release-skill 0.6.2 → 0.6.3

package/adapters/claude/schemas/.render-manifest.json

@@ -21,17 +21,21 @@
       "digest": "b7e14522a5aba818cab191545f23d2323be0e4c80566e9d3e4da576103a00490",
       "bytes": 2390
     },
+    "postpublish-approval-record.schema.json": {
+      "digest": "e365c9e9f5aa189ca6788e68dbedfa718aa120f2c197534417c21e019b9a29a4",
+      "bytes": 1744
+    },
     "release-plan.schema.json": {
-      "digest": "5e988a5301b89b3d3260154ffae12669af0e4d6ec7f9db8c44df21037ea0eaf6",
-      "bytes": 46948
+      "digest": "517ac9b1d92d2bf348497ee0e79c9e474a4c60e6ed8ba77830948716d143dfa2",
+      "bytes": 49369
     },
     "release-project.schema.json": {
-      "digest": "546e05845cd83a3b1db0a54036f9555081420337e9df961d783d2d2630800ef7",
-      "bytes": 41898
+      "digest": "d38649d1dc9b1dbc643f4e2c98fd18d111090e9ce221c9c61fa50245f6c4c232",
+      "bytes": 45715
     },
     "release-run.schema.json": {
-      "digest": "6dd239c59f7045df11d13d6ba2027610d3c55c27a6af5bc87676b0eaad9600fd",
-      "bytes": 17663
+      "digest": "a605db801d6994d657049431ad453233974bd10610b7b447b196136bb0692866",
+      "bytes": 17847
     }
   }
 }

package/adapters/claude/schemas/postpublish-approval-record.schema.json

@@ -0,0 +1,47 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://release-skill.dev/schemas/postpublish-approval-record/v1",
+  "title": "PostPublish Hook Approval Record",
+  "description": "Schema for checkpoint-level approval of a requiresApproval postPublish hook (v0.6.3 R1, design §2.7 ruling 2). Binds the approval to (planDigest, hookId); the plan-level approval-record schema is untouched. runId is audit-only and never participates in binding or validation semantics.",
+  "type": "object",
+  "required": [
+    "planDigest",
+    "hookId",
+    "actor",
+    "approvedAt",
+    "expiresAt"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "planDigest": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$",
+      "description": "SHA-256 digest of the frozen release plan whose postPublish hooks block this approval binds to"
+    },
+    "hookId": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9._-]*$",
+      "description": "id of the requiresApproval postPublish hook being approved (must be declared in the frozen plan)"
+    },
+    "actor": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Identity of the approver"
+    },
+    "approvedAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO 8601 timestamp when approval was granted"
+    },
+    "expiresAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO 8601 timestamp when approval expires (max 24h after approvedAt; 5-minute clock skew tolerated at validation)"
+    },
+    "runId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Audit-only identifier of the distribute run present when approval was granted; never a binding"
+    }
+  }
+}

