release-skill 0.9.24 → 0.9.25

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.24.",
+      "Prepare a release plan for version 0.9.25.",
       "Help me understand the release workflow."
     ]
   }

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.qoder-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.9.25 locale=en baseline=sha256:7251718ad92327e37679d4db09d19657ea13f51a5720aa33369181fe5ddb3bbe -->
+## [0.9.25] - 2026-10-12
+
+0.9.25 is a local source candidate. It fixes a RangeError in public-file inspection when one scan root contains 128197 files. The three Foundation dependencies remain pinned to 0.22.0. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- Existing safety boundaries are unchanged: Hub publication remains a compare-and-swap operation bound to the observed branch head. Partial Hub publication is never rolled back or force-pushed automatically, and completed steps are not overwritten.
+
+### Changed
+
+- The distribution path is unchanged: Skill Family Hub remains the central marketplace, and its entry is still updated through the existing GitHub Git Data API after release verification.
+
+### Fixed
+
+- Public-file inspection now appends files individually to avoid passing too many arguments in one call and interrupting release preparation. Scan order, file identities, public-file mappings, and include/exclude classification policy remain unchanged. A regression test runs the real scanning, classification, and mapping logic with 128197 in-memory directory entries. It reproduced the RangeError at the same location in the old implementation and passes after the fix; it does not create that many files on disk.
+
+### Upgrade Notes
+
+No configuration migration is required. Installations still using the old release-skill standalone marketplace should remove it and use the ifoohoo/skill-family-hub repository with the Hub-qualified plugin id release-skill@skill-family-hub; this migration path is unchanged. This note does not replace execution evidence for the full release gates, publication, consumer installation, host loading, or independent acceptance.
+<!-- release-skill:changelog:end version=0.9.25 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.9.24 locale=en baseline=sha256:17152a17c71bea35445f03040022e41c7fb5a77be0024c049f96d3fb6b0053bb -->
 ## [0.9.24] - 2026-10-02
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.24 -->
+<!-- release-skill:release-version: 0.9.25 -->
 ## Prerequisites
 
 - Node.js `>=22.22.2 <23` (22.22.2 or newer, and below 23)
@@ -125,7 +125,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.24
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.25
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.24 -->
+<!-- release-skill:release-version: 0.9.25 -->
 ## 前置条件
 
 - Node.js `>=22.22.2 <23`（22.22.2 及以上，且低于 23）
@@ -113,7 +113,7 @@ release-skill 当前只采用并验证 Kimi Code 的交互式 TUI 路径，**无
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.24
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.25
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.24 -->
+<!-- release-skill:release-version: 0.9.25 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,34 +14,29 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.24** (2026-10-02)
+**0.9.25** (2026-10-12)
 
-0.9.24 is a local source candidate. Production prepare no longer deletes run directories. captureBaseline accepts a git status listing up to 64 MiB. Frozen commit dates treat a Git Z reading and the plan +00:00 form as the same UTC instant before comparison. The three Foundation dependencies stay pinned to 0.22.0. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+0.9.25 is a local source candidate. It fixes a RangeError in public-file inspection when one scan root contains 128197 files. The three Foundation dependencies remain pinned to 0.22.0. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
 
 **Security**
 
-- Hub publication remains a compare-and-swap operation bound to the observed branch head. A partial Hub publication is never rolled back or force-pushed automatically.
+- Existing safety boundaries are unchanged: Hub publication remains a compare-and-swap operation bound to the observed branch head. Partial Hub publication is never rolled back or force-pushed automatically, and completed steps are not overwritten.
 
 **Changed**
 
-- Skill Family Hub remains the central marketplace. After release verification, its release entry still uses the existing GitHub Git Data API through the postVerify Hook.
-
-**Removed**
-
-- Production prepare no longer runs the run-retention cleanup. It keeps the directories already present under .release-skill/runs/, including sealed failed prepares and finished lineages. src/core/run-retention.mjs is not part of the public file list.
+- The distribution path is unchanged: Skill Family Hub remains the central marketplace, and its entry is still updated through the existing GitHub Git Data API after release verification.
 
