release-skill 0.8.1 → 0.9.0

package/src/commands/prepare.mjs

@@ -28,7 +28,7 @@ const execFile = promisify(execFileCb);
 import { classifyPathInput, writeFileAtomic } from 'skill-family-harness-node';
 import { loadProjectConfig } from '../core/config.mjs';
 import { captureBaseline } from '../core/baseline.mjs';
-import { findPostPublishUnitConflict, runHook } from '../core/hooks.mjs';
+import { runHook } from '../core/hooks.mjs';
 import { computeHookCacheKey, readHookCache, writeHookCache } from '../core/hook-cache.mjs';
 import {
   assertExpectedPublicSurface,
@@ -81,6 +81,7 @@ import {
   validatePostPublishDeclaration,
   normalizePostPublishDeclaration,
   orderNormalizedHooks,
+  validatePostPublishHookIdUniqueness,
   PAYLOAD_SOURCE_TAG_WORKTREE,
 } from '../core/postpublish.mjs';
 import { freezeExecutionBundle, bundleRootForAuthorityDir } from '../core/postpublish-bundle.mjs';
@@ -3092,38 +3093,31 @@ export async function prepareRelease(options) {
 
     // --- Step 1c: postPublish distribution declaration gate (R1/R2) ---
     // The per-unit postPublish block drives the post-publish distribute
-    // command. Validate it here, before any hook, baseline, snapshot, remote
-    // check, or plan write, so an unsafe declaration fails closed with zero
-    // side effects. This is the runtime re-check on top of the config JSON
-    // schema: plans frozen by older schema versions must not be able to
-    // smuggle shell strings, option-like executables, or secret-ish env
-    // keys through. R2: preset references resolve against the built-in
-    // preset registry (per-preset config validation + requiresApproval
-    // grading), and targets normalize onto preset hooks — the normalized
-    // table is a deterministic projection of the digest-bound declaration,
-    // so any list change changes the plan digest and voids approvals. A
-    // plan binds exactly one declaration; multiple units declaring
-    // postPublish is a hard gate failure.
+    // command. Validate every declaration here, before any hook, baseline,
+    // snapshot, remote check, or plan write, so an unsafe declaration fails
+    // closed with zero side effects. This is the runtime re-check on top of
+    // the config JSON schema: plans frozen by older schema versions must not
+    // be able to smuggle shell strings, option-like executables, or
+    // secret-ish env keys through. R2: preset references resolve against the
+    // built-in preset registry (per-preset config validation +
+    // requiresApproval grading), and targets normalize onto preset hooks —
+    // the normalized table is a deterministic projection of the digest-bound
+    // declaration, so any list change changes the plan digest and voids
+    // approvals. Multiple units may each declare postPublish (multi-release-
+    // unit v3): every declaration is validated individually, in plan.units
+    // order, and the whole project's EXPLICIT hooks[].id must be unique
+    // across units (target and internal probe local ids may repeat; the
+    // (planDigest, hookId) approval contract needs globally unique hook ids).
     const postPublishDeclarations = configUnits
       .map((unit, index) => ({ unit, index }))
       .filter(({ unit }) => unit.postPublish !== undefined);
-    if (findPostPublishUnitConflict(configUnits)) {
-      throw new ReleaseError(
-        GATE_FAILED,
-        `multiple units declare postPublish (${postPublishDeclarations.map(({ unit }) => unit.id).join(', ')}); a release plan binds exactly one postPublish declaration`,
-        { unitIds: postPublishDeclarations.map(({ unit }) => unit.id) },
-      );
-    }
-    let postPublishDeclaration = null;
-    if (postPublishDeclarations.length === 1) {
-      const { unit, index } = postPublishDeclarations[0];
+    for (const { unit } of postPublishDeclarations) {
       validatePostPublishDeclaration(unit.postPublish, { unitId: unit.id });
       // Normalized hook table (design §2.2): validate the dependency
       // topology at freeze time too, so a cyclic/dangling declaration can
       // never be frozen for distribute to trip over.
       const normalizedDeclaration = normalizePostPublishDeclaration(unit.postPublish);
       const orderedNormalizedHooks = orderNormalizedHooks(normalizedDeclaration.hooks);
-      postPublishDeclaration = { unit, index };
       await evidence.append({
         phase: 'postpublish-declaration',
         status: 'validated',
@@ -3134,6 +3128,19 @@ export async function prepareRelease(options) {
         preGates: normalizedDeclaration.preGates.map((gate) => gate.gate),
       });
     }
+    // Whole-project explicit hooks[].id uniqueness (design §9.2 rule 3;
+    // rework R-02): the (planDigest, hookId) approval contract binds every
+    // explicit hook id plan-wide, so a duplicate across units must fail
+    // before any plan write and before any project hook runs. The single
+    // array-level authority lives in core/postpublish.mjs
+    // validatePostPublishHookIdUniqueness — this entry only normalizes its
+    // input to the declaration array view (config blocks carry no unitId;
+    // the owning unit id is bound here, exactly as the frozen plan does) and
+    // calls it. Per-declaration duplicates are already rejected by
+    // validatePostPublishDeclaration.
+    validatePostPublishHookIdUniqueness(
+      postPublishDeclarations.map(({ unit }) => ({ ...unit.postPublish, unitId: unit.id })),
+    );
 
