release-skill 0.9.16 → 0.9.18

package/src/commands/verify-records.mjs

@@ -0,0 +1,467 @@
+/**
+ * Pure, offline verification of caller-supplied release records.
+ *
+ * This module never discovers records or performs I/O. The CLI layer supplies
+ * the exact bytes and source labels selected by the caller.
+ */
+
+import { digestBytes } from 'skill-family-harness-node';
+
+import {
+  computeApprovalDigest,
+  validateApproval,
+  validateApprovalRecordSchema,
+  validateApprovalTimeWindow,
+} from '../core/approval.mjs';
+import { isMarketplaceAction, isRemoteWriteAction } from '../core/checkpoints.mjs';
+import { computePlanDigest, validatePlan } from '../core/plan.mjs';
+import {
+  computeRunDigest,
+  validateRun,
+  validateRunCheckpointMapping,
+  validateRunPlanDigest,
+  validateSourceRunEdge,
+} from '../core/run.mjs';
+
+export const VERIFY_RECORDS_EXIT_CODES = Object.freeze({
+  CONSISTENT: 0,
+  CONTRADICTED: 1,
+  INSUFFICIENT: 2,
+});
+
+const SUPPORTED_PLAN_VERSIONS = new Set([1, 2, 3]);
+const SUPPORTED_RUN_COMMANDS = new Set(['publish', 'reconcile', 'verify']);
+const SUPPORTED_TERMINAL_STATUSES = new Set(['PARTIAL', 'PUBLISHED', 'VERIFIED']);
+const FINDING_ORDER = Object.freeze([
+  'INPUT_MISSING',
+  'INPUT_DAMAGED',
+  'FORMAT_UNSUPPORTED',
+  'PLAN_DIGEST_MISMATCH',
+  'APPROVAL_DIGEST_MISMATCH',
+  'RUN_DIGEST_MISMATCH',
+  'IDENTITY_MISMATCH',
+  'PLAN_BINDING_MISMATCH',
+  'APPROVAL_ACTION_MISMATCH',
+  'RUN_LINEAGE_MISMATCH',
+  'TRANSITION_MISMATCH',
+  'CHECKPOINT_MISMATCH',
+  'HISTORICAL_TIME_MISSING',
+  'HISTORICAL_TIME_OUTSIDE_WINDOW',
+]);
+const FINDING_RANK = new Map(FINDING_ORDER.map((code, index) => [code, index]));
+
+function sourceLabel(source) {
+  if (typeof source !== 'string' || source.length === 0) return null;
+  return source.replaceAll('\\', '/').split('/').filter(Boolean).at(-1) ?? null;
+}
+
+function parseInput(input, role, addFinding) {
+  const summary = { role, source: sourceLabel(input?.source) };
+  if (!input || input.bytes === undefined || input.bytes === null) {
+    addFinding('INPUT_MISSING', role, `required ${role} input was not provided`, 'INSUFFICIENT');
+    return { summary, digest: null, document: null, bytes: null, usable: false };
+  }
+
+  let bytes;
+  try {
+    bytes = Buffer.isBuffer(input.bytes)
+      ? Buffer.from(input.bytes)
+      : Buffer.from(input.bytes);
+  } catch {
+    addFinding('INPUT_DAMAGED', role, `${role} input is not byte-compatible`);
+    return { summary, digest: null, document: null, bytes: null, usable: false };
+  }
+
+  const bytesSha256 = digestBytes(bytes);
+  try {
+    const document = JSON.parse(bytes.toString('utf8'));
+    if (!document || typeof document !== 'object' || Array.isArray(document)) {
+      addFinding('INPUT_DAMAGED', role, `${role} input must be a JSON object`);
+      return {
+        summary,
+        digest: { bytesSha256, carriedDomainDigest: null, recomputedDomainDigest: null },
+        document: null,
+        bytes,
+        usable: false,
+      };
+    }
+    return {
+      summary,
+      digest: { bytesSha256, carriedDomainDigest: null, recomputedDomainDigest: null },
+      document,
+      bytes,
+      usable: true,
+    };
+  } catch {
+    addFinding('INPUT_DAMAGED', role, `${role} input is not valid JSON`);
+    return {
+      summary,
+      digest: { bytesSha256, carriedDomainDigest: null, recomputedDomainDigest: null },
+      document: null,
+      bytes,
+      usable: false,
+    };
+  }
+}
+
+function sameStringSet(left, right) {
+  return JSON.stringify([...new Set(left)].sort()) === JSON.stringify([...new Set(right)].sort());
+}
+
+function commandStatusIsValid(run) {
+  if (run.command === 'publish' || run.command === 'reconcile') {
