release-skill 0.9.23 → 0.9.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.23",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/platform-manifest.json

@@ -2,11 +2,11 @@
   "schemaVersion": "1.0.0",
   "platformId": "release-skill",
   "platformName": "release-skill Plugin Platform",
-  "version": "0.9.23",
+  "version": "0.9.25",
   "logicalRoot": "skills-src/",
-  "logicalRootDigest": "693b190f880abe5a441a5d18bc14b01142806de1289d927cda0da38ad3dd2425",
-  "projectionDigest": "8c04c93ffc8e5652038dc10020ea00052b6a1dcf1ea70158e35117d6370a6db9",
-  "projectionId": "release-skill:platform:0.9.23",
+  "logicalRootDigest": "7b62f9ded9aea774298ad86a781d58ad83f4092f3c3220b4a75dfe11ad19f809",
+  "projectionDigest": "bb92d4a3f57842000aa404a0698c5e38c111f05408027491e0904912af81d716",
+  "projectionId": "release-skill:platform:0.9.25",
   "manifestRequired": true,
   "projectionSources": {
     "skills-src-root": {

package/references/05-evidence-and-errors.md

@@ -207,8 +207,8 @@ v2 的顶层结构封闭（`additionalProperties: false`），只接受 Schema
 
 ### 5.1 文件保留
 
-- 不得手工删除运行证据。下一次生产 prepare 会在现有项目锁内执行一次尽力清理，只删除已被更新完整谱系取代的终态谱系，以及没有有效计划或外部写入迹象的封口失败 prepare。
-- 当前 prepare、当前计划对应的全部 run、最近完整谱系、任何非终态或部分成功谱系，以及损坏、越界、身份含糊或信息冲突的目录都受保护。清理以 `.release-skill/runs/` 下的真实直接子目录为单位，不删除计划、批准或 ship 记录；单个删除失败只记录目录基名和错误码，不阻断 prepare。
+- 不得手工删除运行证据。生产 prepare 保留 `.release-skill/runs/` 中已有的运行目录，包括封口失败的 prepare 和已经结束的谱系。
+- 生产 prepare 保留的是这些运行目录，不保证目录内每个历史文件的字节永久不变。文件如何写入仍按本节其余证据合同执行。
 - `evidence.jsonl` 为追加写入，不得在执行过程中被截断。
 - `summary.json` 在执行结束时原子写入（writer 单次封口：`finish()` 只能成功一次，封口后 append/finish 均为 no-op；正常命令的成功与失败路径都必须封口）。
 - `states/` 台账为不可变写集：外部检查点成功后立即记账，失败时保留 `PARTIAL` 状态，reconcile 据此跳过已成功步骤。

package/scripts/build-bundle.mjs

@@ -22,6 +22,7 @@
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { createHash } from 'node:crypto';
 import { computeBundleSourceDigest } from '../src/core/bundle-freshness.mjs';
 import {
@@ -32,7 +33,7 @@ import {
 
 const CHECK_MODE = process.argv.includes('--check');
 
-const SCRIPT_DIR = dirname(new URL(import.meta.url).pathname);
+const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
 const PKG_ROOT = join(SCRIPT_DIR, '..');
 const ENTRY = join(PKG_ROOT, 'bin', 'release-skill-cli.mjs');
 const OUTFILE = join(PKG_ROOT, 'bin', 'release-skill.bundle.mjs');

package/scripts/sync-public-files.mjs

@@ -36,7 +36,7 @@ import { PLATFORMS } from '../src/platforms/registry.mjs';
 // Constants
 // ---------------------------------------------------------------------------
 
-const SCRIPT_DIR = new URL('.', import.meta.url).pathname;
+const SCRIPT_DIR = fileURLToPath(new URL('.', import.meta.url));
 const PKG_ROOT = process.env.RELEASE_SKILL_PKG_ROOT ?? join(SCRIPT_DIR, '..');
 const PROJECT_YAML = join(PKG_ROOT, '..', '..', '.release-skill', 'project.yaml');
 const SOURCE_PREFIX = 'packages/release-skill/';

package/skills/release-help/SKILL.md

@@ -29,9 +29,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.23 候选边界
+## 0.9.25 候选边界
 
