release-skill 0.9.15 → 0.9.17

package/adapters/workbuddy/schemas/release-plan.schema.json

@@ -1624,7 +1624,7 @@
           "type": "array",
           "minItems": 1,
           "uniqueItems": true,
-          "items": { "type": "string", "enum": ["claude", "codex", "kimi", "codebuddy", "workbuddy"] }
+          "items": { "type": "string", "enum": ["claude", "codex", "kimi", "codebuddy", "workbuddy", "qoder"] }
         },
         "hub": { "$ref": "#/definitions/planLocalHostHub" }
       }

package/adapters/workbuddy/schemas/release-project.schema.json

@@ -44,6 +44,24 @@
         }
       }
     },
+    "releaseFinish": {
+      "type": "object",
+      "description": "Optional local post-release finish settings. Omitted sourceBranchCheck defaults to remind.",
+      "additionalProperties": false,
+      "properties": {
+        "sourceBranchCheck": {
+          "type": "string",
+          "enum": [
+            "remind",
+            "skip"
+          ]
+        },
+        "setupSkill": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9-]*(?::[a-z0-9][a-z0-9-]*)?$"
+        }
+      }
+    },
     "publicSourceAuthorityReceipt": {
       "type": "object",
       "description": "Optional public source-authority receipt uploaded to one coordinator GitHub Release after all subject npm tarballs are frozen.",
@@ -1035,7 +1053,7 @@
           "type": "array",
           "minItems": 1,
           "uniqueItems": true,
-          "items": { "type": "string", "enum": ["claude", "codex", "kimi", "codebuddy", "workbuddy"] }
+          "items": { "type": "string", "enum": ["claude", "codex", "kimi", "codebuddy", "workbuddy", "qoder"] }
         },
         "hub": { "$ref": "#/definitions/localHostHub" }
       }

package/adapters/workbuddy/skills/release-finish/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: release-finish
-description: 发布达到 VERIFIED 后处理发布收尾：确认 postVerify 提案送达边界，按发布分支策略决定是否询问合并，并在用户确认后更新本机 Claude、Codex、Kimi、CodeBuddy/WorkBuddy 插件
+description: 发布达到 VERIFIED 后处理发布收尾：确认 postVerify 提案送达边界，按发布分支策略决定是否询问合并，并在用户确认后更新本机 Claude、Codex、Kimi、CodeBuddy/WorkBuddy、Qoder 插件
 ---
 
 # release-finish
@@ -13,7 +13,7 @@ description: 发布达到 VERIFIED 后处理发布收尾：确认 postVerify 提
 
 这是发布后的独立收尾，不属于 `prepare → approve → publish → verify` 状态机。它不能把本机更新结果写成新的发布状态，也不能因为本机更新失败而降低 `VERIFIED`。
 
-默认只读取冻结计划和 verify 或 postVerify run。没有用户明确同意，不合并分支，不更新插件。Kimi 只在插件信任界面中的仓库和标签都与冻结目标一致时确认安装；目录信任不自动确认。
+默认只读取冻结计划和 verify 或 postVerify run。没有用户明确同意，不合并分支，不更新插件。用户显式选择 Kimi 更新后，只有标准初始目录信任界面和插件信任界面中的冻结身份都通过核对，才确认当前项目并安装。用户显式选择 Qoder 且冻结计划声明该宿主后，才执行计划绑定的 Hub 更新。
 
 ## 先生成收尾清单
 
@@ -35,7 +35,7 @@ node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill-local-finish.mjs" \
 
 1. `merge.promptRequired=false` 时，发布工作流已经推进或初始化目标分支，不再询问合并。
