release-skill 0.9.15 → 0.9.16

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.15",
+  "version": "0.9.16",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.15",
+  "version": "0.9.16",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.15",
+  "version": "0.9.16",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.15.",
+      "Prepare a release plan for version 0.9.16.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.15",
+  "version": "0.9.16",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.9.16 locale=en baseline=sha256:ea8288d2ffcedf02008eb0bc10280d52bc6ddd2e383f072913340eb64cb7ca63 -->
+## [0.9.16] - 2026-09-09
+
+0.9.16 is a local source candidate that connects verified releases to explicit source-branch checks, host-aware setup continuation, and postVerify finish guidance. The three Foundation dependencies remain pinned to the exact 0.17.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- The source-branch reminder runs only `git branch --show-current` and `git status --short --branch`; it never fetches, switches, merges, rebases, stashes, resets, cleans, or pushes. Setup names are matched as skill metadata and are never executed as shell text.
+- Skill Family Hub updates bind the observed branch head with compare-and-swap semantics. Partial Hub publication is never rolled back or force-pushed, and remote state is never overwritten.
+
+### Added
+
+- Projects may configure `releaseFinish.sourceBranchCheck` as `remind` or `skip` and may name a loaded setup entry through `releaseFinish.setupSkill`. The release-finish workflow keeps the publishing workspace separate from an explicitly selected consumer project and reports setup as pending when the target directory, loaded plugin version, or callable host is not established.
+- Source checks use read-only Git commands and report the current branch, worktree changes, upstream summary, and any decision that still belongs to the maintainer. A project can select `release-setup` when it wants the release-finish workflow to continue into release-skill setup.
+
+### Changed
+
+- After a successful postVerify run reaches `DISTRIBUTED`, both JSON and text CLI output now expose the same Hub-backed local-host finish guidance used by the release-finish workflow. The guidance remains diagnostic and never invokes a host command on its own.
+- Host updates and setup checks remain local follow-up work and do not change the immutable release plan or the `VERIFIED` publication result. Shared project readiness may be checked once only when the plugin version, consumer directory, and runtime environment are the same; host-specific installation and loading remain separate checks.
+- Skill Family Hub publication continues through the project-private postVerify hook and GitHub Git Data API. The Hub update remains a separately approved compare-and-swap write against the observed branch head.
+
+### Fixed
+
+- A completed postVerify delivery now keeps `DISTRIBUTED` even when the optional finish checklist cannot reread its plan. The CLI returns an explicit unavailable diagnostic without rewriting the successful delivery checkpoint.
+
+### Upgrade Notes
+
+Upgrade from 0.9.15 to receive postVerify finish guidance and optional source-branch and setup continuation. Add a top-level `releaseFinish` block only when the project wants to select a setup entry or change the default reminder policy. Remove any release-skill standalone marketplace registration, add or update `ifoohoo/skill-family-hub`, and use `release-skill@skill-family-hub`. Restart an updated host before treating the new plugin version or setup entry as loaded.
+<!-- release-skill:changelog:end version=0.9.16 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.9.15 locale=en baseline=sha256:caaa3680d940673edb3421512224623f618d8bff4ab159be60c797620ea3851f -->
 ## [0.9.15] - 2026-09-07
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.15 -->
+<!-- release-skill:release-version: 0.9.16 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -110,7 +110,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.15
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.16
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.15 -->
+<!-- release-skill:release-version: 0.9.16 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -101,7 +101,7 @@ release-skill 当前只采用并验证 Kimi Code 的交互式 TUI 路径，**无
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.15
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.16
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.15 -->
+<!-- release-skill:release-version: 0.9.16 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,33 +14,37 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.15** (2026-09-07)
+**0.9.16** (2026-09-09)
 
-0.9.15 is a local source candidate that makes release preparation use the project's existing assessment, refresh, focused-check, and formal prepare entry points, and makes prepare help return before business execution. The three Foundation dependencies remain pinned to the exact 0.17.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+0.9.16 is a local source candidate that connects verified releases to explicit source-branch checks, host-aware setup continuation, and postVerify finish guidance. The three Foundation dependencies remain pinned to the exact 0.17.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
 
