release-skill 0.7.7 → 0.7.8

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.7.7",
+      "version": "0.7.8",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.7.7.",
+      "Prepare a release plan for version 0.7.8.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.7.8 locale=en baseline=sha256:058929eb1d0fa2abb8488f1b7f736da9046ac494c312057767d649f792bb9b81 -->
+## [0.7.8] - 2026-08-24
+
+v0.7.8 lets a fresh publish safely accept an npm version that already contains the exact frozen tarball, without executing npm publish again.
+
+### Security
+
+- **Fail-closed integrity check**: a different, missing, blank, or unparseable observed integrity stops the run before any adapter execute. The existing classifier, approval model, and forward-recovery state machine remain unchanged.
+- **Checkpoint evidence**: a matching skipped npm checkpoint records only the observed integrity in `remoteRef.integrity`; package, version, registry, expected integrity, and tarball SHA-256 remain authoritative in the frozen plan.
+
+### Fixed
+
+- **Existing npm version recovery**: when npm preflight finds the target version already published, publish compares the registry observation with the immutable plan. An exact match becomes `SKIPPED`, the npm execute count stays zero, and the remaining release actions continue.
+
+### Upgrade Notes
+
+No configuration or migration is required. Existing release-run files remain valid because `remoteRef.integrity` is optional.
+<!-- release-skill:changelog:end version=0.7.8 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.7.7 locale=en baseline=sha256:bdd8a5cd123e916f5581051c7138f56572b35b3640187551aca6faa453ea1a51 -->
 ## [0.7.7] - 2026-08-24
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.7.7 -->
+<!-- release-skill:release-version: 0.7.8 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -114,7 +114,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.7
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.8
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.7.7 -->
+<!-- release-skill:release-version: 0.7.8 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -104,7 +104,7 @@ Kimi Code 有交互式插件市场，但**没有可脚本化的非交互安装
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.7
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.8
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.7.7 -->
+<!-- release-skill:release-version: 0.7.8 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,26 +14,26 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.7.7** (2026-08-24)
+**0.7.8** (2026-08-24)
 
-v0.7.7 can publish a small public source-authority receipt that binds an exact source repository and commit to one or more frozen npm tarballs.
+v0.7.8 lets a fresh publish safely accept an npm version that already contains the exact frozen tarball, without executing npm publish again.
 
 **Security**
 
-- **Remote commit binding**: publish now requires the remotely observed source commit to equal the receipt's frozen `sourceBaseCommit` before any adapter preflight or write. Verify and reconcile retain the same constraint.
-- **Actual tarball verification**: offline receipt verification reopens every frozen subject tgz with the existing no-follow, file-identity, digest, package-name, and package-version checks before accepting its receipt entry.
+- **Fail-closed integrity check**: a different, missing, blank, or unparseable observed integrity stops the run before any adapter execute. The existing classifier, approval model, and forward-recovery state machine remain unchanged.
+- **Checkpoint evidence**: a matching skipped npm checkpoint records only the observed integrity in `remoteRef.integrity`; package, version, registry, expected integrity, and tarball SHA-256 remain authoritative in the frozen plan.
 
-**Added**
+**Fixed**
 
-- **Optional public source authority**: projects may declare `publicSourceAuthorityReceipt` with one coordinator release unit and one or more npm subject units. Production prepare freezes canonical `source-authority-receipt.json` bytes from the normalized source repository, baseline commit, package name, version, tarball filename, and SHA-256. Publish then uploads those exact bytes as a GitHub Release asset.
+- **Existing npm version recovery**: when npm preflight finds the target version already published, publish compares the registry observation with the immutable plan. An exact match becomes `SKIPPED`, the npm execute count stays zero, and the remaining release actions continue.
 
 **Upgrade Notes**
 
-`publicSourceAuthorityReceipt` is optional. Existing projects require no configuration or migration; enable it only when a release needs the public source-authority asset.
+No configuration or migration is required. Existing release-run files remain valid because `remoteRef.integrity` is optional.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.7.7 is the current source candidate; v0.7.6 remains
+> **Current boundary:** v0.7.8 is the current source candidate; v0.7.7 remains
 > the latest published release. v0.4.1 was an earlier published milestone;
 > v0.2.2 previously held published status before the platform verification
 > convergence fix was added.
@@ -53,8 +53,8 @@ v0.7.7 can publish a small public source-authority receipt that binds an exact s
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.7.7 is the current
-> source candidate and v0.7.6 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
+> **Production path verified since the v0.1.1 milestone; v0.7.8 is the current
+> source candidate and v0.7.7 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >
 > **Start here:**

package/README.zh-CN.md

@@ -2,32 +2,32 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.7.7 -->
+<!-- release-skill:release-version: 0.7.8 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.7.7** (2026-08-24)
+**0.7.8** (2026-08-24)
 
