release-skill 0.9.25 → 0.9.27

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.25.",
+      "Prepare a release plan for version 0.9.27.",
       "Help me understand the release workflow."
     ]
   }

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.qoder-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.9.27 locale=en baseline=sha256:69bb1c474b2b31ec80eead86837455a7ec3b128baa671245db12cf509fa53a5b -->
+## [0.9.27] - 2026-10-13
+
+0.9.27 fixes Kimi local-host observation when a managed plugin root contains kimi.plugin.json and no package.json. The WorkBuddy lite-wb selector remains the 0.9.26 fix and is not part of this version. The three Foundation dependencies remain pinned to 0.22.0. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- Existing safety boundaries are unchanged: Hub publication remains a compare-and-swap operation bound to the observed branch head. Partial Hub publication is never rolled back or force-pushed automatically, and completed steps are not overwritten.
+- Approval, publication, post-publication verification, consumer installation, real-host loading, and independent acceptance still require their own actual records. This note does not prove any of those outcomes. Reading a Kimi plugin manifest does not establish authentication or real-host qualification.
+
+### Changed
+
+- The distribution path is unchanged: Skill Family Hub remains the central marketplace, and its entry is still updated through the existing GitHub Git Data API after release verification.
+- The WorkBuddy CODEBUDDY_FORCE_LITE_WB_BUNDLE selector shipped in 0.9.26. This version does not change that selector.
+
+### Fixed
+
+- Kimi local host observation still reads package.json when that file is present, and that path is unchanged. When the read fails with the existing missing-resource or ENOENT shape, observation reads kimi.plugin.json in the same managed root and uses its name and version in the existing identity comparison, together with the GitHub tag ref and installed SHA from installed.json. A missing kimi.plugin.json still fails closed. Declared-root checks, tag ref handling, installed SHA handling, and git HEAD comparison stay as they are. This fallback does not add package.json to any Kimi projection.
+
+### Upgrade Notes
+
+For consumers already using Skill Family Hub, no configuration migration is required. Installations still using the old release-skill standalone marketplace should remove it and use the ifoohoo/skill-family-hub repository with the Hub-qualified plugin id release-skill@skill-family-hub; this migration path is unchanged. The existing --unit release-selection contract is unchanged.
+<!-- release-skill:changelog:end version=0.9.27 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.9.26 locale=en baseline=sha256:233636f011ef5211286935424f64ef11eb1170dc297f40a2dd65e6572c459bb0 -->
+## [0.9.26] - 2026-10-12
+
+0.9.26 corrects wording that treated the current installed version as permanently a source candidate. It also makes existing WorkBuddy CLI calls in local host updates select the official lite-wb bundle. The three Foundation dependencies remain pinned to 0.22.0. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- Existing safety boundaries are unchanged: Hub publication remains a compare-and-swap operation bound to the observed branch head. Partial Hub publication is never rolled back or force-pushed automatically, and completed steps are not overwritten.
+- Approval, publication, post-publication verification, consumer installation, real-host loading, and independent acceptance still require their own actual records. This note does not prove any of those outcomes. Selecting the WorkBuddy bundle does not establish authentication or real-host qualification.
+
+### Changed
+
+- The distribution path is unchanged: Skill Family Hub remains the central marketplace, and its entry is still updated through the existing GitHub Git Data API after release verification.
+
+### Fixed
+
+- The help and prepare skills, both READMEs, and README acceptance prompts describe capabilities and evidence boundaries without assigning a permanent candidate status to the current version. Version synchronization retains necessary version references without restoring that status assertion. Existing regression checks cover these boundaries.
+- The WorkBuddy branch of local host update commands sets CODEBUDDY_FORCE_LITE_WB_BUNDLE=1 to select the official lite-wb bundle. Other hosts do not receive this selector. Existing authentication filtering, exact-source checks, and fail-closed behavior remain in place.
+
+### Upgrade Notes
+
+For consumers already using Skill Family Hub, no configuration migration is required. Installations still using the old release-skill standalone marketplace should remove it and use the ifoohoo/skill-family-hub repository with the Hub-qualified plugin id release-skill@skill-family-hub; this migration path is unchanged. The existing --unit release-selection contract is unchanged. This update adds no automatic first-time installation capability and does not change the existing MANUAL_REQUIRED boundary.
+<!-- release-skill:changelog:end version=0.9.26 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.9.25 locale=en baseline=sha256:7251718ad92327e37679d4db09d19657ea13f51a5720aa33369181fe5ddb3bbe -->
 ## [0.9.25] - 2026-10-12
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.25 -->
+<!-- release-skill:release-version: 0.9.27 -->
 ## Prerequisites
 