-当前 0.9.23 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.23 仍是源码候选，不能从本说明推断已批准、发布或验证。
+当前 0.9.25 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.25 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
 

package/skills-src/release-help/SKILL.md

@@ -29,9 +29,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.23 候选边界
+## 0.9.25 候选边界
 
-当前 0.9.23 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.23 仍是源码候选，不能从本说明推断已批准、发布或验证。
+当前 0.9.25 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.25 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
 

package/src/artifacts/producer-registry.mjs

@@ -15,6 +15,7 @@ import { join } from 'node:path';
 import { mkdtemp } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { readFileSync } from 'node:fs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { canonicalJson, sha256Hex } from '../core/digest.mjs';
 import { digestBytes } from 'skill-family-harness-node';
@@ -44,7 +45,7 @@ export { buildProducerGraph };
  * @returns {string[]} Absolute paths of all reachable local modules.
  */
 function collectStaticImports(filePath, visited = new Set()) {
-  const abs = new URL(`file://${filePath}`).pathname;
+  const abs = fileURLToPath(pathToFileURL(filePath));
   if (visited.has(abs)) return [];
   visited.add(abs);
 
@@ -109,7 +110,7 @@ export async function createBuiltInProducerRegistry() {
   const producers = new Map();
 
   // Resolve lockfile path (one level up from package root)
-  const lockfilePath = join(new URL('../../..', import.meta.url).pathname, 'pnpm-lock.yaml');
+  const lockfilePath = join(fileURLToPath(new URL('../../..', import.meta.url)), 'pnpm-lock.yaml');
   let lockfileBytes;
   try {
     lockfileBytes = await readFile(lockfilePath);
@@ -128,7 +129,7 @@ export async function createBuiltInProducerRegistry() {
     }
 
     // Collect full static dependency closure
-    const modulePath = new URL(moduleUrl).pathname;
+    const modulePath = fileURLToPath(moduleUrl);
     const allModulePaths = collectStaticImports(modulePath);
     const allModuleBytes = await Promise.all(
       allModulePaths.map(async (p) => {

package/src/commands/prepare.mjs

@@ -78,7 +78,6 @@ import { acquireProjectLock } from '../artifacts/project-lock.mjs';
 import { observePreviousPublicBaseline } from '../core/previous-public-baseline.mjs';
 import { verifyFrozenNpmTarballContract } from '../adapters/npm.mjs';
 import { createProductionPrepareRunDir } from '../core/run.mjs';
-import { cleanupRunRetention } from '../core/run-retention.mjs';
 import {
   PLATFORMS,
   normalizeHostId,
@@ -279,7 +278,9 @@ import { boundedOutputTail } from '../core/bounded-output.mjs';
  * already captures child stdout/stderr on non-zero exit; on failure this
  * layer writes bounded tails into the hooks evidence event AND echoes them to
  * the current process' stderr, so a failing hook is diagnosable on the
- * terminal without opening evidence.jsonl. Success events carry no tails.
+ * terminal without opening evidence.jsonl. Fresh success and non-zero exit
+ * events also retain the returned full streams through the evidence writer's
+ * redaction. Success events carry no tails; cache hits have no fresh streams.
  * Exit-code semantics are unchanged.
  *
  * @param {object} config - The loaded project config.
@@ -413,6 +414,7 @@ export async function runDeclaredHooks(config, root, evidence, hookFn = runHook,
         // streams instead of the noisy compiler prelude at the beginning.
         stdoutTail,
         stderrTail,
+        details: { stdout: result.stdout, stderr: result.stderr },
         ...selectionField,
       });
       throw new ReleaseError(
@@ -448,6 +450,7 @@ export async function runDeclaredHooks(config, root, evidence, hookFn = runHook,
       status: 'completed',
       hookName: name,
       exitCode: 0,
+      details: { stdout: result.stdout, stderr: result.stderr },
       ...selectionField,
     });
     records.push({ name, completed: true, cached: false, testSelection: selectionField.testSelection });
@@ -3404,34 +3407,6 @@ export async function prepareRelease(options) {
   const evidence = createEvidenceWriter({ runDir, command: 'prepare', clock });
 