-v0.7.7 可以发布精简的公开源码权威收据，把精确的源码仓库与提交绑定到一个或多个已冻结的 npm tarball。
+v0.7.8 允许全新的发布安全接受已经包含同一份冻结 tarball 的 npm 版本，不会再次执行 npm publish。
 
 **安全**
 
-- **远端提交绑定**：publish 现在会在任何 adapter preflight 或写入前，要求远端实际提交与收据中的源码基线字段 `sourceBaseCommit` 一致。verify 与 reconcile 保留相同约束。
-- **实际 tarball 验证**：离线验证会重新打开每个主体的真实冻结 tgz。既有检查会核对符号链接、文件身份、摘要、包名和版本，通过后才接受对应的收据条目。
+- **integrity 失败关闭**：观察到的 integrity 不同、缺失、空白或无法解析时，run 会在任何 Adapter execute 前停止。现有 classifier、批准模型和前向恢复状态机保持不变。
+- **检查点证据**：npm 检查点一致并跳过时，只在 `remoteRef.integrity` 记录本次观察到的 integrity；包名、版本、registry、预期 integrity 和 tarball SHA-256 继续以冻结计划为准。
 
-**新增**
+**修复**
 
-- **可选的公开源码权威收据**：项目可以通过可选配置 `publicSourceAuthorityReceipt` 声明一个协调发布单元和一个或多个 npm 主体单元。生产 prepare 根据规范化后的源码仓库、基线提交、包名、版本、tarball 文件名和 SHA-256，生成 canonical JSON（规范化 JSON）格式的公开收据文件 `source-authority-receipt.json`。publish 随后把完全相同的字节作为 GitHub Release 资产上传。
+- **已存在 npm 版本的恢复**：npm preflight 发现目标版本已经发布后，publish 会把 registry observation 与不可变计划逐项比较。完全一致时，npm 检查点进入 `SKIPPED`，npm execute 次数保持为零，其他发布动作继续执行。
 
 **升级说明**
 
-`publicSourceAuthorityReceipt` 是可选配置。现有项目不需要修改配置或迁移；只有发布需要公开源码权威资产时才启用。
+无需修改配置或迁移。`remoteRef.integrity` 是可选字段，已有 release-run 文件继续有效。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.7.7 是当前源码候选，v0.7.6 是最新已发布版本。v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
+> **当前边界：** v0.7.8 是当前源码候选，v0.7.7 是最新已发布版本。v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；"当前发布版本"与"首次生产验证里程碑"
@@ -40,7 +40,7 @@ v0.7.7 可以发布精简的公开源码权威收据，把精确的源码仓库
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.7.7 是当前源码候选，v0.7.6 是最新已发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.7.8 是当前源码候选，v0.7.7 是最新已发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.7.7",
+      "version": "0.7.8",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.7"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.8"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "abe5151f6131b7016e6d66bdd83c223b92b40586443e9110d9367f5986e81bf4";
+const __bundleSourceDigest = "33dc18dc83ac5f6211859bd64e1b323b9166acf7307e5b8748ea1d2d99376df2";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -103001,6 +103001,7 @@ async function publishRelease(options) {
         status: checkpoint.status === "SUCCEEDED" ? "succeeded" : checkpoint.status === "FAILED" ? "failed" : checkpoint.status === "UNCERTAIN" ? "uncertain" : checkpoint.status === "SKIPPED" ? "skipped" : checkpoint.status === "DEFERRED" ? "deferred" : "pending",
         ...checkpoint.preObserve ? { preObserve: checkpoint.preObserve } : {},
         ...checkpoint.postObserve ? { postObserve: checkpoint.postObserve } : {},
+        ...checkpoint.remoteRef ? { remoteRef: checkpoint.remoteRef } : {},
         ...checkpoint.error ? { error: { code: "GATE_FAILED", message: checkpoint.error } } : {},
         ...checkpoint.reason === CONSUMER_VERIFICATION_DEFERRED ? { reason: CONSUMER_VERIFICATION_DEFERRED, phase: checkpoint.phase ?? "post-publish-verification" } : {}
       })),
@@ -103080,6 +103081,9 @@ async function publishRelease(options) {
         checkpoint.error = result.error;
         if (result.preObserve) checkpoint.preObserve = result.preObserve;
         if (result.postObserve) checkpoint.postObserve = result.postObserve;
+        if (action.type === "npm-publish" && result.status === "SKIPPED" && result.preObserve === PRE_OBSERVE.CONSISTENT && typeof result.observation?.integrity === "string" && /^sha512-[A-Za-z0-9+/]+={0,2}$/.test(result.observation.integrity)) {
+          checkpoint.remoteRef = { integrity: result.observation.integrity };
+        }
         action.status = result.status;
         await evidence.append({
           phase: "checkpoint",