 - Node.js `>=22.22.2 <23` (22.22.2 or newer, and below 23)
@@ -125,7 +125,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.25
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.27
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.25 -->
+<!-- release-skill:release-version: 0.9.27 -->
 ## 前置条件
 
 - Node.js `>=22.22.2 <23`（22.22.2 及以上，且低于 23）
@@ -113,7 +113,7 @@ release-skill 当前只采用并验证 Kimi Code 的交互式 TUI 路径，**无
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.25
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.27
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.25 -->
+<!-- release-skill:release-version: 0.9.27 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,30 +14,32 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.25** (2026-10-12)
+**0.9.27** (2026-10-13)
 
-0.9.25 is a local source candidate. It fixes a RangeError in public-file inspection when one scan root contains 128197 files. The three Foundation dependencies remain pinned to 0.22.0. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+0.9.27 fixes Kimi local-host observation when a managed plugin root contains kimi.plugin.json and no package.json. The WorkBuddy lite-wb selector remains the 0.9.26 fix and is not part of this version. The three Foundation dependencies remain pinned to 0.22.0. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
 
 **Security**
 
 - Existing safety boundaries are unchanged: Hub publication remains a compare-and-swap operation bound to the observed branch head. Partial Hub publication is never rolled back or force-pushed automatically, and completed steps are not overwritten.
+- Approval, publication, post-publication verification, consumer installation, real-host loading, and independent acceptance still require their own actual records. This note does not prove any of those outcomes. Reading a Kimi plugin manifest does not establish authentication or real-host qualification.
 
 **Changed**
 
 - The distribution path is unchanged: Skill Family Hub remains the central marketplace, and its entry is still updated through the existing GitHub Git Data API after release verification.
+- The WorkBuddy CODEBUDDY_FORCE_LITE_WB_BUNDLE selector shipped in 0.9.26. This version does not change that selector.
 
 **Fixed**
 
-- Public-file inspection now appends files individually to avoid passing too many arguments in one call and interrupting release preparation. Scan order, file identities, public-file mappings, and include/exclude classification policy remain unchanged. A regression test runs the real scanning, classification, and mapping logic with 128197 in-memory directory entries. It reproduced the RangeError at the same location in the old implementation and passes after the fix; it does not create that many files on disk.
+- Kimi local host observation still reads package.json when that file is present, and that path is unchanged. When the read fails with the existing missing-resource or ENOENT shape, observation reads kimi.plugin.json in the same managed root and uses its name and version in the existing identity comparison, together with the GitHub tag ref and installed SHA from installed.json. A missing kimi.plugin.json still fails closed. Declared-root checks, tag ref handling, installed SHA handling, and git HEAD comparison stay as they are. This fallback does not add package.json to any Kimi projection.
 
 **Upgrade Notes**
 
-No configuration migration is required. Installations still using the old release-skill standalone marketplace should remove it and use the ifoohoo/skill-family-hub repository with the Hub-qualified plugin id release-skill@skill-family-hub; this migration path is unchanged. This note does not replace execution evidence for the full release gates, publication, consumer installation, host loading, or independent acceptance.
+For consumers already using Skill Family Hub, no configuration migration is required. Installations still using the old release-skill standalone marketplace should remove it and use the ifoohoo/skill-family-hub repository with the Hub-qualified plugin id release-skill@skill-family-hub; this migration path is unchanged. The existing --unit release-selection contract is unchanged.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.9.25 is the current source candidate. This README
-> records intended scope and verification boundaries; it is not evidence of
+> **Current boundary:** v0.9.27: this README records capabilities and verification boundaries;
+> it is not evidence of
 > publication, consumer-installation verification, or independent acceptance.
 > Release availability must be established from the corresponding release records
 > and post-publish verification results.
@@ -60,9 +62,9 @@ No configuration migration is required. Installations still using the old releas
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.9.25 is the current
-> source candidate. Its README does not establish publication,
-> consumer-installation verification, or independent acceptance.**
+> **Production path verified since the v0.1.1 milestone; for v0.9.27,
+> publication, consumer-installation verification, and independent acceptance
+> require version-specific release records and verification results.**
 > The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >
@@ -93,18 +95,17 @@ checkpoints remain intact and use matching-version recovery. Evidence v1 stays
 read-only; v2 uses a closed top level with phase extensions in `details`.
 Summaries and recovery suggestions are diagnostic, never publication authority.
 