   try {
-    // R14-01: production prepare performs one best-effort retention pass only
-    // after the current run/evidence authority exists and before high-cost
-    // config, snapshot, and hook work begins. It never blocks prepare.
-    if (production) {
-      try {
-        const retention = await (options.runRetentionFn ?? cleanupRunRetention)({
-          releaseDir,
-          currentRunDir: runDir,
-        });
-        await evidence.append({
-          phase: 'run-retention',
-          status: 'completed',
-          scanned: retention.scanned,
-          deleted: retention.deleted,
-          errors: retention.errors,
-        });
-      } catch (error) {
-        await evidence.append({
-          phase: 'run-retention',
-          status: 'warning',
-          scanned: 0,
-          deleted: 0,
-          errors: 1,
-          error: { code: error?.code ?? 'RUN_RETENTION_FAILED', message: error?.message ?? String(error) },
-        });
-      }
-    }
-
     // --- Step 1: Load and validate config ---
     await evidence.append({ phase: 'config', status: 'started' });
 

package/src/core/baseline.mjs

@@ -292,7 +292,15 @@ async function computeWorkspaceDigest(root) {
  * @returns {Promise<{ gitHead: string, gitTreeHash: string, workspaceDigest: string, statusEntries: string[], capturedAt: string }>}
  */
 export async function captureBaseline(root) {
-  const opts = { cwd: root, shell: false, encoding: 'utf8' };
+  // Same 64 MiB bound as computeWorkspaceDigest: `git status --porcelain=v1
+  // -z --untracked-files=all` lists every untracked file and exceeds Node's
+  // default 1 MiB execFile maxBuffer once that listing grows past ~1 MiB.
+  const opts = {
+    cwd: root,
+    shell: false,
+    encoding: 'utf8',
+    maxBuffer: 64 * 1024 * 1024,
+  };
 
   const [{ stdout: headOut }, { stdout: treeOut }, { stdout: statusOut }] =
     await Promise.all([

package/src/core/public-surface.mjs

@@ -437,7 +437,7 @@ export async function inspectExpectedPublicSurface({ root, unit } = {}) {
   let skippedNonRegularCount = 0;
   for (const rule of resolvedRoots) {
     const observed = await scanRoot({ workspaceRoot, unit, rule });
-    observedFiles.push(...observed.files);
+    for (const file of observed.files) observedFiles.push(file);
     skippedNonRegularCount += observed.skippedNonRegularCount;
   }
 

package/src/core/redact.mjs

@@ -54,12 +54,19 @@ export const REDACTED_PATH_PLACEHOLDER = '<redacted-path>';
 // (b) UNC paths (\\server\share...);
 // (c) POSIX absolute paths: a '/' anchored at the start of the string or
 //     preceded by a delimiter (whitespace, quote, '=', ':', ',', '(', '[',
-//     '{', '<'), running until whitespace or a quote. The left boundary keeps
-//     redaction from firing inside relative fragments ('src/core/x.mjs'),
-//     fragment-anchored JSON pointers ('#/required'), or protocol-relative
-//     URLs ('https://x/y').
+//     '{', '<'). Non-final '/'-separated segments may contain spaces (a
+//     volume name such as /Volumes/Samsung 990 pro 4T/src/file), so the
+//     token continues across those spaces and stops before trailing prose
+//     ('plan.json rejected: ...'). The left boundary keeps redaction from
+//     firing inside relative fragments ('src/core/x.mjs'), fragment-anchored
+//     JSON pointers ('#/required'), or protocol-relative URLs ('https://x/y').
+//     Windows drive and UNC alternatives still stop at whitespace; only the
+//     POSIX alternative crosses spaces, and only in non-final segments.
+//     A segment starting with a space right after '/' (e.g. /Volumes/ 990/x)
+//     and Windows drive/UNC tokens still truncate at that whitespace (known
+//     limitation).
 const PATH_TOKEN_RE =
-  /(?<=^|[\s'"=:,([{<])(?:[A-Za-z]:[\\/][^\s'"]*|\\\\[^\s'"]+|\/[^\s'"]+)/g;
+  /(?<=^|[\s'"=:,([{<])(?:[A-Za-z]:[\\/][^\s'"]*|\\\\[^\s'"]+|\/(?:[^/\s'"]+(?:[ ]+[^/\s'"]+)*\/)*[^/\s'"]*)/g;
 