 **Fixed**
 
-- captureBaseline reads git status with a 64 MiB maxBuffer, the same bound computeWorkspaceDigest already uses. A status listing larger than Node's default 1 MiB no longer fails that capture.
-- Frozen commit verification still requires the author and committer instants to equal the plan freeze timestamp. Git may return the same UTC instant as Z, and the plan form stays +00:00. Both sides pass through normalizeGitTimestamp before comparison. A different instant still fails.
+- Public-file inspection now appends files individually to avoid passing too many arguments in one call and interrupting release preparation. Scan order, file identities, public-file mappings, and include/exclude classification policy remain unchanged. A regression test runs the real scanning, classification, and mapping logic with 128197 in-memory directory entries. It reproduced the RangeError at the same location in the old implementation and passes after the fix; it does not create that many files on disk.
 
 **Upgrade Notes**
 
-Compared with 0.9.23, this candidate needs no configuration migration. Prepare no longer reclaims disk by deleting old run directories; those directories remain until an operator removes them outside this command. An installation still using the old release-skill standalone marketplace should remove it and use the ifoohoo/skill-family-hub repository with the Hub-qualified plugin id release-skill@skill-family-hub. This file describes the local source candidate. Publication, host loading, and acceptance remain separate later authorizations.
+No configuration migration is required. Installations still using the old release-skill standalone marketplace should remove it and use the ifoohoo/skill-family-hub repository with the Hub-qualified plugin id release-skill@skill-family-hub; this migration path is unchanged. This note does not replace execution evidence for the full release gates, publication, consumer installation, host loading, or independent acceptance.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.9.24 is the current source candidate. This README
+> **Current boundary:** v0.9.25 is the current source candidate. This README
 > records intended scope and verification boundaries; it is not evidence of
 > publication, consumer-installation verification, or independent acceptance.
 > Release availability must be established from the corresponding release records
@@ -65,7 +60,7 @@ Compared with 0.9.23, this candidate needs no configuration migration. Prepare n
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.9.24 is the current
+> **Production path verified since the v0.1.1 milestone; v0.9.25 is the current
 > source candidate. Its README does not establish publication,
 > consumer-installation verification, or independent acceptance.**
 > The npm-installed CLI is the supported user entry. Source checkout
@@ -98,7 +93,7 @@ checkpoints remain intact and use matching-version recovery. Evidence v1 stays
 read-only; v2 uses a closed top level with phase extensions in `details`.
 Summaries and recovery suggestions are diagnostic, never publication authority.
 
-The current 0.9.24 candidate includes the narrow R-05 Hook cache v2 consumer
+The current 0.9.25 candidate includes the narrow R-05 Hook cache v2 consumer
 path, the public `postverify` path, and the stable isolated install-tree record
 path (A2/A3). It also adds the explicit-input `verify-records` command and a
 self-contained Qoder projection, first-class Cursor packaging, and the

package/README.zh-CN.md

@@ -2,40 +2,35 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.24 -->
+<!-- release-skill:release-version: 0.9.25 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.24** (2026-10-02)
+**0.9.25** (2026-10-12)
 
-0.9.24 是一个本地源码候选。生产 prepare 不再删除运行目录。captureBaseline 可以接收不超过 64 MiB 的 git status 列表。冻结提交日期在比较前把 Git 读出的 Z 与计划中的 +00:00 视为同一 UTC 时刻。Foundation 三个依赖继续固定为 0.22.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
+0.9.25 是一个本地源码候选。本次修复公开文件检查在单个扫描根含 128197 个文件时触发的 RangeError。Foundation 三个依赖继续固定为 0.22.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
 
 **安全**
 
-- Hub 发布仍绑定已观察的分支头执行比较后写入。部分发布时不回滚、不覆盖已成功的远端步骤，也不自动强推。
+- 既有安全边界保持不变：Hub 写入继续绑定已观察的分支头，按 compare-and-swap 比较后写入。部分发布时不回滚、不覆盖已成功步骤，也不自动强推。
 
 **变更**
 
-- Skill Family Hub 继续作为统一市场。发布验证完成后，postVerify Hook 仍使用既有 GitHub Git Data API 更新 Hub 的发布条目。
-
-**移除**
-
-- 生产 prepare 不再执行 run-retention 清理。它保留 .release-skill/runs/ 中已有的目录，包括封口失败的 prepare 和已经结束的谱系。src/core/run-retention.mjs 不再属于公开文件清单。
+- 分发路径保持不变：Skill Family Hub 仍是统一市场，发布验证完成后，仍通过既有 GitHub Git Data API 更新 Hub 条目。
 