package/adapters/claude/schemas/release-plan.schema.json

@@ -1307,7 +1307,6 @@
       "description": "冻结的发布后分发块：声明本身 + tag/tagCommit/unitId/payloadSource 绑定。整体参与 plan digest（planVersion 2 记录层剥离不包含该块），任何配置变更都会改变 planDigest。tagCommit 仅在 prepare 能冻结 create-tag 预期 commit 时存在（production 资产）；缺省时 distribute fail-closed。",
       "required": [
         "materialize",
-        "targets",
         "commitIdentity",
         "tag",
         "unitId",
@@ -1325,6 +1324,13 @@
             "$ref": "#/definitions/planPostPublishTarget"
           }
         },
+        "hooks": {
+          "type": "array",
+          "description": "冻结的发布后钩子声明（v0.6.3 R1）；随整块参与 plan digest",
+          "items": {
+            "$ref": "#/definitions/planPostPublishHook"
+          }
+        },
         "commitIdentity": {
           "type": "object",
           "required": [
@@ -1373,6 +1379,64 @@
         }
       }
     },
+    "planPostPublishHook": {
+      "type": "object",
+      "description": "冻结的发布后钩子声明项（v0.6.3 R1）：preset 与 command 运行时互斥；phase 缺省 distribute；blocksVerified 缺省 true 且仅 preset 可声明 false",
+      "required": [
+        "id"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9._-]*$"
+        },
+        "preset": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9._-]*$"
+        },
+        "command": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          }
+        },
+        "phase": {
+          "type": "string",
+          "enum": [
+            "distribute",
+            "postVerify"
+          ]
+        },
+        "config": {
+          "type": "object"
+        },
+        "cwd": {
+          "type": "string",
+          "pattern": "^(?:\\.$|(?!\\/)(?!\\.\\/)(?!.*\\\\)(?!.*:)(?!\\.\\.(?:\\/|$))(?!.*\\/\\.\\.\\/)(?!.*\\/\\.\\.$)(?!.*\\/\\.\\/)(?!.*\\/\\/)(?!.*\\0)(?!.*\\/\\.$)(?!.*\\/\\/$)(?!.*\\/$).*)$"
+        },
+        "timeoutMs": {
+          "type": "integer",
+          "minimum": 1000,
+          "maximum": 7200000
+        },
+        "envAllowlist": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^(?!.*(?:TOKEN|SECRET|PASSWORD|PASSPHRASE|API_KEY|CREDENTIAL))[A-Z_][A-Z0-9_]*$"
+          },
+          "uniqueItems": true
+        },
+        "requiresApproval": {
+          "type": "boolean"
+        },
+        "blocksVerified": {
+          "type": "boolean"
+        }
+      }
+    },
     "planPostPublishMaterialize": {
       "type": "object",
       "required": [

package/adapters/claude/schemas/release-project.schema.json

@@ -889,7 +889,6 @@
       "description": "发布后分发声明：materialize 钩子从冻结 tag 工作树物化载荷，targets 将载荷镜像或渲染市场索引推送到独立 git 远端。分发在 publish 之后由 distribute 命令执行，时序契约禁止读取工作区状态。",
       "required": [
         "materialize",
-        "targets",
         "commitIdentity"
       ],
       "additionalProperties": false,
@@ -904,6 +903,13 @@
             "$ref": "#/definitions/postPublishTarget"
           }
         },
+        "hooks": {
+          "type": "array",
+          "description": "发布后钩子声明（v0.6.3 R1）：每项为命名 preset（+config）或自定义 command 钩子（executable+参数数组，禁止 shell 字符串）。schema 层只校验形状；preset 与 command 互斥、preset 注册表归属等语义在运行时 fail-closed 校验（POSTPUBLISH_HOOK_INVALID）",
+          "items": {
+            "$ref": "#/definitions/postPublishHook"
+          }
+        },
         "commitIdentity": {
           "type": "object",
           "description": "分发仓库提交者身份（bot 身份），通过 git -c user.name/-c user.email 注入，绝不读取或修改全局 git 配置",
@@ -936,6 +942,72 @@
         }
       }
     },
+    "postPublishHook": {
+      "type": "object",
+      "description": "发布后钩子声明项：preset（命名预设 + config）与 command（自定义命令）在运行时互斥校验；phase 缺省为 distribute（VERIFIED 之前执行），postVerify 在 verify 通过后作为独立 run 执行（R3）；blocksVerified 缺省 true，仅 preset 可声明 false",
+      "required": [
+        "id"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9._-]*$"
+        },
+        "preset": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9._-]*$",
+          "description": "预设注册表中的预设名（R2 起）；R1 无注册表，任何 preset 引用在运行时 fail-closed"
+        },
+        "command": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          },
+          "description": "executable+参数数组（禁止 shell 字符串）；在冻结 tag 工作树中执行"
+        },
+        "phase": {
+          "type": "string",
+          "enum": [
+            "distribute",
+            "postVerify"
+          ],
+          "description": "执行阶段；缺省 distribute"
+        },
+        "config": {
+          "type": "object",
+          "description": "preset 钩子的配置对象；语义由预设注册表校验（R2 起）"
+        },
+        "cwd": {
+          "type": "string",
+          "pattern": "^(?:\\.$|(?!\\/)(?!\\.\\/)(?!.*\\\\)(?!.*:)(?!\\.\\.(?:\\/|$))(?!.*\\/\\.\\.\\/)(?!.*\\/\\.\\.$)(?!.*\\/\\.\\/)(?!.*\\/\\/)(?!.*\\0)(?!.*\\/\\.$)(?!.*\\/\\/$)(?!.*\\/$).*)$",
+          "description": "command 钩子执行目录（相对冻结 tag 工作树）；preset 钩子禁止声明（运行时 fail-closed）"
+        },
+        "timeoutMs": {
+          "type": "integer",
+          "minimum": 1000,
+          "maximum": 7200000
+        },
+        "envAllowlist": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^(?!.*(?:TOKEN|SECRET|PASSWORD|PASSPHRASE|API_KEY|CREDENTIAL))[A-Z_][A-Z0-9_]*$"
+          },
+          "uniqueItems": true,
+          "description": "允许透传给钩子进程的环境变量白名单；TOKEN/SECRET 等敏感子串在 schema 层即被拒绝"
+        },
+        "requiresApproval": {
+          "type": "boolean",
+          "description": "执行前需要 checkpoint 级批准（绑定 planDigest + hookId）；public-write preset 缺省 true"
+        },
+        "blocksVerified": {
+          "type": "boolean",
+          "description": "失败时是否阻断 VERIFIED；缺省 true；仅 preset 可声明 false（运行时 fail-closed 校验）"
+        }
+      }
+    },
     "postPublishMaterialize": {
       "type": "object",
       "description": "载荷物化钩子：executable+参数数组（禁止 shell 字符串），stdout 中 outputMarker 行之后为载荷目录路径；可选 requireReport 对 stdout 首个 JSON 对象做字段断言",