 2. `merge.promptRequired=true` 时，向用户说明尚未覆盖的发布分支，并询问是否需要合并。用户同意后，先只读核对源分支、目标分支、工作区状态和项目既有合并方式，再用明确的分支名执行；本脚本不猜分支，也不自动推送。
-3. `localHostUpdate.promptRequired=true` 时，列出计划覆盖的宿主，询问是否更新本机插件。Hub-backed 目标必须显示其声明的 Hub、插件和宿主，并明确这是人工安装/升级入口，不运行本机命令；Claude/Codex 使用现有 marketplace 管理入口，Kimi 使用冻结 GitHub Release 和现有人工确认路径，CodeBuddy/WorkBuddy 明确人工处理且不能固定 Hub ref。后续“用户同意更新”段仅适用于 `available=true` 的 executable externalActions 目标；Hub-backed 始终人工入口。两个问题可以一次问完。
+3. `localHostUpdate.promptRequired=true` 时，列出计划覆盖的宿主，询问是否更新本机插件。Hub-backed 目标必须显示其声明的 Hub、插件和宿主。Qoder 是其中唯一可执行的 Hub-backed 目标；Claude/Codex 使用现有 marketplace 管理入口，Kimi 使用冻结 GitHub Release 和现有人工确认路径，CodeBuddy/WorkBuddy 明确人工处理且不能固定 Hub ref。后续“用户同意更新”段适用于 `available=true` 的 executable externalActions 目标和 Qoder Hub 目标，其余 Hub-backed 目标仍为人工入口。两个问题可以一次问完。
 
 ## postVerify 提案送达边界
 
@@ -55,7 +55,7 @@ node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill-local-finish.mjs" \
   --plan <plan-path> \
   --run <verify-or-postverify-run-path> \
   --update-local-hosts \
-  --hosts claude,codex,kimi,codebuddy,workbuddy \
+  --hosts claude,codex,kimi,codebuddy,workbuddy,qoder \
   --confirm-plan <planDigest> \
   --json
 ```
@@ -63,12 +63,71 @@ node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill-local-finish.mjs" \
 只传用户选择且计划声明的宿主。宿主 CLI 不存在时返回 `SKIPPED_NOT_INSTALLED`。各宿主按以下规则处理：
 
 - Claude 或 Codex 只有在市场需要重绑时，才会在该宿主第一条写命令之前只读查询冻结的市场仓库、引用和提交。远端不可达、引用缺失或提交不一致时返回 `MANUAL_REQUIRED`，该宿主不执行市场或插件写入；其他已选宿主继续处理。精确当前安装仍核对真实载荷，但不强制联网。
-- Kimi 的精确当前安装会在返回 `ALREADY_CURRENT` 前核对真实载荷；发生安装或迁移时，只在操作完成后核对结果。配置根依次取显式 `kimiHome`、`KIMI_CODE_HOME`、用户主目录下的 `.kimi-code`，TUI 与安装后观察使用同一根。release-finish 当前只采用并验证 Kimi Code 的受控终端交互界面（TUI）路径：清理 ANSI/OSC 控制序列和软换行后，在插件信任对话框内分别核对冻结仓库与标签，确认选中 `Trust and install` 后才提交，再重新加载。出现 `Trust this folder?`、未知界面、超时、提前退出，或无法确认身份和选中项时返回 `MANUAL_REQUIRED` 或失败结果，不确认目录信任，也不继续安装。包名、版本、发布标签、已安装修订号和受管安装根必须与冻结计划一致；`.git` 只提供附加诊断，不是通过条件。旧的本地路径安装会在同一 TUI 会话中先移除，再按发布标签安装。
+- Kimi 的精确当前安装会在返回 `ALREADY_CURRENT` 前核对真实载荷；发生安装或迁移时，只在操作完成后核对结果。配置根依次取显式 `kimiHome`、`KIMI_CODE_HOME`、用户主目录下的 `.kimi-code`，TUI 与安装后观察使用同一根。release-finish 当前只采用并验证 Kimi Code 的受控终端交互界面（TUI）路径，并把 TUI 工作目录固定为 `--root` 指定的当前发布项目。用户已确认冻结计划、显式选择更新且 `--hosts` 包含 `kimi` 时，流程只在初始标准 `Trust this folder?` 界面确认目录：先核对当前选中 `No, exit` 和目标 `Trust this folder`，移动并重新核对目标选中项，确认后等待已知命令提示符。插件命令发出后再次出现目录信任、界面或选中项未知、移动后无法确认、超时或提前退出时，该宿主失败并停止后续安装步骤。插件信任仍先清理 ANSI/OSC 控制序列和软换行，再分别核对冻结仓库与标签；只有选中 `Trust and install` 才提交并重新加载。包名、版本、发布标签、已安装修订号和受管安装根必须与冻结计划一致；`.git` 只提供附加诊断，不是通过条件。旧的本地路径安装会在同一 TUI 会话中先移除，再按发布标签安装。
 - CodeBuddy/WorkBuddy 只处理同一 bundled-family 插件和市场。CodeBuddy 仅探测全局 `codebuddy`/`cbc`，由收尾脚本把 `CODEBUDDY_CONFIG_DIR` 固定为有效 `HOME`（环境未提供时取操作系统用户主目录）下名为 `.codebuddy` 的目录；WorkBuddy 仅在 macOS 探测 WorkBuddy 应用内嵌 CLI，由收尾脚本把 `CODEBUDDY_CONFIG_DIR` 与 `WORKBUDDY_CONFIG_DIR` 同时固定为有效 `HOME` 下名为 `.workbuddy` 的目录，绝不把两者互作回退。只有冻结标签与计划声明的可变分支都从同一远端解析到冻结提交时，才调用正式市场更新和插件更新命令；完成后重新读取安装列表，并精确核对唯一条目的市场、版本和修订号。目标未安装、来源不符、远端不可访问或身份不一致时返回 `MANUAL_REQUIRED`，不修改宿主。非 macOS 的 WorkBuddy 返回 `SKIPPED_UNSUPPORTED_PLATFORM`。