-The current 0.9.25 candidate includes the narrow R-05 Hook cache v2 consumer
+release-skill includes the narrow R-05 Hook cache v2 consumer
 path, the public `postverify` path, and the stable isolated install-tree record
-path (A2/A3). It also adds the explicit-input `verify-records` command and a
+path (A2/A3). It also includes the explicit-input `verify-records` command and a
 self-contained Qoder projection, first-class Cursor packaging, and the
 Foundation-backed host verification bridge. Skill Family Hub remains the single
-marketplace source. The candidate
-also makes the `release-prepare` Skill organize existing assessment, refresh,
+marketplace source. The `release-prepare` Skill organizes existing assessment, refresh,
 focused-check, and prepare entry points without adding another execution
 engine. `prepare --help` and `prepare -h` now return before configuration,
 locks, runs, or hooks can observe the request. The `release-finish` Skill can
 also report the source branch and continue into a configured setup entry after
-the selected host has loaded the released plugin. This candidate still excludes
+the selected host has loaded the released plugin. This scope still excludes
 R-02 safe full-tree inventory. Marketplace installation and live invocation
 remain host-level post-release checks; Cursor is distributed through its
 supported local-plugin directory rather than a Hub marketplace entry.

package/README.zh-CN.md

@@ -2,51 +2,53 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.25 -->
+<!-- release-skill:release-version: 0.9.27 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.25** (2026-10-12)
+**0.9.27** (2026-10-13)
 
-0.9.25 是一个本地源码候选。本次修复公开文件检查在单个扫描根含 128197 个文件时触发的 RangeError。Foundation 三个依赖继续固定为 0.22.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
+0.9.27 修复 Kimi 本机宿主观察：受管插件根只有 kimi.plugin.json、没有 package.json 时不再失败。WorkBuddy 的 lite-wb 选择器修复已在 0.9.26 完成，不属于本版。Foundation 三个依赖继续固定为 0.22.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
 
 **安全**
 
 - 既有安全边界保持不变：Hub 写入继续绑定已观察的分支头，按 compare-and-swap 比较后写入。部分发布时不回滚、不覆盖已成功步骤，也不自动强推。
+- 批准、发布、发布后验证、消费者安装、真实宿主加载和独立验收仍分别需要实际记录。本说明不能证明这些结果，读取 Kimi 插件清单也不能证明认证已成立或真实宿主资格已经通过。
 
 **变更**
 
-- 分发路径保持不变：Skill Family Hub 仍是统一市场，发布验证完成后，仍通过既有 GitHub Git Data API 更新 Hub 条目。
+- 分发路径保持不变：Skill Family Hub 仍是统一市场；发布验证完成后，Hub 条目仍通过既有 GitHub Git Data API 更新。
+- WorkBuddy 的 CODEBUDDY_FORCE_LITE_WB_BUNDLE 选择器已随 0.9.26 交付，本版不改动该选择器。
 
 **修复**
 
-- 公开文件检查改为逐项追加，避免一次调用传入过多参数而阻断发布准备；原扫描顺序、文件身份、公开文件映射及包含/排除分类策略保持不变。新增回归用 128197 个内存目录项执行真实扫描、分类和映射逻辑，在旧实现上精确复现同位置的 RangeError，修复后通过；该回归没有创建同等规模的真实磁盘文件。
+- Kimi 本机宿主观察在 package.json 存在时仍读取该文件，这条路径保持不变。读取失败且错误属于既有 missing-resource 或 ENOENT 形态时，改为读取同一受管根下的 kimi.plugin.json，并用其 name 与 version 参加既有身份比较，同时继续使用 installed.json 中的 GitHub tag ref 与 installedSha。kimi.plugin.json 同样缺失时仍按原错误失败关闭。声明根检查、tag ref、installedSha 与 git HEAD 比较逻辑不变。该回退不会给任何 Kimi 投影补上 package.json。
 
