release-skill 0.6.3 → 0.7.0

package/src/commands/prepare.mjs

@@ -18,13 +18,14 @@
  * @module commands/prepare
  */
 
-import { resolve, relative, isAbsolute, normalize, dirname, basename } from 'node:path';
-import { readFile, mkdir, readdir, realpath } from 'node:fs/promises';
+import { resolve, relative, isAbsolute, normalize, dirname, basename, posix as pathPosix } from 'node:path';
+import { readFile, mkdir, readdir, realpath, lstat } from 'node:fs/promises';
 import { execFile as execFileCb } from 'node:child_process';
 import { promisify } from 'node:util';
 
 const execFile = promisify(execFileCb);
 
+import { classifyPathInput } from 'skill-family-harness-node';
 import { loadProjectConfig } from '../core/config.mjs';
 import { captureBaseline } from '../core/baseline.mjs';
 import { runHook } from '../core/hooks.mjs';
@@ -78,6 +79,7 @@ import {
   orderNormalizedHooks,
   PAYLOAD_SOURCE_TAG_WORKTREE,
 } from '../core/postpublish.mjs';
+import { freezeExecutionBundle, bundleRootForAuthorityDir } from '../core/postpublish-bundle.mjs';
 
 // ---------------------------------------------------------------------------
 // 安装契约常量
@@ -1122,6 +1124,128 @@ async function buildProductionAssets(
   return assets;
 }
 