 **Security**
 
-- The orchestration change adds no execution engine, Hook type, cache key, approval state, or external write. Environment allowlists still forward only values already present in the invoking environment, and invalid lowercase names remain configuration errors.
-- Frozen candidates keep their existing acceptance boundary. A newly generated candidate requires validation against its own bytes; earlier acceptance evidence is not reused for changed output.
-- Skill Family Hub updates continue to use compare-and-swap against the observed branch head through GitHub's Git Data API. A partial Hub publication is never rolled back or force-pushed, and existing remote state is never overwritten.
+- The source-branch reminder runs only `git branch --show-current` and `git status --short --branch`; it never fetches, switches, merges, rebases, stashes, resets, cleans, or pushes. Setup names are matched as skill metadata and are never executed as shell text.
+- Skill Family Hub updates bind the observed branch head with compare-and-swap semantics. Partial Hub publication is never rolled back or force-pushed, and remote state is never overwritten.
+
+**Added**
+
+- Projects may configure `releaseFinish.sourceBranchCheck` as `remind` or `skip` and may name a loaded setup entry through `releaseFinish.setupSkill`. The release-finish workflow keeps the publishing workspace separate from an explicitly selected consumer project and reports setup as pending when the target directory, loaded plugin version, or callable host is not established.
+- Source checks use read-only Git commands and report the current branch, worktree changes, upstream summary, and any decision that still belongs to the maintainer. A project can select `release-setup` when it wants the release-finish workflow to continue into release-skill setup.
 
 **Changed**
 
-- The release-prepare Skill now reads the current project contract and authorization, resolves required release-document and generated-artifact freshness work through existing project entry points, runs focused checks after repairs, and leaves complete validation to the formal prepare Hook path.
-- After a failure, release-prepare groups directly related fixes before retrying and does not add a same-purpose full test run by default. Explicitly requested independent full acceptance remains part of the workflow, and projects without valid cache evidence still execute their complete Hooks.
-- Existing 0.9.14 production-run retention and Hub-backed post-verification host guidance remain available. The project-private postVerify Hook continues to publish the verified release-skill entry and public snapshot to Skill Family Hub through GitHub's Git Data API.
+- After a successful postVerify run reaches `DISTRIBUTED`, both JSON and text CLI output now expose the same Hub-backed local-host finish guidance used by the release-finish workflow. The guidance remains diagnostic and never invokes a host command on its own.
+- Host updates and setup checks remain local follow-up work and do not change the immutable release plan or the `VERIFIED` publication result. Shared project readiness may be checked once only when the plugin version, consumer directory, and runtime environment are the same; host-specific installation and loading remain separate checks.
+- Skill Family Hub publication continues through the project-private postVerify hook and GitHub Git Data API. The Hub update remains a separately approved compare-and-swap write against the observed branch head.
 
 **Fixed**
 
-- `prepare --help` and `prepare -h` now return before project-root resolution, configuration loading, lock acquisition, run cleanup, Hook execution, snapshot construction, or plan writes. JSON help returns `command: prepare` with `status: HELP`; prepare without a help flag keeps its existing business path.
+- A completed postVerify delivery now keeps `DISTRIBUTED` even when the optional finish checklist cannot reread its plan. The CLI returns an explicit unavailable diagnostic without rewriting the successful delivery checkpoint.
 
