release-skill 0.9.16 → 0.9.17

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.16",
+  "version": "0.9.17",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.16",
+  "version": "0.9.17",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.16",
+  "version": "0.9.17",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.16.",
+      "Prepare a release plan for version 0.9.17.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.16",
+  "version": "0.9.17",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.qoder-plugin/plugin.json

@@ -0,0 +1,10 @@
+{
+  "name": "release-skill",
+  "version": "0.9.17",
+  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
+  "author": {
+    "name": "广州市风荷科技有限公司"
+  },
+  "license": "Apache-2.0",
+  "skills": "./adapters/qoder/skills/"
+}

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.9.17 locale=en baseline=sha256:83fe967a104a1b324ea1b704cfc6ee67d6a2999f3d6c0e2d92411435fa6986a2 -->
+## [0.9.17] - 2026-09-09
+
+0.9.17 is a local source candidate that adds explicit offline verification of historical release records and a self-contained Qoder projection, while preserving the setup-root and Kimi initial-directory trust fixes. The three Foundation dependencies remain pinned to the exact 0.17.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance; it also does not establish Hub acceptance.
+
+### Security
+
+- Offline verification reads only paths explicitly supplied on the command line and redacts local path details from its JSON result. Historical consistency does not prove that records are globally latest or that remote objects still exist.
+- Qoder remains outside release distributions and publication checkpoints. The updater does not add a marketplace, perform a first install, uninstall, or reload the current session; `UPDATED` does not mean the new plugin has been loaded.
+- Any later central Skill Family Hub publication uses the existing Git Data API with compare-and-swap. A partial Hub publication remains recoverable and is never rolled back or force-pushed automatically.
+
+### Added
+
+- The public `release-skill verify-records` CLI checks caller-supplied plan, approval, target-run, and predecessor-run bytes. It reports `CONSISTENT`, `CONTRADICTED`, or `INSUFFICIENT` without scanning `.release-skill`, following paths from records, contacting remotes, writing files, or changing release state.
+- The npm package now includes `.qoder-plugin/plugin.json` and a self-contained `adapters/qoder/` projection. The existing post-release updater can update an already installed user-scope Qoder plugin only after the selected Hub source and frozen payload match.
+
+### Changed
+
+- The release-finish setup continuation uses the current `--root` release project directly. It no longer asks for a second project path, while project-level readiness and host-specific loading checks remain distinct.
+
+### Fixed
+
+- An authorized Kimi update can confirm the standard initial `Trust this folder?` dialog for the current release project before continuing. Unknown rows, selections, repeated trust dialogs, timeout, or early exit still stop that host.
+
+### Upgrade Notes
+
+Upgrade from 0.9.16 to use `release-skill verify-records`, the Qoder package projection, and the setup/Kimi fixes. Remove the old release-skill standalone marketplace; use the ifoohoo/skill-family-hub repository and Hub-qualified plugin id release-skill@skill-family-hub. The central Skill Family Hub must accept the Qoder entry before marketplace installation can begin. Real Qoder and Kimi installation, reload, and business invocation remain separate authorized follow-up work.
+<!-- release-skill:changelog:end version=0.9.17 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.9.16 locale=en baseline=sha256:ea8288d2ffcedf02008eb0bc10280d52bc6ddd2e383f072913340eb64cb7ca63 -->
 ## [0.9.16] - 2026-09-09
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.16 -->
+<!-- release-skill:release-version: 0.9.17 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -41,7 +41,9 @@ Claude Code, CodeBuddy, WorkBuddy, and Codex install release-skill from the
 central [Skill Family Hub](https://github.com/ifoohoo/skill-family-hub).
 The release-skill repository carries plugin manifests but no marketplace index.
 release-skill currently invokes no scriptable install API for Kimi Code — see the
-[Kimi Code section](#install-as-a-kimi-code-plugin). Add the marketplace once,
+[Kimi Code section](#install-as-a-kimi-code-plugin). Qoder uses the same Hub only
+after its root `marketplace.json` has accepted the release-skill entry; see the
+[Qoder section](#install-as-a-qoder-plugin). Add the marketplace once,
 then install the plugin:
 
 > **Prerequisite: GitHub access.** The `owner/repo` shorthand makes Claude Code
@@ -81,6 +83,16 @@ release-skill currently uses the version-pinned interactive TUI path for Kimi
 Code. The release state machine reports installation as a post-release manual
 task and does not verify its completion.
 