+    return run.status === 'PARTIAL' || run.status === 'PUBLISHED';
+  }
+  return run.command === 'verify' && run.status === 'VERIFIED';
+}
+
+function checkpointStatusIsValid(run) {
+  if (run.status === 'VERIFIED') {
+    return run.checkpoints.every((checkpoint) => ['succeeded', 'skipped'].includes(checkpoint.status));
+  }
+  if (run.status === 'PUBLISHED') {
+    return run.checkpoints.every((checkpoint) => (
+      isRemoteWriteAction(checkpoint.actionType)
+        ? ['succeeded', 'skipped'].includes(checkpoint.status)
+        : isMarketplaceAction(checkpoint.actionType)
+          ? ['succeeded', 'skipped', 'deferred', 'failed'].includes(checkpoint.status)
+          : true
+    ));
+  }
+  if (run.status === 'PARTIAL') {
+    return run.checkpoints.some((checkpoint) => !['succeeded', 'skipped', 'deferred'].includes(checkpoint.status));
+  }
+  return false;
+}
+
+/**
+ * Verify one explicitly supplied record set without filesystem, network, or
+ * process access.
+ *
+ * @param {object} request
+ * @param {{bytes: Buffer|string, source?: string}} request.plan
+ * @param {{bytes: Buffer|string, source?: string}} request.approval
+ * @param {{bytes: Buffer|string, source?: string}} request.targetRun
+ * @param {Array<{bytes: Buffer|string, source?: string}>} [request.sourceRuns]
+ * @param {string} request.unitId
+ * @param {string} request.targetVersion
+ */
+export function verifyReleaseRecords(request = {}) {
+  const findings = [];
+  const addFinding = (code, role, message, outcome = 'CONTRADICTED') => {
+    findings.push({ code, role, message, _outcome: outcome });
+  };
+
+  const planInput = parseInput(request.plan, 'plan', addFinding);
+  const approvalInput = parseInput(request.approval, 'approval', addFinding);
+  const targetInput = parseInput(request.targetRun, 'targetRun', addFinding);
+  const sourceInputs = Array.isArray(request.sourceRuns)
+    ? request.sourceRuns.map((input, index) => parseInput(input, `sourceRun[${index}]`, addFinding))
+    : [];
+
+  const plan = planInput.document;
+  const approval = approvalInput.document;
+  const targetRun = targetInput.document;
+
+  let planSupported = false;
+  if (planInput.usable) {
+    if (!SUPPORTED_PLAN_VERSIONS.has(plan?.planVersion)) {
+      addFinding('FORMAT_UNSUPPORTED', 'plan', `unsupported release plan version: ${String(plan?.planVersion)}`, 'INSUFFICIENT');
+    } else {
+      planSupported = true;
+      try {
+        validatePlan(plan);
+      } catch (error) {
+        addFinding('INPUT_DAMAGED', 'plan', error.message);
+        planSupported = false;
+      }
+      const recomputed = computePlanDigest(plan);
+      planInput.digest.carriedDomainDigest = plan?.digest ?? null;
+      planInput.digest.recomputedDomainDigest = recomputed;
+      if (!plan?.digest || plan.digest !== recomputed) {
+        addFinding('PLAN_DIGEST_MISMATCH', 'plan', 'plan digest does not match its binding content');
+      }
+    }
+  }
+
+  let approvalSupported = false;
+  let approvalDigest = null;
+  if (approvalInput.usable) {
+    approvalDigest = computeApprovalDigest(approvalInput.bytes);
+    approvalInput.digest.recomputedDomainDigest = approvalDigest;
+    try {
+      validateApprovalRecordSchema(approval);
+      approvalSupported = true;
+    } catch (error) {
+      addFinding('INPUT_DAMAGED', 'approval', error.message);
+    }
+    if (approvalSupported) {
+      try {
+        validateApprovalTimeWindow(approval, {
+          clock: () => approval.approvedAt,
+          requireUnexpired: false,
+        });
+      } catch (error) {
+        addFinding('INPUT_DAMAGED', 'approval', error.message);
+        approvalSupported = false;
+      }
+    }
+  }
+
+  const runEntries = [