 **Upgrade Notes**
 
-Upgrade from 0.9.14 to use the consolidated release-prepare workflow and side-effect-free prepare help. No project configuration migration is required. Keep project-specific generation and prerequisite checks in their existing reviewed entry points. Remove any release-skill standalone marketplace registration, add or update `ifoohoo/skill-family-hub`, and use `release-skill@skill-family-hub`. Existing executable `externalActions` targets retain their current update path; Hub-backed targets remain manual in 0.9.15.
+Upgrade from 0.9.15 to receive postVerify finish guidance and optional source-branch and setup continuation. Add a top-level `releaseFinish` block only when the project wants to select a setup entry or change the default reminder policy. Remove any release-skill standalone marketplace registration, add or update `ifoohoo/skill-family-hub`, and use `release-skill@skill-family-hub`. Restart an updated host before treating the new plugin version or setup entry as loaded.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.9.15 is the current source candidate. This README
+> **Current boundary:** v0.9.16 is the current source candidate. This README
 > records intended scope and verification boundaries; it is not evidence of
 > publication, consumer-installation verification, or independent acceptance.
 > Release availability must be established from the corresponding release records
@@ -64,7 +68,7 @@ Upgrade from 0.9.14 to use the consolidated release-prepare workflow and side-ef
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.9.15 is the current
+> **Production path verified since the v0.1.1 milestone; v0.9.16 is the current
 > source candidate. Its README does not establish publication,
 > consumer-installation verification, or independent acceptance.**
 > The npm-installed CLI is the supported user entry. Source checkout
@@ -93,13 +97,15 @@ checkpoints remain intact and use matching-version recovery. Evidence v1 stays
 read-only; v2 uses a closed top level with phase extensions in `details`.
 Summaries and recovery suggestions are diagnostic, never publication authority.
 
