release-skill 0.7.5 → 0.7.7

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.7.5",
+      "version": "0.7.7",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.7.5.",
+      "Prepare a release plan for version 0.7.7.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.7.7 locale=en baseline=sha256:bdd8a5cd123e916f5581051c7138f56572b35b3640187551aca6faa453ea1a51 -->
+## [0.7.7] - 2026-08-24
+
+v0.7.7 can publish a small public source-authority receipt that binds an exact source repository and commit to one or more frozen npm tarballs.
+
+### Security
+
+- **Remote commit binding**: publish now requires the remotely observed source commit to equal the receipt's frozen `sourceBaseCommit` before any adapter preflight or write. Verify and reconcile retain the same constraint.
+- **Actual tarball verification**: offline receipt verification reopens every frozen subject tgz with the existing no-follow, file-identity, digest, package-name, and package-version checks before accepting its receipt entry.
+
+### Added
+
+- **Optional public source authority**: projects may declare `publicSourceAuthorityReceipt` with one coordinator release unit and one or more npm subject units. Production prepare freezes canonical `source-authority-receipt.json` bytes from the normalized source repository, baseline commit, package name, version, tarball filename, and SHA-256. Publish then uploads those exact bytes as a GitHub Release asset.
+
+### Upgrade Notes
+
+`publicSourceAuthorityReceipt` is optional. Existing projects require no configuration or migration; enable it only when a release needs the public source-authority asset.
+<!-- release-skill:changelog:end version=0.7.7 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.7.6 locale=en baseline=sha256:16665362b8c0f06b7ed94f2839f5b380216b13ca6ab5e6c51b043985f8a8c8c2 -->
+## [0.7.6] - 2026-08-22
+
+v0.7.6 executes every schema-declared prepare hook and corrects the documented postPublish hierarchy while preserving the current hook authorization and Codex adapter-root semantics.
+
+### Changed
+
+- **Codex adapter contract coverage**: isolated-copy and negative path tests now preserve the existing self-contained adapter root: the host-provided skill path matches `PLUGIN_ROOT/skills/<skill>/SKILL.md`, and the launcher remains `PLUGIN_ROOT/bin/release-skill.mjs`. This is contract hardening, not a runtime protocol change.
+- **Hook authorization remains unchanged**: configuring a hook and invoking its workflow authorizes execution without a separate confirmation point. The legacy acknowledgement flags remain no-effect compatibility inputs; v0.7.6 does not restore a pre-execution confirmation gate.
+
+### Fixed
+
+- **Prepare lint hook**: `lint` now runs before `docs`, `build`, `test`, and `typecheck`; a non-zero lint result stops prepare with `GATE_FAILED`. A schema-to-execution-table contract prevents accepted hook keys from becoming silent dead configuration.
+- **postPublish documentation**: the project configuration standard now places `postPublish` inside each `releaseUnits[]` item and carries a schema-validated example.
+<!-- release-skill:changelog:end version=0.7.6 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.7.5 locale=en baseline=sha256:39f8f00f21c9071341106ea4becf4e8d10a732bd01b430e244dc4e3c5bf07da2 -->
 ## [0.7.5] - 2026-08-22
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.7.5 -->
+<!-- release-skill:release-version: 0.7.7 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -114,7 +114,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.5
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.7
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.7.5 -->
+<!-- release-skill:release-version: 0.7.7 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -104,7 +104,7 @@ Kimi Code 有交互式插件市场，但**没有可脚本化的非交互安装
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.5
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.7
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.7.5 -->
+<!-- release-skill:release-version: 0.7.7 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,17 +14,26 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.7.5** (2026-08-22)
+**0.7.7** (2026-08-24)
 
-v0.7.5 recognizes registered platform projections that publish a single `skill/` entry, closing the remaining false missing-host result for Skill Failure Auditor releases.
+v0.7.7 can publish a small public source-authority receipt that binds an exact source repository and commit to one or more frozen npm tarballs.
 