+**Qoder:** after the central Hub has accepted the release-skill Qoder entry and
+that marketplace is configured locally:
+
+```bash
+qoder plugins install release-skill@skill-family-hub --scope user --json
+```
+
+Do not treat the local adapter or a successful validation alone as proof of a
+Hub marketplace install.
+
 ### Alternative: direct repository install (advanced)
 
 The Hub marketplace above is the supported primary path. Direct installation
@@ -91,6 +103,9 @@ remains available only where the host supports a repository URL:
 - CodeBuddy: single-session use from a source checkout via
   `--plugin-dir <path>/adapters/workbuddy` (see the
   [CodeBuddy/WorkBuddy section](#install-as-a-codebuddyworkbuddy-plugin)).
+- Qoder: validate the generated candidate with
+  `qoder plugins validate <path>/adapters/qoder --json --strict`; validation is
+  not marketplace installation or a real Skill call.
 
 ## Install as a Kimi Code plugin
 
@@ -110,7 +125,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.16
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.17
    /plugins reload
    ```
 
@@ -129,12 +144,17 @@ same TUI session before accepting the plugin trust prompt and reloading.
 
 The effective configuration root is explicit `kimiHome`, then
 `KIMI_CODE_HOME`, then `~/.kimi-code`. The TUI process and post-operation
-observation use that same root. release-finish strips ANSI/OSC control sequences
-and soft wrapping before it checks the frozen repository, tag, and selected
-`Trust and install` action inside the plugin trust dialog. A `Trust this folder?`
-prompt, unknown interface, timeout, early exit, or identity mismatch stops the
-flow without confirming folder trust or continuing installation. This local
-check is not part of `verify` and does not alter the `VERIFIED` release state.
+observation use that same root. The TUI working directory is the resolved release
+project root passed through `--root`. After explicit confirmation of the frozen
+plan and selection of Kimi for update, release-finish accepts only the initial
+standard `Trust this folder?` dialog with `No, exit` selected and
+`Trust this folder` available. It moves to that row, verifies the new selection,
+confirms it, and waits for the known command prompt. Unknown rows or selections,
+a failed move, timeout, early exit, or a folder-trust dialog after the plugin
+command fails closed. release-finish still strips ANSI/OSC control sequences and
+soft wrapping before it checks the frozen repository, tag, and selected
+`Trust and install` action inside the plugin trust dialog. This local check is
+not part of `verify` and does not alter the `VERIFIED` release state.
 
 No receipt or attestation is required. The `attest` command remains available
 only for frozen plans created by older versions that lack the
@@ -178,6 +198,34 @@ For a single session from a source checkout you can also point CodeBuddy at the
 generated plugin directory with `--plugin-dir <path>/adapters/workbuddy`; the
 adapter never references files outside its own directory.
 
+## Install as a Qoder plugin
+
+The npm package ships `.qoder-plugin/plugin.json` and a generated,
+self-contained `adapters/qoder/` tree. Qoder is a build-only projection: it does
+not add a `qoder-plugin` distribution type or a publish/reconcile/verify install
+checkpoint.
+
+The central Hub root `marketplace.json` must first contain an accepted
+release-skill entry whose source resolves to this Qoder projection. Once that
+entry is present and `skill-family-hub` is configured, install at user scope:
+
+```bash
+qoder plugins install release-skill@skill-family-hub --scope user --json
+```
+
+The optional `release-finish` path updates only an existing user-scope Qoder
+installation selected by the user and declared in the frozen plan. Before any
+write it matches the Hub name and repository, then rechecks the refreshed source
+and frozen payload. It may run the named marketplace update followed by
+`qoder plugins update release-skill@skill-family-hub --scope user`; it never
+adds a marketplace, first-installs the plugin, removes a marketplace, or
+uninstalls and reinstalls the plugin.
+
+An `UPDATED` result proves installed bytes, not what the current Qoder session
+has loaded. Reload the plugin or start a new session, then use the discovered
+release-skill to complete one read-only release task before claiming the new
+version is active. These local results do not change `VERIFIED`.
+
 ## Consumer verification boundaries
 