+// ---------------------------------------------------------------------------
+// F-01 / T1: private execution inputs freeze gate
+// ---------------------------------------------------------------------------
+
+/**
+ * Normalize one relative path for closure-style set comparison (the same
+ * lexical normalization Foundation applies to closure resource paths).
+ *
+ * @param {string} value - Relative path candidate.
+ * @returns {string} POSIX-normalized form.
+ */
+function normalizeRelativeClosurePath(value) {
+  return pathPosix.normalize(String(value).replaceAll('\\', '/'));
+}
+
+/**
+ * Enumerate the paths present in the frozen tag tree: the production asset
+ * commit is the commit the distribution tag will point at, and its tree
+ * lives in the detached asset repository built by buildProductionAssets.
+ * Read-only local git; no network.
+ *
+ * @param {string} root - Release workspace root.
+ * @param {object} asset - productionAssets entry (gitObjectDir + commit).
+ * @returns {Promise<Set<string>>} Normalized paths contained in the tag.
+ */
+async function enumerateFrozenTagPaths(root, asset) {
+  const gitDir = resolve(root, asset.gitObjectDir);
+  let stdout;
+  try {
+    ({ stdout } = await execFile('git', [
+      '--git-dir', gitDir,
+      'ls-tree', '-r', '-z', '--name-only', asset.commit,
+    ]));
+  } catch (err) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      `cannot enumerate the frozen tag tree for the executionFiles gate: ${err?.message ?? err}`,
+      { gitObjectDir: asset.gitObjectDir, commit: asset.commit },
+    );
+  }
+  return new Set(`${stdout}`.split('\0').filter(Boolean).map(normalizeRelativeClosurePath));
+}
+
+/**
+ * Collect the relative-path candidates from every postPublish command array
+ * (materialize, steps, custom command hooks). Flag-like elements are not
+ * path candidates; lexical safety is decided by Foundation classification.
+ *
+ * @param {object} postPublish - The unit postPublish declaration.
+ * @returns {Array<{where: string, element: string}>}
+ */
+function collectPostPublishCommandCandidates(postPublish) {
+  const candidates = [];
+  const visit = (where, command) => {
+    if (!Array.isArray(command)) return;
+    for (const element of command) {
+      if (typeof element !== 'string' || element.length === 0 || element.startsWith('-')) continue;
+      candidates.push({ where, element });
+    }
+  };
+  visit('materialize', postPublish.materialize?.command);
+  for (const step of postPublish.steps ?? []) visit(`steps[${step.name}]`, step.command);
+  for (const hook of postPublish.hooks ?? []) {
+    if (Array.isArray(hook.command)) visit(`hooks[${hook.id}]`, hook.command);
+  }
+  return candidates;
+}
+
+/**
+ * F-01 / T1 declaration gate (fail-closed, before any plan write):
+ *
+ * - a command-array element that is a safe relative path, EXISTS as a
+ *   regular file in the live workspace, is ABSENT from the frozen tag tree,
+ *   and is NOT declared in executionFiles is an undeclared private input —
+ *   report it immediately instead of letting distribute guess or copy;
+ * - an executionFiles entry that already exists in the frozen tag is
+ *   rejected: tag files stay bound to tagCommit and the execution bundle
+ *   must never shadow them.
+ *
+ * When no frozen tag exists yet (non-production prepare) the tag-dependent
+ * checks are skipped — distribute fails closed later without a tagCommit.
+ *
+ * @param {object} postPublish - Unit postPublish declaration.
+ * @param {object} params
+ * @param {string} params.workspaceRoot - Release workspace root (realpath).
+ * @param {Set<string>|null} params.frozenTagPaths - Frozen tag tree paths.
+ * @param {string[]} params.executionFiles - Declared closed-world manifest.
+ */
+async function assertPrivateExecutionDeclarations(postPublish, { workspaceRoot, frozenTagPaths, executionFiles }) {
+  const declared = new Set(executionFiles.map(normalizeRelativeClosurePath));
+  for (const { where, element } of collectPostPublishCommandCandidates(postPublish)) {
+    const classification = classifyPathInput(element);
+    if (!classification.ok) continue; // absolute/UNC/backslash inputs are not workspace-relative files
+    let stats = null;
+    try {
+      stats = await lstat(resolve(workspaceRoot, element));
+    } catch {
+      continue; // not present in the live workspace: nothing to declare
+    }
+    if (!stats.isFile()) continue;
+    const normalized = normalizeRelativeClosurePath(element);
+    if (frozenTagPaths && frozenTagPaths.has(normalized)) continue; // bound by tagCommit
+    if (declared.has(normalized)) continue;
+    throw new ReleaseError(
+      GATE_FAILED,
+      `postPublish ${where} command references the workspace-private file "${element}" that exists in the workspace but is absent from the frozen tag; declare it in postPublish.executionFiles (closed world — helper files included)`,
+      { where, path: element },
+    );
+  }
+  if (frozenTagPaths) {
+    for (const entry of executionFiles) {
+      if (frozenTagPaths.has(normalizeRelativeClosurePath(entry))) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          `postPublish.executionFiles entry "${entry}" already exists in the frozen tag; tag files stay bound to tagCommit and the execution bundle must never shadow them`,
+          { path: entry },
+        );
+      }
+    }
+  }
+}
+
 // ---------------------------------------------------------------------------
 // External independent marketplace freeze (production + online only)
 // ---------------------------------------------------------------------------
@@ -1836,6 +1960,15 @@ export function buildExternalActions(unitResults, resolvedVersions, productionAs
  * @param {boolean} [options.hookCache=true] - When false (CLI --no-hook-cache),
  *   every declared hook runs in full and the incremental hook cache is neither
  *   read nor written.
+ * @param {Function} [options.adapterFreshnessFn] - Adapter derived-artifact
+ *   pre-gate (default assertAdapterFreshness). No environment variable
+ *   exempts the default gate (F-03): it runs in the CLI, plain function
+ *   calls, and the node:test harness alike. Tests that need a lightweight
+ *   fixture inject a double explicitly in-process; the CLI exposes no
+ *   parameter for it.
+ * @param {Function} [options.selfBootstrapFactsFn] - Self-bootstrap fact-pin
+ *   pre-gate (default assertSelfBootstrapFacts); same injection contract as
+ *   adapterFreshnessFn.
  *
  * @returns {Promise<{ planPath: string, planDigest: string, evidenceDir: string, warnings: ReadonlyArray<object>, nextSteps: ReadonlyArray<{ code: string, message: string }> }>}
  *
@@ -2108,6 +2241,11 @@ export async function prepareRelease(options) {
     // stage so the same drift fails closed in seconds, before any hook. Like
     // the bundle freshness gate this is artifact-integrity class: workflow
     // trimming never exempts it. Installed layouts record not-applicable.
+    // F-03 (2026-08-21 architecture review): the gates run identically in
+    // the CLI, plain function calls, and the node:test harness — no
+    // environment variable may exempt them (a test seam is never a
+    // production switch). Tests that need lightweight fixtures inject the
+    // adapterFreshnessFn/selfBootstrapFactsFn seams explicitly in-process.
     await evidence.append({ phase: 'adapter-freshness', status: 'started' });
     const adapterFreshnessFn = options.adapterFreshnessFn ?? assertAdapterFreshness;
     let adapterFreshness;
@@ -3595,16 +3733,51 @@ export async function prepareRelease(options) {
     // tagCommit, never from workspace state). planVersion 2 record-layer
     // stripping does not strip this block, so every declaration detail is
     // bound into the plan digest.
+    //
+    // F-01 / T1 private execution bundle: parent-workspace files that the
+    // post-publish commands need but the frozen tag does not contain are
+    // frozen here — Foundation closure (verbatim computeResourceClosure
+    // return) + the release-unit publicFiles projection — and their bytes
+    // are published digest-addressed under this plan's .release-skill. The
+    // plan is the bundle's only source of truth (no parallel manifest, no
+    // second bundle digest): the raw executionFiles list folds into the
+    // closure and is NOT duplicated into the frozen block.
     let frozenPostPublish = null;
     if (postPublishDeclaration) {
       const { unit, index } = postPublishDeclaration;
       const { tag } = resolveProductionBranch(unit, resolvedVersions[index]);
+      const declaredExecutionFiles = unit.postPublish.executionFiles ?? [];
+      const frozenTagPaths = productionAssets
+        ? await enumerateFrozenTagPaths(realRoot, productionAssets[index])
+        : null;
+      await assertPrivateExecutionDeclarations(unit.postPublish, {
+        workspaceRoot: realRoot,
+        frozenTagPaths,
+        executionFiles: declaredExecutionFiles,
+      });
+      const executionBundle = await freezeExecutionBundle({
+        workspaceRoot: realRoot,
+        releaseSkillDir: releaseDir,
+        executionFiles: declaredExecutionFiles,
+        publicFiles: unit.publicFiles ?? [],
+      });
+      await evidence.append({
+        phase: 'postpublish-execution-bundle',
+        status: 'frozen',
+        unitId: unit.id,
+        closureDigest: executionBundle.closure.digest,
+        resourceCount: executionBundle.closure.resources.length,
+        publicFileCount: executionBundle.publicFiles.length,
+        bundleRoot: relative(realRoot, bundleRootForAuthorityDir(releaseDir)),
+      });
+      const { executionFiles: _executionFiles, ...declarationWithoutManifest } = structuredClone(unit.postPublish);
       frozenPostPublish = {
-        ...structuredClone(unit.postPublish),
+        ...declarationWithoutManifest,
         tag,
         ...(productionAssets ? { tagCommit: productionAssets[index].commit } : {}),
         unitId: unit.id,
         payloadSource: PAYLOAD_SOURCE_TAG_WORKTREE,
+        executionBundle,
       };
     }
 