     // --- Step 2: Hook authorization gate ---
     // Hooks are user-configured arbitrary local processes without filesystem
@@ -3841,20 +3848,21 @@ export async function prepareRelease(options) {
       });
     }
 
-    // New prepares emit planVersion 2 (design: t1-2-digest-decoupling.md
-    // §4.2/§7). Production freeze timestamps are derived deterministically
-    // from the baseline headCommit's committer date, before the first frozen
-    // Git object exists. This single canonical value becomes
-    // GIT_AUTHOR_DATE/GIT_COMMITTER_DATE for every unit's frozen commit and
-    // every unit's frozenSnapshot.commitTimestamp; identical sources freeze
-    // byte-identical Git objects on every re-prepare. The wall-clock sample
-    // is still validated here (fail closed before any Git write) and becomes
-    // plan.createdAt -- record-layer real clock behind the 24h approval
-    // window, no longer equal to the freeze timestamp for v2 plans. The v1
-    // legacy path used this same sample as the freeze timestamp itself
-    // (commitTimestamp == createdAt). publish, retry, and reconcile consume
-    // the frozen value from the plan and never re-read the wall clock or
-    // re-derive it.
+    // New prepares emit planVersion 3 (multi-release-unit postPublish v3;
+    // v3 inherits the v2 record-layer freeze-timestamp semantics from
+    // t1-2-digest-decoupling.md §4.2/§7). Production freeze timestamps are
+    // derived deterministically from the baseline headCommit's committer
+    // date, before the first frozen Git object exists. This single canonical
+    // value becomes GIT_AUTHOR_DATE/GIT_COMMITTER_DATE for every unit's
+    // frozen commit and every unit's frozenSnapshot.commitTimestamp;
+    // identical sources freeze byte-identical Git objects on every
+    // re-prepare. The wall-clock sample is still validated here (fail closed
+    // before any Git write) and becomes plan.createdAt -- record-layer real
+    // clock behind the 24h approval window, no longer equal to the freeze
+    // timestamp for v2/v3 plans. The v1 legacy path used this same sample as
+    // the freeze timestamp itself (commitTimestamp == createdAt). publish,
+    // retry, and reconcile consume the frozen value from the plan and never
+    // re-read the wall clock or re-derive it.
     const createdAtTimestamp = production
       ? normalizeGitTimestamp(clock ? clock() : new Date().toISOString(), 'plan createdAt timestamp')
       : null;
@@ -4252,16 +4260,20 @@ export async function prepareRelease(options) {
         ? 'foundationPayloadThenManualFollowUps'
         : 'manualFollowUps';
 