+    { input: targetInput, role: 'targetRun', isTarget: true },
+    ...sourceInputs.map((input, index) => ({ input, role: `sourceRun[${index}]`, isTarget: false })),
+  ];
+  const usableRuns = [];
+  let trustedTargetTerminalStatus = null;
+  for (const entry of runEntries) {
+    const run = entry.input.document;
+    if (!entry.input.usable) continue;
+    entry.input.digest.carriedDomainDigest = run?.runDigest ?? null;
+    entry.input.digest.recomputedDomainDigest = computeRunDigest(run);
+
+    if (!SUPPORTED_RUN_COMMANDS.has(run?.command) || !SUPPORTED_TERMINAL_STATUSES.has(run?.status)) {
+      addFinding(
+        'FORMAT_UNSUPPORTED',
+        entry.role,
+        `unsupported release run command/status: ${String(run?.command)}/${String(run?.status)}`,
+        'INSUFFICIENT',
+      );
+      continue;
+    }
+
+    const { runDigest: _runDigest, ...unsignedRun } = run;
+    try {
+      validateRun(unsignedRun);
+    } catch (error) {
+      addFinding('INPUT_DAMAGED', entry.role, error.message);
+      continue;
+    }
+
+    const digestMatches = Boolean(run.runDigest)
+      && run.runDigest === entry.input.digest.recomputedDomainDigest;
+    const transitionIsValid = commandStatusIsValid(run);
+    const terminalCheckpointsAreValid = checkpointStatusIsValid(run);
+    if (!digestMatches) {
+      addFinding('RUN_DIGEST_MISMATCH', entry.role, 'run digest does not match its content');
+    }
+    if (!transitionIsValid) {
+      addFinding('TRANSITION_MISMATCH', entry.role, `run command ${run.command} cannot terminate as ${run.status}`);
+    }
+    if (!terminalCheckpointsAreValid) {
+      addFinding('CHECKPOINT_MISMATCH', entry.role, `checkpoint results do not support terminal status ${run.status}`);
+    }
+    if (entry.isTarget && digestMatches && transitionIsValid && terminalCheckpointsAreValid) {
+      trustedTargetTerminalStatus = run.status;
+    }
+    usableRuns.push({ ...entry, run });
+  }
+
+  if (planSupported && typeof request.unitId === 'string' && typeof request.targetVersion === 'string') {
+    const expectedUnit = (plan.units ?? []).find((unit) => unit.id === request.unitId);
+    if (!expectedUnit || expectedUnit.targetVersion !== request.targetVersion) {
+      addFinding('IDENTITY_MISMATCH', 'plan', 'expected release unit and version do not match the plan');
+    }
+  } else if (typeof request.unitId !== 'string' || typeof request.targetVersion !== 'string') {
+    addFinding('INPUT_MISSING', 'identity', 'unitId and targetVersion are required', 'INSUFFICIENT');
+  }
+
+  if (planSupported && approvalSupported) {
+    const planDigest = computePlanDigest(plan);
+    if (approval.planDigest !== planDigest) {
+      addFinding('PLAN_BINDING_MISMATCH', 'approval', 'approval planDigest does not match the supplied plan');
+    }
+
+    const expectedUnitVersions = Object.fromEntries((plan.units ?? []).map((unit) => [unit.id, unit.targetVersion]));
+    const approvedUnitVersions = approval.unitVersions
+      ?? ((plan.units ?? []).length === 1 ? { [plan.units[0].id]: approval.targetVersion } : {});
+    const identityMatches = sameStringSet(Object.keys(expectedUnitVersions), Object.keys(approvedUnitVersions))
+      && Object.entries(expectedUnitVersions).every(([unitId, version]) => approvedUnitVersions[unitId] === version)
+      && (approval.targetVersion === undefined
+        || new Set(Object.values(expectedUnitVersions)).size !== 1
+        || approval.targetVersion === Object.values(expectedUnitVersions)[0]);
+    if (!identityMatches) {
+      addFinding('IDENTITY_MISMATCH', 'approval', 'approval unit/version identity does not match the plan');
+    }
+
+    const planActions = (plan.externalActions ?? []).map((action) => action.id);
