release-skill 0.9.29 → 0.9.30

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. package/.claude-plugin/plugin.json +1 -1
  2. package/.codebuddy-plugin/plugin.json +1 -1
  3. package/.codex-plugin/plugin.json +2 -2
  4. package/.cursor-plugin/plugin.json +1 -1
  5. package/.kimi-plugin/plugin.json +1 -1
  6. package/.qoder-plugin/plugin.json +1 -1
  7. package/CHANGELOG.md +30 -0
  8. package/INSTALL.md +2 -2
  9. package/INSTALL.zh-CN.md +2 -2
  10. package/README.md +13 -23
  11. package/README.zh-CN.md +16 -17
  12. package/adapters/claude/.claude-plugin/plugin.json +1 -1
  13. package/adapters/claude/bin/release-skill.bundle.mjs +2 -2
  14. package/adapters/claude/skills/release-help/SKILL.md +2 -2
  15. package/adapters/codex/.codex-plugin/plugin.json +2 -2
  16. package/adapters/codex/bin/release-skill.bundle.mjs +2 -2
  17. package/adapters/codex/skills/release-help/SKILL.md +2 -2
  18. package/adapters/cursor/.cursor-plugin/plugin.json +1 -1
  19. package/adapters/cursor/bin/release-skill.bundle.mjs +2 -2
  20. package/adapters/cursor/skills/release-help/SKILL.md +2 -2
  21. package/adapters/kimi/.kimi-plugin/plugin.json +1 -1
  22. package/adapters/kimi/bin/release-skill.bundle.mjs +2 -2
  23. package/adapters/kimi/skills/release-help/SKILL.md +2 -2
  24. package/adapters/qoder/.qoder-plugin/plugin.json +1 -1
  25. package/adapters/qoder/bin/release-skill.bundle.mjs +2 -2
  26. package/adapters/qoder/skills/release-help/SKILL.md +2 -2
  27. package/adapters/workbuddy/.codebuddy-plugin/plugin.json +1 -1
  28. package/adapters/workbuddy/bin/release-skill.bundle.mjs +2 -2
  29. package/adapters/workbuddy/skills/release-help/SKILL.md +2 -2
  30. package/bin/release-skill.bundle.mjs +2 -2
  31. package/package.json +1 -1
  32. package/platform-manifest.json +4 -4
  33. package/skills/release-help/SKILL.md +2 -2
  34. package/skills-src/release-help/SKILL.md +2 -2
package/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "release-skill",
3
- "version": "0.9.29",
3
+ "version": "0.9.30",
4
4
  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
5
5
  "author": {
6
6
  "name": "广州市风荷科技有限公司"
package/.codebuddy-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "release-skill",
3
- "version": "0.9.29",
3
+ "version": "0.9.30",
4
4
  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
5
5
  "author": {
6
6
  "name": "广州市风荷科技有限公司"
package/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "release-skill",
3
- "version": "0.9.29",
3
+ "version": "0.9.30",
4
4
  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
5
5
  "author": {
6
6
  "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
19
19
  ],
20
20
  "defaultPrompt": [
21
21
  "Assess this project for release readiness.",
22
- "Prepare a release plan for version 0.9.29.",
22
+ "Prepare a release plan for version 0.9.30.",
23
23
  "Help me understand the release workflow."
24
24
  ]
25
25
  }
package/.cursor-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "release-skill",
3
- "version": "0.9.29",
3
+ "version": "0.9.30",
4
4
  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
5
5
  "author": {
6
6
  "name": "广州市风荷科技有限公司"
package/.kimi-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "release-skill",
3
- "version": "0.9.29",
3
+ "version": "0.9.30",
4
4
  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
5
5
  "author": {
6
6
  "name": "广州市风荷科技有限公司"
package/.qoder-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "release-skill",
3
- "version": "0.9.29",
3
+ "version": "0.9.30",
4
4
  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
5
5
  "author": {
6
6
  "name": "广州市风荷科技有限公司"
package/CHANGELOG.md CHANGED
@@ -1,5 +1,35 @@
1
1
  # Changelog
2
2
 