-    // --- Fold the validated postPublish declaration into the frozen plan ---
-    // Bindings: tag (tagTemplate rendered at the resolved target version —
-    // the same computation create-tag will use), tagCommit (the frozen
-    // production asset commit the tag will point at; only production
+    // --- Fold the validated postPublish declarations into the frozen plan ---
+    // Multi-release-unit v3 contract: the frozen field is ALWAYS an array,
+    // one entry per declaring unit in plan.units order (zero declarations
+    // freeze the empty array, which never enters post-release execution).
+    // Bindings per entry: tag (tagTemplate rendered at the resolved target
+    // version — the same computation create-tag will use), tagCommit (the
+    // frozen production asset commit the tag will point at; only production
     // prepares can freeze it — distribute fails closed when it is absent),
     // unitId (declaring unit), and payloadSource "tag-worktree" (R1 timing
     // contract: payload may only come from the detached worktree at
-    // tagCommit, never from workspace state). planVersion 2 record-layer
-    // stripping does not strip this block, so every declaration detail is
-    // bound into the plan digest.
+    // tagCommit, never from workspace state). The array and every entry
+    // participate in the plan digest through the existing digest mechanism
+    // (no per-entry summaries, maps, or second manifest), so declaration
+    // order and any bound field change change the plan digest.
     //
     // F-01 / T1 private execution bundle: parent-workspace files that the
     // post-publish commands need but the frozen tag does not contain are
@@ -4271,9 +4283,8 @@ export async function prepareRelease(options) {
     // plan is the bundle's only source of truth (no parallel manifest, no
     // second bundle digest): the raw executionFiles list folds into the
     // closure and is NOT duplicated into the frozen block.
-    let frozenPostPublish = null;
-    if (postPublishDeclaration) {
-      const { unit, index } = postPublishDeclaration;
+    const frozenPostPublish = [];
+    for (const { unit, index } of postPublishDeclarations) {
       const { tag } = resolveProductionBranch(unit, resolvedVersions[index]);
       const declaredExecutionFiles = unit.postPublish.executionFiles ?? [];
       const frozenTagPaths = productionAssets
@@ -4300,18 +4311,22 @@ export async function prepareRelease(options) {
         bundleRoot: relative(realRoot, bundleRootForAuthorityDir(releaseDir)),
       });
       const { executionFiles: _executionFiles, ...declarationWithoutManifest } = structuredClone(unit.postPublish);
-      frozenPostPublish = {
+      frozenPostPublish.push({
         ...declarationWithoutManifest,
         tag,
         ...(productionAssets ? { tagCommit: productionAssets[index].commit } : {}),
         unitId: unit.id,
         payloadSource: PAYLOAD_SOURCE_TAG_WORKTREE,
         executionBundle,
-      };
+      });
     }
 
     const plan = {
-      planVersion: 2,
+      // New prepares emit planVersion 3 (multi-release-unit postPublish v3):
+      // postPublish is the declaration ARRAY (possibly empty). v3 inherits
+      // the v2 record-layer digest and approval semantics; only the
+      // postPublish shape changes.
+      planVersion: 3,
       status: 'PREPARED',
       // Workflow profile (H5): 'full' for the complete gate set;
       // 'docs'/'config'/'marketplace' for trimmed code-class gates. Both
@@ -4352,7 +4367,7 @@ export async function prepareRelease(options) {
       units,
       externalActions,
       ...(publicSourceAuthorityReceipt ? { publicSourceAuthorityReceipt } : {}),
-      ...(frozenPostPublish ? { postPublish: frozenPostPublish } : {}),
+      postPublish: frozenPostPublish,
       ...(sourceAuthority ? { sourceAuthority } : {}),
       createdAt: production ? createdAtTimestamp : (clock ? clock() : new Date().toISOString()),
     };

package/src/commands/publish.mjs

@@ -791,21 +791,22 @@ export async function publishRelease(options) {
 
     const currentBaseline = await captureBaselineActual(root);
 
-    // planVersion fork (design: t1-2-digest-decoupling.md §4.3): for v2
-    // plans the baseline is record-layer audit data. Drift is recorded as a
-    // warning and execution continues -- artifact integrity is sealed by the
-    // frozen-artifact re-verification above, never by workspace equality.
-    // v1 plans keep the BASELINE_CHANGED hard failure, byte for byte.
-    const planV2 = plan.planVersion === 2;
+    // planVersion fork (design: t1-2-digest-decoupling.md §4.3): for
+    // planVersion 2/3 plans (v3 inherits the v2 semantics per 多发布单元
+    // postPublish v3 §4.2) the baseline is record-layer audit data. Drift is
+    // recorded as a warning and execution continues -- artifact integrity is
+    // sealed by the frozen-artifact re-verification above, never by workspace
+    // equality. v1 plans keep the BASELINE_CHANGED hard failure, byte for byte.
+    const recordLayerBaseline = plan.planVersion === 2 || plan.planVersion === 3;
 
     if (currentBaseline.gitTreeHash !== plan.baseline.gitTreeHash) {
-      if (planV2) {
+      if (recordLayerBaseline) {
         await evidence.append({
           phase: 'safety-gate',
           gate: 'baseline-check',
           status: 'warning',
           severity: 'warning',
-          reason: 'planVersion 2: baseline drift is record-layer audit data; frozen-artifact re-verification remains the integrity authority',
+          reason: 'planVersion 2/3: baseline drift is record-layer audit data; frozen-artifact re-verification remains the integrity authority',
           planTreeHash: plan.baseline.gitTreeHash,
           currentTreeHash: currentBaseline.gitTreeHash,
         });
@@ -831,13 +832,13 @@ export async function publishRelease(options) {
       plan.baseline.workspaceDigest &&
       currentBaseline.workspaceDigest !== plan.baseline.workspaceDigest
     ) {
-      if (planV2) {
+      if (recordLayerBaseline) {
         await evidence.append({
           phase: 'safety-gate',
           gate: 'baseline-check',
           status: 'warning',
           severity: 'warning',
-          reason: 'planVersion 2: workspace digest drift is record-layer audit data; frozen-artifact re-verification remains the integrity authority',
+          reason: 'planVersion 2/3: workspace digest drift is record-layer audit data; frozen-artifact re-verification remains the integrity authority',
           planWorkspaceDigest: plan.baseline.workspaceDigest,
           currentWorkspaceDigest: currentBaseline.workspaceDigest,
         });

package/src/commands/reconcile.mjs

@@ -357,21 +357,22 @@ export async function reconcileRelease(options) {
 
     const currentBaseline = await captureBaselineActual(root);
 