package/adapters/claude/schemas/release-run.schema.json

@@ -43,7 +43,8 @@
         "PARTIAL",
         "BLOCKED",
         "DISTRIBUTING",
-        "DISTRIBUTED"
+        "DISTRIBUTED",
+        "NEEDS_INPUT"
       ],
       "description": "Current status of the run"
     },
@@ -55,7 +56,8 @@
         "publish",
         "reconcile",
         "verify",
-        "distribute"
+        "distribute",
+        "postverify"
       ],
       "description": "The command that initiated this run"
     },
@@ -133,7 +135,8 @@
               "codebuddy-marketplace-install",
               "set-default-branch",
               "distribute-probe",
-              "distribute-mirror"
+              "distribute-mirror",
+              "postpublish-hook"
             ],
             "description": "Type of external action"
           },
@@ -149,9 +152,10 @@
               "PASSED_AUTOMATIC",
               "PASSED_MANUAL",
               "NOT_REQUIRED_UNCHANGED",
-              "NO_CHANGE"
+              "NO_CHANGE",
+              "AWAITING_APPROVAL"
             ],
-            "description": "Result status of this checkpoint (uncertain = started, result unknown; deferred = marketplace action postponed to verify phase; PASSED_AUTOMATIC/PASSED_MANUAL/NOT_REQUIRED_UNCHANGED 为验证阶段专用状态; NO_CHANGE = distribute 目标暂存差异为空，未产生 commit/tag/push)"
+            "description": "Result status of this checkpoint (uncertain = started, result unknown; deferred = marketplace action postponed to verify phase; PASSED_AUTOMATIC/PASSED_MANUAL/NOT_REQUIRED_UNCHANGED 为验证阶段专用状态; NO_CHANGE = distribute 目标暂存差异为空，未产生 commit/tag/push; AWAITING_APPROVAL = requiresApproval postPublish hook 尚无 checkpoint 批准，v0.6.3 R1)"
           },
           "preObserve": {
             "type": "string",
@@ -621,7 +625,8 @@
             "enum": [
               "reconcile",
               "verify",
-              "distribute"
+              "distribute",
+              "postverify"
             ]
           }
         },

package/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.6.2.",
+      "Prepare a release plan for version 0.6.3.",
       "Help me understand the release workflow."
     ]
   }