+- Qoder 先用 `qoder plugins marketplace list --json` 核对计划声明的 Hub 名称、仓库、分支和本机 checkout，再用 `qoder plugins list --json` 核对唯一插件条目的市场、`scope=user`、版本与 `installPath`。目标市场或插件未安装时返回 `MANUAL_REQUIRED`，不添加市场，也不执行首次安装。旧版已安装时，只运行 `qoder plugins marketplace update <name>` 和 `qoder plugins update <plugin@marketplace> --scope user`。市场刷新后、插件更新前，必须从 Hub 的 `marketplace.json` 核对目标条目的 `source.url` 和 `source.sha`；操作后从真实 `installPath` 核对 Qoder manifest、完整声明载荷和冻结来源。市场可能在检查与更新之间变化，事后身份不符时报告失败，不自动降级、卸载或覆盖。
 
 任何宿主失败都保留其他宿主的实际结果，不回滚，也不把失败冒充成功。
 
-完成后报告每个宿主的状态，并提醒用户重启已更新的宿主。本机结果只记录收尾事实，不改变发布状态。
+完成后报告每个宿主的安装状态。Qoder 返回 `UPDATED` 只表示安装载荷已经更新；启动新会话或执行 `/plugins reload` 并核对实际加载版本后，才能报告新版已加载。本机结果只记录收尾事实，不改变发布状态。
+
+## 配置与目录
+
+从发布项目目录的 `.release-skill/project.yaml` 读取 `releaseFinish` 和 `project.defaultBranch`。
+文件缺失或无法解析时，报告具体配置问题，不猜默认分支或 setup，也不得把文件缺失当作字段合法缺省；
+已经取得的发布结果仍保留。只有配置文件有效时，整个 `releaseFinish` 或其中字段缺省才按各自合同默认。
+
+发布项目目录用于读取配置、执行源码 Git 检查和调用 setup。`--root <project-root>` 指定的目录也是 setup
+的目标目录；不再接收或询问另一个项目路径。
+
+## 更新后 setup
+
+完成现有清单及已授权的宿主处理后，读取发布项目 `.release-skill/project.yaml` 的
+`releaseFinish.setupSkill`。未配置时不增加 setup 提示。配置的技能名只用于匹配入口，不作为 shell 命令执行，
+也不授权安装同名插件。
+
+只有本次所选宿主已经成功更新，或现有检查确认它已是目标版本时，才衔接 setup。通过宿主实际技能
+元数据核对目标插件身份、版本和入口；不能从开发仓库、旧会话缓存或同名技能推断新版已加载。当前宿主
+不满足时，可以使用同次更新中另一个已安装并加载目标版本和入口的宿主。
+
+setup 的目标目录固定为当前发布项目根目录。宿主需要重启、当前环境不能调用可用宿主、入口不存在或
+归属有歧义时，标为“待执行”，并给出插件与版本、技能名、当前项目路径和已有授权的续接提示。发出提示
+不代表 setup 已完成。
+
+对同一插件版本、同一项目目录和相同共享运行环境，项目级依赖、项目配置和 Git hooks 由一个已加载
+新版插件的宿主检查一次。其余宿主分别核对自身安装、加载和宿主专属配置。不同运行环境不得无条件
+复用项目就绪结论；按目标 setup 的实际合同补查差异。release-finish 不保存去重键、收据或新的状态。
+
+调用 setup 前完整读取目标技能及其必读引用，并传入当前发布项目、插件版本、只读检查意图和已有授权范围。
+已有具体修复授权应传递给 setup；未覆盖的写入不能执行。只读检查、安装结果和配置修复结果分别报告。
+最终自然语言回复列出执行宿主、插件版本、当前项目路径、实际结果和未完成项。任何 setup 结果都不改变
+`VERIFIED`，也不影响其他宿主已经完成的结果。
+
+## 源码分支检查
+
+宿主更新和 setup 不影响本项检查。读取 `releaseFinish.sourceBranchCheck`；字段或整个
+`releaseFinish` 缺省时按 `remind` 处理。配置为 `skip` 时不运行 Git 命令，只说明项目已关闭
+源码分支检查。
+
+`remind` 时，在发布项目目录依次运行两条只读命令：
+
+```bash
+git branch --show-current
+git status --short --branch
+```
+
+第一条命令取得当前分支。第二条命令读取工作区改动和现有上游跟踪摘要；不得增加会写入或访问网络的
+参数。当前分支等于 `project.defaultBranch` 且没有文件改动时，说明本地已位于目标分支；输出含
+ahead 或 behind 等跟踪信息时，仍原样概括。分支不一致时说明两个准确名称，并询问用户是否需要处理。
+第一条命令输出为空时，说明处于 detached HEAD，不猜测目标操作。工作区存在改动时说明不建议直接
+切换或清理。任一命令失败时，报告命令、退出结果和无法完成检查的事实。
+
+最终自然语言回复至少列出提醒策略、目标分支、当前分支或无法取得的事实、工作区是否有改动、Git
+上游跟踪摘要，以及是否需要用户决定下一步。没有上游信息时，明确说明命令输出未显示上游信息。
+
+本项检查不从宿主更新推导出 Git 写入授权，不自动执行 fetch、switch、checkout、merge、rebase、stash、
+reset、clean 或 push。用户跳过宿主更新仍执行默认分支检查。用户已经明确授权同一仓库、分支和操作时，