 **When verification runs.** Consumer-side install verification executes only

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.16 -->
+<!-- release-skill:release-version: 0.9.17 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -37,7 +37,9 @@ release-skill help
 Claude Code、CodeBuddy、WorkBuddy 和 Codex 从统一的
 [Skill Family Hub](https://github.com/ifoohoo/skill-family-hub)
 安装 release-skill。release-skill 仓库只携带插件清单，不再携带市场索引。当前没有接入
-Kimi Code 的可脚本化安装接口，见 [Kimi Code 小节](#安装为-kimi-code-插件)。先添加一次市场，再安装
+Kimi Code 的可脚本化安装接口，见 [Kimi Code 小节](#安装为-kimi-code-插件)。Qoder
+只有在 Hub 根 `marketplace.json` 已接纳 release-skill 条目后才使用同一市场，见
+[Qoder 小节](#安装为-qoder-插件)。先添加一次市场，再安装
 插件：
 
 > **前置条件：GitHub 访问。** `owner/repo` 简写会让 Claude Code 通过
@@ -75,6 +77,14 @@ codex plugin marketplace add ifoohoo/skill-family-hub
 release-skill 当前对 Kimi Code 采用钉死版本的交互式 TUI 路径。发布状态机会把安装
 列为发布后人工待办，不核验其完成结果。
 
+**Qoder：** 中央 Hub 已接纳 release-skill 的 Qoder 条目，且本机已配置该市场后执行：
+
+```bash
+qoder plugins install release-skill@skill-family-hub --scope user --json
+```
+
+本地适配器存在或候选校验成功，都不能单独证明 Hub 市场安装成立。
+
 ### 备选：直接从仓库安装（进阶）
 
 上面的 Hub 市场是受支持的主路径。只有宿主支持仓库 URL 时，才能直接安装：
@@ -84,6 +94,8 @@ release-skill 当前对 Kimi Code 采用钉死版本的交互式 TUI 路径。
 - CodeBuddy：源码检出后通过 `--plugin-dir <path>/adapters/workbuddy`
   单会话使用（见
   [CodeBuddy/WorkBuddy 小节](#安装为-codebuddyworkbuddy-插件)）。
+- Qoder：执行 `qoder plugins validate <path>/adapters/qoder --json --strict`
+  校验生成候选；该结果不等于市场安装，也不等于真实 Skill 调用。
 
 ## 安装为 Kimi Code 插件
 
@@ -101,7 +113,7 @@ release-skill 当前只采用并验证 Kimi Code 的交互式 TUI 路径，**无
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.16
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.17
    /plugins reload
    ```
 
@@ -114,10 +126,13 @@ release-finish 会重新读取 Kimi 的受管安装根，不复用操作前的
 移除，再按发布标签安装、确认插件信任并重新加载。
 
 有效配置根依次取显式 `kimiHome`、`KIMI_CODE_HOME`、`~/.kimi-code`，TUI 进程和
-操作后观察使用同一根。release-finish 会先清理 ANSI/OSC 控制序列和软换行，再在插件
-信任对话框内核对冻结仓库、标签和当前选中的 `Trust and install`。出现
-`Trust this folder?`、未知界面、超时、提前退出或身份不一致时，流程停止，不确认目录
-信任，也不继续安装。这个本机检查不属于 `verify`，也不会改变
+操作后观察使用同一根，TUI 工作目录固定为 `--root` 指定的当前发布项目。用户确认冻结
+计划并显式选择更新 Kimi 后，release-finish 只接受初始标准 `Trust this folder?` 界面：
+当前必须选中 `No, exit`，且存在 `Trust this folder` 目标行。流程移动到目标行，重新确认
+选中项，再提交并等待已知命令提示符。出现未知行或选中项、移动后无法确认、超时、提前
+退出，或者插件命令发出后再次出现目录信任时，该宿主失败并停止。release-finish 仍会先
+清理 ANSI/OSC 控制序列和软换行，再在插件信任对话框内核对冻结仓库、标签和当前选中的
+`Trust and install`。这个本机检查不属于 `verify`，也不会改变
 已经完成的 `VERIFIED` 发布状态。
 
