release-skill 0.7.6 → 0.7.7

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.7.6",
+      "version": "0.7.7",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.7.6.",
+      "Prepare a release plan for version 0.7.7.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.7.7 locale=en baseline=sha256:bdd8a5cd123e916f5581051c7138f56572b35b3640187551aca6faa453ea1a51 -->
+## [0.7.7] - 2026-08-24
+
+v0.7.7 can publish a small public source-authority receipt that binds an exact source repository and commit to one or more frozen npm tarballs.
+
+### Security
+
+- **Remote commit binding**: publish now requires the remotely observed source commit to equal the receipt's frozen `sourceBaseCommit` before any adapter preflight or write. Verify and reconcile retain the same constraint.
+- **Actual tarball verification**: offline receipt verification reopens every frozen subject tgz with the existing no-follow, file-identity, digest, package-name, and package-version checks before accepting its receipt entry.
+
+### Added
+
+- **Optional public source authority**: projects may declare `publicSourceAuthorityReceipt` with one coordinator release unit and one or more npm subject units. Production prepare freezes canonical `source-authority-receipt.json` bytes from the normalized source repository, baseline commit, package name, version, tarball filename, and SHA-256. Publish then uploads those exact bytes as a GitHub Release asset.
+
+### Upgrade Notes
+
+`publicSourceAuthorityReceipt` is optional. Existing projects require no configuration or migration; enable it only when a release needs the public source-authority asset.
+<!-- release-skill:changelog:end version=0.7.7 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.7.6 locale=en baseline=sha256:16665362b8c0f06b7ed94f2839f5b380216b13ca6ab5e6c51b043985f8a8c8c2 -->
 ## [0.7.6] - 2026-08-22
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.7.6 -->
+<!-- release-skill:release-version: 0.7.7 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -114,7 +114,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.6
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.7
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.7.6 -->
+<!-- release-skill:release-version: 0.7.7 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -104,7 +104,7 @@ Kimi Code 有交互式插件市场，但**没有可脚本化的非交互安装
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.6
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.7
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.7.6 -->
+<!-- release-skill:release-version: 0.7.7 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,23 +14,26 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.7.6** (2026-08-22)
+**0.7.7** (2026-08-24)
 
-v0.7.6 executes every schema-declared prepare hook and corrects the documented postPublish hierarchy while preserving the current hook authorization and Codex adapter-root semantics.
+v0.7.7 can publish a small public source-authority receipt that binds an exact source repository and commit to one or more frozen npm tarballs.
 
-**Changed**
+**Security**
 
-- **Codex adapter contract coverage**: isolated-copy and negative path tests now preserve the existing self-contained adapter root: the host-provided skill path matches `PLUGIN_ROOT/skills/<skill>/SKILL.md`, and the launcher remains `PLUGIN_ROOT/bin/release-skill.mjs`. This is contract hardening, not a runtime protocol change.
-- **Hook authorization remains unchanged**: configuring a hook and invoking its workflow authorizes execution without a separate confirmation point. The legacy acknowledgement flags remain no-effect compatibility inputs; v0.7.6 does not restore a pre-execution confirmation gate.
+- **Remote commit binding**: publish now requires the remotely observed source commit to equal the receipt's frozen `sourceBaseCommit` before any adapter preflight or write. Verify and reconcile retain the same constraint.
+- **Actual tarball verification**: offline receipt verification reopens every frozen subject tgz with the existing no-follow, file-identity, digest, package-name, and package-version checks before accepting its receipt entry.
 