+按项目 Git 纪律继续，不重复询问相同授权；检查本身不改变 `VERIFIED`，不保存结果，也不产生新的 run。
 
 ## 临时归属
 

package/adapters/workbuddy/skills/release-help/SKILL.md

@@ -17,15 +17,15 @@ description: "Discoverable entry point for release-skill: dependency and environ
 - 只读诊断：运行 dry-run 检查，不修改任何文件
 - 故障引导：根据错误码指向对应的修复 Skill
 
-## 0.9.5 候选边界
+## 0.9.17 候选边界
 
 当前源码候选允许多发布单元项目在计划冻结前显式选择本轮范围。`prepare` 和新建的 `ship` 状态支持重复传入 `--unit <id>`；未传时继续选择全部配置单元。成功选择会列出选中与延期单元。延期单元不进入本轮计划，也不获得发布状态。
 
 选择只影响按单元绑定的检查与动作。完整配置、生成物新鲜度和顶层 Hook 仍覆盖整个项目。`publicSourceAuthorityReceipt` 涉及的 coordinator 和 subjects 必须作为完整闭包共同选择，系统不会自动扩选。计划冻结后，`plan.units` 是唯一范围权威；publish、reconcile、verify 和 distribute 不接受 `--unit`。
 
-0.9.3 引入的四项工作流保护、Hook cache v2 和稳定隔离安装树记录在 0.9.4 继续保留。0.9.4 精确消费 Foundation 0.16.0 的公开包根 API。Hook cache 只复用绝对路径或经真实 cwd 校验的 cwd-relative executable identity；裸 PATH、PATHEXT、Windows 和观察不可用时，Hook 仍冷执行，缓存复用失败关闭且不写入 v2 cache。缓存没有 TTL。
+0.9.3 引入的四项工作流保护、Hook cache v2 和稳定隔离安装树记录在后续版本继续保留。当前 0.9.17 候选精确消费 Foundation 0.17.0 的公开包根 API。Hook cache 只复用绝对路径或经真实 cwd 校验的 cwd-relative executable identity；裸 PATH、PATHEXT、Windows 和观察不可用时，Hook 仍冷执行，缓存复用失败关闭且不写入 v2 cache。缓存没有 TTL。
 
-稳定隔离安装树记录只在宿主命令退出、目录已隔离且扫描期间没有并发写入时执行；宿主附加链接只记录、不跟随，声明载荷中的 symlink 失败关闭，legacy 全树语义保持不变。0.9.5 仍是源码候选，不能从本说明推断已批准、发布或验证。
+稳定隔离安装树记录只在宿主命令退出、目录已隔离且扫描期间没有并发写入时执行；宿主附加链接只记录、不跟随，声明载荷中的 symlink 失败关闭，legacy 全树语义保持不变。0.9.17 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 **阶段通过规则**: `status` 与 `readiness.localPreparation.status` 只判断本地 help/assess/prepare；其充要条件是 `READY` 且 exit code 为 0。`missingRequired` 列出缺失的 Node/Git。生产发布必须另外读取 `readiness.productionPublish`：缺少 npm/gh 时为 `NOT_READY`，依赖存在时仍是 `AUTH_CHECK_REQUIRED`，因为 help 不访问网络、不验证认证。Agent 无权把本地就绪解释为生产就绪。
 

package/adapters/workbuddy/skills/release-verify/SKILL.md

@@ -22,9 +22,9 @@ ship state；hook approval 缺失、错误或过期时，在 hook 执行前失
 
 **注意**: distribute gate (W1) 已经实现并集成在标准 verify 流程中。verify 现在会检查 postPublish 分发状态（git mirror + marketplace index），只有当所有外部动作都完成并通过验证时才达到 VERIFIED。
 
-**工作流兼容性**: 
+**工作流兼容性**:
 - `docs-only`: consumer-verify preserved (步骤⑧)
-- `config-only`: scene B completes full chain including verify  
+- `config-only`: scene B completes full chain including verify
 - `marketplace-only`: delegates to workspace's exclusive skill for final verification
 - `full-happy-end`: standard complete path with all gates
 

package/bin/release-skill-cli.mjs

@@ -37,11 +37,11 @@ registerPathRedactor(redactSensitivePaths);
 
 const execFile = promisify(execFileCb);
 
-const COMMANDS = new Set(['help', 'setup', 'assess', 'prepare', 'approve', 'publish', 'reconcile', 'verify', 'postverify', 'ship', 'post-release', 'attest', 'hooks', 'artifacts', 'docs', 'distribute', 'route', 'lineage']);