-The current 0.9.15 candidate includes the narrow R-05 Hook cache v2 consumer
+The current 0.9.16 candidate includes the narrow R-05 Hook cache v2 consumer
 path, the public `postverify` path, and the stable isolated install-tree record
 path (A2/A3). It keeps Skill Family Hub as the single marketplace source. It
 also makes the `release-prepare` Skill organize existing assessment, refresh,
 focused-check, and prepare entry points without adding another execution
 engine. `prepare --help` and `prepare -h` now return before configuration,
-locks, runs, or hooks can observe the request. This candidate still
+locks, runs, or hooks can observe the request. The `release-finish` Skill can
+also report the source branch and continue into a configured setup entry after
+the selected host has loaded the released plugin. This candidate still
 excludes R-02 safe full-tree inventory, R-10 historical-release verification
 implementation, real Kimi/WorkBuddy public-marketplace installation and
 invocation gates, and an Audit public offline release-record verifier.
@@ -496,6 +502,9 @@ project:
   name: my-project
   defaultBranch: main
   sourceRepository: owner/my-workspace
+releaseFinish:
+  sourceBranchCheck: remind
+  setupSkill: release-setup
 releaseUnits:
   - id: my-project
     source: .
@@ -526,6 +535,12 @@ releaseUnits:
       branchStrategy: create-release-branch
 ```
 
+`releaseFinish` controls only local post-release work. `sourceBranchCheck`
+defaults to `remind`; set it to `skip` to suppress the read-only source-branch
+reminder. `setupSkill` is optional and names an already installed and loaded
+setup entry such as `release-setup` or `plugin:skill`; it is never executed as
+a shell command. The two settings are independent.
+
 `distributions` is required but may be an explicit empty array. Use
 `distributions: []` when release-skill should publish only the unit's GitHub
 snapshot, tag, and GitHub Release, with no npm publish or marketplace consumer
@@ -797,7 +812,7 @@ A release unit may also declare `postPublish.localHostUpdate` for a plugin that
 is delivered through a project-selected Hub by a `postVerify` hook. After that
 hook reaches `DISTRIBUTED`, `ship`, `verify`, `post-release`, and
 `release-finish` display the declared Hub, plugin, and hosts. These Hub-backed
-targets are manual in 0.9.14 (`promptRequired: true`, `available: false`): the
+targets are manual in 0.9.16 (`promptRequired: true`, `available: false`): the
 prompt does not query the Hub, inspect the host, or run host commands. Claude
 and Codex use their existing marketplace management entry; Kimi uses the
 frozen GitHub Release and its existing confirmation path; CodeBuddy and

package/README.zh-CN.md

@@ -2,39 +2,43 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.15 -->
+<!-- release-skill:release-version: 0.9.16 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.15** (2026-09-07)
+**0.9.16** (2026-09-09)
 
-0.9.15 是一个本地源码候选。本版本让发布准备复用项目已有评估、刷新、聚焦检查和正式 prepare 入口，并让 prepare 帮助在业务执行前返回。三项 Foundation 依赖仍精确固定在已发布的 0.17.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
+0.9.16 是把已验证发布衔接到显式源码分支检查、宿主感知 setup 续接和 postVerify 收尾提示的本地源码候选。三项 Foundation 依赖仍精确固定在已发布的 0.17.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
 
 **安全**
 
-- 本次编排调整不新增执行引擎、Hook 类型、缓存键、批准状态或外部写入。环境变量白名单仍只转发调用环境中已存在的同名值，非法的小写名称继续按配置错误处理。
-- 已冻结候选保留原有验收边界。新生成的候选必须针对自身字节验证，不得复用变更前的验收证据。
-- Skill Family Hub 更新继续通过 GitHub Git Data API，根据已观察的分支头比较后写入。Hub 局部发布不回滚、不覆盖，也不强推。
+- 源码分支提醒只运行 `git branch --show-current` 和 `git status --short --branch`，不会 fetch、切换、合并、rebase、stash、reset、clean 或 push。setup 名只作为技能元数据匹配，不会按 shell 文本执行。