 **升级说明**
 
-升级无需迁移配置。若仍使用旧版独立的 `release-skill` 市场，应移除旧市场，改用 ifoohoo/skill-family-hub 仓库与 Hub 限定插件名 release-skill@skill-family-hub；这条迁移路径保持不变。本说明不能代替完整发布门禁、正式发布、消费者安装、宿主加载或独立验收的实际证据。
+已使用 Skill Family Hub 的消费者升级时无需迁移配置。若仍使用旧版独立的 `release-skill` 市场，应移除旧市场，改用 ifoohoo/skill-family-hub 仓库与 Hub 限定插件名 release-skill@skill-family-hub；这条迁移路径保持不变。既有 --unit 选择合同保持不变。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.9.25 只是当前源码候选。本 README 记录预期范围与验证边界，
+> **当前边界：** v0.9.27 的能力范围与验证边界见本 README，
 > 不代表已经发布、完成消费者安装验证或通过独立验收。
 > 版本可用性以对应发布记录及发布后验证结果为准。
 > v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
-> v0.1.1 已完成 GitHub 与 npm 的
-> 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
-> 安装及 Claude/Codex 消费者安装验证；"当前发布版本"与"首次生产验证里程碑"
-> 是两个不同的事实，不得混写成同一含义。同一工作流还通过了本地
-> 生产等价协议套件：测试运行真实 release-skill CLI 和冻结制品，Git 目标是
-> 本地 bare remote，`gh`、`npm`、Claude、Codex 使用协议级 fake。该套件没有
+> v0.1.1 已完成 GitHub 与 npm 的真实生产发布，是首次生产验证的历史里程碑。
+> 该版本还从冻结 Git ref 完成精确 npm 安装及 Claude/Codex 消费者安装验证。
+> “当前发布版本”与“首次生产验证里程碑”是两个不同的事实，不能混为一谈。
+> 同一工作流还通过了本地生产等价协议套件：测试使用真实 release-skill CLI 和
+> 冻结制品，Git 目标为本地 bare remote，`gh`、`npm`、Claude、Codex 使用
+> 协议级 fake。该套件没有
 > 提供 OS 级网络隔离，也不能证明其他项目的认证、权限、限流和最终一致性行为
 > 与本次发布相同；每个项目的第一次生产发布仍应作为受监控 canary。
 > `prepare --online` 观察 bound 前序公开基线，漂移或不可观察时失败关闭；
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.25 是当前源码候选，本 README 不证明该候选已经发布、完成消费者安装验证或通过独立验收。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.27 的发布、消费者安装验证和独立验收状态须由该版本的发布记录及验证结果确认。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
@@ -68,8 +70,8 @@ marketplace 委托目标工作区发布的边界不变。
 
 旧 production 计划缺少 `sourceAuthority` 时，在外部写入前拒绝。未发生外部写入的计划必须重新 prepare 并批准新摘要，不能补写旧计划或迁移批准。已有 `PARTIAL` 保留检查点，走匹配版本的恢复路径。evidence v1 只读；v2 顶层封闭，阶段扩展放在 `details`。摘要和恢复建议只作诊断，不构成发布权威。
 
-当前 0.9.25 候选包含窄范围的 R-05 Hook cache v2 消费路径、公开 `postverify`
-路径和稳定隔离安装树记录路径（A2/A3），并增加只接受显式输入的 `verify-records`
+release-skill 包含窄范围的 R-05 Hook cache v2 消费路径、公开 `postverify`
+路径和稳定隔离安装树记录路径（A2/A3），还包含只接受显式输入的 `verify-records`
 命令、自包含 Qoder 投影、Cursor 正式打包，以及基于 Foundation 的宿主核验桥。
 Skill Family Hub 仍是唯一市场来源。
 `release-prepare` Skill 现在会组织项目已有的评估、刷新、聚焦检查和 prepare 入口，不新增执行引擎。