+const COMMANDS = new Set(['help', 'setup', 'assess', 'prepare', 'approve', 'publish', 'reconcile', 'verify', 'verify-records', 'postverify', 'ship', 'post-release', 'attest', 'hooks', 'artifacts', 'docs', 'distribute', 'route', 'lineage']);
 
 function printHubManualTargets(targets = []) {
   for (const target of targets) {
-    if (target.targetKind === 'hub-backed') {
+    if (target.targetKind === 'hub-backed' && target.executionMode === 'manual') {
       console.log(`Manual host update: ${target.plugin} via Hub ${target.hub.name} (${target.host}). ${target.message}`);
     }
   }
@@ -270,6 +270,13 @@ async function performEnvironmentChecks() {
     usage: '仅供发布后的人工安装使用；release-skill 不核验 CodeBuddy/WorkBuddy 安装',
   };
 
+  const qoderCheck = await checkDependency('qoder', ['--version']);
+  checks.qoder = {
+    ...qoderCheck,
+    required: false,
+    usage: '仅供发布后的可选 Qoder 本机更新使用；不影响生产发布就绪度',
+  };
+
   return checks;
 }
 
@@ -303,7 +310,7 @@ function getCapabilityMaturity() {
     publish: {
       available: true,
       mode: 'controlled production (protocol-tested; no OS/network sandbox)',
-      description: 'Publishes frozen GitHub/npm artifacts after one readable-plan approval, runs automated Claude/Codex checkpoints, and emits non-blocking Kimi/CodeBuddy manual follow-ups',
+      description: 'Publishes frozen GitHub/npm artifacts after one readable-plan approval, runs automated Claude/Codex checkpoints, and emits non-blocking Kimi/CodeBuddy manual follow-ups plus the optional Qoder post-release update',
     },
     reconcile: {
       available: true,
@@ -313,7 +320,12 @@ function getCapabilityMaturity() {
     verify: {
       available: true,
       mode: 'fresh consumer verification (protocol-tested; no OS/network sandbox)',
-      description: 'Recheck remote state, exact npm installation, CLI help, and automated Claude/Codex installs before VERIFIED; Kimi/CodeBuddy remain unverified manual follow-ups',
+      description: 'Recheck remote state, exact npm installation, CLI help, and automated Claude/Codex installs before VERIFIED; Kimi/CodeBuddy remain unverified manual follow-ups and Qoder remains optional post-release local work',
+    },
+    verifyRecords: {
+      available: true,
+      mode: 'offline explicit-input verification',
+      description: 'Verify caller-supplied plan, approval, and release-run bytes without record discovery, remote access, process execution, or state changes',
     },
     postverify: {
       available: true,
@@ -353,6 +365,7 @@ Commands:
   publish    Publish frozen GitHub/npm artifacts after approval
   reconcile  Resume PARTIAL state from evidence; conflicts require a human
   verify     Fresh remote and consumer verification; only this reaches VERIFIED
+  verify-records Verify explicitly supplied historical plan, approval, and run records offline