package/adapters/claude/schemas/.render-manifest.json

@@ -26,16 +26,16 @@
       "bytes": 1744
     },
     "release-plan.schema.json": {
-      "digest": "48b7755dfbeee88ccf78c3200000ab2f5dd06db42bc7b423aed0f81a91cc0418",
-      "bytes": 54672
+      "digest": "3d24cb908cdfbfd5d89551b7c6fed5140f6f1448b9920f114264291ca4cf1c52",
+      "bytes": 55905
     },
     "release-project.schema.json": {
-      "digest": "cc2061799c3a0dd6daea940148e3497b7a4ae8cafb987bf51de7c34c1fed921d",
-      "bytes": 46932
+      "digest": "b0ba3c46692622f734a80d3f4e3904180bbfd1096ca2d9b6d6fd957917e96f73",
+      "bytes": 47688
     },
     "release-run.schema.json": {
-      "digest": "9755a8caa58dd02509ac8e6f869aec5e74d8ae3f7339a3f944977bfad7b729ad",
-      "bytes": 17897
+      "digest": "4a041b8f6488e7d61b7eb271ebdbc2e043731df41c4437783ef63e77f664c192",
+      "bytes": 19002
     }
   }
 }

package/adapters/claude/schemas/release-run.schema.json

@@ -199,6 +199,11 @@
               },
               "url": {
                 "type": "string"
+              },
+              "integrity": {
+                "type": "string",
+                "pattern": "^sha512-[A-Za-z0-9+/]{86}==$",
+                "description": "Observed npm dist.integrity when an already-consistent npm publish is skipped"
               }
             }
           },
@@ -280,7 +285,42 @@
             "minimum": 0,
             "description": "写入目标的载荷文件数"
           }
-        }
+        },
+        "allOf": [
+          {
+            "if": {
+              "properties": {
+                "remoteRef": {
+                  "type": "object",
+                  "required": [
+                    "integrity"
+                  ]
+                }
+              },
+              "required": [
+                "remoteRef"
+              ]
+            },
+            "then": {
+              "properties": {
+                "actionType": {
+                  "const": "npm-publish"
+                },
+                "status": {
+                  "const": "skipped"
+                },
+                "preObserve": {
+                  "const": "CONSISTENT"
+                }
+              },
+              "required": [
+                "actionType",
+                "status",
+                "preObserve"
+              ]
+            }
+          }
+        ]
       }
     },
     "sourceAuthorityReceipts": {

package/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.7.7.",
+      "Prepare a release plan for version 0.7.8.",
       "Help me understand the release workflow."
     ]
   }

package/adapters/codex/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.7"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.8"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "abe5151f6131b7016e6d66bdd83c223b92b40586443e9110d9367f5986e81bf4";
+const __bundleSourceDigest = "33dc18dc83ac5f6211859bd64e1b323b9166acf7307e5b8748ea1d2d99376df2";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -103001,6 +103001,7 @@ async function publishRelease(options) {
         status: checkpoint.status === "SUCCEEDED" ? "succeeded" : checkpoint.status === "FAILED" ? "failed" : checkpoint.status === "UNCERTAIN" ? "uncertain" : checkpoint.status === "SKIPPED" ? "skipped" : checkpoint.status === "DEFERRED" ? "deferred" : "pending",
         ...checkpoint.preObserve ? { preObserve: checkpoint.preObserve } : {},
         ...checkpoint.postObserve ? { postObserve: checkpoint.postObserve } : {},
+        ...checkpoint.remoteRef ? { remoteRef: checkpoint.remoteRef } : {},
         ...checkpoint.error ? { error: { code: "GATE_FAILED", message: checkpoint.error } } : {},
         ...checkpoint.reason === CONSUMER_VERIFICATION_DEFERRED ? { reason: CONSUMER_VERIFICATION_DEFERRED, phase: checkpoint.phase ?? "post-publish-verification" } : {}
       })),
@@ -103080,6 +103081,9 @@ async function publishRelease(options) {
         checkpoint.error = result.error;
         if (result.preObserve) checkpoint.preObserve = result.preObserve;
         if (result.postObserve) checkpoint.postObserve = result.postObserve;
+        if (action.type === "npm-publish" && result.status === "SKIPPED" && result.preObserve === PRE_OBSERVE.CONSISTENT && typeof result.observation?.integrity === "string" && /^sha512-[A-Za-z0-9+/]+={0,2}$/.test(result.observation.integrity)) {
+          checkpoint.remoteRef = { integrity: result.observation.integrity };
+        }
         action.status = result.status;
         await evidence.append({
           phase: "checkpoint",