+- Skill Family Hub 更新以已观察的分支头为基础比较后写入。Hub 局部发布不回滚、不覆盖，也不强推。
+
+**新增**
+
+- 项目可以把 `releaseFinish.sourceBranchCheck` 配置为 `remind` 或 `skip`，并通过 `releaseFinish.setupSkill` 指定已加载的 setup 入口。release-finish 会区分发布工作区和用户明确选择的消费项目；目标目录、新版插件加载状态或可调用宿主不能确认时，只报告 setup 待执行。
+- 源码检查只运行只读 Git 命令，报告当前分支、工作区改动、上游摘要，以及仍需维护者决定的事项。项目需要让 release-finish 继续进入 release-skill setup 时，可以选择 `release-setup`。
 
 **变更**
 
-- release-prepare Skill 现在先读取项目合同和授权，通过项目已有入口处理发布文档与生成物新鲜度，修复后运行聚焦检查，并把完整验证交给正式 prepare Hook 路径。
-- 一次失败后，release-prepare 会集中处理直接相关的修复再重试，默认不增加同目的的完整测试。用户明确要求的独立完整验收仍保留；项目没有有效缓存证据时，完整 Hook 仍会执行。
-- 0.9.14 的 production run 保留策略和 Hub-backed 发布后验证宿主提示继续可用。项目私有的 postVerify Hook 继续通过 GitHub Git Data API，把已验证的 release-skill 条目和公开快照发布到 Skill Family Hub。
+- postVerify 成功进入 `DISTRIBUTED` 后，JSON 和文本 CLI 输出都会显示与 release-finish 一致的 Hub-backed 本机宿主收尾提示。提示只用于诊断，不会自行调用宿主命令。
+- 宿主更新和 setup 检查仍属于本地后续工作，不改写不可变发布计划，也不改变 `VERIFIED` 发布结果。只有插件版本、消费目录和运行环境都相同时，才可复用一次项目就绪检查；各宿主仍分别检查安装与加载状态。
+- Skill Family Hub 继续通过项目私有的 postVerify hook 和 GitHub Git Data API 发布。Hub 更新仍需单独批准，并根据已观察的分支头比较后写入。
 
 **修复**
 
-- `prepare --help` 和 `prepare -h` 现在会在项目根目录解析、配置读取、锁获取、run 清理、Hook 执行、快照构建或计划写入前返回。JSON 帮助返回 `command: prepare` 和 `status: HELP`；没有帮助参数的 prepare 保留原有业务路径。
+- postVerify 已完成分发后，即使可选收尾清单无法重新读取计划，也会保留 `DISTRIBUTED`。CLI 会返回明确的不可用诊断，不会改写已成功的分发检查点。
 
 **升级说明**
 
-从 0.9.14 升级后，可使用收敛后的 release-prepare 流程和无业务副作用的 prepare 帮助。项目配置无需迁移；项目专属的生成和前提检查仍通过已审阅入口执行。删除各宿主中独立的 `release-skill` 市场登记，添加或更新 `ifoohoo/skill-family-hub`，并使用 `release-skill@skill-family-hub`。现有 `externalActions` 可执行目标继续使用原更新路径；0.9.15 的 Hub-backed 目标仍由维护者人工处理。
+从 0.9.15 升级后，可获得 postVerify 收尾提示，以及可选的源码分支与 setup 续接。只有需要指定 setup 入口或修改默认提醒策略时，才增加顶层 `releaseFinish` 配置。删除各宿主中独立的 `release-skill` 市场登记，添加或更新 `ifoohoo/skill-family-hub`，并使用 `release-skill@skill-family-hub`。宿主更新后需先重启，才能把新版插件或 setup 入口视为已加载。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.9.15 只是当前源码候选。本 README 记录预期范围与验证边界，
+> **当前边界：** v0.9.16 只是当前源码候选。本 README 记录预期范围与验证边界，
 > 不代表已经发布、完成消费者安装验证或通过独立验收。
 > 版本可用性以对应发布记录及发布后验证结果为准。
 > v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
@@ -50,7 +54,7 @@ release-skill 帮助维护者回答三个问题：准备发布什么、还有哪
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.15 是当前源码候选，本 README 不证明该候选已经发布、完成消费者安装验证或通过独立验收。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.16 是当前源码候选，本 README 不证明该候选已经发布、完成消费者安装验证或通过独立验收。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
@@ -68,10 +72,11 @@ marketplace 委托目标工作区发布的边界不变。
 
 旧 production 计划缺少 `sourceAuthority` 时，在外部写入前拒绝。未发生外部写入的计划必须重新 prepare 并批准新摘要，不能补写旧计划或迁移批准。已有 `PARTIAL` 保留检查点，走匹配版本的恢复路径。evidence v1 只读；v2 顶层封闭，阶段扩展放在 `details`。摘要和恢复建议只作诊断，不构成发布权威。
 
-当前 0.9.15 候选包含窄范围的 R-05 Hook cache v2 消费路径、公开 `postverify`
+当前 0.9.16 候选包含窄范围的 R-05 Hook cache v2 消费路径、公开 `postverify`
 路径和稳定隔离安装树记录路径（A2/A3），继续以 Skill Family Hub 为唯一市场来源。
 `release-prepare` Skill 现在会组织项目已有的评估、刷新、聚焦检查和 prepare 入口，不新增执行引擎。
-`prepare --help` 和 `prepare -h` 会在配置、锁、run 或 Hook 观察请求之前返回。当前仍不包含
+`prepare --help` 和 `prepare -h` 会在配置、锁、run 或 Hook 观察请求之前返回。
+所选宿主加载已发布插件后，`release-finish` Skill 还可以报告源码分支，并继续执行已配置的 setup 入口。当前仍不包含
 R-02 安全整树盘点、R-10 历史发布验证
 的产品实现、真实 Kimi/WorkBuddy 公开市场安装与调用门禁或 Audit 公开离线发布记录
 验证器。本范围说明不构成远端发布记录或消费者升级指引。
@@ -415,6 +420,9 @@ project:
   name: my-project
   defaultBranch: main
   sourceRepository: owner/my-workspace
+releaseFinish:
+  sourceBranchCheck: remind
+  setupSkill: release-setup
 releaseUnits:
   - id: my-project
     source: .
@@ -445,6 +453,10 @@ releaseUnits:
       branchStrategy: create-release-branch
 ```
 