+    if (!sameStringSet(approval.approvedActions ?? [], planActions)) {
+      addFinding('APPROVAL_ACTION_MISMATCH', 'approval', 'approved actions do not exactly match the plan actions');
+    }
+
+    try {
+      validateApproval(plan, approval, {
+        clock: () => approval.approvedAt,
+        requireUnexpired: false,
+      });
+    } catch (error) {
+      const alreadyRepresented = (
+        (/planDigest/i.test(error.message)
+          && findings.some((finding) => finding.role === 'approval' && finding.code === 'PLAN_BINDING_MISMATCH'))
+        || (/version|unitVersions/i.test(error.message)
+          && findings.some((finding) => finding.role === 'approval' && finding.code === 'IDENTITY_MISMATCH'))
+        || (/approved|action/i.test(error.message)
+          && findings.some((finding) => finding.role === 'approval' && finding.code === 'APPROVAL_ACTION_MISMATCH'))
+      );
+      if (!alreadyRepresented) {
+        addFinding('INPUT_DAMAGED', 'approval', error.message);
+      }
+    }
+  }
+
+  if (planSupported) {
+    for (const entry of usableRuns) {
+      try {
+        validateRunPlanDigest(entry.run, plan);
+      } catch (error) {
+        addFinding('PLAN_BINDING_MISMATCH', entry.role, error.message);
+      }
+      try {
+        validateRunCheckpointMapping(entry.run, plan.externalActions ?? []);
+      } catch (error) {
+        addFinding('CHECKPOINT_MISMATCH', entry.role, error.message);
+      }
+    }
+  }
+
+  if (approvalDigest) {
+    for (const entry of usableRuns) {
+      if (!entry.run.approvalDigest) {
+        addFinding('INPUT_MISSING', entry.role, 'run does not carry the approval digest needed to bind the supplied approval', 'INSUFFICIENT');
+      } else if (entry.run.approvalDigest !== approvalDigest) {
+        addFinding('APPROVAL_DIGEST_MISMATCH', entry.role, 'run approvalDigest does not match the supplied approval bytes');
+      }
+    }
+  }
+
+  const supportingRuns = usableRuns.filter((entry) => !entry.isTarget);
+  const chain = [];
+  let lineageComplete = false;
+  if (targetRun && usableRuns.some((entry) => entry.isTarget)) {
+    let current = usableRuns.find((entry) => entry.isTarget);
+    const visited = new Set();
+    for (let depth = 0; depth <= 16 && current; depth += 1) {
+      chain.push(current.run);
+      const visitKey = `${current.run.runId}:${current.run.runDigest}`;
+      if (visited.has(visitKey)) {
+        addFinding('RUN_LINEAGE_MISMATCH', current.role, 'release run lineage contains a cycle');
+        break;
+      }
+      visited.add(visitKey);
+
+      if (current.run.command === 'publish') {
+        lineageComplete = true;
+        break;
+      }
+      if (!current.run.sourceRunId || !current.run.sourceRunDigest || !current.run.sourceRunPath) {
+        addFinding('INPUT_MISSING', current.role, 'run is missing complete source-run lineage fields', 'INSUFFICIENT');
+        break;
+      }
+      const exactParent = supportingRuns.find((candidate) => (
+        candidate.run.runId === current.run.sourceRunId
+        && candidate.run.runDigest === current.run.sourceRunDigest
+      ));
+      if (!exactParent) {
+        const sameId = supportingRuns.find((candidate) => candidate.run.runId === current.run.sourceRunId);
+        if (sameId) {
+          addFinding('RUN_LINEAGE_MISMATCH', current.role, 'source run id is present but its digest does not match');
+        } else {
+          addFinding('INPUT_MISSING', current.role, 'explicit source run required by lineage was not supplied', 'INSUFFICIENT');
+        }
+        break;
+      }
+      try {
+        validateSourceRunEdge(current.run, exactParent.run);
+      } catch (error) {
+        addFinding('TRANSITION_MISMATCH', current.role, error.message);