package/adapters/codex/schemas/.render-manifest.json

@@ -26,16 +26,16 @@
       "bytes": 1744
     },
     "release-plan.schema.json": {
-      "digest": "48b7755dfbeee88ccf78c3200000ab2f5dd06db42bc7b423aed0f81a91cc0418",
-      "bytes": 54672
+      "digest": "3d24cb908cdfbfd5d89551b7c6fed5140f6f1448b9920f114264291ca4cf1c52",
+      "bytes": 55905
     },
     "release-project.schema.json": {
-      "digest": "cc2061799c3a0dd6daea940148e3497b7a4ae8cafb987bf51de7c34c1fed921d",
-      "bytes": 46932
+      "digest": "b0ba3c46692622f734a80d3f4e3904180bbfd1096ca2d9b6d6fd957917e96f73",
+      "bytes": 47688
     },
     "release-run.schema.json": {
-      "digest": "9755a8caa58dd02509ac8e6f869aec5e74d8ae3f7339a3f944977bfad7b729ad",
-      "bytes": 17897
+      "digest": "4a041b8f6488e7d61b7eb271ebdbc2e043731df41c4437783ef63e77f664c192",
+      "bytes": 19002
     }
   }
 }

package/adapters/codex/schemas/release-run.schema.json

@@ -199,6 +199,11 @@
               },
               "url": {
                 "type": "string"
+              },
+              "integrity": {
+                "type": "string",
+                "pattern": "^sha512-[A-Za-z0-9+/]{86}==$",
+                "description": "Observed npm dist.integrity when an already-consistent npm publish is skipped"
               }
             }
           },
@@ -280,7 +285,42 @@
             "minimum": 0,
             "description": "写入目标的载荷文件数"
           }
-        }
+        },
+        "allOf": [
+          {
+            "if": {
+              "properties": {
+                "remoteRef": {
+                  "type": "object",
+                  "required": [
+                    "integrity"
+                  ]
+                }
+              },
+              "required": [
+                "remoteRef"
+              ]
+            },
+            "then": {
+              "properties": {
+                "actionType": {
+                  "const": "npm-publish"
+                },
+                "status": {
+                  "const": "skipped"
+                },
+                "preObserve": {
+                  "const": "CONSISTENT"
+                }
+              },
+              "required": [
+                "actionType",
+                "status",
+                "preObserve"
+              ]
+            }
+          }
+        ]
       }
     },
     "sourceAuthorityReceipts": {

package/adapters/kimi/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/kimi/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.7"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.8"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "abe5151f6131b7016e6d66bdd83c223b92b40586443e9110d9367f5986e81bf4";
+const __bundleSourceDigest = "33dc18dc83ac5f6211859bd64e1b323b9166acf7307e5b8748ea1d2d99376df2";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -103001,6 +103001,7 @@ async function publishRelease(options) {
         status: checkpoint.status === "SUCCEEDED" ? "succeeded" : checkpoint.status === "FAILED" ? "failed" : checkpoint.status === "UNCERTAIN" ? "uncertain" : checkpoint.status === "SKIPPED" ? "skipped" : checkpoint.status === "DEFERRED" ? "deferred" : "pending",
         ...checkpoint.preObserve ? { preObserve: checkpoint.preObserve } : {},
         ...checkpoint.postObserve ? { postObserve: checkpoint.postObserve } : {},
+        ...checkpoint.remoteRef ? { remoteRef: checkpoint.remoteRef } : {},
         ...checkpoint.error ? { error: { code: "GATE_FAILED", message: checkpoint.error } } : {},
         ...checkpoint.reason === CONSUMER_VERIFICATION_DEFERRED ? { reason: CONSUMER_VERIFICATION_DEFERRED, phase: checkpoint.phase ?? "post-publish-verification" } : {}
       })),
@@ -103080,6 +103081,9 @@ async function publishRelease(options) {
         checkpoint.error = result.error;
         if (result.preObserve) checkpoint.preObserve = result.preObserve;
         if (result.postObserve) checkpoint.postObserve = result.postObserve;
+        if (action.type === "npm-publish" && result.status === "SKIPPED" && result.preObserve === PRE_OBSERVE.CONSISTENT && typeof result.observation?.integrity === "string" && /^sha512-[A-Za-z0-9+/]+={0,2}$/.test(result.observation.integrity)) {
+          checkpoint.remoteRef = { integrity: result.observation.integrity };
+        }
         action.status = result.status;
         await evidence.append({
           phase: "checkpoint",

package/adapters/kimi/schemas/.render-manifest.json

@@ -26,16 +26,16 @@
       "bytes": 1744
     },
     "release-plan.schema.json": {
-      "digest": "48b7755dfbeee88ccf78c3200000ab2f5dd06db42bc7b423aed0f81a91cc0418",
-      "bytes": 54672
+      "digest": "3d24cb908cdfbfd5d89551b7c6fed5140f6f1448b9920f114264291ca4cf1c52",
+      "bytes": 55905
     },
     "release-project.schema.json": {
-      "digest": "cc2061799c3a0dd6daea940148e3497b7a4ae8cafb987bf51de7c34c1fed921d",
-      "bytes": 46932
+      "digest": "b0ba3c46692622f734a80d3f4e3904180bbfd1096ca2d9b6d6fd957917e96f73",
+      "bytes": 47688
     },
     "release-run.schema.json": {
-      "digest": "9755a8caa58dd02509ac8e6f869aec5e74d8ae3f7339a3f944977bfad7b729ad",
-      "bytes": 17897
+      "digest": "4a041b8f6488e7d61b7eb271ebdbc2e043731df41c4437783ef63e77f664c192",
+      "bytes": 19002
     }
   }
 }