+`releaseFinish` 只控制本地发布收尾。`sourceBranchCheck` 缺省为 `remind`；设为
+`skip` 时关闭只读源码分支提醒。`setupSkill` 可省略，填写时指定已经安装并加载的 setup
+入口，例如 `release-setup` 或 `plugin:skill`；它不会作为 shell 命令执行。两个配置彼此独立。
+
 `distributions` 是必填字段，但可以显式设为空数组。使用
 `distributions: []` 时，release-skill 只发布该单元的 GitHub 快照、标签和
 GitHub Release，不生成 npm 发布或市场消费者动作。单元的 `postPublish` 声明仍会

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.15",
+  "version": "0.9.16",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.15"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.16"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "e47969ed810fa0edbed7073f13df855be95feed7ffecc40f72dd887cab52ff97";
+const __bundleSourceDigest = "ba44ad70cebc1cc077887bdf71bf36d78b9073c8aeabd0074aac2eb0d5caffea";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -148166,6 +148166,23 @@ This command creates an independent postVerify run and never reads or writes shi
       root,
       ...postpublishApprovalPaths.length > 0 ? { postpublishApprovalPaths } : {}
     });
+    if (result2.status === "DISTRIBUTED") {
+      const {
+        derivePostReleaseChecklist: derivePostReleaseChecklist2,
+        unavailablePostReleaseChecklist: unavailablePostReleaseChecklist2
+      } = await init_post_release_local().then(() => post_release_local_exports);
+      let plan;
+      try {
+        plan = JSON.parse(await readFile57(resolve42(planPath), "utf8"));
+        result2.postRelease = derivePostReleaseChecklist2(plan, {
+          root,
+          runPath: result2.runPath,
+          postVerifyComplete: true
+        });
+      } catch (error) {
+        result2.postRelease = unavailablePostReleaseChecklist2(plan, error);
+      }
+    }
     if (hasJson) {
       console.log(JSON.stringify(result2, null, 2));
     } else {
@@ -148174,6 +148191,17 @@ This command creates an independent postVerify run and never reads or writes shi
         console.log(`  ${cp4.actionId}: ${cp4.status}`);
       }
       if (result2.runPath) console.log(`PostVerify run: ${result2.runPath}`);
+      if (result2.postRelease?.status === "UNAVAILABLE") {
+        console.warn(`Post-release checklist unavailable: ${result2.postRelease.diagnostic?.message ?? "unknown error"}`);
+      } else if (result2.postRelease?.localHostUpdate?.promptRequired === true) {
+        const localHostUpdate = result2.postRelease.localHostUpdate;
+        console.log(`Post-release: ask whether to update local host plugins (${localHostUpdate.hosts.join(", ")}).`);
+        if (localHostUpdate.available === true && typeof localHostUpdate.runPath === "string") {
+          console.log(`Post-release command: release-skill post-release --plan ${resolve42(planPath)} --run ${localHostUpdate.runPath}`);
+          console.log("Choose --hosts before adding --update-local-hosts to perform a local update.");
+        }
+        printHubManualTargets(localHostUpdate.targets);
+      }
     }
     await exitAfterFlush(result2.status === "DISTRIBUTED" ? 0 : 1);
   } catch (err) {

package/adapters/claude/schemas/release-project.schema.json

@@ -44,6 +44,24 @@
         }
       }
     },
+    "releaseFinish": {
+      "type": "object",
+      "description": "Optional local post-release finish settings. Omitted sourceBranchCheck defaults to remind.",
+      "additionalProperties": false,
+      "properties": {
+        "sourceBranchCheck": {
+          "type": "string",
+          "enum": [
+            "remind",
+            "skip"
+          ]
+        },
+        "setupSkill": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9-]*(?::[a-z0-9][a-z0-9-]*)?$"
+        }
+      }
+    },
     "publicSourceAuthorityReceipt": {
       "type": "object",
       "description": "Optional public source-authority receipt uploaded to one coordinator GitHub Release after all subject npm tarballs are frozen.",

package/adapters/claude/skills/release-finish/SKILL.md

@@ -70,6 +70,64 @@ node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill-local-finish.mjs" \
 
