 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.6.0** (2026-08-18)
+**0.6.1** (2026-08-18)
 
-v0.6.0 automates the most error-prone bookkeeping step of the release loop: after a release reaches VERIFIED, verify now advances each unit's previousPublicBaseline in project.yaml to the just-published commit, tree, and manifest digest recorded in the frozen plan. The advance is local-only, idempotent, validated with automatic rollback, and commits the config file on its own only when it was clean before the write, so the drift gate always sees a truthful previous public baseline without anyone hand-copying hashes.
+v0.6.1 closes the four root causes of the 0.6.0 self-bootstrap release cycle, in which 22 of 25 runs failed and nearly all wall-clock time was spent in diagnose-repair loops or on external interference: hook failures are no longer silent, stale bundles fail closed at the earliest gate, the freeze path can never skip the full test suite, and a machine-readable frozen marker now tells sibling governance tasks to keep out of a repository mid-release.
 
 **Added**
 
-- **Automatic baseline advance (baseline-advance)**: after `verify` reaches `VERIFIED`, every `mode: bound` unit's `previousPublicBaseline` (`commit`, `tree`, `manifestDigest`) is advanced to the published values derived from the frozen plan's `push-snapshot` binding — never recomputed from workspace state. The rewritten `project.yaml` preserves comments, is re-validated with `loadProjectConfig`, and is restored byte-for-byte if validation fails. The advance never demotes `VERIFIED`: failures are recorded in evidence and reported for manual handling.
-- **Clean-worktree commit policy**: the baseline advance auto-commits the config file in an isolated commit only when `project.yaml` had no staged or unstaged changes before the write; a dirty worktree leaves the file written but uncommitted for human review, and a missing or broken git fails safe to never committing.
-- **Ship-state traceability**: `ship` persists the verify `baselineAdvance` result (`advanced` / `already-current` / `committed` / `failed`) in its durable state, and the `verify` human-readable output reports the advance outcome line.
+- **Hook failure output passthrough (R1)**: when a prepare hook exits non-zero, the run evidence now carries bounded `stderrTail` / `stdoutTail` projections (last 50 lines, capped at 8 KiB) and the CLI echoes the stderr tail, so failures such as a bare `exit=13` are diagnosable immediately instead of by blind retry. Exit-code semantics are unchanged.
+- **Bundle freshness gate (R2)**: every rebuilt bundle embeds a frozen digest of its source tree, and prepare compares source against bundle right after the config phase; any mismatch fails closed as `BUNDLE_STALE` (error code 54) with the rebuild command in the message, before hooks, snapshots, or network checks run. No workflow path is exempt.
+- **Full-test freeze gate (R3)**: plan digests can no longer be computed unless the full test suite ran in this prepare; the gate sits before `computePlanDigest`, the `testSelection` value is validated against a schema enum in project and plan schemas, and no overlay switch can waive the freeze-path requirement.
+- **Frozen-release marker (R4)**: a successful prepare writes `.release-skill/FROZEN` carrying `planDigest`, `targetVersions` (unit → version), `createdAt`, and `runId`; the marker is removed only when verify reaches `VERIFIED`, giving sibling repositories and governance tasks a machine-readable signal to skip a repository mid-release.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.6.0 is the current source candidate; v0.4.1 remains
+> **Current boundary:** v0.6.1 is the current source candidate; v0.4.1 remains
 > the latest published release (v0.2.2 previously held
 > published status before the platform verification convergence fix was added).
 > v0.1.1 completed a real production release to GitHub and npm — the first
@@ -45,7 +46,7 @@ v0.6.0 automates the most error-prone bookkeeping step of the release loop: afte
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.6.0 is the current
+> **Production path verified since the v0.1.1 milestone; v0.6.1 is the current
 > source candidate and v0.4.1 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >

package/README.zh-CN.md

@@ -2,25 +2,26 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.6.0 -->
+<!-- release-skill:release-version: 0.6.1 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.6.0** (2026-08-18)
+**0.6.1** (2026-08-18)
 