-    // planVersion fork (design: t1-2-digest-decoupling.md §4.3): for v2
-    // plans the baseline is record-layer audit data. Drift is recorded as a
-    // warning and execution continues -- artifact integrity is sealed by the
-    // frozen-artifact re-verification, never by workspace equality. v1 plans
-    // keep the BASELINE_CHANGED hard failure, byte for byte.
-    const planV2 = plan.planVersion === 2;
+    // planVersion fork (design: t1-2-digest-decoupling.md §4.3): for
+    // planVersion 2/3 plans (v3 inherits the v2 semantics per 多发布单元
+    // postPublish v3 §4.2) the baseline is record-layer audit data. Drift is
+    // recorded as a warning and execution continues -- artifact integrity is
+    // sealed by the frozen-artifact re-verification, never by workspace
+    // equality. v1 plans keep the BASELINE_CHANGED hard failure, byte for byte.
+    const recordLayerBaseline = plan.planVersion === 2 || plan.planVersion === 3;
 
     if (currentBaseline.gitTreeHash !== plan.baseline.gitTreeHash) {
-      if (planV2) {
+      if (recordLayerBaseline) {
         await evidence.append({
           phase: 'safety-gate',
           gate: 'baseline-check',
           status: 'warning',
           severity: 'warning',
-          reason: 'planVersion 2: baseline drift is record-layer audit data; frozen-artifact re-verification remains the integrity authority',
+          reason: 'planVersion 2/3: baseline drift is record-layer audit data; frozen-artifact re-verification remains the integrity authority',
           planTreeHash: plan.baseline.gitTreeHash,
           currentTreeHash: currentBaseline.gitTreeHash,
         });
@@ -396,13 +397,13 @@ export async function reconcileRelease(options) {
       plan.baseline.workspaceDigest &&
       currentBaseline.workspaceDigest !== plan.baseline.workspaceDigest
     ) {
-      if (planV2) {
+      if (recordLayerBaseline) {
         await evidence.append({
           phase: 'safety-gate',
           gate: 'baseline-check',
           status: 'warning',
           severity: 'warning',
-          reason: 'planVersion 2: workspace digest drift is record-layer audit data; frozen-artifact re-verification remains the integrity authority',
+          reason: 'planVersion 2/3: workspace digest drift is record-layer audit data; frozen-artifact re-verification remains the integrity authority',
           planWorkspaceDigest: plan.baseline.workspaceDigest,
           currentWorkspaceDigest: currentBaseline.workspaceDigest,
         });

package/src/commands/setup.mjs

@@ -34,7 +34,7 @@ import {
 } from '../core/errors.mjs';
 import { readTrustedPackageResource } from '../core/trusted-resource.mjs';
 import { validatePresetHook } from '../core/presets.mjs';
-import { validatePostPublishDeclaration } from '../core/postpublish.mjs';
+import { validatePostPublishDeclaration, validatePostPublishHookIdUniqueness } from '../core/postpublish.mjs';
 import { loadProjectConfig } from '../core/config.mjs';
 import { resolveProducerVersion } from '../core/evidence.mjs';
 import { validateHook } from '../core/hooks.mjs';
@@ -46,7 +46,6 @@ import {
   deriveGateSuggestions,
   deriveHookDurations,
   deriveLongHookSuggestions,
-  findPostPublishUnitConflict,
   scanGateDeclarationFindings,
   FINDING_CATEGORY,
   ASSESSMENT_STATUS,
@@ -3101,17 +3100,31 @@ export async function assessAdoption({ root } = {}) {
     evidence: { configDigest },
   }));
 