 **修复**
 
-- captureBaseline 读取 git status 时使用 64 MiB maxBuffer，与 computeWorkspaceDigest 已有的上限相同。状态列表超过 Node 默认的 1 MiB 时，这次采集不再因此失败。
-- 冻结提交校验仍要求作者和提交者时刻等于计划冻结时间。Git 可能把同一 UTC 时刻读成 Z，计划形式仍是 +00:00。两边都先经过 normalizeGitTimestamp 再比较。不同的时刻仍然失败。
+- 公开文件检查改为逐项追加，避免一次调用传入过多参数而阻断发布准备；原扫描顺序、文件身份、公开文件映射及包含/排除分类策略保持不变。新增回归用 128197 个内存目录项执行真实扫描、分类和映射逻辑，在旧实现上精确复现同位置的 RangeError，修复后通过；该回归没有创建同等规模的真实磁盘文件。
 
 **升级说明**
 
-本候选相对 0.9.23 无需迁移配置。prepare 不再通过删除旧运行目录回收磁盘；这些目录会保留，直到操作者在该命令之外移除。若安装仍使用独立的 `release-skill` 市场，应将其移除，改用 ifoohoo/skill-family-hub 仓库与 Hub 限定插件名 release-skill@skill-family-hub。本文件只说明本地源码候选；正式发布、宿主加载和验收留待后续单独授权。
+升级无需迁移配置。若仍使用旧版独立的 `release-skill` 市场，应移除旧市场，改用 ifoohoo/skill-family-hub 仓库与 Hub 限定插件名 release-skill@skill-family-hub；这条迁移路径保持不变。本说明不能代替完整发布门禁、正式发布、消费者安装、宿主加载或独立验收的实际证据。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.9.24 只是当前源码候选。本 README 记录预期范围与验证边界，
+> **当前边界：** v0.9.25 只是当前源码候选。本 README 记录预期范围与验证边界，
 > 不代表已经发布、完成消费者安装验证或通过独立验收。
 > 版本可用性以对应发布记录及发布后验证结果为准。
 > v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
@@ -51,7 +46,7 @@ release-skill 帮助维护者回答三个问题：准备发布什么、还有哪
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.24 是当前源码候选，本 README 不证明该候选已经发布、完成消费者安装验证或通过独立验收。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.25 是当前源码候选，本 README 不证明该候选已经发布、完成消费者安装验证或通过独立验收。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
@@ -73,7 +68,7 @@ marketplace 委托目标工作区发布的边界不变。
 
 旧 production 计划缺少 `sourceAuthority` 时，在外部写入前拒绝。未发生外部写入的计划必须重新 prepare 并批准新摘要，不能补写旧计划或迁移批准。已有 `PARTIAL` 保留检查点，走匹配版本的恢复路径。evidence v1 只读；v2 顶层封闭，阶段扩展放在 `details`。摘要和恢复建议只作诊断，不构成发布权威。
 
-当前 0.9.24 候选包含窄范围的 R-05 Hook cache v2 消费路径、公开 `postverify`
+当前 0.9.25 候选包含窄范围的 R-05 Hook cache v2 消费路径、公开 `postverify`
 路径和稳定隔离安装树记录路径（A2/A3），并增加只接受显式输入的 `verify-records`
 命令、自包含 Qoder 投影、Cursor 正式打包，以及基于 Foundation 的宿主核验桥。
 Skill Family Hub 仍是唯一市场来源。

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.24"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.25"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "0bb99087b65e06d81cc887e899c16ab8964ff5994530881b36007cfce6a3f428";
+const __bundleSourceDigest = "42145a246d5fd5adff3a1218e94fbfc06df377290431628aa3270e2414b8183e";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -50175,7 +50175,7 @@ async function inspectExpectedPublicSurface({ root, unit } = {}) {
   let skippedNonRegularCount = 0;
   for (const rule of resolvedRoots) {
     const observed = await scanRoot({ workspaceRoot, unit, rule });
-    observedFiles.push(...observed.files);
+    for (const file of observed.files) observedFiles.push(file);
     skippedNonRegularCount += observed.skippedNonRegularCount;
   }
   const includedByIdentity = /* @__PURE__ */ new Map();

package/adapters/claude/skills/release-help/SKILL.md

@@ -29,9 +29,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.24 候选边界
+## 0.9.25 候选边界
 