package/src/core/docs-refresh-preset.mjs

@@ -28,6 +28,7 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 
 import { ReleaseError, GATE_FAILED } from './errors.mjs';
 import { applyDownstreamGitChange } from './preset-gitwrite.mjs';
+import { redactUrlCredentialsIfPresent } from './git-url-policy.mjs';
 
 /**
  * Assert `from` stays inside the materialized payload directory (declaration
@@ -60,14 +61,15 @@ function resolvePayloadSource(payloadDir, from) {
  * @param {object} params.commitIdentity - Frozen commitIdentity.
  * @param {string} params.payloadDir - Materialized payload directory
  *   (distribute phase; postVerify contexts never carry it).
- * @param {string} params.root - Release workspace root.
+ * @param {string} params.releaseWorkspaceRoot - Release workspace root (the
+ *   real project root; workspace addressing resolution + write exclusion).
  * @param {Function} [params.exec] - Injectable git exec (tests).
  * @param {Function} [params.hookRunner] - Injectable gate runner (tests).
  * @returns {Promise<{ status: string, observation: object,
  *   observations: object[], mode: string }>}
  */
 export async function executeDocsRefreshHook(params) {
-  const { hook, contextProjection, commitIdentity, payloadDir, root, exec, hookRunner } = params ?? {};
+  const { hook, contextProjection, commitIdentity, payloadDir, releaseWorkspaceRoot, exec, hookRunner } = params ?? {};
   const config = hook?.config;
   const repositories = config?.repositories;
   if (!Array.isArray(repositories) || repositories.length === 0) {
@@ -124,7 +126,7 @@ export async function executeDocsRefreshHook(params) {
         mutate,
         gates,
         contextProjection,
-        root,
+        releaseWorkspaceRoot,
         ...(exec !== undefined ? { exec } : {}),
         ...(hookRunner !== undefined ? { hookRunner } : {}),
       });
@@ -137,7 +139,9 @@ export async function executeDocsRefreshHook(params) {
     }
     observations.push({
       repositoryIndex: index,
-      ...(typeof target.remoteUrl === 'string' ? { remoteUrl: target.remoteUrl } : {}),
+      ...(typeof target.remoteUrl === 'string'
+        ? { remoteUrl: redactUrlCredentialsIfPresent(target.remoteUrl) }
+        : {}),
       ...(typeof target.workspace === 'string' ? { workspace: target.workspace } : {}),
       branch: target.branch,
       ...(result.observation ?? {}),

package/src/core/evidence.mjs

@@ -10,6 +10,8 @@
 import { open, mkdir, writeFile } from 'node:fs/promises';
 import { basename } from 'node:path';
 