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.25"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.27"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "42145a246d5fd5adff3a1218e94fbfc06df377290431628aa3270e2414b8183e";
+const __bundleSourceDigest = "25d576aeb1a7c01598399f326190124dbdd91b562e32ad4d9a532e3399654151";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -135457,6 +135457,7 @@ function hostEnvironment(host, { kimiHome } = {}) {
   if (host === "workbuddy") {
     env.CODEBUDDY_CONFIG_DIR = join29(env.HOME, ".workbuddy");
     env.WORKBUDDY_CONFIG_DIR = join29(env.HOME, ".workbuddy");
+    env.CODEBUDDY_FORCE_LITE_WB_BUNDLE = "1";
   }
   if (host === "kimi" && kimiHome) env.KIMI_CODE_HOME = kimiHome;
   return env;
@@ -136644,10 +136645,17 @@ async function observeKimiTarget(target, kimiHome, run6) {
   const pluginRoot = await resolveContained(managedRoot, target.plugin);
   const declaredRoot = await resolveContained(managedRoot, relative28(managedRoot, entry.root));
   if (declaredRoot !== pluginRoot) throw new Error("Kimi installed plugin root does not match its managed root");
-  const packageJson = parseJson2(
-    await readFileContained(pluginRoot, "package.json", { encoding: "utf8" }),
-    "Kimi installed package manifest"
-  );
+  let manifestText;
+  let manifestLabel = "Kimi installed package manifest";
+  try {
+    manifestText = await readFileContained(pluginRoot, "package.json", { encoding: "utf8" });
+  } catch (error) {
+    const missing = error?.code === "ENOENT" || error?.details?.causeCode === "ENOENT" || error?.details?.kind === "missing-resource";
+    if (!missing) throw error;
+    manifestLabel = "Kimi installed plugin manifest";
+    manifestText = await readFileContained(pluginRoot, "kimi.plugin.json", { encoding: "utf8" });
+  }
+  const packageJson = parseJson2(manifestText, manifestLabel);
   const refName = entry.github.ref?.kind === "tag" ? entry.github.ref.value : void 0;
   const revision = entry.github.installedSha;
   let gitHeadExact = true;

package/adapters/claude/skills/release-help/SKILL.md

@@ -29,15 +29,17 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.25 候选边界
+## 0.9.27 能力与证据边界
 
-当前 0.9.25 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.25 仍是源码候选，不能从本说明推断已批准、发布或验证。
+release-skill 0.9.27 精确依赖 Foundation 0.22.0 的公开包根 API。本版修复 Kimi 本机宿主观察：受管插件根只有 kimi.plugin.json、没有 package.json 时不再失败。本节说明当前版本的能力范围与证据边界；批准、发布和验证状态以对应计划、批准及执行记录为准，不能由本说明推断。
 
-冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
+在冻结前，`prepare` 或新建 `ship` 状态时可重复传入 `--unit <id>`；未传入则默认选择全部单元。延期单元不进入发布计划，亦不获得发布状态。完整配置、生成物新鲜度检查及顶层 Hook 仍作用于全项目范围。`publicSourceAuthorityReceipt` 的 coordinator 与全部 subjects 必须共同选择。
 
-每个单元都要声明 `previousPublicBaseline`：确认没有前序版本才用 `none`，否则使用带 repo/ref/commit 的 `bound`。`none` 不绕过 publish 的唯一性预检。
+冻结后，发布流程（publish、reconcile、verify、distribute）不再接受 `--unit` 参数，仅以 `plan.units` 为唯一有效范围。
 
-Hook cache v2 只复用绝对路径，或已用真实 cwd 核验的 cwd-relative executable identity；裸 PATH、PATHEXT、Windows 或观察不可用时冷执行，并失败关闭。稳定隔离安装树只在宿主命令退出、目录隔离且扫描期间无并发写入时记录；附加链接只记录、不跟随，声明载荷中的 symlink 失败关闭。
+每个单元必须声明 `previousPublicBaseline`：只有确认没有前序公开版本时，才使用 `none`；否则必须提供 `bound`，并包含 `repo/ref/commit` 信息。`none` 不绕过 publish 阶段的唯一性预检。
+
+Hook 缓存 v2 仅复用绝对路径，或已通过真实 cwd 核验的 cwd-relative 可执行文件身份；若依赖裸 PATH、PATHEXT、Windows 环境或观察不可用，将触发冷执行并失败关闭。稳定隔离安装树仅在宿主命令退出、目录隔离且扫描期间无并发写入时记录；附加链接仅记录，不跟随；声明载荷中出现 symlink 将导致失败关闭。
 
 ## 最短路径
 

package/adapters/claude/skills/release-prepare/SKILL.md

@@ -13,7 +13,7 @@ description: Freeze an immutable release plan with local configuration, document
 
 运行项目构建/测试 hook，生成公开快照并扫描泄漏，冻结不可变发布计划。prepare 自身不调用发布 adapter，但会执行用户配置的 hook。
 
-0.9.4 候选允许多发布单元项目在冻结前显式选择本轮范围。`--unit <id>` 可以重复传入；未传时仍选择全部单元。显式选择只跳过延期单元的单元级工作，完整配置校验、生成物新鲜度和顶层 Hook 仍全部执行。计划冻结后以 `plan.units` 为唯一范围权威，publish、reconcile、verify 和 distribute 不接受单元选择。
+自 0.9.4 起，多发布单元项目可在计划冻结前显式指定本轮发布范围。重复传入 `--unit <id>` 可选择多个单元；未传入该参数时，默认选择全部单元。显式选择只跳过延期单元的单元级工作；完整配置校验、生成物新鲜度检查及顶层 Hook 仍全部执行。冻结后，`plan.units` 是唯一范围权威，publish、reconcile、verify 和 distribute 不再接受单元选择。
 