+        break;
+      }
+      current = exactParent;
+    }
+    if (!lineageComplete && chain.length > 16) {
+      addFinding('RUN_LINEAGE_MISMATCH', 'targetRun', 'release run lineage exceeds maximum depth');
+    }
+  }
+
+  for (const entry of usableRuns) {
+    const run = entry.run;
+    if (run.stateSequence === undefined) {
+      if (run.previousStateDigest !== undefined) {
+        addFinding('RUN_LINEAGE_MISMATCH', entry.role, 'non-state run claims a previous state digest');
+      }
+      continue;
+    }
+    if (run.stateSequence === 0) {
+      if (run.previousStateDigest !== undefined) {
+        addFinding('RUN_LINEAGE_MISMATCH', entry.role, 'initial state run claims a previous state digest');
+      }
+      continue;
+    }
+    const predecessor = supportingRuns.find((candidate) => (
+      candidate.run.runId === run.runId
+      && candidate.run.stateSequence === run.stateSequence - 1
+    ));
+    if (!predecessor) {
+      addFinding('INPUT_MISSING', entry.role, 'explicit predecessor state snapshot was not supplied', 'INSUFFICIENT');
+    } else if (
+      predecessor.run.runDigest !== run.previousStateDigest
+      || predecessor.run.command !== run.command
+      || predecessor.run.planDigest !== run.planDigest
+    ) {
+      addFinding('RUN_LINEAGE_MISMATCH', entry.role, 'state predecessor identity or digest does not match');
+    }
+  }
+
+  if (approvalSupported) {
+    const executionRun = [...chain].reverse().find((run) => (
+      ['publish', 'reconcile'].includes(run.command)
+      && (run.checkpoints ?? []).some((checkpoint) => isRemoteWriteAction(checkpoint.actionType))
+    ));
+    if (!lineageComplete || !executionRun?.startedAt || !executionRun?.finishedAt) {
+      addFinding('HISTORICAL_TIME_MISSING', 'approval', 'historical publish execution interval cannot be proven', 'INSUFFICIENT');
+    } else {
+      const approvedAt = Date.parse(approval.approvedAt);
+      const expiresAt = Date.parse(approval.expiresAt);
+      const startedAt = Date.parse(executionRun.startedAt);
+      const finishedAt = Date.parse(executionRun.finishedAt);
+      if (
+        !Number.isFinite(startedAt)
+        || !Number.isFinite(finishedAt)
+        || startedAt < approvedAt
+        || finishedAt > expiresAt
+        || finishedAt < startedAt
+      ) {
+        addFinding('HISTORICAL_TIME_OUTSIDE_WINDOW', 'approval', 'publish execution interval is outside the approval window');
+      }
+    }
+  }
+
+  findings.sort((left, right) => (
+    (FINDING_RANK.get(left.code) ?? 999) - (FINDING_RANK.get(right.code) ?? 999)
+    || left.role.localeCompare(right.role)
+    || left.message.localeCompare(right.message)
+  ));
+  const hasContradiction = findings.some((finding) => finding._outcome === 'CONTRADICTED');
+  const hasInsufficient = findings.some((finding) => finding._outcome === 'INSUFFICIENT');
+  const status = hasContradiction ? 'CONTRADICTED' : hasInsufficient ? 'INSUFFICIENT' : 'CONSISTENT';
+
+  return {
+    status,
+    unitId: typeof request.unitId === 'string' ? request.unitId : null,
+    targetVersion: typeof request.targetVersion === 'string' ? request.targetVersion : null,
+    historicalTerminalStatus: trustedTargetTerminalStatus,
+    inputs: {
+      plan: planInput.summary,
+      approval: approvalInput.summary,
+      targetRun: targetInput.summary,
+      sourceRuns: sourceInputs.map((input) => input.summary),
+    },
+    digests: {
+      plan: planInput.digest,
+      approval: approvalInput.digest,
+      targetRun: targetInput.digest,
+      sourceRuns: sourceInputs.map((input) => input.digest),
+    },
+    findings: findings.map(({ _outcome, ...finding }) => finding),
+  };
+}