package/adapters/kimi/schemas/release-run.schema.json

@@ -199,6 +199,11 @@
               },
               "url": {
                 "type": "string"
+              },
+              "integrity": {
+                "type": "string",
+                "pattern": "^sha512-[A-Za-z0-9+/]{86}==$",
+                "description": "Observed npm dist.integrity when an already-consistent npm publish is skipped"
               }
             }
           },
@@ -280,7 +285,42 @@
             "minimum": 0,
             "description": "写入目标的载荷文件数"
           }
-        }
+        },
+        "allOf": [
+          {
+            "if": {
+              "properties": {
+                "remoteRef": {
+                  "type": "object",
+                  "required": [
+                    "integrity"
+                  ]
+                }
+              },
+              "required": [
+                "remoteRef"
+              ]
+            },
+            "then": {
+              "properties": {
+                "actionType": {
+                  "const": "npm-publish"
+                },
+                "status": {
+                  "const": "skipped"
+                },
+                "preObserve": {
+                  "const": "CONSISTENT"
+                }
+              },
+              "required": [
+                "actionType",
+                "status",
+                "preObserve"
+              ]
+            }
+          }
+        ]
       }
     },
     "sourceAuthorityReceipts": {

package/adapters/workbuddy/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/workbuddy/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.7"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.8"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "abe5151f6131b7016e6d66bdd83c223b92b40586443e9110d9367f5986e81bf4";
+const __bundleSourceDigest = "33dc18dc83ac5f6211859bd64e1b323b9166acf7307e5b8748ea1d2d99376df2";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -103001,6 +103001,7 @@ async function publishRelease(options) {
         status: checkpoint.status === "SUCCEEDED" ? "succeeded" : checkpoint.status === "FAILED" ? "failed" : checkpoint.status === "UNCERTAIN" ? "uncertain" : checkpoint.status === "SKIPPED" ? "skipped" : checkpoint.status === "DEFERRED" ? "deferred" : "pending",
         ...checkpoint.preObserve ? { preObserve: checkpoint.preObserve } : {},
         ...checkpoint.postObserve ? { postObserve: checkpoint.postObserve } : {},
+        ...checkpoint.remoteRef ? { remoteRef: checkpoint.remoteRef } : {},
         ...checkpoint.error ? { error: { code: "GATE_FAILED", message: checkpoint.error } } : {},
         ...checkpoint.reason === CONSUMER_VERIFICATION_DEFERRED ? { reason: CONSUMER_VERIFICATION_DEFERRED, phase: checkpoint.phase ?? "post-publish-verification" } : {}
       })),
@@ -103080,6 +103081,9 @@ async function publishRelease(options) {
         checkpoint.error = result.error;
         if (result.preObserve) checkpoint.preObserve = result.preObserve;
         if (result.postObserve) checkpoint.postObserve = result.postObserve;
+        if (action.type === "npm-publish" && result.status === "SKIPPED" && result.preObserve === PRE_OBSERVE.CONSISTENT && typeof result.observation?.integrity === "string" && /^sha512-[A-Za-z0-9+/]+={0,2}$/.test(result.observation.integrity)) {
+          checkpoint.remoteRef = { integrity: result.observation.integrity };
+        }
         action.status = result.status;
         await evidence.append({
           phase: "checkpoint",

package/adapters/workbuddy/schemas/.render-manifest.json

@@ -26,16 +26,16 @@
       "bytes": 1744
     },
     "release-plan.schema.json": {
-      "digest": "48b7755dfbeee88ccf78c3200000ab2f5dd06db42bc7b423aed0f81a91cc0418",
-      "bytes": 54672
+      "digest": "3d24cb908cdfbfd5d89551b7c6fed5140f6f1448b9920f114264291ca4cf1c52",
+      "bytes": 55905
     },
     "release-project.schema.json": {
-      "digest": "cc2061799c3a0dd6daea940148e3497b7a4ae8cafb987bf51de7c34c1fed921d",
-      "bytes": 46932
+      "digest": "b0ba3c46692622f734a80d3f4e3904180bbfd1096ca2d9b6d6fd957917e96f73",
+      "bytes": 47688
     },
     "release-run.schema.json": {
-      "digest": "9755a8caa58dd02509ac8e6f869aec5e74d8ae3f7339a3f944977bfad7b729ad",
-      "bytes": 17897
+      "digest": "4a041b8f6488e7d61b7eb271ebdbc2e043731df41c4437783ef63e77f664c192",
+      "bytes": 19002
     }
   }
 }