 新计划无需收据或人工证明。`attest` 命令仅兼容缺少
@@ -152,6 +167,28 @@ codebuddy CLI 可以添加市场并安装插件，但 **`plugin marketplace add`
 源码检出后也可以用 `--plugin-dir <path>/adapters/workbuddy` 把 CodeBuddy 指向
 生成的插件目录做单会话使用；适配器不引用自身目录之外的任何文件。
 
+## 安装为 Qoder 插件
+
+npm 包内提供 `.qoder-plugin/plugin.json` 和生成的自包含 `adapters/qoder/` 目录。
+Qoder 只是 build-only 投影，不新增 `qoder-plugin` 分发类型，也不新增 publish、
+reconcile 或 verify 安装检查点。
+
+中央 Hub 根 `marketplace.json` 必须先接纳 release-skill 条目，且该条目的来源要解析到
+本插件的 Qoder 投影。条目存在并已配置 `skill-family-hub` 后，执行用户范围安装：
+
+```bash
+qoder plugins install release-skill@skill-family-hub --scope user --json
+```
+
+可选的 `release-finish` 只更新用户已选择、冻结计划已声明且已经存在的用户范围 Qoder
+安装。写入前先核对 Hub 名称和仓库；刷新市场后，再核对来源与冻结载荷。流程可以更新
+指定市场，再执行 `qoder plugins update release-skill@skill-family-hub --scope user`；
+不会添加市场、首次安装插件、删除市场，也不会卸载后重装。
+
+`UPDATED` 只证明安装载荷已更新，不代表当前 Qoder 会话已经加载新版。必须重新加载插件
+或新开会话，再由真实发现的 release-skill 完成一次只读发布业务调用，才能宣称新版已
+生效。这些本机结果不会改变 `VERIFIED`。
+
 ## 消费端安装验证边界
 
 **何时执行验证。** 消费端安装验证仅在安装契约关键文件相对已确认公开基线发生变化时执行；

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.16 -->
+<!-- release-skill:release-version: 0.9.17 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,37 +14,36 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.16** (2026-09-09)
+**0.9.17** (2026-09-09)
 
-0.9.16 is a local source candidate that connects verified releases to explicit source-branch checks, host-aware setup continuation, and postVerify finish guidance. The three Foundation dependencies remain pinned to the exact 0.17.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+0.9.17 is a local source candidate that adds explicit offline verification of historical release records and a self-contained Qoder projection, while preserving the setup-root and Kimi initial-directory trust fixes. The three Foundation dependencies remain pinned to the exact 0.17.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance; it also does not establish Hub acceptance.
 
 **Security**
 
-- The source-branch reminder runs only `git branch --show-current` and `git status --short --branch`; it never fetches, switches, merges, rebases, stashes, resets, cleans, or pushes. Setup names are matched as skill metadata and are never executed as shell text.
-- Skill Family Hub updates bind the observed branch head with compare-and-swap semantics. Partial Hub publication is never rolled back or force-pushed, and remote state is never overwritten.
+- Offline verification reads only paths explicitly supplied on the command line and redacts local path details from its JSON result. Historical consistency does not prove that records are globally latest or that remote objects still exist.
+- Qoder remains outside release distributions and publication checkpoints. The updater does not add a marketplace, perform a first install, uninstall, or reload the current session; `UPDATED` does not mean the new plugin has been loaded.
+- Any later central Skill Family Hub publication uses the existing Git Data API with compare-and-swap. A partial Hub publication remains recoverable and is never rolled back or force-pushed automatically.
 
 **Added**
 
-- Projects may configure `releaseFinish.sourceBranchCheck` as `remind` or `skip` and may name a loaded setup entry through `releaseFinish.setupSkill`. The release-finish workflow keeps the publishing workspace separate from an explicitly selected consumer project and reports setup as pending when the target directory, loaded plugin version, or callable host is not established.
-- Source checks use read-only Git commands and report the current branch, worktree changes, upstream summary, and any decision that still belongs to the maintainer. A project can select `release-setup` when it wants the release-finish workflow to continue into release-skill setup.
+- The public `release-skill verify-records` CLI checks caller-supplied plan, approval, target-run, and predecessor-run bytes. It reports `CONSISTENT`, `CONTRADICTED`, or `INSUFFICIENT` without scanning `.release-skill`, following paths from records, contacting remotes, writing files, or changing release state.
+- The npm package now includes `.qoder-plugin/plugin.json` and a self-contained `adapters/qoder/` projection. The existing post-release updater can update an already installed user-scope Qoder plugin only after the selected Hub source and frozen payload match.
 