package/src/commands/verify.mjs

@@ -72,6 +72,7 @@ import {
   isFoundationPluginVerificationEligible,
   verifyFrozenPluginWithFoundation,
 } from '../core/foundation-plugin-verification.mjs';
+import { verifyFrozenCursorSkillWithFoundation } from '../core/foundation-host-verification.mjs';
 import { resolveUnitScopedPath } from '../snapshot/public-path.mjs';
 import { canonicalJson } from '../core/digest.mjs';
 import {
@@ -130,6 +131,53 @@ export const VERIFICATION_RESOLVED_TYPES = Object.freeze({
   NOT_REQUIRED_UNCHANGED: 'NOT_REQUIRED_UNCHANGED',
 });
 
+/** Verify actionless Cursor distributions through their frozen host contract. */
+export async function verifyCursorHostDistributions({
+  plan,
+  root,
+  cursorHostRuntime,
+  runHostVerificationFn,
+  clock = defaultClock,
+  evidence,
+} = {}) {
+  const checks = [];
+  for (const unit of plan?.units ?? []) {
+    const cursorDistribution = (unit.distributions ?? []).find(
+      (distribution) => distribution.type === 'cursor-plugin',
+    );
+    if (!cursorDistribution) continue;
+    const result = await verifyFrozenCursorSkillWithFoundation({
+      plan,
+      unitId: unit.id,
+      root,
+      cursorHostRuntime,
+      ...(runHostVerificationFn ? { runHostVerificationFn } : {}),
+      clock,
+    });
+    checks.push({
+      actionId: `cursor-host-verification-${unit.id}`,
+      actionType: 'cursor-host-verification',
+      unitId: unit.id,
+      distributionType: cursorDistribution.type,
+      status: VERIFICATION_RESOLVED_TYPES.PASSED_AUTOMATIC,
+      observation: result,
+    });
+    await evidence?.append({
+      phase: 'verify-host',
+      unitId: unit.id,
+      distributionType: cursorDistribution.type,
+      status: VERIFICATION_RESOLVED_TYPES.PASSED_AUTOMATIC,
+      hostId: result.hostId,
+      driverId: result.driverId,
+      requestDigest: result.requestDigest,
+      payloadDigest: result.payloadDigest,
+      entrySkill: result.entrySkill,
+      observation: result,
+    });
+  }
+  return checks;
+}
+
 /** Re-read every frozen subject tarball before consuming the public receipt. */
 export async function verifyPublicSourceAuthorityReceiptOffline({ plan, root }) {
   const descriptor = plan.publicSourceAuthorityReceipt;
@@ -179,6 +227,7 @@ const ADAPTER_ACTION_TYPE_MAP = {
   'codex-marketplace-install': 'codex-marketplace-install',
   'kimi-marketplace-install': 'kimi-marketplace-install',
   'codebuddy-marketplace-install': 'codebuddy-marketplace-install',
+  'qoder-marketplace-install': 'qoder-marketplace-install',
 };
 
 // ---------------------------------------------------------------------------
@@ -349,6 +398,7 @@ async function collectMissingManualAttestations({
   const manual = actions.filter((action) => (
     action.type === 'kimi-marketplace-install'
     || action.type === 'codebuddy-marketplace-install'
+    || action.type === 'qoder-marketplace-install'
   ));
   if (manual.length === 0) return [];
 
@@ -1097,6 +1147,8 @@ export async function verifyRelease(options) {
     execFn,
     configPath: configPathOpt,
     runPluginVerificationFn,
+    runHostVerificationFn,
+    cursorHostRuntime,
     observeFirstReleaseMarketplaceHeadFn,
     fetchFirstReleaseMarketplaceIndexFn,
   } = options ?? {};
@@ -1576,6 +1628,20 @@ export async function verifyRelease(options) {
     const manualFollowUps = [];
     const foundationPluginVerificationReceipts = [];
 
+    // Cursor has no marketplace action or publish checkpoint. Verify each
+    // declared Cursor distribution directly from its frozen unit contract,
+    // using explicit runtime roots that never enter the release run record.
+    // Plans without Cursor distributions do not enter
+    // this branch and retain their existing action-only behavior.
+    adapterChecks.push(...await verifyCursorHostDistributions({
+      plan,
+      root,
+      cursorHostRuntime,
+      runHostVerificationFn,
+      clock: clockFn,
+      evidence,
+    }));
+
     // Every action is identity-bound and adapters receive read-only or
     // per-action isolated consumer paths. Run independent checks concurrently;
     // the evidence writer serializes append operations and result arrays are
@@ -1710,6 +1776,7 @@ export async function verifyRelease(options) {
           'codex-marketplace-install': 'codex-plugin',
           'kimi-marketplace-install': 'kimi-plugin',
           'codebuddy-marketplace-install': 'codebuddy-plugin',
+          'qoder-marketplace-install': 'qoder-plugin',
         };
         const dist = unit?.distributions?.find((d) => d.type === typeToDist[action.type]);
 