 // Trailing prose punctuation that may cling to a token and must survive.
 const TRAILING_PUNCT_RE = /^(.*?)([.!,;:)\]}>]*)$/;

package/src/core/source-authority.mjs

@@ -272,6 +272,21 @@ function normalizeLocalGitMode(mode) {
   return (mode & 0o111) === 0 ? '100644' : '100755';
 }
 
+function gitPathSegments(value) {
+  return String(value).replaceAll('\\', '/').replace(/\/+$/u, '').split('/').filter(Boolean);
+}
+
+function sharesDirectoryBoundary(recordPath, requestedPath) {
+  const recordSegments = gitPathSegments(recordPath);
+  const requestedSegments = gitPathSegments(requestedPath);
+  const limit = Math.min(recordSegments.length, requestedSegments.length);
+  if (limit === 0) return false;
+  for (let index = 0; index < limit; index += 1) {
+    if (recordSegments[index] !== requestedSegments[index]) return false;
+  }
+  return true;
+}
+
 /**
  * Check only frozen source-input paths for staged, unstaged or untracked
  * changes. Unrelated dirty files remain allowed.
@@ -310,11 +325,21 @@ export async function checkSourceInputDirty({ closure, root, execFn = execFile }
     if (record.length < 4) continue;
     const status = record.slice(0, 2);
     const recordPath = record.slice(3);
+    let renamedPath = '';
+    if (status.startsWith('R') || status.startsWith('C')) {
+      renamedPath = records[index + 1] ?? '';
+      index += 1;
+    }
     // Ignored inputs are still untracked inputs. A file explicitly selected
     // for publication must not escape the prepare gate merely because a
-    // .gitignore rule hides it from ordinary status output.
-    dirtyPaths.push(recordPath);
-    if (status.startsWith('R') || status.startsWith('C')) index += 1;
+    // .gitignore rule hides it from ordinary status output. A porcelain row
+    // counts only when its path shares a full directory segment with a
+    // requested closure path. A character prefix is not a selection.
+    for (const candidate of [recordPath, renamedPath]) {
+      if (candidate && paths.some((requested) => sharesDirectoryBoundary(candidate, requested))) {
+        dirtyPaths.push(candidate);
+      }
+    }
   }
   return {
     dirty: dirtyPaths.length > 0,

package/src/npm/npm-entry-closure.mjs

@@ -84,6 +84,37 @@ function checkTarget({ field, target, fileIndex, requireDotSlash = false }) {
   };
 }
 
+// Identity mapping whose only star is the final character, for example
+// "./schemas/*" -> "./schemas/*". Node replaces that star with any non-empty
+// string, including "/". Other shapes stay rejected.
+function isDirectTrailingStarMapping(key, value) {
+  return typeof value === 'string'
+    && key === value
+    && key.startsWith('./')
+    && key.indexOf('*') === key.length - 1;
+}
+
+function validateTrailingStarPrefix(pattern) {
+  const head = pattern.slice(0, -1);
+  if (head === './') return {};
+  const staticTarget = head.endsWith('/') ? head.slice(0, -1) : head;
+  const validated = validateRelativeTarget(staticTarget, 'exports', { requireDotSlash: true });
+  if (validated.error) return validated;
+  return {};
+}
+
+function matchingIndexPaths(pattern, fileIndex) {
+  const prefix = pattern.slice(0, -1);
+  const matched = [];
+  for (const path of fileIndex.keys()) {
+    if (typeof path !== 'string') continue;
+    const subpath = `./${path}`;
+    if (subpath.startsWith(prefix) && subpath.length >= pattern.length) matched.push(path);
+  }
+  matched.sort();
+  return matched;
+}
+
 function collectExports(value, location, result) {
   if (value === null) return;
   if (typeof value === 'string') {
@@ -117,14 +148,18 @@ function collectExports(value, location, result) {
   for (const [key, child] of Object.entries(value)) {
     const childLocation = `${location}.${key}`;
     if (key.includes('*')) {
-      result.errors.push(
-        entryError(
-          'exports',
-          key,
-          'unsupported_entry_shape',
-          `${childLocation} uses a wildcard subpath that the static gate cannot verify`,
-        ),
-      );
+      if (isDirectTrailingStarMapping(key, child)) {
+        result.patterns.push({ location: childLocation, pattern: key });
+      } else {
+        result.errors.push(
+          entryError(
+            'exports',
+            key,
+            'unsupported_entry_shape',
+            `${childLocation} uses a wildcard subpath that the static gate cannot verify`,
+          ),
+        );
+      }
       continue;
     }
     collectExports(child, childLocation, result);
@@ -166,7 +201,7 @@ export function checkNpmEntryClosure(manifest, fileIndex) {
   }
 