3
+ <!-- release-skill:changelog:start version=0.9.30 locale=en baseline=sha256:f96989498b14d998fb38751ca6bd2610255761ebb1618018ec2ca362ebe707a5 -->
4
+ ## [0.9.30] - 2026-10-16
5
+
6
+ 0.9.30 fixes the private Hub hook's missing release-evidence argument while retaining exact Foundation 0.25.0 dependencies. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
7
+
8
+ ### Security
9
+
10
+ - The hook rejects missing or invalid evidence paths before remote access; the authoritative Hub gate validates the original release evidence.
11
+ - Gate failure prevents Git Data API writes. Partial Hub publication is never rolled back or force-pushed, and completed steps are not overwritten. Writes remain bound to the observed branch head through compare-and-swap.
12
+
13
+ ### Changed
14
+
15
+ - Skill Family Hub remains the unified market; entries are updated via GitHub Git Data API after post-verify validation.
16
+
17
+ ### Fixed
18
+
19
+ - The private Hub hook forwards the absolute path supplied through `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` to `npm run release:check -- --release-evidence <file>`. The path must name an existing regular file; symbolic links are rejected.
20
+
21
+ ### Upgrade Notes
22
+
23
+ Before running `postverify`, maintainers set the `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` environment variable to the absolute path of the original Hub evidence descriptor; the existing `envAllowlist` forwards only that key. The descriptor and referenced native records are not copied or rewritten.
24
+
25
+ A new plan freezes the corrected hook and still requires independent checkpoint approval. Historical plans, approvals and frozen hooks remain unchanged and are not replayed. `ALREADY_CURRENT` still requires the authoritative Hub gate.
26
+
27
+ Existing Hub users need no configuration migration. The old release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub`.
28
+
29
+ This note does not authorize publication or prove real-host business or consumer installation verification. No consumer installation or update is added.
30
+ <!-- release-skill:changelog:end version=0.9.30 locale=en -->
31
+
32
+
3
33
  <!-- release-skill:changelog:start version=0.9.29 locale=en baseline=sha256:b0f764fb7dc5897a2bc031a06114e766eb3bb2a39fe4778c0c23bc620921bf40 -->
4
34
  ## [0.9.29] - 2026-10-16
5
35
 
package/INSTALL.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [简体中文](INSTALL.zh-CN.md)
4
4
 
5
- <!-- release-skill:release-version: 0.9.29 -->
5
+ <!-- release-skill:release-version: 0.9.30 -->
6
6
  ## Prerequisites
7
7
 
8
8
  - Node.js `>=22.22.2 <23` (22.22.2 or newer, and below 23)
@@ -125,7 +125,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
125
125
  the latest release or default branch), confirm the trust prompt, then reload:
126
126
 
127
127
  ```
128
- /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.29
128
+ /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.30
129
129
  /plugins reload
130
130
  ```
131
131
 
package/INSTALL.zh-CN.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [English](INSTALL.md)
4
4
 
5
- <!-- release-skill:release-version: 0.9.29 -->
5
+ <!-- release-skill:release-version: 0.9.30 -->
6
6
  ## 前置条件
7
7
 
8
8
  - Node.js `>=22.22.2 <23`（22.22.2 及以上，且低于 23）
@@ -113,7 +113,7 @@ release-skill 当前只采用并验证 Kimi Code 的交互式 TUI 路径，**无
113
113
  （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
114
114
 
115
115
  ```
116
- /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.29
116
+ /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.30
117
117
  /plugins reload
118
118
  ```
119
119
 
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
4
4
 
5
- <!-- release-skill:release-version: 0.9.29 -->
5
+ <!-- release-skill:release-version: 0.9.30 -->
6
6
  Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
7
7
 
8
8
  release-skill helps a maintainer answer three questions: what will be released,
@@ -14,46 +14,36 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
14
14
  report stays in a temporary session directory.
15
15
 