@@ -1896,6 +1963,8 @@ export async function verifyRelease(options) {
             ? 'codex-plugin'
             : action.type === 'codebuddy-marketplace-install'
               ? 'codebuddy-plugin'
+              : action.type === 'qoder-marketplace-install'
+                ? 'qoder-plugin'
               : 'kimi-plugin';
         const installPath = verifyResult.observation?.installPath;
         consumerGateResults.push(...await runConsumerVerificationGates({
@@ -1919,6 +1988,10 @@ export async function verifyRelease(options) {
                 ? {
                     HOME: resolve(runDir, 'consumers', `codebuddy-${action.parameters.plugin}`),
                   }
+                : action.type === 'qoder-marketplace-install'
+                  ? {
+                      HOME: resolve(runDir, 'consumers', `qoder-${action.parameters.plugin}`),
+                    }
                 : {
                     HOME: resolve(runDir, 'consumers', `kimi-${action.parameters.plugin}`),
                   },

package/src/core/checkpoints.mjs

@@ -34,6 +34,7 @@ export const CHECKPOINT_ORDER = [
   'codex-marketplace-install',
   'kimi-marketplace-install',
   'codebuddy-marketplace-install',
+  'qoder-marketplace-install',
 ];
 
 /**
@@ -54,6 +55,7 @@ export const ADAPTER_ACTION_TYPE_MAP = {
   'codex-marketplace-install': 'codex-marketplace-install',
   'kimi-marketplace-install': 'kimi-marketplace-install',
   'codebuddy-marketplace-install': 'codebuddy-marketplace-install',
+  'qoder-marketplace-install': 'qoder-marketplace-install',
 };
 
 /**
@@ -68,7 +70,7 @@ export const ADAPTER_ACTION_TYPE_MAP = {
  *   placed in Tier 1 only for conservative scheduling.
  * - Tier 2 `github-release` depends on Tier 1 `create-tag` (release `--verify-tag`).
  *
- * Marketplace actions (claude/codex/kimi/codebuddy-marketplace-install) are
+ * Marketplace actions (claude/codex/kimi/codebuddy/qoder-marketplace-install) are
  * included in the tier table for ADAPTER_ACTION_TYPE_MAP lookup but are
  * filtered out before tier grouping in both publish and reconcile. They are
  * recorded as DEFERRED with CONSUMER_VERIFICATION_DEFERRED reason and never
@@ -82,7 +84,7 @@ export const TIER_TABLE = [
   ['push-commit', 'push-snapshot'],                                              // Tier 0
   ['set-default-branch', 'create-tag', 'npm-publish'],                          // Tier 1
   ['github-release', 'claude-marketplace-install', 'codex-marketplace-install'], // Tier 2
-  ['kimi-marketplace-install', 'codebuddy-marketplace-install'],                // Tier 3
+  ['kimi-marketplace-install', 'codebuddy-marketplace-install', 'qoder-marketplace-install'], // Tier 3
 ];
 
 /** Fast reverse lookup: action type -> tier index (-1 when unknown). */
@@ -170,6 +172,7 @@ export const MARKETPLACE_ACTION_TYPES = new Set([
   'codex-marketplace-install',
   'kimi-marketplace-install',
   'codebuddy-marketplace-install',
+  'qoder-marketplace-install',
 ]);
 
 /**

package/src/core/config.mjs

@@ -401,7 +401,7 @@ export async function loadProjectConfig({ root, configPath } = {}) {
     for (const unit of config.releaseUnits) {
       if (!unit?.distributions) continue;
       for (const dist of unit.distributions) {
-        if (dist.type === 'npm') continue;
+        if (dist.type === 'npm' || dist.type === 'cursor-plugin') continue;
         if (dist.marketplaceSourceType === undefined || dist.marketplaceSourceType === null) {
           dist.marketplaceSourceType = dist.marketplaceRepo ? 'standalone-index' : 'bundled-family';
         }