   postverify Run approved postVerify hooks from a VERIFIED run in an independent run
   ship       Resume one durable prepare -> approve -> publish -> verify flow; completes a parked
              postVerify hook once its checkpoint approval is provided (--hook-approval)
@@ -371,6 +384,8 @@ Options:
   --plan <path>    Path to the release plan file (required for approve/publish/reconcile/verify/postverify)
   --run <path>     Path to the release run file, or a run directory whose release-run.json
                    is resolved automatically (required for reconcile/verify/postverify)
+  --target-run <path> Target release-run.json for verify-records
+  --source-run <path> Explicit predecessor release-run.json for verify-records (repeatable)
   --approval <path> Path to the release-level approval record (required for publish/postverify)
   --production     Prepare immutable Git/npm production artifacts
   --output <path>  Override prepare/approve output path (non-production only)
@@ -399,6 +414,7 @@ Options:
   --select-hooks <ids> Comma-separated proposal ids to adopt (propose-hooks mode)
   --foundation-profile <path> Explicit foundation postPublish profile JSON (proposal input only; never auto-applied)
   --unit <id>      Select a release unit for prepare/ship (repeatable); docs refresh accepts one unit
+  --target-version <version> Expected release unit version for prepare/ship/verify-records
   --confirm-refresh <sha256:...> Confirm the exact dry-run refreshDigest before any document write
   --ack-local-document-write Acknowledge the explicit local release-document write (docs refresh --write)
   --platform <id>   Legacy attestation platform: kimi or codebuddy
@@ -411,7 +427,7 @@ Options:
   --hook-approval <path> Checkpoint approval for one requiresApproval hook (ship/distribute/postverify; repeatable)
   --state <path>    Override the durable ship state file
   --update-local-hosts Update installed plugins for selected local hosts after VERIFIED
-  --hosts <ids>     Comma-separated local hosts for post-release update. No local host is updated unless --hosts contains at least one id
+  --hosts <ids>     Comma-separated local hosts for post-release update: claude,codex,kimi,codebuddy,workbuddy,qoder. No local host is updated unless --hosts contains at least one id
   --confirm-plan <digest> Confirm the exact VERIFIED plan before local host mutation
   --no-hook-cache  Force every prepare hook to run in full; neither read nor write the hook cache
   --json           Output results as JSON
@@ -424,6 +440,7 @@ Safety:
   The ship command runs configured hooks and gates automatically. Frozen plan approval is the only
   normal release-level approval; requiresApproval postPublish hooks keep independent checkpoint approvals.