-当前 0.9.24 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.24 仍是源码候选，不能从本说明推断已批准、发布或验证。
+当前 0.9.25 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.25 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
 

package/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.24.",
+      "Prepare a release plan for version 0.9.25.",
       "Help me understand the release workflow."
     ]
   }

package/adapters/codex/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.24"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.25"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "0bb99087b65e06d81cc887e899c16ab8964ff5994530881b36007cfce6a3f428";
+const __bundleSourceDigest = "42145a246d5fd5adff3a1218e94fbfc06df377290431628aa3270e2414b8183e";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -50175,7 +50175,7 @@ async function inspectExpectedPublicSurface({ root, unit } = {}) {
   let skippedNonRegularCount = 0;
   for (const rule of resolvedRoots) {
     const observed = await scanRoot({ workspaceRoot, unit, rule });
-    observedFiles.push(...observed.files);
+    for (const file of observed.files) observedFiles.push(file);
     skippedNonRegularCount += observed.skippedNonRegularCount;
   }
   const includedByIdentity = /* @__PURE__ */ new Map();

package/adapters/codex/skills/release-help/SKILL.md

@@ -37,9 +37,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.24 候选边界
+## 0.9.25 候选边界
 
-当前 0.9.24 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.24 仍是源码候选，不能从本说明推断已批准、发布或验证。
+当前 0.9.25 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.25 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
 

package/adapters/cursor/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/cursor/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.24"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.25"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "0bb99087b65e06d81cc887e899c16ab8964ff5994530881b36007cfce6a3f428";
+const __bundleSourceDigest = "42145a246d5fd5adff3a1218e94fbfc06df377290431628aa3270e2414b8183e";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -50175,7 +50175,7 @@ async function inspectExpectedPublicSurface({ root, unit } = {}) {
   let skippedNonRegularCount = 0;
   for (const rule of resolvedRoots) {
     const observed = await scanRoot({ workspaceRoot, unit, rule });
-    observedFiles.push(...observed.files);
+    for (const file of observed.files) observedFiles.push(file);
     skippedNonRegularCount += observed.skippedNonRegularCount;
   }
   const includedByIdentity = /* @__PURE__ */ new Map();

package/adapters/cursor/skills/release-help/SKILL.md

@@ -38,9 +38,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.24 候选边界
+## 0.9.25 候选边界
 
-当前 0.9.24 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.24 仍是源码候选，不能从本说明推断已批准、发布或验证。
+当前 0.9.25 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.25 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
 

package/adapters/kimi/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/kimi/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.24"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.25"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "0bb99087b65e06d81cc887e899c16ab8964ff5994530881b36007cfce6a3f428";
+const __bundleSourceDigest = "42145a246d5fd5adff3a1218e94fbfc06df377290431628aa3270e2414b8183e";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -50175,7 +50175,7 @@ async function inspectExpectedPublicSurface({ root, unit } = {}) {
   let skippedNonRegularCount = 0;
   for (const rule of resolvedRoots) {
     const observed = await scanRoot({ workspaceRoot, unit, rule });
-    observedFiles.push(...observed.files);
+    for (const file of observed.files) observedFiles.push(file);
     skippedNonRegularCount += observed.skippedNonRegularCount;
   }
   const includedByIdentity = /* @__PURE__ */ new Map();

package/adapters/kimi/skills/release-help/SKILL.md

@@ -37,9 +37,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.24 候选边界
+## 0.9.25 候选边界
 
-当前 0.9.24 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.24 仍是源码候选，不能从本说明推断已批准、发布或验证。
+当前 0.9.25 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.25 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
 

package/adapters/qoder/.qoder-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/qoder/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.24"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.25"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "0bb99087b65e06d81cc887e899c16ab8964ff5994530881b36007cfce6a3f428";
+const __bundleSourceDigest = "42145a246d5fd5adff3a1218e94fbfc06df377290431628aa3270e2414b8183e";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -50175,7 +50175,7 @@ async function inspectExpectedPublicSurface({ root, unit } = {}) {
   let skippedNonRegularCount = 0;
   for (const rule of resolvedRoots) {
     const observed = await scanRoot({ workspaceRoot, unit, rule });
-    observedFiles.push(...observed.files);
+    for (const file of observed.files) observedFiles.push(file);
     skippedNonRegularCount += observed.skippedNonRegularCount;
   }
   const includedByIdentity = /* @__PURE__ */ new Map();

package/adapters/qoder/skills/release-help/SKILL.md

@@ -37,9 +37,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.24 候选边界
+## 0.9.25 候选边界
 