 完成后报告每个宿主的状态，并提醒用户重启已更新的宿主。本机结果只记录收尾事实，不改变发布状态。
 
+## 配置与目录
+
+从发布项目目录的 `.release-skill/project.yaml` 读取 `releaseFinish` 和 `project.defaultBranch`。
+文件缺失或无法解析时，报告具体配置问题，不猜默认分支或 setup，也不得把文件缺失当作字段合法缺省；
+已经取得的发布结果仍保留。只有配置文件有效时，整个 `releaseFinish` 或其中字段缺省才按各自合同默认。
+
+发布项目目录用于读取配置和执行源码 Git 检查。setup 使用用户明确指定的消费项目目录或已明确的使用
+上下文。只有用户明确把发布源码仓库作为消费项目时，才能在那里执行 setup；同时提供两个目录时不得混用。
+
+## 更新后 setup
+
+完成现有清单及已授权的宿主处理后，读取发布项目 `.release-skill/project.yaml` 的
+`releaseFinish.setupSkill`。未配置时不增加 setup 提示。配置的技能名只用于匹配入口，不作为 shell 命令执行，
+也不授权安装同名插件。
+
+只有本次所选宿主已经成功更新，或现有检查确认它已是目标版本时，才衔接 setup。通过宿主实际技能
+元数据核对目标插件身份、版本和入口；不能从开发仓库、旧会话缓存或同名技能推断新版已加载。当前宿主
+不满足时，可以使用同次更新中另一个已安装并加载目标版本和入口的宿主。
+
+目标目录来自用户本次明确指定的消费项目或已明确的使用上下文。目录不明确、宿主需要重启、当前环境
+不能调用可用宿主、入口不存在或归属有歧义时，标为“待执行”，并给出插件与版本、技能名、目标目录和
+已有授权的续接提示。发出提示不代表 setup 已完成。
+
+对同一插件版本、同一项目目录和相同共享运行环境，项目级依赖、项目配置和 Git hooks 由一个已加载
+新版插件的宿主检查一次。其余宿主分别核对自身安装、加载和宿主专属配置。不同运行环境不得无条件
+复用项目就绪结论；按目标 setup 的实际合同补查差异。release-finish 不保存去重键、收据或新的状态。
+
+调用 setup 前完整读取目标技能及其必读引用，并传入目标项目、插件版本、只读检查意图和已有授权范围。
+已有具体修复授权应传递给 setup；未覆盖的写入不能执行。只读检查、安装结果和配置修复结果分别报告。
+最终自然语言回复列出执行宿主、插件版本、消费项目路径、实际结果和未完成项。任何 setup 结果都不改变
+`VERIFIED`，也不影响其他宿主已经完成的结果。
+
+## 源码分支检查
+
+宿主更新和 setup 不影响本项检查。读取 `releaseFinish.sourceBranchCheck`；字段或整个
+`releaseFinish` 缺省时按 `remind` 处理。配置为 `skip` 时不运行 Git 命令，只说明项目已关闭
+源码分支检查。
+
+`remind` 时，在发布项目目录依次运行两条只读命令：
+
+```bash
+git branch --show-current
+git status --short --branch
+```
+
+第一条命令取得当前分支。第二条命令读取工作区改动和现有上游跟踪摘要；不得增加会写入或访问网络的
+参数。当前分支等于 `project.defaultBranch` 且没有文件改动时，说明本地已位于目标分支；输出含
+ahead 或 behind 等跟踪信息时，仍原样概括。分支不一致时说明两个准确名称，并询问用户是否需要处理。
+第一条命令输出为空时，说明处于 detached HEAD，不猜测目标操作。工作区存在改动时说明不建议直接
+切换或清理。任一命令失败时，报告命令、退出结果和无法完成检查的事实。
+
+最终自然语言回复至少列出提醒策略、目标分支、当前分支或无法取得的事实、工作区是否有改动、Git
+上游跟踪摘要，以及是否需要用户决定下一步。没有上游信息时，明确说明命令输出未显示上游信息。
+
+本项检查不从宿主更新推导出 Git 写入授权，不自动执行 fetch、switch、checkout、merge、rebase、stash、
+reset、clean 或 push。用户跳过宿主更新仍执行默认分支检查。用户已经明确授权同一仓库、分支和操作时，
+按项目 Git 纪律继续，不重复询问相同授权；检查本身不改变 `VERIFIED`，不保存结果，也不产生新的 run。
+
 ## 临时归属
 