   Kimi/CodeBuddy installations are non-blocking manual follow-up tasks (not verified by system).
+  Qoder is an optional post-release local update; it never becomes a release distribution checkpoint.
   prepare copies current public files into a local snapshot; it does not rewrite source files.
   - Default mode is offline (release-skill pipeline does no remote writes)
   - prepare output goes to .release-skill/ directory only
@@ -432,6 +449,7 @@ Safety:
   - docs refresh --write rewrites only declared README managed regions and the current CHANGELOG entry after exact refreshDigest confirmation; it never commits, pushes, tags, publishes, or installs.
   - publish requires explicit approval; plan digest is auto-read from the plan file
   - post-release local host updates are optional local mutations and never change VERIFIED
+  - verify-records reads only the paths named on its command line; it never discovers records, contacts remotes, or changes release state
   - publish consumes frozen Git/npm artifacts, never the live workspace
   - existing remote objects and uncertain checks stop for human intervention
   - production-equivalent protocol sandbox is verified; a real remote canary is not
@@ -520,6 +538,7 @@ if (!command || command === 'help') {
             codex: '声明 codex-plugin distribution 时必须可用',
             kimi: '发布后人工安装待办；不影响生产发布就绪度，系统不核验',
             codebuddy: '发布后人工安装待办；不影响生产发布就绪度，系统不核验',
+            qoder: '发布后可选本机更新；不影响生产发布就绪度，不是 release distribution checkpoint',
           },
         },
       },
@@ -533,7 +552,7 @@ if (!command || command === 'help') {
         onlinePrepare: 'previous-public-baseline observation available; production mode freezes publish artifacts and fails closed on drift or unknown state',
         publish: 'GitHub/npm plus automated Claude/Codex consumer checkpoints are protocol-tested without an OS/network sandbox; one approval is required and the internal plan digest is checked automatically',
         reconcile: 'PARTIAL recovery is protocol-tested without an OS/network sandbox; remote conflicts require human intervention',
-        verify: 'fresh exact npm and Claude/Codex consumer installation checks are protocol-tested without an OS/network sandbox; Kimi/CodeBuddy are unverified manual follow-ups; command invocation authorizes configured gates',
+        verify: 'fresh exact npm and Claude/Codex consumer installation checks are protocol-tested without an OS/network sandbox; Kimi/CodeBuddy are unverified manual follow-ups and Qoder is optional post-release local work; command invocation authorizes configured gates',
       },
       recommendations: [],
     };
@@ -688,6 +707,105 @@ For parallel or cross-session versions, use .release-skill/ships/<version>.json.
   await exitAfterFlush(0);
 }
 
+// Offline record verification help stops before reading any caller path or
+// importing the domain verifier. The command always emits one JSON document;
+// --json remains mandatory so consumers cannot accidentally parse prose.
+if (command === 'verify-records' && (args.includes('--help') || args.includes('-h'))) {
+  console.log(`release-skill verify-records - Verify explicit historical release records offline
+
+Usage:
+  release-skill verify-records --plan <path> --approval <path> --target-run <path> --source-run <path>... --unit <id> --target-version <version> --json
+
+Options:
+  --plan <path>              Explicit release-plan JSON file
+  --approval <path>          Explicit approval-record JSON file
+  --target-run <path>        Explicit target release-run JSON file
+  --source-run <path>        Explicit predecessor release-run JSON file (repeatable)
+  --unit <id>                Expected release unit id
+  --target-version <version> Expected release unit version
+  --json                     Required; output one JSON result
+  -h, --help                 Show this help message and exit
+
+The command reads only these explicit paths. It never scans .release-skill,
+follows paths carried inside records, contacts a remote, writes a file, or
+changes release state.`);
+  await exitAfterFlush(0);
+}
+
+if (command === 'verify-records') {
+  const value = (flag) => {
+    const index = args.indexOf(flag);
+    return index !== -1 && args[index + 1] && !args[index + 1].startsWith('--')
+      ? args[index + 1]
+      : undefined;
+  };
+  const values = (flag) => {
+    const selected = [];
+    for (let index = 0; index < args.length; index += 1) {
+      if (args[index] === flag && args[index + 1] && !args[index + 1].startsWith('--')) {
+        selected.push(args[index + 1]);
+      }
+    }
+    return selected;
+  };
+  const planPath = value('--plan');
+  const approvalPath = value('--approval');
+  const targetRunPath = value('--target-run');
+  const sourceRunPaths = values('--source-run');
+  const unitId = value('--unit');
+  const targetVersion = value('--target-version');
+
+  if (!hasJson) {
+    console.log(JSON.stringify({
+      status: 'INSUFFICIENT',
+      unitId: unitId ?? null,
+      targetVersion: targetVersion ?? null,
+      historicalTerminalStatus: null,
+      inputs: {},
+      digests: {},
+      findings: [{
+        code: 'INPUT_MISSING',
+        role: 'cli',
+        message: '--json is required for verify-records',
+      }],
+    }));
+    await exitAfterFlush(2);
+  }
+
+  // A failed explicit read is represented as a missing input. Passing the
+  // original path only as a source label lets the verifier reduce it to the
+  // basename and prevents filesystem details from entering stdout.