16
16
  <!-- release-skill:managed:start id=latest-release -->
17
- **0.9.29** (2026-10-16)
17
+ **0.9.30** (2026-10-16)
18
18
 
19
- 0.9.29 fixes Qoder local updates rejecting the valid ./skills/ layout in Foundation 0.25.0's frozen manifest. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
19
+ 0.9.30 fixes the private Hub hook's missing release-evidence argument while retaining exact Foundation 0.25.0 dependencies. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
20
20
 
21
21
  **Security**
22
22
 
23
- - The skills path must be a non-empty string naming an existing directory within the plugin. The installed name/version/skills must match this release's frozen manifest. Both UPDATED and ALREADY_CURRENT branches validate the actual installed payload.
24
- - Frozen snapshot digest, identity, Hub repository/ref and entry source.url/source.sha checks remain in effect. Missing, invalid or escaping paths and payload drift still fail; no automatic initial installation is added.
25
- - Hub writes remain bound to the observed branch head through compare-and-swap. Partial Hub publication is never rolled back or force-pushed automatically, and completed steps are not overwritten.
23
+ - The hook rejects missing or invalid evidence paths before remote access; the authoritative Hub gate validates the original release evidence.
24
+ - Gate failure prevents Git Data API writes. Partial Hub publication is never rolled back or force-pushed, and completed steps are not overwritten. Writes remain bound to the observed branch head through compare-and-swap.
26
25
 
27
26
  **Changed**
28
27
 
29
- - Skill Family Hub remains the unified marketplace. After release validation, Hub entries are updated via GitHub Git Data API. This mechanism remains unchanged and is not claimed to have been executed in this release.
28
+ - Skill Family Hub remains the unified market; entries are updated via GitHub Git Data API after post-verify validation.
30
29
 
31
30
  **Fixed**
32
31
 
33
- - Resolved incorrect path hardcoding in 0.9.28 that rejected valid ./skills/ directory from Foundation 0.25.0's frozen manifest. Qoder plugins now read skills path from verified frozen manifest, ensuring compatibility with both ./adapters/qoder/skills/ and ./skills/ layouts.
32
+ - The private Hub hook forwards the absolute path supplied through `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` to `npm run release:check -- --release-evidence <file>`. The path must name an existing regular file; symbolic links are rejected.
34
33
 
35
34
  **Upgrade Notes**
36
35
 
37
- - Existing installations may continue using the existing local-finish entry point,
38
- provided they maintain authorization.
36
+ Before running `postverify`, maintainers set the `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` environment variable to the absolute path of the original Hub evidence descriptor; the existing `envAllowlist` forwards only that key. The descriptor and referenced native records are not copied or rewritten.
39
37
 
40
- - The release note does not constitute a release authorization, nor does it confirm
41
- real-world host business validation.
38
+ A new plan freezes the corrected hook and still requires independent checkpoint approval. Historical plans, approvals and frozen hooks remain unchanged and are not replayed. `ALREADY_CURRENT` still requires the authoritative Hub gate.
42
39
 
43
- - Do not infer published status from this document; actual release status must be
44
- referenced from approved plans, approvals, and execution records.
40
+ Existing Hub users need no configuration migration. The old release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub`.
45
41
 
46
- - The path must be a valid existing directory within the plugin and match the frozen
47
- manifest exactly.
48
-
49
- - No new configuration parameters or migration steps are introduced.
50
- - Users of the existing Skill Family Hub do not need to perform configuration migration.
51
- - The old release-skill standalone marketplace is deprecated and should be removed.
52
- Replace it with the `ifoohoo/skill-family-hub` repository and `release-skill@skill-family-hub`.
42
+ This note does not authorize publication or prove real-host business or consumer installation verification. No consumer installation or update is added.
53
43
  <!-- release-skill:managed:end id=latest-release -->
54
44
 