-  // 裁决 20: 跨单元 postPublish 规则（一次发布计划只绑定一个声明）。
-  const postPublishConflict = findPostPublishUnitConflict(declaredUnits);
-  if (postPublishConflict) {
-    findings.push(createFinding({
-      category: FINDING_CATEGORY.MANDATORY_GAP, code: 'POSTPUBLISH_MULTI_UNIT_CONFLICT',
-      fieldPath: 'releaseUnits[].postPublish',
-      message: `多个发布单元声明 postPublish（${postPublishConflict.unitIds.join(', ')}）；一次发布计划只绑定一个 postPublish 声明。`,
-      evidence: { unitIds: postPublishConflict.unitIds },
-      action: '只保留一个发布单元的 postPublish 声明（或将分发目标合并进同一单元）后重新评估。',
-      severity: 'blocking',
-    }));
+  // 多发布单元 postPublish v3（设计 §9.2/§9.7；返工 R-02）：多个发布单元
+  // 各自声明 postPublish 本身不再构成缺口——每个声明的字段级校验已在上面
+  // 逐项完成。仍失败关闭的只有：声明内容无效（POSTPUBLISH_INVALID，逐项
+  // 报告）与整份计划显式 hooks[].id 跨单元重复（(planDigest, hookId) 批准
+  // 合同要求全局唯一；target 与内部 probe 的本地 ID 可跨单元重复，检查点
+  // 以 unitId 区分）。唯一校验真源是 core/postpublish.mjs 的
+  // validatePostPublishHookIdUniqueness——本入口只做输入归一（收集各单元的
+  // 声明块）并调用同一函数，再把领域事实转成评估 finding。
+  const declaredPostPublishBlocks = declaredUnits
+    .filter((unit) => unit.postPublish !== undefined)
+    .map((unit) => ({ ...unit.postPublish, unitId: unit.id }));
+  try {
+    validatePostPublishHookIdUniqueness(declaredPostPublishBlocks);
+  } catch (error) {
+    if (error?.details?.hookId !== undefined && Array.isArray(error?.details?.unitIds)) {
+      const [owner, unitId] = error.details.unitIds;
+      findings.push(createFinding({
+        category: FINDING_CATEGORY.MANDATORY_GAP, code: 'POSTPUBLISH_HOOK_ID_DUPLICATE',
+        unitId, fieldPath: 'releaseUnits[].postPublish.hooks[].id',
+        message: `postPublish 显式 hook id "${error.details.hookId}" 同时由发布单元 "${owner}" 与 "${unitId}" 声明；整份计划的显式 hooks[].id 必须唯一（target 与内部 probe 的本地 ID 可跨单元重复）。`,
+        evidence: { hookId: error.details.hookId, unitIds: error.details.unitIds },
+        action: '为重复的显式 hook id 改名（或合并声明）后重新评估。',
+        severity: 'blocking',
+      }));
+    }
   }
 
   // 裁决 20: 评估复用实际 Hook 校验（core/hooks.mjs 的纯校验函数，不调用

package/src/commands/ship.mjs

@@ -3,7 +3,15 @@ import { basename, dirname, resolve } from 'node:path';
 import { publishFileOrReplace } from 'skill-family-harness-node';
 