package/adapters/workbuddy/schemas/release-run.schema.json

@@ -199,6 +199,11 @@
               },
               "url": {
                 "type": "string"
+              },
+              "integrity": {
+                "type": "string",
+                "pattern": "^sha512-[A-Za-z0-9+/]{86}==$",
+                "description": "Observed npm dist.integrity when an already-consistent npm publish is skipped"
               }
             }
           },
@@ -280,7 +285,42 @@
             "minimum": 0,
             "description": "写入目标的载荷文件数"
           }
-        }
+        },
+        "allOf": [
+          {
+            "if": {
+              "properties": {
+                "remoteRef": {
+                  "type": "object",
+                  "required": [
+                    "integrity"
+                  ]
+                }
+              },
+              "required": [
+                "remoteRef"
+              ]
+            },
+            "then": {
+              "properties": {
+                "actionType": {
+                  "const": "npm-publish"
+                },
+                "status": {
+                  "const": "skipped"
+                },
+                "preObserve": {
+                  "const": "CONSISTENT"
+                }
+              },
+              "required": [
+                "actionType",
+                "status",
+                "preObserve"
+              ]
+            }
+          }
+        ]
       }
     },
     "sourceAuthorityReceipts": {

package/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.7"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.8"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "abe5151f6131b7016e6d66bdd83c223b92b40586443e9110d9367f5986e81bf4";
+const __bundleSourceDigest = "33dc18dc83ac5f6211859bd64e1b323b9166acf7307e5b8748ea1d2d99376df2";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -103001,6 +103001,7 @@ async function publishRelease(options) {
         status: checkpoint.status === "SUCCEEDED" ? "succeeded" : checkpoint.status === "FAILED" ? "failed" : checkpoint.status === "UNCERTAIN" ? "uncertain" : checkpoint.status === "SKIPPED" ? "skipped" : checkpoint.status === "DEFERRED" ? "deferred" : "pending",
         ...checkpoint.preObserve ? { preObserve: checkpoint.preObserve } : {},
         ...checkpoint.postObserve ? { postObserve: checkpoint.postObserve } : {},
+        ...checkpoint.remoteRef ? { remoteRef: checkpoint.remoteRef } : {},
         ...checkpoint.error ? { error: { code: "GATE_FAILED", message: checkpoint.error } } : {},
         ...checkpoint.reason === CONSUMER_VERIFICATION_DEFERRED ? { reason: CONSUMER_VERIFICATION_DEFERRED, phase: checkpoint.phase ?? "post-publish-verification" } : {}
       })),
@@ -103080,6 +103081,9 @@ async function publishRelease(options) {
         checkpoint.error = result.error;
         if (result.preObserve) checkpoint.preObserve = result.preObserve;
         if (result.postObserve) checkpoint.postObserve = result.postObserve;
+        if (action.type === "npm-publish" && result.status === "SKIPPED" && result.preObserve === PRE_OBSERVE.CONSISTENT && typeof result.observation?.integrity === "string" && /^sha512-[A-Za-z0-9+/]+={0,2}$/.test(result.observation.integrity)) {
+          checkpoint.remoteRef = { integrity: result.observation.integrity };
+        }
         action.status = result.status;
         await evidence.append({
           phase: "checkpoint",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/platform-manifest.json

@@ -2,11 +2,11 @@
   "schemaVersion": "1.0.0",
   "platformId": "release-skill",
   "platformName": "release-skill Plugin Platform",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "logicalRoot": "skills-src/",
   "logicalRootDigest": "b261a4cc49e6dc52dabddb083c22e414902fb269d5879ad01ef8146ceffd7bc7",
   "projectionDigest": "6629de035a25005fd4676b09a0526a46f992a33d974cadd542b0c964d7f906ff",
-  "projectionId": "release-skill:platform:0.7.7",
+  "projectionId": "release-skill:platform:0.7.8",
   "manifestRequired": true,
   "projectionSources": {
     "skills-src-root": {

package/references/.render-manifest.json

@@ -6,12 +6,12 @@
       "bytes": 6335
     },
     "01-state-machine.md": {
-      "digest": "711265e093be13f582ac8be89c391eff79ac22f56c25b91d1ccaef31856ef269",
-      "bytes": 12086
+      "digest": "5afc8e9c29c0d5fb0de0db8b248bbb812fc715af185ac594a172fe68d9a24fed",
+      "bytes": 12617
     },
     "02-project-config.md": {
-      "digest": "ce1986761f2aee9aab2646170cbd9ee3d14b7032db3bfb57b17e7369a45197f2",
-      "bytes": 21924
+      "digest": "09e3c470dea54fe9437528620cc169596e75b5162e137683923347c9cb3702a6",
+      "bytes": 23167
     },
     "03-readme-quality.md": {
       "digest": "d74e41052592443ebbd450d0ace5f9b9b19c7a94db50f952b17c1c5a4c5dc230",
@@ -26,8 +26,8 @@
       "bytes": 12014
     },
     "06-adapter-contract.md": {
-      "digest": "e00c175b24764487618dfdf20dc295f12a7e809f7dbfc69f6936a1e97bd02ab8",
-      "bytes": 18517
+      "digest": "fd58e8a438aaa9a7a4a939ac190dbdd5d11c3fcaca08feaced4a612a6d6dcf3f",
+      "bytes": 19206
     }
   }
 }