   if (manifest.exports !== undefined) {
-    const exportsResult = { targets: [], errors: [], diagnostics: [] };
+    const exportsResult = { targets: [], patterns: [], errors: [], diagnostics: [] };
     collectExports(manifest.exports, 'exports', exportsResult);
     result.errors.push(...exportsResult.errors);
     result.diagnostics.push(...exportsResult.diagnostics);
@@ -180,6 +215,33 @@ export function checkNpmEntryClosure(manifest, fileIndex) {
       result.entries.push(...checked.entries);
       result.errors.push(...checked.errors);
     }
+    for (const pattern of exportsResult.patterns) {
+      const validated = validateTrailingStarPrefix(pattern.pattern);
+      if (validated.error) {
+        result.errors.push(validated.error);
+        continue;
+      }
+      const matched = matchingIndexPaths(pattern.pattern, fileIndex);
+      if (matched.length === 0) {
+        result.errors.push(entryError(
+          'exports',
+          pattern.pattern,
+          'empty_pattern_match',
+          `${pattern.location} matched no files in the package file index`,
+        ));
+        continue;
+      }
+      for (const path of matched) {
+        const checked = checkTarget({
+          field: 'exports',
+          target: `./${path}`,
+          fileIndex,
+          requireDotSlash: true,
+        });
+        result.entries.push(...checked.entries);
+        result.errors.push(...checked.errors);
+      }
+    }
   }
 
   return result;

package/src/producers/build-adapters.mjs

@@ -22,6 +22,7 @@
 import { readdir, mkdir, lstat, realpath, open, rm } from 'node:fs/promises';
 import { constants as fsConstants } from 'node:fs';
 import { join, dirname, relative, isAbsolute, sep, resolve, posix as pathPosix } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 import { sha256Hex } from '../core/digest.mjs';
 import { digestDocument } from 'skill-family-contracts';
@@ -713,7 +714,7 @@ async function generateAdapterFiles(platform, skills, templateJson, root, market
  * @param {string} [options.platformFilter] - Only generate for this platform name.
  */
 export async function produceBuildAdapters({ inputs, output, outputRoots, platformFilter } = {}) {
-  const defaultRoot = new URL('../..', import.meta.url).pathname;
+  const defaultRoot = fileURLToPath(new URL('../..', import.meta.url));
   const requestedRoot = inputs ?? defaultRoot;
 
   // ── Phase 1: Validate input root is not a symlink ──

package/src/producers/render-public-assets.mjs

@@ -13,6 +13,7 @@
 
 import { readFile, writeFile, readdir, stat, mkdir } from 'node:fs/promises';
 import { join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 import { canonicalJson, sha256Hex } from '../core/digest.mjs';
 import { digestDocument } from 'skill-family-contracts';
@@ -111,7 +112,7 @@ async function renderDir(srcDir, outDir, pathPrefix) {
  * @returns {Promise<{outputs: Array, outputManifestDigest: string}>}
  */
 export async function produceRenderPublicAssets({ inputs, output } = {}) {
-  const defaultRoot = new URL('../../..', import.meta.url).pathname;
+  const defaultRoot = fileURLToPath(new URL('../../..', import.meta.url));
   const root = inputs ?? defaultRoot;
 
   const srcDirs = [

package/src/producers/sync-skills.mjs

@@ -11,6 +11,7 @@
 
 import { readdir, readFile, writeFile, mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 import { canonicalJson, sha256Hex } from '../core/digest.mjs';
 import { digestDocument } from 'skill-family-contracts';
@@ -44,7 +45,7 @@ export function computeSyncSkillsDigest(sourceBytes) {
  * @param {string} options.output - Output directory path.
  */
 export async function produceSyncSkills({ inputs, output } = {}) {
-  const defaultSrc = new URL('../../skills-src', import.meta.url).pathname;
+  const defaultSrc = fileURLToPath(new URL('../../skills-src', import.meta.url));
   const srcDir = inputs ?? defaultSrc;
 