 import { canonicalJson, sha256Hex } from '../core/digest.mjs';
-import { effectiveHookRequiresApproval } from '../core/postpublish.mjs';
+import {
+  effectiveHookRequiresApproval,
+  normalizePostPublishView,
+  postPublishActionId,
+} from '../core/postpublish.mjs';
+import {
+  derivePostReleaseChecklist,
+  unavailablePostReleaseChecklist,
+} from './post-release-local.mjs';
 import {
   ReleaseError,
   GATE_FAILED,
@@ -101,11 +109,13 @@ function publicState(state) {
     ...(state.approvalSummary ? { approvalSummary: state.approvalSummary } : {}),
     ...(state.approvalPath ? { approvalPath: state.approvalPath } : {}),
     ...(state.sourceRunPath ? { sourceRunPath: state.sourceRunPath } : {}),
+    ...(state.verifyRunPath ? { verifyRunPath: state.verifyRunPath } : {}),
     ...(state.distributeRunPath ? { distributeRunPath: state.distributeRunPath } : {}),
     ...(state.postVerify ? { postVerify: state.postVerify } : {}),
     ...(state.requirements ? { requirements: state.requirements } : {}),
     ...(state.manualFollowUps ? { manualFollowUps: state.manualFollowUps } : {}),
     ...(state.metadataUpdate ? { metadataUpdate: state.metadataUpdate } : {}),
+    ...(state.postRelease ? { postRelease: state.postRelease } : {}),
     verificationGateAuthorizationIncludedInPlanApproval: true,
     postVerifyMetadataUpdateIncludedInPlanApproval: true,
   };
@@ -146,11 +156,19 @@ async function buildApprovalSummary(planPath) {
  * or missing record falls back to ALL declared hooks — fail-safe, because a
  * gated hook in doubt keeps the gate shut.
  *
+ * Checkpoint action ids are unit-scoped for planVersion 3
+ * (`unitId/localId`, postPublishActionId) and bare local ids for legacy
+ * plans, so the closed-set comparison must derive the id from the owning
+ * declaration instead of comparing the bare hook id — otherwise every v3
+ * hook looks unclosed and a closed gated hook keeps the gate shut.
+ *
  * @param {object} state - Ship state (postVerify.runPath inspected).
- * @param {object[]} postVerifyHooks - Declared phase:postVerify hooks.
+ * @param {Array<{hook: object, unitId: string}>} postVerifyHooks - Declared
+ *   phase:postVerify hooks bound to their owning declaration's unitId.
+ * @param {number} planVersion - Frozen plan's planVersion (action-id rule).
  * @returns {Promise<boolean>}
  */
-async function allUnclosedPostVerifyHooksUngated(state, postVerifyHooks) {
+async function allUnclosedPostVerifyHooksUngated(state, postVerifyHooks, planVersion) {
   if (!Array.isArray(postVerifyHooks) || postVerifyHooks.length === 0) return false;
   let candidates = postVerifyHooks;
   if (state.postVerify?.runPath) {
@@ -163,13 +181,14 @@ async function allUnclosedPostVerifyHooksUngated(state, postVerifyHooks) {
             && (cp.status === 'succeeded' || cp.status === 'NO_CHANGE'))
           .map((cp) => cp.actionId),
       );
-      candidates = postVerifyHooks.filter((hook) => !closedIds.has(hook.id));
+      candidates = postVerifyHooks.filter(({ hook, unitId }) =>
+        !closedIds.has(postPublishActionId({ planVersion, unitId, localId: hook.id })));
     } catch {
       candidates = postVerifyHooks; // unreadable record: fail safe
     }
   }
   if (candidates.length === 0) return false;
-  return candidates.every((hook) => effectiveHookRequiresApproval(hook) === false);
+  return candidates.every(({ hook }) => effectiveHookRequiresApproval(hook) === false);
 }
 
 /**
@@ -344,10 +363,12 @@ export async function advanceShip(options = {}, injected = {}) {
   if (state.status === 'PUBLISHED' || state.status === 'NEEDS_MANUAL_ATTESTATIONS') {
     // Step 1: Check if postPublish requires distribution.
     // Hooks-only declarations (no targets) still route through distribute.
+    // §4.3 unified normalization: v3 empty arrays carry no distribute work;
+    // legacy absent postPublish resolves to the same empty view.
     const plan = JSON.parse(await readFile(state.planPath, 'utf8'));
-    const hasDistributeWork = (plan.postPublish?.targets?.length ?? 0) > 0
-      || (plan.postPublish?.hooks?.length ?? 0) > 0;
-    const needsDistribution = Boolean(plan.postPublish) && hasDistributeWork;
+    const hasDistributeWork = normalizePostPublishView(plan).some((declaration) =>
+      (declaration.targets?.length ?? 0) > 0 || (declaration.hooks?.length ?? 0) > 0);
+    const needsDistribution = hasDistributeWork;
     if (needsDistribution && deps.distributeRelease) {
       state.status = 'DISTRIBUTING';
       await writeJsonAtomic(statePath, state);
@@ -404,9 +425,19 @@ export async function advanceShip(options = {}, injected = {}) {
         requirements: undefined,
         manualFollowUps: verified.manualFollowUps ?? undefined,
         baselineAdvance: verified.baselineAdvance ?? undefined,
+        postRelease: undefined,
         updatedAt: new Date().toISOString(),
       };
       await writeJsonAtomic(statePath, state);
+      if (verified.status === 'VERIFIED') {
+        try {
+          state.postRelease = derivePostReleaseChecklist(plan);
+        } catch (error) {
+          state.postRelease = unavailablePostReleaseChecklist(plan, error);
+        }
+        state.updatedAt = new Date().toISOString();
+        await writeJsonAtomic(statePath, state);
+      }
     } catch (error) {
       if (error?.code !== CONSUMER_VERIFICATION_DEFERRED) throw error;
       state = {
@@ -422,7 +453,8 @@ export async function advanceShip(options = {}, injected = {}) {
     // independent run after the main run is VERIFIED, with the verify run as
     // lineage source. A PARTIAL postVerify run or a postVerify gate failure
     // NEVER demotes VERIFIED — the outcome is recorded on the ship state.
-    const postVerifyHooks = (plan.postPublish?.hooks ?? [])
+    const postVerifyHooks = normalizePostPublishView(plan)
+      .flatMap((declaration) => declaration.hooks ?? [])
       .filter((hook) => hook.phase === 'postVerify');
     if (state.status === 'VERIFIED' && postVerifyHooks.length > 0 && deps.postVerifyRelease) {
       postVerifyRanThisCall = true;
@@ -476,10 +508,11 @@ export async function advanceShip(options = {}, injected = {}) {
     && (!state.postVerify || state.postVerify.status !== 'DISTRIBUTED')
   ) {
     const reentryPlan = JSON.parse(await readFile(state.planPath, 'utf8'));
-    const reentryPostVerifyHooks = (reentryPlan.postPublish?.hooks ?? [])
-      .filter((hook) => hook.phase === 'postVerify');
+    const reentryPostVerifyHooks = normalizePostPublishView(reentryPlan)
+      .flatMap((declaration) => (declaration.hooks ?? []).map((hook) => ({ hook, unitId: declaration.unitId })))
+      .filter(({ hook }) => hook.phase === 'postVerify');
     const approvallessRetryAllowed = reentryApprovalPaths.length === 0
-      && await allUnclosedPostVerifyHooksUngated(state, reentryPostVerifyHooks);
+      && await allUnclosedPostVerifyHooksUngated(state, reentryPostVerifyHooks, reentryPlan.planVersion);
     if (reentryPostVerifyHooks.length > 0
       && (reentryApprovalPaths.length > 0 || approvallessRetryAllowed)) {
       let postVerifyOutcome;