package/references/01-state-machine.md

@@ -148,7 +148,7 @@ postPublish hooks 分两个阶段，各自对应独立的 distribute run：
 
 工作区基线（Git tree hash、workspace digest、捕获时间）与生命周期状态（计划 status、createdAt、action 运行时 status）是**记录层审计数据**：继续写入计划与审批文件以备查，但不参与 planVersion 2 的 digest、不使批准失效。publish/reconcile 检测到基线漂移时记录 warning 级证据事件并继续执行，产物完整性由发布前的冻结产物重验兜底。planVersion 1（旧版）计划维持旧规则：Git tree hash 与 workspace digest 变化同样使批准失效，基线漂移硬失败（BASELINE_CHANGED）。
 
-远端冲突状态（如 tag 已存在、npm 版本冲突等）不在 approval 绑定字段中；它在 publish/reconcile 的 preflight 阶段阻断执行并要求人工决策。
+远端冲突状态不在 approval 绑定字段中。远端对象已存在但与冻结计划完全一致时，`publish`/`reconcile` 把对应检查点标为 `SKIPPED`；存在且不一致，或无法可靠判断时，preflight 阶段阻断执行并要求人工决策。npm 版本只有在观察到有效且与冻结计划相同的 integrity 时才能进入 `SKIPPED`；integrity 缺失、空白、无法解析或不同都在任何 Adapter execute 前失败关闭。
 
 失效后系统回退到 PREPARED 状态，要求重新批准。
 
@@ -161,7 +161,7 @@ postPublish hooks 分两个阶段，各自对应独立的 distribute run：
 3. 创建并推送签名或可追溯 tag。
 4. 发布 npm 包。
 5. 创建 GitHub Release。
-6. 写入远端 URL、commit、tag、包版本、integrity 和执行结果。
+6. 写入远端 URL、commit、tag、包版本、integrity 和执行结果。若 npm 检查点因执行前观察结果为 `CONSISTENT` 而跳过，只把本次观察到的 integrity 保存到检查点的 `remoteRef.integrity`；包名、版本、registry、预期 integrity 和 tarball 摘要继续以冻结计划为准。
 
 任一步失败都停止后续动作，保存检查点并进入 PARTIAL。已完成的检查点通过 `observe` 验证后在 `reconcile` 中幂等跳过。
 

package/references/06-adapter-contract.md

@@ -205,6 +205,7 @@ marketplace install action 的安装侧载荷校验以 action 参数 `payloadCon
 
 ### 4.1 幂等规则
 
+- `publish` 在全局 preflight 发现远端对象已存在时，先用同一套 `observe` 分类判断它是已一致还是冲突；已一致的检查点进入 `SKIPPED`，冲突或无法可靠判断时在任何 execute 前失败关闭。
 - `reconcile` 阶段首先通过 `observe` 查询所有计划操作的远端状态。
 - 状态为 `CONSISTENT` 的操作幂等跳过，不重新执行。
 - 状态为 `MISSING` 的操作安全重试。
@@ -226,7 +227,7 @@ marketplace install action 的安装侧载荷校验以 action 参数 `payloadCon
 - 执行前的 `observe` 结果。
 - 执行结果（成功/失败/跳过）。
 - 执行后的 `observe` 验证结果。
-- 远端资源标识（commit、tag、版本、URL）。
+- 远端资源标识（commit、tag、版本、URL）。npm 检查点因 `preObserve=CONSISTENT` 而跳过时，可在 `remoteRef.integrity` 保存本次观察到的有效 integrity；其他 npm 身份和摘要继续由冻结计划提供。
 