55
45
  <!-- release-skill:capability:external-write-boundary -->
56
- > **Current boundary:** v0.9.29: this README records capabilities and verification boundaries;
46
+ > **Current boundary:** v0.9.30: this README records capabilities and verification boundaries;
57
47
  > it is not evidence of
58
48
  > publication, consumer-installation verification, or independent acceptance.
59
49
  > Release availability must be established from the corresponding release records
@@ -77,7 +67,7 @@ report stays in a temporary session directory.
77
67
  > publish global preflight.
78
68
 
79
69
  <!-- release-skill:capability:safe-first-command -->
80
- > **Production path verified since the v0.1.1 milestone; for v0.9.29,
70
+ > **Production path verified since the v0.1.1 milestone; for v0.9.30,
81
71
  > publication, consumer-installation verification, and independent acceptance
82
72
  > require version-specific release records and verification results.**
83
73
  > The npm-installed CLI is the supported user entry. Source checkout
package/README.zh-CN.md CHANGED
@@ -2,43 +2,42 @@
2
2
 
3
3
  [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
4
4
 
5
- <!-- release-skill:release-version: 0.9.29 -->
5
+ <!-- release-skill:release-version: 0.9.30 -->
6
6
  面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
7
7
 
8
8
  release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
9
9
 
10
10
  <!-- release-skill:managed:start id=latest-release -->
11
- **0.9.29** (2026-10-16)
11
+ **0.9.30** (2026-10-16)
12
12
 
13
- 0.9.29 修复 Qoder 本机更新拒绝 Foundation 0.25.0 冻结清单中合法 ./skills/ 目录的问题。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
13
+ 0.9.30 修复项目私有 Hub 钩子漏传发布证据参数的问题，继续使用精确的 Foundation 0.25.0 依赖。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
14
14
 
15
15
  **安全**
16
16
 
17
- - skills 路径必须是非空字符串，指向插件内已有目录；安装清单的 name/version/skills 必须匹配本次冻结清单。UPDATED 与 ALREADY_CURRENT 分支均核验实际安装载荷。
18
- - 冻结快照摘要、身份、Hub 仓库/ref 与条目 source.url/source.sha 校验继续生效。路径缺失、非法、越界或载荷漂移仍会失败，不新增自动初装。
19
- - 部分发布不回滚、不覆盖已完成步骤、不自动强推；Hub 写入绑定已观察分支头，compare-and-swap 比较后写入。
17
+ - 钩子在访问远端前拒绝缺失或非法的证据路径，证据内容交由 Hub 正式门禁验证。
18
+ - 门禁失败不进行 Git Data API 写入；部分发布不回滚、不覆盖已完成步骤、不自动强推；写入绑定观察到的分支头并比较后写入。
20
19
 
21
20
  **变更**
22
21
 
23
- - Skill Family Hub 仍是统一市场。发布验证完成后，Hub 条目仍通过 GitHub Git Data API 更新。此机制保持不变，不声称本次已执行。
22
+ - Skill Family Hub 仍是统一市场，验证后经 GitHub Git Data API 更新条目。
24
23
 
25
24
  **修复**
26
25
 
27
- - 修复0.9.28中路径硬编码问题，该问题导致拒绝Foundation 0.25.0冻结清单中有效的./skills/目录。Qoder插件现从已验证的冻结清单读取skills路径，确保与./adapters/qoder/skills/和./skills/两种布局兼容。
26
+ - 项目私有 Hub 钩子把 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` 指定的绝对路径传给 `npm run release:check -- --release-evidence <file>`。路径必须指向已有普通文件，不接受符号链接。
28
27
 