package/src/commands/verify.mjs

@@ -23,6 +23,7 @@ import { resolveContained } from 'skill-family-harness-node';
 const execFile = promisify(execFileCb);
 
 import { validatePlan, computePlanDigest, validatePlanActionCompleteness } from '../core/plan.mjs';
+import { normalizePostPublishView, postPublishActionId } from '../core/postpublish.mjs';
 import { createEvidenceWriter } from '../core/evidence.mjs';
 import { readRunRecovery } from '../core/recovery.mjs';
 import {
@@ -888,7 +889,7 @@ async function discoverDistributeRuns({ planPath, plan }) {
  *   governance rule that NEEDS_INPUT/BLOCKED cannot silently become VERIFIED.
  *
  * @param {Object} run - A distribute run record (checkpoints + status).
- * @param {Object} plan - The frozen release plan (postPublish.hooks source).
+ * @param {Object} plan - The frozen release plan (normalized postPublish declaration source).
  * @returns {{ pass: boolean, warned: boolean, exemptions: Object[] }}
  */
 export function evaluateDistributeGateRun(run, plan) {
@@ -896,12 +897,19 @@ export function evaluateDistributeGateRun(run, plan) {
   if (run.status === 'DISTRIBUTED') return { pass: true, warned: false, exemptions: [] };
   if (run.status !== 'PARTIAL') return { pass: false, warned: false, exemptions: [] };
 
-  const hooksById = new Map(((plan?.postPublish?.hooks ?? [])).map((hook) => [hook.id, hook]));
+  // §4.3 unified normalization: hooks resolve across all declarations and
+  // are keyed by the SAME action-id derivation the distribute run used, so
+  // v3 namespaced checkpoint ids (unitId/hookId) map back to their hook.
+  const hooksByActionId = new Map((plan ? normalizePostPublishView(plan) : [])
+    .flatMap((declaration) => (declaration.hooks ?? []).map((hook) => [
+      postPublishActionId({ planVersion: plan?.planVersion, unitId: declaration.unitId, localId: hook.id }),
+      hook,
+    ])));
   const exemptions = [];
   for (const checkpoint of run.checkpoints ?? []) {
     if (checkpoint.status === 'succeeded' || checkpoint.status === 'skipped') continue;
     const hook = checkpoint.actionType === 'postpublish-hook'
-      ? hooksById.get(checkpoint.actionId)
+      ? hooksByActionId.get(checkpoint.actionId)
       : undefined;
     if (hook && checkpoint.status === 'failed' && hook.blocksVerified === false) {
       exemptions.push({ actionId: checkpoint.actionId, status: checkpoint.status });
@@ -929,7 +937,7 @@ export function evaluateDistributeGateRun(run, plan) {
  * @param {() => string} [options.clock] - Clock function returning ISO-8601 strings.
  * @param {Object} [options.previousVerifyRun] - 上一次验证成功的 verify run 记录，用于安装契约摘要免验。
  *
- * @returns {Promise<{ planPath: string, status: string, adapterChecks: Object[], smokeTest: Object }>}
+ * @returns {Promise<{ planPath: string, runPath: string, status: string, adapterChecks: Object[], smokeTest: Object }>}
  *
  * @throws {ReleaseError} GATE_FAILED on safety gate failures.
  * @throws {ReleaseError} POST_PUBLISH_VERIFY_FAILED if any verification fails.
@@ -1068,10 +1076,12 @@ export async function verifyRelease(options) {
     // PARTIAL distribute run passes only through the blocksVerified:false
     // exemption path (evaluateDistributeGateRun) — warned, never silent.
     // =======================================================================
-    const declaredPostPublishTargets = plan.postPublish?.targets ?? [];
-    const declaredPostPublishHooks = plan.postPublish?.hooks ?? [];
-    if (plan.postPublish
-      && (declaredPostPublishTargets.length > 0 || declaredPostPublishHooks.length > 0)) {
+    // §4.3 unified normalization: v3 empty arrays mean no distribution
+    // requirement; legacy absent postPublish resolves to the same empty view.
+    const postPublishDeclarations = normalizePostPublishView(plan);
+    const requiresDistribution = postPublishDeclarations.some((declaration) =>
+      (declaration.targets?.length ?? 0) > 0 || (declaration.hooks?.length ?? 0) > 0);
+    if (requiresDistribution) {
       await evidence.append({ phase: 'verify', step: 'distribute-run-discovery', status: 'started' });
 