-v0.6.0 把发布循环中最容易出错的一步记账工作自动化了：发布到达 VERIFIED 后，verify 会自动把 project.yaml 中每个 unit 的 previousPublicBaseline 推进到本次已发布的 commit、tree 与 manifest digest，数值全部取自冻结计划的记录。推进只写本地、幂等、写回后自动校验并在失败时原样回滚，并且只在写回前文件干净时才用独立提交落库——漂移门禁从此总是看到真实的前序公开基线，不再需要任何人手工抄写哈希。
+v0.6.1 收口 0.6.0 自举发布周期暴露的四个根因——该周期 25 次运行中 22 次失败，几乎全部墙钟时间消耗在失败-诊断-修复循环与外部干扰上：hook 失败不再无声、陈旧 bundle 在最早期门禁失败关闭、冻结路径不可能跳过全量测试、机器可读的冻结标记让兄弟仓库的治理任务知道发布期间不要写入本仓库。
 
 **新增**
 
-- **基线自动推进（baseline-advance）**：`verify` 到达 `VERIFIED` 后，每个 `mode: bound` unit 的 `previousPublicBaseline`（`commit`、`tree`、`manifestDigest`）自动推进到冻结计划 `push-snapshot` 绑定中的已发布值——绝不从工作区状态重新计算。写回的 `project.yaml` 保留注释，经 `loadProjectConfig` 重新校验，校验失败时逐字节还原。推进失败不会降级 `VERIFIED`：失败记录进证据并提示人工处理。
-- **干净工作区提交策略**：仅当写回前 `project.yaml` 没有任何暂存或未暂存改动时，基线推进才用一次独立提交只包含该文件；工作区有在途改动时只落盘不提交、留给人工复核；git 缺失或损坏时安全失败为永不提交。
-- **ship 状态可追溯**：`ship` 把 verify 的 `baselineAdvance` 结果（`advanced` / `already-current` / `committed` / `failed`）写入持久状态；`verify` 的人类可读输出新增推进结果行。
+- **hook 失败输出透传（R1）**：prepare hook 非零退出时，运行证据携带有界的 `stderrTail` / `stdoutTail` 投影（最后 50 行、上限 8 KiB），CLI 同时回显 stderr 尾部——裸 `exit=13` 这类失败从此可即时诊断，不再需要盲目重试。exit code 语义不变。
+- **bundle 陈旧度门禁（R2）**：每次重建的 bundle 内嵌其源码树冻结摘要，prepare 在 config 阶段之后立即比对源码与 bundle；不一致即以 `BUNDLE_STALE`（错误码 54）失败关闭并在消息中给出重建命令，先于 hooks、快照与网络检查执行。任何工作流路径都不可豁免。
+- **全量测试冻结门禁（R3）**：本次 prepare 未跑全量测试就无法产生计划摘要；门禁位于 `computePlanDigest` 之前，`testSelection` 取值在 project 与 plan schema 中按枚举校验，overlay 无豁免开关。
+- **发布冻结标记（R4）**：prepare 成功后写入 `.release-skill/FROZEN`，内容为 `planDigest`、`targetVersions`（unit → 版本映射）、`createdAt`、`runId`；仅当 verify 到达 `VERIFIED` 时才清除，为兄弟仓库与治理任务提供机器可读的发布期回避信号。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.6.0 是当前源码候选，v0.4.1 仍是最新已发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
+> **当前边界：** v0.6.1 是当前源码候选，v0.4.1 仍是最新已发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；"当前发布版本"与"首次生产验证里程碑"
@@ -33,7 +34,7 @@ v0.6.0 把发布循环中最容易出错的一步记账工作自动化了：发
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.6.0 是当前源码候选，v0.4.1 是最新已发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.6.1 是当前源码候选，v0.4.1 是最新已发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.6.0",
+      "version": "0.6.1",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"