29
28
  **升级说明**
30
29
 
31
- - 现有安装可继续使用原本机收尾入口，但需保持授权。
32
- - 本说明不构成发布授权，也不代表真实宿主业务已通过验证。
33
- - 不得据此断言版本已发布；发布状态应以实际计划、批准和执行记录为准。
34
- - 路径必须为插件内有效的已有目录，且与冻结清单完全一致。
35
- - 未引入新增参数或配置迁移。
36
- - 已使用 Skill Family Hub 的用户无需配置迁移。
37
- - 旧版独立的 `release-skill` 市场已弃用，应移除并改用 `ifoohoo/skill-family-hub` 仓库与 `release-skill@skill-family-hub`。
30
+ 维护者在运行 `postverify` 前，将环境变量 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` 设为原始 Hub 证据描述符的绝对路径；现有 `envAllowlist` 只转发该键。描述符及其引用的原生记录不复制、不改写。
31
+
32
+ 新计划冻结修正的钩子，仍须取得独立检查点批准；历史计划、批准和冻结钩子保持不变，不重放。`ALREADY_CURRENT` 仍须通过 Hub 正式门禁。
33
+
34
+ 已使用 Hub 的用户无需配置迁移。旧版独立的 `release-skill` 市场已弃用，应改用 `ifoohoo/skill-family-hub` 与 `release-skill@skill-family-hub`。
35
+
36
+ 本说明不授权发布，也不证明真实宿主业务或消费者安装验证完成；不新增消费者安装或更新动作。
38
37
  <!-- release-skill:managed:end id=latest-release -->
39
38
 
40
39
  <!-- release-skill:capability:external-write-boundary -->
41
- > **当前边界：** v0.9.29 的能力范围与验证边界见本 README，
40
+ > **当前边界：** v0.9.30 的能力范围与验证边界见本 README，
42
41
  > 不代表已经发布、完成消费者安装验证或通过独立验收。
43
42
  > 版本可用性以对应发布记录及发布后验证结果为准。
44
43
  > v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
@@ -54,7 +53,7 @@ release-skill 帮助维护者回答三个问题：准备发布什么、还有哪
54
53
  > 远端唯一性检查在 `publish` 全局预检执行。
55
54
 
56
55
  <!-- release-skill:capability:safe-first-command -->
57
- > **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.29 的发布、消费者安装验证和独立验收状态须由该版本的发布记录及验证结果确认。**
56
+ > **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.30 的发布、消费者安装验证和独立验收状态须由该版本的发布记录及验证结果确认。**
58
57
  > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
59
58
  >
60
59
  > **第一条命令：**
package/adapters/claude/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "release-skill",
3
- "version": "0.9.29",
3
+ "version": "0.9.30",
4
4
  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
5
5
  "author": {
6
6
  "name": "广州市风荷科技有限公司"
package/adapters/claude/bin/release-skill.bundle.mjs CHANGED
@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
9
9
  // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
10
10
  const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
11
11
  // Package identity injected at build time — closure-independent --version probe.
12
- const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.29"});
12
+ const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.30"});
13
13
  // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
14
- const __bundleSourceDigest = "4b1d1fa4db3d1788009a6035816d59dfa1298cba9c5d691ae3aa36e49067d145";
14
+ const __bundleSourceDigest = "52acbaddf4e589b42b49defb03ff5dfa59e0306f37a3ce0e8e3aaa240b9cfba4";
15
15
 
16
16
  var __create = Object.create;
17
17
  var __defProp = Object.defineProperty;
package/adapters/claude/skills/release-help/SKILL.md CHANGED
@@ -29,9 +29,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
29
29
 
30
30
  治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
31
31
 
32
- ## 0.9.29 能力与证据边界
32
+ ## 0.9.30 能力与证据边界
33
33
 
34
- release-skill 0.9.29 保留 Foundation 0.25.0精确依赖、可选宿主覆盖诊断输入`--host-coverage <file>`与`--observe-hosts`、Codex 0.154.0静态加载规则检查11份真实生成Skill的原字节等既有事实；本版修复 Qoder 本机更新的路径处理：从已验证摘要的冻结清单读取skills路径，支持既有`./adapters/qoder/skills/`和`./skills/`布局，仍核对安装name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
34
+ release-skill 0.9.30 保留 Foundation 0.25.0 精确依赖、可选宿主覆盖诊断输入 `--host-coverage <file>` 与 `--observe-hosts`、Codex 0.154.0 静态加载规则检查 11 份真实生成 Skill 的原字节等既有事实；本版修复私有 Hub 的 postVerify 钩子：通过既有 `envAllowlist` 传递 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE`，其值为原始描述符所指向的已有普通文件绝对路径（拒绝符号链接），交由 Hub `npm run release:check -- --release-evidence <file>` 验证。Qoder 本机更新路径处理维持既有能力，支持 `./adapters/qoder/skills/` 与 `./skills/` 两种布局，仍核对安装 name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
35
35
 