       const distributeCandidates = await discoverDistributeRuns({ planPath, plan }) ?? [];
@@ -2176,6 +2186,7 @@ export async function verifyRelease(options) {
 
     return {
       planPath,
+      runPath: verifyRunPath,
       status: VERIFIED,
       adapterChecks,
       recoveryActionCode: null,

package/src/core/adoption-assessment.mjs

@@ -40,9 +40,6 @@
 import { canonicalJson, sha256Hex } from './digest.mjs';
 import { resolveProducerVersion } from './evidence.mjs';
 
-// Keep the assessment entry point compatible without duplicating the rule.
-export { findPostPublishUnitConflict } from './hooks.mjs';
-
 /** Four adoption statuses; never reuses ASSESSED (design §3.2). */
 export const ASSESSMENT_STATUS = Object.freeze({
   NOT_CONFIGURED: 'NOT_CONFIGURED',

package/src/core/approval.mjs

@@ -12,7 +12,8 @@
  * - approvedAt is not in the future (beyond 5-minute clock skew tolerance)
  *
  * The planVersion fork (design: t1-2-digest-decoupling.md §4.3) is
- * centralized here: for planVersion 2 plans the baseline is record-layer
+ * centralized here: for planVersion 2/3 plans (v3 inherits the v2 approval
+ * boundary per 多发布单元 postPublish v3 §4.2) the baseline is record-layer
  * data -- gitTreeHash/workspaceDigest equality and the production workspace
  * digest algorithm double-check are NOT invalidation conditions (artifact
  * integrity is sealed by the frozen-artifact re-verification at publish).
@@ -186,11 +187,13 @@ export function validateApproval(plan, approval, options = {}) {
     );
   }
 
-  // planVersion fork (centralized here; see module header): v2 plans treat
-  // the baseline as optional record-layer data.
-  const planV2 = plan?.planVersion === 2;
+  // planVersion fork (centralized here; see module header): planVersion 2/3
+  // plans treat the baseline as optional record-layer data (v3 inherits the
+  // v2 approval boundary per 多发布单元 postPublish v3 §4.2). Versions beyond
+  // {2,3} stay on the legacy v1 path and are never silently admitted.
+  const recordLayerBaseline = plan?.planVersion === 2 || plan?.planVersion === 3;
 
-  if (planV2) {
+  if (recordLayerBaseline) {
     if (!approval.planDigest || !approval.expiresAt) {
       throw new ReleaseError(
         GATE_FAILED,
@@ -206,7 +209,7 @@ export function validateApproval(plan, approval, options = {}) {
     );
   }
 
-  if (!planV2) {
+  if (!recordLayerBaseline) {
     if (plan.production?.mode === 'github-npm-v1') {
       if (plan.baseline?.workspaceDigestAlgorithm !== WORKSPACE_DIGEST_ALGORITHM) {
         throw new ReleaseError(
@@ -249,9 +252,9 @@ export function validateApproval(plan, approval, options = {}) {
   }
 
   // --- baseline equality checks (v1 plans only) ---
-  // For planVersion 2 plans the baseline is record-layer data: it stays in
+  // For planVersion 2/3 plans the baseline is record-layer data: it stays in
   // the plan/approval files for audit but is not an invalidation condition.
-  if (!planV2) {
+  if (!recordLayerBaseline) {
     // --- baseline.gitTreeHash match ---
     if (approval.baseline.gitTreeHash !== plan.baseline?.gitTreeHash) {
       throw new ReleaseError(