 ---
 
@@ -238,9 +239,9 @@ marketplace install action 的安装侧载荷校验以 action 参数 `payloadCon
 2. 重新验证发布计划摘要。
 3. 检查批准记录是否过期。
 4. 按 planVersion 分叉复验工作区基线：planVersion 1 计划基线变化即失败（`BASELINE_CHANGED`）；planVersion 2 计划基线漂移仅记录 warning 级证据事件并继续，产物身份由外部写之前的冻结产物复验保证。
-5. 执行远程 preflight。
+5. 执行全局远程 preflight；占用类结果先用只读 pre-observe 仲裁，`CONSISTENT` 放行到幂等跳过路径，`CONFLICTING` 或不可可靠观察时失败关闭。
 6. 按批准的操作列表顺序执行每个检查点。
-7. 每个检查点：preflight -> execute -> observe -> 记录。
+7. 每个检查点：pre-observe -> preflight -> execute -> post-observe -> 记录。pre-observe 为 `CONSISTENT` 时直接记录 `SKIPPED`，不调用 execute 或 post-observe。
 8. 任一检查点失败时停止后续动作，计算 PARTIAL（若已有成功检查点）。
 9. 所有检查点成功后进入 PUBLISHED 状态。
 

package/schemas/.render-manifest.json

@@ -26,16 +26,16 @@
       "bytes": 1744
     },
     "release-plan.schema.json": {
-      "digest": "48b7755dfbeee88ccf78c3200000ab2f5dd06db42bc7b423aed0f81a91cc0418",
-      "bytes": 54672
+      "digest": "3d24cb908cdfbfd5d89551b7c6fed5140f6f1448b9920f114264291ca4cf1c52",
+      "bytes": 55905
     },
     "release-project.schema.json": {
-      "digest": "cc2061799c3a0dd6daea940148e3497b7a4ae8cafb987bf51de7c34c1fed921d",
-      "bytes": 46932
+      "digest": "b0ba3c46692622f734a80d3f4e3904180bbfd1096ca2d9b6d6fd957917e96f73",
+      "bytes": 47688
     },
     "release-run.schema.json": {
-      "digest": "9755a8caa58dd02509ac8e6f869aec5e74d8ae3f7339a3f944977bfad7b729ad",
-      "bytes": 17897
+      "digest": "4a041b8f6488e7d61b7eb271ebdbc2e043731df41c4437783ef63e77f664c192",
+      "bytes": 19002
     }
   }
 }

package/schemas/release-run.schema.json

@@ -199,6 +199,11 @@
               },
               "url": {
                 "type": "string"
+              },
+              "integrity": {
+                "type": "string",
+                "pattern": "^sha512-[A-Za-z0-9+/]{86}==$",
+                "description": "Observed npm dist.integrity when an already-consistent npm publish is skipped"
               }
             }
           },
@@ -280,7 +285,42 @@
             "minimum": 0,
             "description": "写入目标的载荷文件数"
           }
-        }
+        },
+        "allOf": [
+          {
+            "if": {
+              "properties": {
+                "remoteRef": {
+                  "type": "object",
+                  "required": [
+                    "integrity"
+                  ]
+                }
+              },
+              "required": [
+                "remoteRef"
+              ]
+            },
+            "then": {
+              "properties": {
+                "actionType": {
+                  "const": "npm-publish"
+                },
+                "status": {
+                  "const": "skipped"
+                },
+                "preObserve": {
+                  "const": "CONSISTENT"
+                }
+              },
+              "required": [
+                "actionType",
+                "status",
+                "preObserve"
+              ]
+            }
+          }
+        ]
       }
     },
     "sourceAuthorityReceipts": {

package/src/commands/publish.mjs

@@ -1171,6 +1171,7 @@ export async function publishRelease(options) {
           : 'pending',
         ...(checkpoint.preObserve ? { preObserve: checkpoint.preObserve } : {}),
         ...(checkpoint.postObserve ? { postObserve: checkpoint.postObserve } : {}),
+        ...(checkpoint.remoteRef ? { remoteRef: checkpoint.remoteRef } : {}),
         ...(checkpoint.error ? { error: { code: 'GATE_FAILED', message: checkpoint.error } } : {}),
         ...(checkpoint.reason === CONSUMER_VERIFICATION_DEFERRED
           ? { reason: CONSUMER_VERIFICATION_DEFERRED, phase: checkpoint.phase ?? 'post-publish-verification' }
@@ -1294,6 +1295,20 @@ export async function publishRelease(options) {
         checkpoint.error = result.error;
         if (result.preObserve) checkpoint.preObserve = result.preObserve;
         if (result.postObserve) checkpoint.postObserve = result.postObserve;
+        // When npm is already published with the exact frozen integrity, keep
+        // that observed integrity on the existing checkpoint authority. The
+        // immutable plan remains the source for package/version/registry and
+        // expected artifact identity; no second receipt or duplicated fields
+        // are introduced here.
+        if (
+          action.type === 'npm-publish'
+          && result.status === 'SKIPPED'
+          && result.preObserve === PRE_OBSERVE.CONSISTENT
+          && typeof result.observation?.integrity === 'string'
+          && /^sha512-[A-Za-z0-9+/]+={0,2}$/.test(result.observation.integrity)
+        ) {
+          checkpoint.remoteRef = { integrity: result.observation.integrity };
+        }
         action.status = result.status;
         await evidence.append({
           phase: 'checkpoint',