36
36
  在冻结前，`prepare` 或新建 `ship` 状态时可重复传入 `--unit <id>`；未传入则默认选择全部单元。延期单元不进入发布计划，亦不获得发布状态。完整配置、生成物新鲜度检查及顶层 Hook 仍作用于全项目范围。`publicSourceAuthorityReceipt` 的 coordinator 与全部 subjects 必须共同选择。
37
37
 
package/adapters/codex/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "release-skill",
3
- "version": "0.9.29",
3
+ "version": "0.9.30",
4
4
  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
5
5
  "author": {
6
6
  "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
19
19
  ],
20
20
  "defaultPrompt": [
21
21
  "Assess this project for release readiness.",
22
- "Prepare a release plan for version 0.9.29.",
22
+ "Prepare a release plan for version 0.9.30.",
23
23
  "Help me understand the release workflow."
24
24
  ]
25
25
  }
package/adapters/codex/bin/release-skill.bundle.mjs CHANGED
@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
9
9
  // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
10
10
  const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
11
11
  // Package identity injected at build time — closure-independent --version probe.
12
- const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.29"});
12
+ const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.30"});
13
13
  // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
14
- const __bundleSourceDigest = "4b1d1fa4db3d1788009a6035816d59dfa1298cba9c5d691ae3aa36e49067d145";
14
+ const __bundleSourceDigest = "52acbaddf4e589b42b49defb03ff5dfa59e0306f37a3ce0e8e3aaa240b9cfba4";
15
15
 
16
16
  var __create = Object.create;
17
17
  var __defProp = Object.defineProperty;
package/adapters/codex/skills/release-help/SKILL.md CHANGED
@@ -37,9 +37,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
37
37
 
38
38
  治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
39
39
 
40
- ## 0.9.29 能力与证据边界
40
+ ## 0.9.30 能力与证据边界
41
41
 
42
- release-skill 0.9.29 保留 Foundation 0.25.0精确依赖、可选宿主覆盖诊断输入`--host-coverage <file>`与`--observe-hosts`、Codex 0.154.0静态加载规则检查11份真实生成Skill的原字节等既有事实；本版修复 Qoder 本机更新的路径处理：从已验证摘要的冻结清单读取skills路径，支持既有`./adapters/qoder/skills/`和`./skills/`布局，仍核对安装name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
42
+ release-skill 0.9.30 保留 Foundation 0.25.0 精确依赖、可选宿主覆盖诊断输入 `--host-coverage <file>` 与 `--observe-hosts`、Codex 0.154.0 静态加载规则检查 11 份真实生成 Skill 的原字节等既有事实；本版修复私有 Hub 的 postVerify 钩子：通过既有 `envAllowlist` 传递 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE`，其值为原始描述符所指向的已有普通文件绝对路径（拒绝符号链接），交由 Hub `npm run release:check -- --release-evidence <file>` 验证。Qoder 本机更新路径处理维持既有能力，支持 `./adapters/qoder/skills/` 与 `./skills/` 两种布局，仍核对安装 name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
43
43
 
44
44
  在冻结前，`prepare` 或新建 `ship` 状态时可重复传入 `--unit <id>`；未传入则默认选择全部单元。延期单元不进入发布计划，亦不获得发布状态。完整配置、生成物新鲜度检查及顶层 Hook 仍作用于全项目范围。`publicSourceAuthorityReceipt` 的 coordinator 与全部 subjects 必须共同选择。
45
45
 