+import { redactEmbeddedUrlCredentials } from './git-url-policy.mjs';
+
 /** Schema version for evidence events. */
 const SCHEMA_VERSION = 1;
 
@@ -66,11 +68,16 @@ export function redact(obj) {
   }
 
   if (typeof obj === 'string') {
+    // F-05: strip any embedded URL userinfo before the value reaches disk.
+    // Only credential-bearing URL spans are rewritten; ordinary strings and
+    // credential-free URLs pass through unchanged.
+    const urlRedacted = redactEmbeddedUrlCredentials(obj);
     for (const { prefix, label } of CREDENTIAL_PREFIXES) {
-      if (obj.startsWith(prefix)) {
+      if (urlRedacted.startsWith(prefix)) {
         return `[REDACTED:${label}]`;
       }
     }
+    return urlRedacted;
   }
 
   return obj;

package/src/core/git-url-policy.mjs

@@ -0,0 +1,214 @@
+/**
+ * Release-domain Git remote URL policy (architecture gap F-05, T5).
+ *
+ * The SINGLE boundary for every postPublish remote-write URL: allowed
+ * protocols, the Git path shape, and the remote-write grading. Consumers:
+ * core/postpublish.mjs (declaration re-validation), core/presets.mjs (preset
+ * registry config), core/preset-gitwrite.mjs + core/proposal-inbox.mjs
+ * (write transports), adapters/distribute-git.mjs (legacy target mirror).
+ * The root JSON schemas are only the first gate; this runtime policy is the
+ * final authority, so plans frozen by older schema versions cannot smuggle
+ * unsafe URLs through.
+ *
+ * Boundary rules (what this module is NOT):
+ * - Parsing is delegated to the standard WHATWG URL — this module expresses
+ *   release-domain POLICY over the parse result; it implements no generic
+ *   URL parser.
+ * - Credential redaction is delegated to the Foundation
+ *   `redactUrlCredentials` (skill-family-harness-node, FG-2) — this module
+ *   implements no generic redactor; it only decides WHEN the Foundation
+ *   redactor applies so non-URL strings are never collapsed into the opaque
+ *   placeholder.
+ *
+ * Fail-closed vocabulary: every rejection reason is a stable token, and
+ * failure text NEVER carries the original URL — a rejected URL may hold
+ * userinfo credentials, and echoing it would defeat the boundary.
+ *
+ * @module core/git-url-policy
+ */
+
+import {
+  redactUrlCredentials,
+  REDACTED_URL_PLACEHOLDER,
+} from 'skill-family-harness-node';
+
+/**
+ * Protocols allowed for postPublish remote writes: http(s) for real remotes,
+ * file: strictly as the test transport.
+ */
+export const GIT_REMOTE_PROTOCOLS = Object.freeze(['http:', 'https:', 'file:']);
+
+/**
+ * Remote-write grading (发布领域远端写分级): the protocol decides the grade —
+ * http(s) are real remote writes, file: is the test transport. Central here
+ * so no consumer re-derives grading from its own protocol regex.
+ */
+export const GIT_REMOTE_WRITE_GRADES = Object.freeze({
+  'http:': 'remote-write',
+  'https:': 'remote-write',
+  'file:': 'test-transport',
+});
+
+/** Rejection reason vocabulary; every entry is safe to surface (no URL). */
+export const GIT_REMOTE_URL_REASONS = Object.freeze({
+  NOT_A_STRING: 'not-a-string',
+  CONTROL_CHARACTERS: 'control-characters',
+  UNPARSEABLE: 'unparseable',
+  PROTOCOL_NOT_ALLOWED: 'protocol-not-allowed',
+  MISSING_HOST: 'missing-host',
+  CREDENTIALS_PRESENT: 'credentials-present',
+  QUERY_OR_FRAGMENT_REJECTED: 'query-or-fragment-rejected',
+  NOT_A_GIT_PATH: 'not-a-git-path',
+});
+
+/**
+ * Human-readable failure text per rejection reason. Deliberately carries NO
+ * part of the offending URL (a credential-bearing URL must never be echoed
+ * back through an error surface).
+ */
+const FAILURE_TEXT = Object.freeze({
+  [GIT_REMOTE_URL_REASONS.NOT_A_STRING]: 'must be a non-empty string',
+  [GIT_REMOTE_URL_REASONS.CONTROL_CHARACTERS]: 'contains control characters',
+  [GIT_REMOTE_URL_REASONS.UNPARSEABLE]:
+    'must be an absolute URL parseable by the standard URL parser',
+  [GIT_REMOTE_URL_REASONS.PROTOCOL_NOT_ALLOWED]:
+    'protocol must be http:, https:, or file: (file: is the test transport)',
+  [GIT_REMOTE_URL_REASONS.MISSING_HOST]: 'http(s) URLs must carry a host',
+  [GIT_REMOTE_URL_REASONS.CREDENTIALS_PRESENT]:
+    'must never carry embedded credentials (username/password) — credentials belong to the host git credential helper, never to the URL',
+  [GIT_REMOTE_URL_REASONS.QUERY_OR_FRAGMENT_REJECTED]:
+    'must carry no query or fragment',
+  [GIT_REMOTE_URL_REASONS.NOT_A_GIT_PATH]: 'pathname must end in .git',
+});
+
+/**
+ * Describe one rejection reason for error messages (always URL-free).
+ *
+ * @param {string} reason - One of GIT_REMOTE_URL_REASONS.
+ * @returns {string} Safe human-readable failure text.
+ */
+export function describeGitRemoteUrlFailure(reason) {
+  return FAILURE_TEXT[reason] ?? 'is not an allowed Git remote URL';
+}
+
+/**
+ * The runtime contract check for one postPublish remote-write URL:
+ * 1. non-empty string, no control characters (checked on the RAW value —
+ *    WHATWG parsing silently folds \t\r\n, so the raw check fails closed);
+ * 2. `new URL()` parse (the standard parser is the only parser);
+ * 3. protocol allowlist: http:, https:, file: (test transport);
+ * 4. http(s) must carry a host;
+ * 5. ALL protocols reject a non-empty username or password;
+ * 6. no query or fragment (a git remote URL is a bare location);
+ * 7. the PATHNAME ends in .git.
+ *
+ * @param {*} remoteUrl
+ * @returns {{ ok: true, protocol: string, grade: string }
+ *   | { ok: false, reason: string }} The verdict never carries the input.
+ */
+export function checkGitRemoteUrl(remoteUrl) {
+  if (typeof remoteUrl !== 'string' || remoteUrl.length === 0) {
+    return { ok: false, reason: GIT_REMOTE_URL_REASONS.NOT_A_STRING };
+  }
+  if (/[\x00-\x1f\x7f]/.test(remoteUrl)) {
+    return { ok: false, reason: GIT_REMOTE_URL_REASONS.CONTROL_CHARACTERS };
+  }
+  let url;
+  try {
+    url = new URL(remoteUrl);
+  } catch {
+    return { ok: false, reason: GIT_REMOTE_URL_REASONS.UNPARSEABLE };
+  }
+  if (!GIT_REMOTE_PROTOCOLS.includes(url.protocol)) {
+    return { ok: false, reason: GIT_REMOTE_URL_REASONS.PROTOCOL_NOT_ALLOWED };
+  }
+  if (url.protocol !== 'file:' && url.hostname === '') {
+    return { ok: false, reason: GIT_REMOTE_URL_REASONS.MISSING_HOST };
+  }
+  if (url.username !== '' || url.password !== '') {
+    return { ok: false, reason: GIT_REMOTE_URL_REASONS.CREDENTIALS_PRESENT };
+  }
+  if (url.search !== '' || url.hash !== '') {
+    return { ok: false, reason: GIT_REMOTE_URL_REASONS.QUERY_OR_FRAGMENT_REJECTED };
+  }
+  if (!url.pathname.endsWith('.git')) {
+    return { ok: false, reason: GIT_REMOTE_URL_REASONS.NOT_A_GIT_PATH };
+  }
+  return { ok: true, protocol: url.protocol, grade: GIT_REMOTE_WRITE_GRADES[url.protocol] };
+}
+
+/**
+ * Boolean form of the policy check (cross-check skip decisions, probes).
+ *
+ * @param {*} remoteUrl
+ * @returns {boolean} True only for policy-allowed Git remote URLs.
+ */
+export function isAllowedGitRemoteUrl(remoteUrl) {
+  return checkGitRemoteUrl(remoteUrl).ok === true;
+}
+
+/**
+ * Remote-write grade for one policy-allowed URL; null when the URL does not
+ * pass the policy (grading never applies to rejected URLs).
+ *
+ * @param {*} remoteUrl
+ * @returns {'remote-write'|'test-transport'|null}
+ */
+export function resolveGitRemoteWriteGrade(remoteUrl) {
+  const verdict = checkGitRemoteUrl(remoteUrl);
+  return verdict.ok ? verdict.grade : null;
+}
+
+/**
+ * Guarded credential redaction for long-lived outputs (evidence, error
+ * messages/details, preset observations). Delegates the actual redaction to
+ * the Foundation `redactUrlCredentials`:
+ * - values that parse as an absolute URL carrying userinfo come back as the
+ *   Foundation's credential-free serialization;
+ * - unparseable `scheme://...@...` authority shapes cannot be proven
+ *   credential-free and fail closed to the opaque placeholder (the same
+ *   stance as the Foundation's degraded path);
+ * - every other value returns UNCHANGED (blindly applying the Foundation
+ *   redactor would collapse ordinary non-URL strings into the placeholder).
+ *
+ * @param {*} value
+ * @returns {*} The credential-free value (or the input, unchanged).
+ */
+export function redactUrlCredentialsIfPresent(value) {
+  if (typeof value !== 'string' || value.length === 0) return value;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    if (/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^/]*@/.test(value)) {
+      return REDACTED_URL_PLACEHOLDER;
+    }
+    return value;
+  }
+  if (url.username === '' && url.password === '') return value;
+  return redactUrlCredentials(url);
+}
+
+/**
+ * Candidate URL-span tokenizer for prose (log lines, error messages). It only
+ * LOCATES spans shaped like `scheme://...`; the credential decision and the
+ * redaction itself are delegated to the standard URL parser + the Foundation
+ * redactor via redactUrlCredentialsIfPresent. This is what makes the error
+ * and evidence chokepoints safe "even if a validation misses" (F-05): a
+ * credential-bearing URL embedded mid-sentence cannot survive to disk.
+ */
+const URL_SPAN_RE = /\b[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^\s'"<>`]+/g;
+
+/**
+ * Redact credential-bearing URL spans anywhere inside a string (whole value
+ * or embedded in prose). Credential-free spans and all non-URL text return
+ * byte-for-byte unchanged.
+ *
+ * @param {*} text
+ * @returns {*} The credential-free string (or the input, unchanged).
+ */
+export function redactEmbeddedUrlCredentials(text) {
+  if (typeof text !== 'string' || text.length === 0) return text;
+  if (!text.includes('://')) return text;
+  return text.replace(URL_SPAN_RE, (span) => redactUrlCredentialsIfPresent(span));
+}