 0.9.3 引入的 Hook cache v2 继续只复用有完整身份和输入证据的成功 Hook 结果。裸 PATH、PATHEXT、Windows、TTL、损坏记录或 Foundation 观察不可用时，缓存保持失败关闭，Hook 仍按完整路径冷执行；该机制不改变 prepare 的计划、批准和发布权威。
 
@@ -31,7 +31,7 @@ description: Freeze an immutable release plan with local configuration, document
 
 **发布文档新鲜度门**: 配置了 `releaseDocuments` 的单元在 hook 授权门前先执行同一只读规划器：`clean` 继续；`changes` 抛 `RELEASE_DOCS_STALE`，详情列出相对路径、语种、`refreshDigest` 和精确演练/写入参数数组。prepare 只检查、不写工作树。正式 prepare 前先运行只读演练；有变化时向用户展示文件/语种/版本/`refreshDigest`，只有在用户明确授权"本地发布文档写入"后，才执行带 `--write --confirm-refresh <refreshDigest> --ack-local-document-write` 三项绑定的写入，随后运行聚焦校验，要求维护者审阅并提交刷新结果，再重新 prepare。该授权不扩展为 hook、提交、push 或 publish 授权。
 
-**显式发布范围**: 只有用户已经指出本轮要发布哪些单元时，才把这些 ID 逐个传给 `--unit`。release-skill 不根据失败自动排除单元。选择命中 `publicSourceAuthorityReceipt` 的 coordinator 或 subject 时，必须包含收据声明的完整单元闭包；缺少单元时按命令返回的精确 argv 重新选择，不自动扩选。成功后展示 `releaseScope.selectedUnitIds`、`releaseScope.deferredUnitIds` 和批准摘要。延期仅表示没有进入本轮计划，不表示通过或失败。
+**显式发布范围**: 只有用户已经指出本轮要发布哪些单元时，才逐个传入 `--unit`；不得根据失败自动排除单元。选中的单元包含 `publicSourceAuthorityReceipt` 的 coordinator 或 subject 时，必须同时包含收据声明的完整单元闭包。缺少单元时，按命令返回的精确 argv 重新选择，不自动扩选。成功后展示 `releaseScope.selectedUnitIds`、`releaseScope.deferredUnitIds` 和批准摘要。延期仅表示没有进入本轮计划，不表示通过或失败。
 
 ## 正向执行路径
 

package/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.25.",
+      "Prepare a release plan for version 0.9.27.",
       "Help me understand the release workflow."
     ]
   }

package/adapters/codex/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.25"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.27"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "42145a246d5fd5adff3a1218e94fbfc06df377290431628aa3270e2414b8183e";
+const __bundleSourceDigest = "25d576aeb1a7c01598399f326190124dbdd91b562e32ad4d9a532e3399654151";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -135457,6 +135457,7 @@ function hostEnvironment(host, { kimiHome } = {}) {
   if (host === "workbuddy") {
     env.CODEBUDDY_CONFIG_DIR = join29(env.HOME, ".workbuddy");
     env.WORKBUDDY_CONFIG_DIR = join29(env.HOME, ".workbuddy");
+    env.CODEBUDDY_FORCE_LITE_WB_BUNDLE = "1";
   }
   if (host === "kimi" && kimiHome) env.KIMI_CODE_HOME = kimiHome;
   return env;
@@ -136644,10 +136645,17 @@ async function observeKimiTarget(target, kimiHome, run6) {
   const pluginRoot = await resolveContained(managedRoot, target.plugin);
   const declaredRoot = await resolveContained(managedRoot, relative28(managedRoot, entry.root));
   if (declaredRoot !== pluginRoot) throw new Error("Kimi installed plugin root does not match its managed root");
-  const packageJson = parseJson2(
-    await readFileContained(pluginRoot, "package.json", { encoding: "utf8" }),
-    "Kimi installed package manifest"
-  );
+  let manifestText;
+  let manifestLabel = "Kimi installed package manifest";
+  try {
+    manifestText = await readFileContained(pluginRoot, "package.json", { encoding: "utf8" });
+  } catch (error) {
+    const missing = error?.code === "ENOENT" || error?.details?.causeCode === "ENOENT" || error?.details?.kind === "missing-resource";
+    if (!missing) throw error;
+    manifestLabel = "Kimi installed plugin manifest";
+    manifestText = await readFileContained(pluginRoot, "kimi.plugin.json", { encoding: "utf8" });
+  }
+  const packageJson = parseJson2(manifestText, manifestLabel);
   const refName = entry.github.ref?.kind === "tag" ? entry.github.ref.value : void 0;
   const revision = entry.github.installedSha;
   let gitHeadExact = true;