-**Fixed**
+**Added**
 
-- **Prepare lint hook**: `lint` now runs before `docs`, `build`, `test`, and `typecheck`; a non-zero lint result stops prepare with `GATE_FAILED`. A schema-to-execution-table contract prevents accepted hook keys from becoming silent dead configuration.
-- **postPublish documentation**: the project configuration standard now places `postPublish` inside each `releaseUnits[]` item and carries a schema-validated example.
+- **Optional public source authority**: projects may declare `publicSourceAuthorityReceipt` with one coordinator release unit and one or more npm subject units. Production prepare freezes canonical `source-authority-receipt.json` bytes from the normalized source repository, baseline commit, package name, version, tarball filename, and SHA-256. Publish then uploads those exact bytes as a GitHub Release asset.
+
+**Upgrade Notes**
+
+`publicSourceAuthorityReceipt` is optional. Existing projects require no configuration or migration; enable it only when a release needs the public source-authority asset.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.7.6 is the current source candidate; v0.7.5 remains
+> **Current boundary:** v0.7.7 is the current source candidate; v0.7.6 remains
 > the latest published release. v0.4.1 was an earlier published milestone;
 > v0.2.2 previously held published status before the platform verification
 > convergence fix was added.
@@ -50,8 +53,8 @@ v0.7.6 executes every schema-declared prepare hook and corrects the documented p
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.7.6 is the current
-> source candidate and v0.7.5 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
+> **Production path verified since the v0.1.1 milestone; v0.7.7 is the current
+> source candidate and v0.7.6 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >
 > **Start here:**

package/README.zh-CN.md

@@ -2,29 +2,32 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.7.6 -->
+<!-- release-skill:release-version: 0.7.7 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.7.6** (2026-08-22)
+**0.7.7** (2026-08-24)
 
-v0.7.6 执行 schema 接受的全部 prepare hook，修正 postPublish 的文档层级，并保持现行 hook 授权与 Codex 适配器根目录语义不变。
+v0.7.7 可以发布精简的公开源码权威收据，把精确的源码仓库与提交绑定到一个或多个已冻结的 npm tarball。
 
-**变更**
+**安全**
 
-- **Codex 适配器契约覆盖**：新增复制隔离与路径负例测试，锁定既有的自包含适配器根目录语义：宿主提供的技能路径匹配 `PLUGIN_ROOT/skills/<skill>/SKILL.md`，入口仍为 `PLUGIN_ROOT/bin/release-skill.mjs`。这只是加强契约测试，不是运行时协议变更。
-- **hook 授权语义保持不变**：配置 hook 并调用对应工作流即授权执行，不增加独立确认点。旧确认参数仍是无效果的兼容输入；v0.7.6 不恢复执行前确认门。
+- **远端提交绑定**：publish 现在会在任何 adapter preflight 或写入前，要求远端实际提交与收据中的源码基线字段 `sourceBaseCommit` 一致。verify 与 reconcile 保留相同约束。
+- **实际 tarball 验证**：离线验证会重新打开每个主体的真实冻结 tgz。既有检查会核对符号链接、文件身份、摘要、包名和版本，通过后才接受对应的收据条目。
 
-**修复**
+**新增**
 
-- **prepare lint hook**：`lint` 现在先于 `docs`、`build`、`test` 和 `typecheck` 执行；lint 返回非零退出码时，prepare 以 `GATE_FAILED` 停止。schema 与执行表之间新增覆盖契约，避免合法配置再次变成静默失效的死键。
-- **postPublish 文档**：项目配置标准现在把 `postPublish` 放在各个 `releaseUnits[]` 条目内，并提供经过 schema 校验的完整样例。
+- **可选的公开源码权威收据**：项目可以通过可选配置 `publicSourceAuthorityReceipt` 声明一个协调发布单元和一个或多个 npm 主体单元。生产 prepare 根据规范化后的源码仓库、基线提交、包名、版本、tarball 文件名和 SHA-256，生成 canonical JSON（规范化 JSON）格式的公开收据文件 `source-authority-receipt.json`。publish 随后把完全相同的字节作为 GitHub Release 资产上传。
+
+**升级说明**
+
+`publicSourceAuthorityReceipt` 是可选配置。现有项目不需要修改配置或迁移；只有发布需要公开源码权威资产时才启用。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.7.6 是当前源码候选，v0.7.5 是最新已发布版本。v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
+> **当前边界：** v0.7.7 是当前源码候选，v0.7.6 是最新已发布版本。v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；"当前发布版本"与"首次生产验证里程碑"
@@ -37,7 +40,7 @@ v0.7.6 执行 schema 接受的全部 prepare hook，修正 postPublish 的文档
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.7.6 是当前源码候选，v0.7.5 是最新已发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.7.7 是当前源码候选，v0.7.6 是最新已发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.7.6",
+      "version": "0.7.7",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"