 **Changed**
 
-- After a successful postVerify run reaches `DISTRIBUTED`, both JSON and text CLI output now expose the same Hub-backed local-host finish guidance used by the release-finish workflow. The guidance remains diagnostic and never invokes a host command on its own.
-- Host updates and setup checks remain local follow-up work and do not change the immutable release plan or the `VERIFIED` publication result. Shared project readiness may be checked once only when the plugin version, consumer directory, and runtime environment are the same; host-specific installation and loading remain separate checks.
-- Skill Family Hub publication continues through the project-private postVerify hook and GitHub Git Data API. The Hub update remains a separately approved compare-and-swap write against the observed branch head.
+- The release-finish setup continuation uses the current `--root` release project directly. It no longer asks for a second project path, while project-level readiness and host-specific loading checks remain distinct.
 
 **Fixed**
 
-- A completed postVerify delivery now keeps `DISTRIBUTED` even when the optional finish checklist cannot reread its plan. The CLI returns an explicit unavailable diagnostic without rewriting the successful delivery checkpoint.
+- An authorized Kimi update can confirm the standard initial `Trust this folder?` dialog for the current release project before continuing. Unknown rows, selections, repeated trust dialogs, timeout, or early exit still stop that host.
 
 **Upgrade Notes**
 
-Upgrade from 0.9.15 to receive postVerify finish guidance and optional source-branch and setup continuation. Add a top-level `releaseFinish` block only when the project wants to select a setup entry or change the default reminder policy. Remove any release-skill standalone marketplace registration, add or update `ifoohoo/skill-family-hub`, and use `release-skill@skill-family-hub`. Restart an updated host before treating the new plugin version or setup entry as loaded.
+Upgrade from 0.9.16 to use `release-skill verify-records`, the Qoder package projection, and the setup/Kimi fixes. Remove the old release-skill standalone marketplace; use the ifoohoo/skill-family-hub repository and Hub-qualified plugin id release-skill@skill-family-hub. The central Skill Family Hub must accept the Qoder entry before marketplace installation can begin. Real Qoder and Kimi installation, reload, and business invocation remain separate authorized follow-up work.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.9.16 is the current source candidate. This README
+> **Current boundary:** v0.9.17 is the current source candidate. This README
 > records intended scope and verification boundaries; it is not evidence of
 > publication, consumer-installation verification, or independent acceptance.
 > Release availability must be established from the corresponding release records
@@ -68,7 +67,7 @@ Upgrade from 0.9.15 to receive postVerify finish guidance and optional source-br
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.9.16 is the current
+> **Production path verified since the v0.1.1 milestone; v0.9.17 is the current
 > source candidate. Its README does not establish publication,
 > consumer-installation verification, or independent acceptance.**
 > The npm-installed CLI is the supported user entry. Source checkout
@@ -97,18 +96,20 @@ checkpoints remain intact and use matching-version recovery. Evidence v1 stays
 read-only; v2 uses a closed top level with phase extensions in `details`.
 Summaries and recovery suggestions are diagnostic, never publication authority.
 
-The current 0.9.16 candidate includes the narrow R-05 Hook cache v2 consumer
+The current 0.9.17 candidate includes the narrow R-05 Hook cache v2 consumer
 path, the public `postverify` path, and the stable isolated install-tree record
-path (A2/A3). It keeps Skill Family Hub as the single marketplace source. It
+path (A2/A3). It also adds the explicit-input `verify-records` command and a
+self-contained Qoder projection. Skill Family Hub remains the single
+marketplace source. The candidate
 also makes the `release-prepare` Skill organize existing assessment, refresh,
 focused-check, and prepare entry points without adding another execution
 engine. `prepare --help` and `prepare -h` now return before configuration,
 locks, runs, or hooks can observe the request. The `release-finish` Skill can
 also report the source branch and continue into a configured setup entry after
-the selected host has loaded the released plugin. This candidate still
-excludes R-02 safe full-tree inventory, R-10 historical-release verification
-implementation, real Kimi/WorkBuddy public-marketplace installation and
-invocation gates, and an Audit public offline release-record verifier.
+the selected host has loaded the released plugin. This candidate still excludes
+R-02 safe full-tree inventory and real Kimi/WorkBuddy/Qoder marketplace
+installation and invocation gates. The central Hub has not yet accepted the
+release-skill Qoder entry.
 Foundation dependencies are pinned to the three released 0.17.0 packages.
 For Kimi/CodeBuddy plans that still use the bundled-family distribution form,
 verify calls the released
@@ -267,7 +268,29 @@ Skill Family Hub marketplace:
 Kimi Code. It uses the version-pinned interactive TUI path described in
 [INSTALL.md](INSTALL.md#install-as-a-kimi-code-plugin).
 
