release-skill 0.7.6 → 0.7.8

package/adapters/codex/schemas/.render-manifest.json

@@ -26,16 +26,16 @@
       "bytes": 1744
     },
     "release-plan.schema.json": {
-      "digest": "48b7755dfbeee88ccf78c3200000ab2f5dd06db42bc7b423aed0f81a91cc0418",
-      "bytes": 54672
+      "digest": "3d24cb908cdfbfd5d89551b7c6fed5140f6f1448b9920f114264291ca4cf1c52",
+      "bytes": 55905
     },
     "release-project.schema.json": {
-      "digest": "cc2061799c3a0dd6daea940148e3497b7a4ae8cafb987bf51de7c34c1fed921d",
-      "bytes": 46932
+      "digest": "b0ba3c46692622f734a80d3f4e3904180bbfd1096ca2d9b6d6fd957917e96f73",
+      "bytes": 47688
     },
     "release-run.schema.json": {
-      "digest": "9755a8caa58dd02509ac8e6f869aec5e74d8ae3f7339a3f944977bfad7b729ad",
-      "bytes": 17897
+      "digest": "4a041b8f6488e7d61b7eb271ebdbc2e043731df41c4437783ef63e77f664c192",
+      "bytes": 19002
     }
   }
 }

package/adapters/codex/schemas/release-plan.schema.json

@@ -53,6 +53,53 @@
         }
       }
     },
+    "publicSourceAuthorityReceipt": {
+      "type": "object",
+      "required": [
+        "coordinatorUnitId",
+        "subjectUnitIds",
+        "asset"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "coordinatorUnitId": {
+          "type": "string",
+          "pattern": "^(?!\\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._-]*$"
+        },
+        "subjectUnitIds": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^(?!\\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._-]*$"
+          }
+        },
+        "asset": {
+          "type": "object",
+          "required": [
+            "name",
+            "path",
+            "sha256"
+          ],
+          "additionalProperties": false,
+          "properties": {
+            "name": {
+              "const": "source-authority-receipt.json"
+            },
+            "path": {
+              "type": "string",
+              "minLength": 1,
+              "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\).+$"
+            },
+            "sha256": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$"
+            }
+          }
+        }
+      }
+    },
     "baseline": {
       "type": "object",
       "required": [

package/adapters/codex/schemas/release-project.schema.json

@@ -44,6 +44,30 @@
         }
       }
     },
+    "publicSourceAuthorityReceipt": {
+      "type": "object",
+      "description": "Optional public source-authority receipt uploaded to one coordinator GitHub Release after all subject npm tarballs are frozen.",
+      "required": [
+        "coordinatorUnitId",
+        "subjectUnitIds"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "coordinatorUnitId": {
+          "type": "string",
+          "pattern": "^(?!\\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._-]*$"
+        },
+        "subjectUnitIds": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^(?!\\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._-]*$"
+          }
+        }
+      }
+    },
     "releaseUnits": {
       "type": "array",
       "minItems": 1,

package/adapters/codex/schemas/release-run.schema.json

@@ -199,6 +199,11 @@
               },
               "url": {
                 "type": "string"
+              },
+              "integrity": {
+                "type": "string",
+                "pattern": "^sha512-[A-Za-z0-9+/]{86}==$",
+                "description": "Observed npm dist.integrity when an already-consistent npm publish is skipped"
               }
             }
           },
@@ -280,7 +285,42 @@
             "minimum": 0,
             "description": "写入目标的载荷文件数"
           }
-        }
+        },
+        "allOf": [
+          {
+            "if": {
+              "properties": {
+                "remoteRef": {
+                  "type": "object",
+                  "required": [
+                    "integrity"
+                  ]
+                }
+              },
+              "required": [
+                "remoteRef"
+              ]
+            },
+            "then": {
+              "properties": {
+                "actionType": {
+                  "const": "npm-publish"
+                },
+                "status": {
+                  "const": "skipped"
+                },
+                "preObserve": {
+                  "const": "CONSISTENT"
+                }
+              },
+              "required": [
+                "actionType",
+                "status",
+                "preObserve"
+              ]
+            }
+          }
+        ]
       }
     },
     "sourceAuthorityReceipts": {

package/adapters/codex/skills/release-prepare/SKILL.md

@@ -40,6 +40,10 @@ description: Freeze an immutable release plan with local configuration, document
 
 若用户明确要求 GitHub+npm 生产发布，加入 `--production`。该模式还会封存独立
 Git commit/tree 和 npm tarball，并把路径、SHA/integrity、branch/tag 写入计划。
+配置声明 `publicSourceAuthorityReceipt` 时，prepare 必须在所有 subject npm tarball
+冻结后生成 `source-authority-receipt.json`，并把该文件的路径与 SHA-256 绑定到
+coordinator unit 的 `github-release` action。该能力不支持非生产 prepare；不得手工
+补写 receipt 或把私有 plan/run 字段复制进公开文件。
 每个 npm tarball 在计划落盘前必须静态验证 `package.json` 的具体
 `bin`/`main`/`module`/`types`/`typings`/`exports` 入口均为 tarball 内普通文件；
 该门禁不依赖项目是否配置 `requiredPublicFiles` 或 `smokeBin`。通配符 exports 不做

package/adapters/kimi/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"