+  const readInput = async (path) => {
+    if (!path) return undefined;
+    try {
+      return { bytes: await readFile(path), source: path };
+    } catch {
+      return { source: path };
+    }
+  };
+
+  const [plan, approval, targetRun, ...sourceRuns] = await Promise.all([
+    readInput(planPath),
+    readInput(approvalPath),
+    readInput(targetRunPath),
+    ...sourceRunPaths.map((path) => readInput(path)),
+  ]);
+  const {
+    VERIFY_RECORDS_EXIT_CODES,
+    verifyReleaseRecords,
+  } = await import('../src/commands/verify-records.mjs');
+  const result = verifyReleaseRecords({
+    plan,
+    approval,
+    targetRun,
+    sourceRuns,
+    unitId,
+    targetVersion,
+  });
+  console.log(JSON.stringify(result));
+  await exitAfterFlush(VERIFY_RECORDS_EXIT_CODES[result.status]);
+}
+
 // --- Setup command routing ---
 if (command === 'setup') {
   const rootIdx = args.indexOf('--root');
@@ -1711,6 +1829,23 @@ This command creates an independent postVerify run and never reads or writes shi
       root,
       ...(postpublishApprovalPaths.length > 0 ? { postpublishApprovalPaths } : {}),
     });
+    if (result.status === 'DISTRIBUTED') {
+      const {
+        derivePostReleaseChecklist,
+        unavailablePostReleaseChecklist,
+      } = await import('../src/commands/post-release-local.mjs');
+      let plan;
+      try {
+        plan = JSON.parse(await readFile(resolve(planPath), 'utf8'));
+        result.postRelease = derivePostReleaseChecklist(plan, {
+          root,
+          runPath: result.runPath,
+          postVerifyComplete: true,
+        });
+      } catch (error) {
+        result.postRelease = unavailablePostReleaseChecklist(plan, error);
+      }
+    }
 
     if (hasJson) {
       console.log(JSON.stringify(result, null, 2));
@@ -1720,6 +1855,17 @@ This command creates an independent postVerify run and never reads or writes shi
         console.log(`  ${cp.actionId}: ${cp.status}`);
       }
       if (result.runPath) console.log(`PostVerify run: ${result.runPath}`);
+      if (result.postRelease?.status === 'UNAVAILABLE') {
+        console.warn(`Post-release checklist unavailable: ${result.postRelease.diagnostic?.message ?? 'unknown error'}`);
+      } else if (result.postRelease?.localHostUpdate?.promptRequired === true) {
+        const localHostUpdate = result.postRelease.localHostUpdate;
+        console.log(`Post-release: ask whether to update local host plugins (${localHostUpdate.hosts.join(', ')}).`);
+        if (localHostUpdate.available === true && typeof localHostUpdate.runPath === 'string') {
+          console.log(`Post-release command: release-skill post-release --plan ${resolve(planPath)} --run ${localHostUpdate.runPath}`);
+          console.log('Choose --hosts before adding --update-local-hosts to perform a local update.');
+        }
+        printHubManualTargets(localHostUpdate.targets);
+      }
     }
 
     await exitAfterFlush(result.status === 'DISTRIBUTED' ? 0 : 1);