-See [INSTALL.md](INSTALL.md) for CodeBuddy, Codex, and Kimi Code commands.
+**Qoder:** the package ships `.qoder-plugin/plugin.json` and the self-contained
+`adapters/qoder/` projection. A user-scope marketplace install is available only
+after the central Hub's root `marketplace.json` has accepted the release-skill
+Qoder entry; the generated adapter alone does not prove Hub consumption. See
+[INSTALL.md](INSTALL.md#install-as-a-qoder-plugin) for the bounded install and
+post-release update contract.
+
+See [INSTALL.md](INSTALL.md) for CodeBuddy, Codex, Kimi Code, and Qoder commands.
+
+### Offline historical record verification
+
+Use the public command below when a consumer already has an explicit plan,
+approval, target run, and every predecessor run referenced by that target:
+
+```text
+release-skill verify-records --plan <path> --approval <path> --target-run <path> --source-run <path>... --unit <id> --target-version <version> --json
+```
+
+The command reads only those paths and emits one JSON object. `CONSISTENT`
+exits 0, `CONTRADICTED` exits 1, and `INSUFFICIENT` exits 2. It does not scan
+`.release-skill`, follow paths embedded in a record, contact a remote, write a
+file, or advance release state. A consistent historical chain does not prove
+that its records are globally latest or that remote objects still exist.
 
 ### Main workflow
 
@@ -539,7 +562,9 @@ releaseUnits:
 defaults to `remind`; set it to `skip` to suppress the read-only source-branch
 reminder. `setupSkill` is optional and names an already installed and loaded
 setup entry such as `release-setup` or `plugin:skill`; it is never executed as
-a shell command. The two settings are independent.
+a shell command. After host updates, release-finish runs that setup entry
+against the current release project root passed through `--root`; it does not
+request a separate project directory. The two settings are independent.
 
 `distributions` is required but may be an explicit empty array. Use
 `distributions: []` when release-skill should publish only the unit's GitHub
@@ -782,6 +807,11 @@ closures. A release unit declares what reaches users via `distributions`:
 | `kimi-plugin` | self-contained closure (release-skill invokes no scriptable install API) | non-blocking post-release manual task |
 | `codebuddy-plugin` | generated `adapters/workbuddy/` with `.codebuddy-plugin/plugin.json` | non-blocking post-release manual task |
 