-当前 0.9.24 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.24 仍是源码候选，不能从本说明推断已批准、发布或验证。
+当前 0.9.25 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.25 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
 

package/adapters/workbuddy/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/workbuddy/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.24"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.25"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "0bb99087b65e06d81cc887e899c16ab8964ff5994530881b36007cfce6a3f428";
+const __bundleSourceDigest = "42145a246d5fd5adff3a1218e94fbfc06df377290431628aa3270e2414b8183e";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -50175,7 +50175,7 @@ async function inspectExpectedPublicSurface({ root, unit } = {}) {
   let skippedNonRegularCount = 0;
   for (const rule of resolvedRoots) {
     const observed = await scanRoot({ workspaceRoot, unit, rule });
-    observedFiles.push(...observed.files);
+    for (const file of observed.files) observedFiles.push(file);
     skippedNonRegularCount += observed.skippedNonRegularCount;
   }
   const includedByIdentity = /* @__PURE__ */ new Map();

package/adapters/workbuddy/skills/release-help/SKILL.md

@@ -29,9 +29,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.24 候选边界
+## 0.9.25 候选边界
 
-当前 0.9.24 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.24 仍是源码候选，不能从本说明推断已批准、发布或验证。
+当前 0.9.25 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.25 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
 

package/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.24"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.25"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "0bb99087b65e06d81cc887e899c16ab8964ff5994530881b36007cfce6a3f428";
+const __bundleSourceDigest = "42145a246d5fd5adff3a1218e94fbfc06df377290431628aa3270e2414b8183e";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -50175,7 +50175,7 @@ async function inspectExpectedPublicSurface({ root, unit } = {}) {
   let skippedNonRegularCount = 0;
   for (const rule of resolvedRoots) {
     const observed = await scanRoot({ workspaceRoot, unit, rule });
-    observedFiles.push(...observed.files);
+    for (const file of observed.files) observedFiles.push(file);
     skippedNonRegularCount += observed.skippedNonRegularCount;
   }
   const includedByIdentity = /* @__PURE__ */ new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/platform-manifest.json

@@ -2,11 +2,11 @@
   "schemaVersion": "1.0.0",
   "platformId": "release-skill",
   "platformName": "release-skill Plugin Platform",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "logicalRoot": "skills-src/",
-  "logicalRootDigest": "762afbc4f52bf04e3550f934b0576911a9d4dd4ca2e7cd074cc56a5560d5f30c",
-  "projectionDigest": "c5e28d2853b4cc2281944f3e4aa44bcdc86b68e5a34571e1b7ee4f8a8a21dd9a",
-  "projectionId": "release-skill:platform:0.9.24",
+  "logicalRootDigest": "7b62f9ded9aea774298ad86a781d58ad83f4092f3c3220b4a75dfe11ad19f809",
+  "projectionDigest": "bb92d4a3f57842000aa404a0698c5e38c111f05408027491e0904912af81d716",
+  "projectionId": "release-skill:platform:0.9.25",
   "manifestRequired": true,
   "projectionSources": {
     "skills-src-root": {

package/skills/release-help/SKILL.md

@@ -29,9 +29,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.24 候选边界
+## 0.9.25 候选边界
 
-当前 0.9.24 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.24 仍是源码候选，不能从本说明推断已批准、发布或验证。
+当前 0.9.25 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.25 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
 

package/skills-src/release-help/SKILL.md

@@ -29,9 +29,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.24 候选边界
+## 0.9.25 候选边界
 
-当前 0.9.24 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.24 仍是源码候选，不能从本说明推断已批准、发布或验证。
+当前 0.9.25 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.25 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
 

package/src/core/public-surface.mjs

@@ -437,7 +437,7 @@ export async function inspectExpectedPublicSurface({ root, unit } = {}) {
   let skippedNonRegularCount = 0;
   for (const rule of resolvedRoots) {
     const observed = await scanRoot({ workspaceRoot, unit, rule });
-    observedFiles.push(...observed.files);
+    for (const file of observed.files) observedFiles.push(file);
     skippedNonRegularCount += observed.skippedNonRegularCount;
   }