   const skillDirs = [];

package/src/snapshot/frozen.mjs

@@ -199,9 +199,10 @@ export async function verifyFrozenDirectoryStructure(directory, label = 'frozen
  *
  * Consumption only: this never rebuilds objects and never reads the wall
  * clock. When `commitTimestamp` (the plan's `frozenSnapshot.commitTimestamp`)
- * is provided, the frozen commit's real `%aI`/`%cI` dates must match it
- * exactly, so a commit carrying any other author/committer time can never
- * pass pre-publish verification.
+ * is provided, the plan canonical form remains `+00:00`. Git may read the
+ * same UTC instant back as `Z` via `%aI`/`%cI`. Both sides pass through
+ * `normalizeGitTimestamp` before comparison, so a commit carrying any other
+ * author/committer instant can never pass pre-publish verification.
  */
 export async function verifyFrozenGitRepository({
   root,
@@ -225,13 +226,15 @@ export async function verifyFrozenGitRepository({
       ['--git-dir', gitDir, 'show', '-s', '--format=%aI%n%cI', commit],
       { shell: false },
     );
-    const [authorDate, committerDate] = datesOut.trim().split('\n');
+    const [rawAuthorDate, rawCommitterDate] = datesOut.trim().split('\n');
+    const authorDate = normalizeGitTimestamp(rawAuthorDate, 'frozen commit author date');
+    const committerDate = normalizeGitTimestamp(rawCommitterDate, 'frozen commit committer date');
     if (authorDate !== expectedTimestamp || committerDate !== expectedTimestamp) {
       throw frozenError('frozen git commit dates do not match the plan freeze timestamp', {
         commit,
         expectedTimestamp,
-        observedAuthorDate: authorDate,
-        observedCommitterDate: committerDate,
+        observedAuthorDate: rawAuthorDate,
+        observedCommitterDate: rawCommitterDate,
       });
     }
   }
@@ -314,9 +317,10 @@ const GIT_ISO8601_STRICT_RE =
  *
  * The value must be a non-empty, strict ISO 8601 timestamp with an explicit UTC
  * offset and a parseable calendar date. It is normalized to UTC with second
- * precision and a `+00:00` offset, which is exactly the form Git stores and
- * re-emits via `%aI`/`%cI`. Missing, empty, malformed, or out-of-range values
- * throw a closed `GATE_FAILED` error.
+ * precision and a `+00:00` offset. The plan canonical form remains `+00:00`.
+ * Git may read the same UTC instant back as `Z` via `%aI`/`%cI`; both sides
+ * pass through `normalizeGitTimestamp` before comparison. Missing, empty,
+ * malformed, or out-of-range values throw a closed `GATE_FAILED` error.
  *
  * Normalization is idempotent: re-normalizing an already-canonical value returns
  * the identical string, so prepare and the Git builder always agree byte-for-byte.
@@ -399,11 +403,12 @@ function publicGitRemote({ repo, githubHost = 'github.com' }) {
  * `commitTimestamp` is the plan freeze timestamp sampled exactly once during
  * production prepare. It is strictly validated BEFORE any filesystem or Git
  * write (missing, empty, malformed, or impossible values fail closed), then
- * written verbatim to both GIT_AUTHOR_DATE and GIT_COMMITTER_DATE, so the
- * frozen commit's `%aI` and `%cI` always equal the plan's
- * `frozenSnapshot.commitTimestamp` byte-for-byte. Identical inputs therefore
- * yield identical tree and commit identifiers, and a different freeze
- * timestamp alone yields a different commit with an identical tree.
+ * written verbatim to both GIT_AUTHOR_DATE and GIT_COMMITTER_DATE. The plan
+ * canonical form remains `+00:00`. Git may read the same UTC instant back as
+ * `Z` via `%aI`/`%cI`; both sides pass through `normalizeGitTimestamp` before
+ * comparison. Identical inputs therefore yield identical tree and commit
+ * identifiers, and a different freeze timestamp alone yields a different
+ * commit with an identical tree.
  */
 export async function buildFrozenGitRepository({
   snapshotDir,