+Qoder is intentionally outside this `distributions` table: it is a build-only
+public projection at `adapters/qoder/`, with root manifest
+`.qoder-plugin/plugin.json`. It does not add a `qoder-plugin` plan type or an
+automated publish, reconcile, or verify checkpoint.
+
 Each adapter closure bundles its own CLI, skills, and schemas for zero external
 dependency after installation. `publish` only publishes frozen Git objects and
 npm tarballs, then checks remote commit/tree/tag integrity. Claude/Codex
@@ -796,12 +826,23 @@ commit before that host's first write; a failed check leaves that host unchanged
 without stopping other selected hosts. The workflow can also migrate or update
 Kimi through one controlled TUI session and verify its real managed payload, or update an existing
 bundled-family CodeBuddy/WorkBuddy entry when the frozen tag and mutable branch
-both resolve to the frozen commit. It requires explicit user confirmation and
+both resolve to the frozen commit. For an explicitly selected Qoder host, it can
+update only an existing user-scope installation after proving the configured Hub
+source and frozen payload; it never adds a marketplace or performs first install.
+An `UPDATED` installation is not treated as loaded: reload or start a new Qoder
+session, then complete one read-only release-skill business call before claiming
+the new version is active. It requires explicit user confirmation and
 does not change release status. Kimi uses one effective configuration root:
 explicit `kimiHome`, then `KIMI_CODE_HOME`, then `~/.kimi-code`. The TUI and
-post-operation observation share that root. A `Trust this folder?` prompt,
-unknown interface, timeout, early exit, or unprovable plugin identity returns a
-manual or failed result without confirming folder trust. Missing, standalone, inaccessible, or ambiguous
+post-operation observation share that root, and the TUI working directory is the
+resolved release project root passed through `--root`. After the user confirms
+the frozen plan and explicitly selects Kimi for update, release-finish accepts
+only the initial standard `Trust this folder?` dialog with `No, exit` selected
+and `Trust this folder` available. It moves to that target, verifies the new
+selection, confirms it, and waits for the known command prompt before sending
+the plugin command. An unknown row or selection, a failed move, timeout, early
+exit, or any folder-trust dialog after the plugin command fails closed. The
+frozen plugin identity and `Trust and install` checks remain unchanged. Missing, standalone, inaccessible, or ambiguous
 CodeBuddy/WorkBuddy targets remain manual and receive no host mutation.
 WorkBuddy local updates are macOS-only; on other platforms they are skipped as
 unsupported. When a plan declares postVerify hooks, release-finish must receive
@@ -812,8 +853,10 @@ A release unit may also declare `postPublish.localHostUpdate` for a plugin that
 is delivered through a project-selected Hub by a `postVerify` hook. After that
 hook reaches `DISTRIBUTED`, `ship`, `verify`, `post-release`, and
 `release-finish` display the declared Hub, plugin, and hosts. These Hub-backed
-targets are manual in 0.9.16 (`promptRequired: true`, `available: false`): the
-prompt does not query the Hub, inspect the host, or run host commands. Claude
+targets retain their declared execution mode. Qoder is executable only when it
+was selected and all frozen-plan, Hub-source, existing user-scope installation,
+and payload checks pass; other Hub-backed targets remain manual. Manual prompts
+do not query the Hub, inspect the host, or run host commands. Claude
 and Codex use their existing marketplace management entry; Kimi uses the
 frozen GitHub Release and its existing confirmation path; CodeBuddy and
 WorkBuddy remain manual because this flow cannot pin a Hub ref. Existing
@@ -844,7 +887,7 @@ the first minimal semantic boundary, so the static gate fails closed until the
 declaration is narrowed to concrete targets.
 
 <!-- release-skill:capability:unsupported-scope -->
-- **not in the current version:** full consumer install-tree scanning (R-02) — the current implementation handles only the declared public surface and the stable isolated install-tree record; and a real-host (Kimi/WorkBuddy) verification gate — host verification stays a non-blocking manual follow-up and does not produce `PASS`/`VERIFIED` evidence;
+- **not in the current version:** full consumer install-tree scanning (R-02) — the current implementation handles only the declared public surface and the stable isolated install-tree record; and a real-host (Kimi/WorkBuddy/Qoder) verification gate — host verification and Qoder activation stay outside release `PASS`/`VERIFIED` evidence;
 - no automatic README generation or source-file overwrite;
 - no automatic conflict merge or rollback workflow;
 - no claim that a real production canary has run for marketplace verification;
@@ -853,10 +896,11 @@ declaration is narrowed to concrete targets.
 - no overwrite of branches/tags/releases or npm unpublish; create-only refs use
   `--force-with-lease=<ref>:` solely as an atomic compare-and-set assertion that
   the ref is absent, while existing branches use an ordinary non-force push;
-- no Kimi or CodeBuddy/WorkBuddy marketplace install checkpoint in the release
+- no Kimi, CodeBuddy/WorkBuddy, or Qoder marketplace install checkpoint in the release
   state machine — optional release-finish can drive and re-check Kimi locally,
   or update an existing CodeBuddy/WorkBuddy entry under strict frozen-identity
-  checks, but those results do not become publication evidence;
+  checks, or update an existing user-scope Qoder entry after equivalent source
+  and payload checks, but those results do not become publication evidence;
 - no promise of Windows or broad multi-platform native write support;
 - no hidden commit, push, tag, release, or package publication.