package/adapters/codex/skills/release-help/SKILL.md

@@ -37,15 +37,17 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.25 候选边界
+## 0.9.27 能力与证据边界
 
-当前 0.9.25 候选精确消费 Foundation 0.22.0 的公开包根 API。0.9.25 仍是源码候选，不能从本说明推断已批准、发布或验证。
+release-skill 0.9.27 精确依赖 Foundation 0.22.0 的公开包根 API。本版修复 Kimi 本机宿主观察：受管插件根只有 kimi.plugin.json、没有 package.json 时不再失败。本节说明当前版本的能力范围与证据边界；批准、发布和验证状态以对应计划、批准及执行记录为准，不能由本说明推断。
 
-冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
+在冻结前，`prepare` 或新建 `ship` 状态时可重复传入 `--unit <id>`；未传入则默认选择全部单元。延期单元不进入发布计划，亦不获得发布状态。完整配置、生成物新鲜度检查及顶层 Hook 仍作用于全项目范围。`publicSourceAuthorityReceipt` 的 coordinator 与全部 subjects 必须共同选择。
 
-每个单元都要声明 `previousPublicBaseline`：确认没有前序版本才用 `none`，否则使用带 repo/ref/commit 的 `bound`。`none` 不绕过 publish 的唯一性预检。
+冻结后，发布流程（publish、reconcile、verify、distribute）不再接受 `--unit` 参数，仅以 `plan.units` 为唯一有效范围。
 
-Hook cache v2 只复用绝对路径，或已用真实 cwd 核验的 cwd-relative executable identity；裸 PATH、PATHEXT、Windows 或观察不可用时冷执行，并失败关闭。稳定隔离安装树只在宿主命令退出、目录隔离且扫描期间无并发写入时记录；附加链接只记录、不跟随，声明载荷中的 symlink 失败关闭。
+每个单元必须声明 `previousPublicBaseline`：只有确认没有前序公开版本时，才使用 `none`；否则必须提供 `bound`，并包含 `repo/ref/commit` 信息。`none` 不绕过 publish 阶段的唯一性预检。
+
+Hook 缓存 v2 仅复用绝对路径，或已通过真实 cwd 核验的 cwd-relative 可执行文件身份；若依赖裸 PATH、PATHEXT、Windows 环境或观察不可用，将触发冷执行并失败关闭。稳定隔离安装树仅在宿主命令退出、目录隔离且扫描期间无并发写入时记录；附加链接仅记录，不跟随；声明载荷中出现 symlink 将导致失败关闭。
 
 ## 最短路径
 

package/adapters/codex/skills/release-prepare/SKILL.md

@@ -20,7 +20,7 @@ description: Freeze an immutable release plan with local configuration, document
 
 运行项目构建/测试 hook，生成公开快照并扫描泄漏，冻结不可变发布计划。prepare 自身不调用发布 adapter，但会执行用户配置的 hook。
 
-0.9.4 候选允许多发布单元项目在冻结前显式选择本轮范围。`--unit <id>` 可以重复传入；未传时仍选择全部单元。显式选择只跳过延期单元的单元级工作，完整配置校验、生成物新鲜度和顶层 Hook 仍全部执行。计划冻结后以 `plan.units` 为唯一范围权威，publish、reconcile、verify 和 distribute 不接受单元选择。
+自 0.9.4 起，多发布单元项目可在计划冻结前显式指定本轮发布范围。重复传入 `--unit <id>` 可选择多个单元；未传入该参数时，默认选择全部单元。显式选择只跳过延期单元的单元级工作；完整配置校验、生成物新鲜度检查及顶层 Hook 仍全部执行。冻结后，`plan.units` 是唯一范围权威，publish、reconcile、verify 和 distribute 不再接受单元选择。
 