package/src/core/marketplace-registry-entry.mjs

@@ -99,13 +99,14 @@ export function serializeRegistry(registry) {
  * @param {object} params.hook - Declared hook entry (config bound).
  * @param {object} params.contextProjection - The §2.3 context projection.
  * @param {object} params.commitIdentity - Frozen commitIdentity.
- * @param {string} params.root - Release workspace root.
+ * @param {string} params.releaseWorkspaceRoot - Release workspace root (the
+ *   real project root; workspace addressing resolution + write exclusion).
  * @param {Function} [params.exec] - Injectable git exec (tests).
  * @param {Function} [params.hookRunner] - Injectable gate runner (tests).
  * @returns {Promise<{ status: string, observation: object, registryPath: string }>}
  */
 export async function executeMarketplaceRegistryEntryHook(params) {
-  const { hook, contextProjection, commitIdentity, root, exec, hookRunner } = params ?? {};
+  const { hook, contextProjection, commitIdentity, releaseWorkspaceRoot, exec, hookRunner } = params ?? {};
   const config = hook?.config;
   const target = config?.target;
   if (!target || typeof target.branch !== 'string') {
@@ -166,7 +167,7 @@ export async function executeMarketplaceRegistryEntryHook(params) {
     mutate,
     gates: config?.gates ?? [],
     contextProjection,
-    root,
+    releaseWorkspaceRoot,
     ...(exec !== undefined ? { exec } : {}),
     ...(hookRunner !== undefined ? { hookRunner } : {}),
   });