-**Fixed**
+**Security**
 
-- **Singular platform skill surfaces**: resource closure now assigns `platforms/<host>/skill/SKILL.md` to the registered `platforms/<host>` surface, while preserving root, adapter, and plural `skills/` behavior. Unregistered platform trees still fail closed. The changed closure algorithm is identified as `skill-resource-closure-v4`, so plans frozen by earlier checker versions cannot cross the publish boundary.
+- **Remote commit binding**: publish now requires the remotely observed source commit to equal the receipt's frozen `sourceBaseCommit` before any adapter preflight or write. Verify and reconcile retain the same constraint.
+- **Actual tarball verification**: offline receipt verification reopens every frozen subject tgz with the existing no-follow, file-identity, digest, package-name, and package-version checks before accepting its receipt entry.
+
+**Added**
+
+- **Optional public source authority**: projects may declare `publicSourceAuthorityReceipt` with one coordinator release unit and one or more npm subject units. Production prepare freezes canonical `source-authority-receipt.json` bytes from the normalized source repository, baseline commit, package name, version, tarball filename, and SHA-256. Publish then uploads those exact bytes as a GitHub Release asset.
+
+**Upgrade Notes**
+
+`publicSourceAuthorityReceipt` is optional. Existing projects require no configuration or migration; enable it only when a release needs the public source-authority asset.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.7.5 is the current source candidate; v0.7.4 remains
+> **Current boundary:** v0.7.7 is the current source candidate; v0.7.6 remains
 > the latest published release. v0.4.1 was an earlier published milestone;
 > v0.2.2 previously held published status before the platform verification
 > convergence fix was added.
@@ -44,8 +53,8 @@ v0.7.5 recognizes registered platform projections that publish a single `skill/`
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.7.5 is the current
-> source candidate and v0.7.4 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
+> **Production path verified since the v0.1.1 milestone; v0.7.7 is the current
+> source candidate and v0.7.6 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >
 > **Start here:**
@@ -528,9 +537,11 @@ hooks:
     envAllowlist: []
 ```
 
-Hooks run when `prepare` is invoked; the command call itself authorizes
-execution. Gates are the controlled extension point for release calibration
-(see `references/02-project-config.md`).
+Hooks run when `prepare` is invoked. Configuring the command and invoking the
+workflow authorizes execution without an extra confirmation point. The legacy
+`--acknowledge-hook-side-effects` and `--acknowledge-gate-side-effects` flags
+remain accepted as no-effect compatibility inputs. Gates are the controlled
+extension point for release calibration (see `references/02-project-config.md`).
 
 ### postPublish hooks
 

package/README.zh-CN.md

@@ -2,23 +2,32 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.7.5 -->
+<!-- release-skill:release-version: 0.7.7 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.7.5** (2026-08-22)
+**0.7.7** (2026-08-24)
 
-v0.7.5 能识别只发布一个 `skill/` 入口的平台注册投影，消除了 Skill Failure Auditor 发布中剩余的宿主面误判。
+v0.7.7 可以发布精简的公开源码权威收据，把精确的源码仓库与提交绑定到一个或多个已冻结的 npm tarball。
 
-**修复**
+**安全**
 
-- **单数平台技能目录**：资源闭包现在会把 `platforms/<host>/skill/SKILL.md` 归入已登记的 `platforms/<host>` 投影面，同时保持根目录、adapter 和复数 `skills/` 布局的原有行为。未登记的平台目录仍会失败关闭。闭包算法标识升级为 `skill-resource-closure-v4`，早期检查器冻结的计划不能越过发布边界。
+- **远端提交绑定**：publish 现在会在任何 adapter preflight 或写入前，要求远端实际提交与收据中的源码基线字段 `sourceBaseCommit` 一致。verify 与 reconcile 保留相同约束。
+- **实际 tarball 验证**：离线验证会重新打开每个主体的真实冻结 tgz。既有检查会核对符号链接、文件身份、摘要、包名和版本，通过后才接受对应的收据条目。
+
+**新增**
+
+- **可选的公开源码权威收据**：项目可以通过可选配置 `publicSourceAuthorityReceipt` 声明一个协调发布单元和一个或多个 npm 主体单元。生产 prepare 根据规范化后的源码仓库、基线提交、包名、版本、tarball 文件名和 SHA-256，生成 canonical JSON（规范化 JSON）格式的公开收据文件 `source-authority-receipt.json`。publish 随后把完全相同的字节作为 GitHub Release 资产上传。
+
+**升级说明**
+
+`publicSourceAuthorityReceipt` 是可选配置。现有项目不需要修改配置或迁移；只有发布需要公开源码权威资产时才启用。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.7.5 是当前源码候选，v0.7.4 是最新已发布版本。v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
+> **当前边界：** v0.7.7 是当前源码候选，v0.7.6 是最新已发布版本。v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；"当前发布版本"与"首次生产验证里程碑"
@@ -31,7 +40,7 @@ v0.7.5 能识别只发布一个 `skill/` 入口的平台注册投影，消除了
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.7.5 是当前源码候选，v0.7.4 是最新已发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.7.7 是当前源码候选，v0.7.6 是最新已发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
@@ -474,7 +483,7 @@ hooks:
     envAllowlist: []
 ```
 
-hook 在 `prepare` 调用时运行，命令调用本身即授权执行。gate 是发布校准的受控扩展点（见 `references/02-project-config.md`）。
+hook 在 `prepare` 调用时运行；配置命令并调用工作流即授权执行，不再增加触发前确认点。旧参数 `--acknowledge-hook-side-effects` 和 `--acknowledge-gate-side-effects` 只作为无效果的兼容输入保留。gate 是发布校准的受控扩展点（见 `references/02-project-config.md`）。
 
 ### postPublish hook
 

package/SECURITY.md

@@ -4,7 +4,8 @@
 
 | Version | Supported |
 | ------- | --------- |
-| 0.1.x   | Yes       |
+| 0.7.x   | Yes       |
+| 0.6.x and earlier | No |
 
 ## Reporting a Vulnerability
 
@@ -30,12 +31,17 @@ release-skill is designed with the following security guarantees:
 
 - **No automatic external writes**: The `prepare` phase never pushes,
   creates releases, or publishes packages itself. User-configured hooks
-  may produce arbitrary side effects; pass `--acknowledge-hook-side-effects`
-  to authorize hook execution.
+  and gates may produce arbitrary side effects. Configuring a command and
+  invoking the workflow authorizes its execution without an extra confirmation
+  point. The legacy `--acknowledge-hook-side-effects` and
+  `--acknowledge-gate-side-effects` flags remain accepted only as no-effect
+  compatibility inputs.
 - **Approval-gated publishing**: The `publish` phase requires an explicit,
-  non-expired approval record bound to a frozen release plan. Approval
-  expires after 24 hours and auto-invalidates when the plan, tree hash,
-  target version, or remote conflict state changes.
+  non-expired approval record bound to an immutable plan v2, its frozen
+  artifact, release action, and target version. Approval expires after 24
+  hours. Workspace tree or hash drift is retained as audit evidence rather
+  than an approval binding, while a remote conflict blocks publish preflight
+  instead of changing the approval record.
 - **Checkpoint-based execution**: Every external write is a checkpoint.
   Failure stops subsequent actions and enters a `PARTIAL` state. The system
   never auto-deletes remote tags, overwrites releases, unpublishes npm

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.7.5",
+      "version": "0.7.7",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"