 0.9.3 引入的 Hook cache v2 继续只复用有完整身份和输入证据的成功 Hook 结果。裸 PATH、PATHEXT、Windows、TTL、损坏记录或 Foundation 观察不可用时，缓存保持失败关闭，Hook 仍按完整路径冷执行；该机制不改变 prepare 的计划、批准和发布权威。
 
@@ -38,7 +38,7 @@ description: Freeze an immutable release plan with local configuration, document
 
 **发布文档新鲜度门**: 配置了 `releaseDocuments` 的单元在 hook 授权门前先执行同一只读规划器：`clean` 继续；`changes` 抛 `RELEASE_DOCS_STALE`，详情列出相对路径、语种、`refreshDigest` 和精确演练/写入参数数组。prepare 只检查、不写工作树。正式 prepare 前先运行只读演练；有变化时向用户展示文件/语种/版本/`refreshDigest`，只有在用户明确授权"本地发布文档写入"后，才执行带 `--write --confirm-refresh <refreshDigest> --ack-local-document-write` 三项绑定的写入，随后运行聚焦校验，要求维护者审阅并提交刷新结果，再重新 prepare。该授权不扩展为 hook、提交、push 或 publish 授权。
 
-**显式发布范围**: 只有用户已经指出本轮要发布哪些单元时，才把这些 ID 逐个传给 `--unit`。release-skill 不根据失败自动排除单元。选择命中 `publicSourceAuthorityReceipt` 的 coordinator 或 subject 时，必须包含收据声明的完整单元闭包；缺少单元时按命令返回的精确 argv 重新选择，不自动扩选。成功后展示 `releaseScope.selectedUnitIds`、`releaseScope.deferredUnitIds` 和批准摘要。延期仅表示没有进入本轮计划，不表示通过或失败。
+**显式发布范围**: 只有用户已经指出本轮要发布哪些单元时，才逐个传入 `--unit`；不得根据失败自动排除单元。选中的单元包含 `publicSourceAuthorityReceipt` 的 coordinator 或 subject 时，必须同时包含收据声明的完整单元闭包。缺少单元时，按命令返回的精确 argv 重新选择，不自动扩选。成功后展示 `releaseScope.selectedUnitIds`、`releaseScope.deferredUnitIds` 和批准摘要。延期仅表示没有进入本轮计划，不表示通过或失败。
 
 ## 正向执行路径
 

package/adapters/cursor/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/cursor/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.25"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.27"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "42145a246d5fd5adff3a1218e94fbfc06df377290431628aa3270e2414b8183e";
+const __bundleSourceDigest = "25d576aeb1a7c01598399f326190124dbdd91b562e32ad4d9a532e3399654151";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -135457,6 +135457,7 @@ function hostEnvironment(host, { kimiHome } = {}) {
   if (host === "workbuddy") {
     env.CODEBUDDY_CONFIG_DIR = join29(env.HOME, ".workbuddy");
     env.WORKBUDDY_CONFIG_DIR = join29(env.HOME, ".workbuddy");
+    env.CODEBUDDY_FORCE_LITE_WB_BUNDLE = "1";
   }
   if (host === "kimi" && kimiHome) env.KIMI_CODE_HOME = kimiHome;
   return env;
@@ -136644,10 +136645,17 @@ async function observeKimiTarget(target, kimiHome, run6) {
   const pluginRoot = await resolveContained(managedRoot, target.plugin);
   const declaredRoot = await resolveContained(managedRoot, relative28(managedRoot, entry.root));
   if (declaredRoot !== pluginRoot) throw new Error("Kimi installed plugin root does not match its managed root");
-  const packageJson = parseJson2(
-    await readFileContained(pluginRoot, "package.json", { encoding: "utf8" }),
-    "Kimi installed package manifest"
-  );
+  let manifestText;
+  let manifestLabel = "Kimi installed package manifest";
+  try {
+    manifestText = await readFileContained(pluginRoot, "package.json", { encoding: "utf8" });
+  } catch (error) {
+    const missing = error?.code === "ENOENT" || error?.details?.causeCode === "ENOENT" || error?.details?.kind === "missing-resource";
+    if (!missing) throw error;
+    manifestLabel = "Kimi installed plugin manifest";
+    manifestText = await readFileContained(pluginRoot, "kimi.plugin.json", { encoding: "utf8" });
+  }
+  const packageJson = parseJson2(manifestText, manifestLabel);
   const refName = entry.github.ref?.kind === "tag" ? entry.github.ref.value : void 0;
   const revision = entry.github.installedSha;
   let gitHeadExact = true;