 本能力目前只服务发布后的本机收尾，因此保留在 release-skill。第二个技能族需要复用宿主更新或 TUI 驱动，或 Foundation 发布等价公共入口时，再把通用机制上收 Foundation并删除这里的通用部分。release-skill 只保留发布计划到宿主更新输入的领域映射。

package/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.15",
+  "version": "0.9.16",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.15.",
+      "Prepare a release plan for version 0.9.16.",
       "Help me understand the release workflow."
     ]
   }

package/adapters/codex/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.15"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.16"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "e47969ed810fa0edbed7073f13df855be95feed7ffecc40f72dd887cab52ff97";
+const __bundleSourceDigest = "ba44ad70cebc1cc077887bdf71bf36d78b9073c8aeabd0074aac2eb0d5caffea";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -148166,6 +148166,23 @@ This command creates an independent postVerify run and never reads or writes shi
       root,
       ...postpublishApprovalPaths.length > 0 ? { postpublishApprovalPaths } : {}
     });
+    if (result2.status === "DISTRIBUTED") {
+      const {
+        derivePostReleaseChecklist: derivePostReleaseChecklist2,
+        unavailablePostReleaseChecklist: unavailablePostReleaseChecklist2
+      } = await init_post_release_local().then(() => post_release_local_exports);
+      let plan;
+      try {
+        plan = JSON.parse(await readFile57(resolve42(planPath), "utf8"));
+        result2.postRelease = derivePostReleaseChecklist2(plan, {
+          root,
+          runPath: result2.runPath,
+          postVerifyComplete: true
+        });
+      } catch (error) {
+        result2.postRelease = unavailablePostReleaseChecklist2(plan, error);
+      }
+    }
     if (hasJson) {
       console.log(JSON.stringify(result2, null, 2));
     } else {
@@ -148174,6 +148191,17 @@ This command creates an independent postVerify run and never reads or writes shi
         console.log(`  ${cp4.actionId}: ${cp4.status}`);
       }
       if (result2.runPath) console.log(`PostVerify run: ${result2.runPath}`);
+      if (result2.postRelease?.status === "UNAVAILABLE") {
+        console.warn(`Post-release checklist unavailable: ${result2.postRelease.diagnostic?.message ?? "unknown error"}`);
+      } else if (result2.postRelease?.localHostUpdate?.promptRequired === true) {
+        const localHostUpdate = result2.postRelease.localHostUpdate;
+        console.log(`Post-release: ask whether to update local host plugins (${localHostUpdate.hosts.join(", ")}).`);
+        if (localHostUpdate.available === true && typeof localHostUpdate.runPath === "string") {
+          console.log(`Post-release command: release-skill post-release --plan ${resolve42(planPath)} --run ${localHostUpdate.runPath}`);
+          console.log("Choose --hosts before adding --update-local-hosts to perform a local update.");
+        }
+        printHubManualTargets(localHostUpdate.targets);
+      }
     }
     await exitAfterFlush(result2.status === "DISTRIBUTED" ? 0 : 1);
   } catch (err) {

package/adapters/codex/schemas/release-project.schema.json

@@ -44,6 +44,24 @@
         }
       }
     },
+    "releaseFinish": {
+      "type": "object",
+      "description": "Optional local post-release finish settings. Omitted sourceBranchCheck defaults to remind.",
+      "additionalProperties": false,
+      "properties": {
+        "sourceBranchCheck": {
+          "type": "string",
+          "enum": [
+            "remind",
+            "skip"
+          ]
+        },
+        "setupSkill": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9-]*(?::[a-z0-9][a-z0-9-]*)?$"
+        }
+      }
+    },
     "publicSourceAuthorityReceipt": {
       "type": "object",
       "description": "Optional public source-authority receipt uploaded to one coordinator GitHub Release after all subject npm tarballs are frozen.",