package/adapters/cursor/.cursor-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "release-skill",
3
- "version": "0.9.29",
3
+ "version": "0.9.30",
4
4
  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
5
5
  "author": {
6
6
  "name": "广州市风荷科技有限公司"
package/adapters/cursor/bin/release-skill.bundle.mjs CHANGED
@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
9
9
  // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
10
10
  const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
11
11
  // Package identity injected at build time — closure-independent --version probe.
12
- const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.29"});
12
+ const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.30"});
13
13
  // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
14
- const __bundleSourceDigest = "4b1d1fa4db3d1788009a6035816d59dfa1298cba9c5d691ae3aa36e49067d145";
14
+ const __bundleSourceDigest = "52acbaddf4e589b42b49defb03ff5dfa59e0306f37a3ce0e8e3aaa240b9cfba4";
15
15
 
16
16
  var __create = Object.create;
17
17
  var __defProp = Object.defineProperty;
package/adapters/cursor/skills/release-help/SKILL.md CHANGED
@@ -38,9 +38,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
38
38
 
39
39
  治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
40
40
 
41
- ## 0.9.29 能力与证据边界
41
+ ## 0.9.30 能力与证据边界
42
42
 
43
- release-skill 0.9.29 保留 Foundation 0.25.0精确依赖、可选宿主覆盖诊断输入`--host-coverage <file>`与`--observe-hosts`、Codex 0.154.0静态加载规则检查11份真实生成Skill的原字节等既有事实；本版修复 Qoder 本机更新的路径处理：从已验证摘要的冻结清单读取skills路径，支持既有`./adapters/qoder/skills/`和`./skills/`布局，仍核对安装name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
43
+ release-skill 0.9.30 保留 Foundation 0.25.0 精确依赖、可选宿主覆盖诊断输入 `--host-coverage <file>` 与 `--observe-hosts`、Codex 0.154.0 静态加载规则检查 11 份真实生成 Skill 的原字节等既有事实；本版修复私有 Hub 的 postVerify 钩子：通过既有 `envAllowlist` 传递 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE`，其值为原始描述符所指向的已有普通文件绝对路径（拒绝符号链接），交由 Hub `npm run release:check -- --release-evidence <file>` 验证。Qoder 本机更新路径处理维持既有能力，支持 `./adapters/qoder/skills/` 与 `./skills/` 两种布局，仍核对安装 name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
44
44
 
45
45
  在冻结前，`prepare` 或新建 `ship` 状态时可重复传入 `--unit <id>`；未传入则默认选择全部单元。延期单元不进入发布计划，亦不获得发布状态。完整配置、生成物新鲜度检查及顶层 Hook 仍作用于全项目范围。`publicSourceAuthorityReceipt` 的 coordinator 与全部 subjects 必须共同选择。
46
46
 
package/adapters/kimi/.kimi-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "release-skill",
3
- "version": "0.9.29",
3
+ "version": "0.9.30",
4
4
  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
5
5
  "author": {
6
6
  "name": "广州市风荷科技有限公司"
package/adapters/kimi/bin/release-skill.bundle.mjs CHANGED
@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
9
9
  // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
10
10
  const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
11
11
  // Package identity injected at build time — closure-independent --version probe.
12
- const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.29"});
12
+ const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.30"});
13
13
  // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
14
- const __bundleSourceDigest = "4b1d1fa4db3d1788009a6035816d59dfa1298cba9c5d691ae3aa36e49067d145";
14
+ const __bundleSourceDigest = "52acbaddf4e589b42b49defb03ff5dfa59e0306f37a3ce0e8e3aaa240b9cfba4";
15
15
 
16
16
  var __create = Object.create;
17
17
  var __defProp = Object.defineProperty;
package/adapters/kimi/skills/release-help/SKILL.md CHANGED
@@ -37,9 +37,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
37
37
 
38
38
  治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
39
39
 
40
- ## 0.9.29 能力与证据边界
40
+ ## 0.9.30 能力与证据边界
41
41
 
42
- release-skill 0.9.29 保留 Foundation 0.25.0精确依赖、可选宿主覆盖诊断输入`--host-coverage <file>`与`--observe-hosts`、Codex 0.154.0静态加载规则检查11份真实生成Skill的原字节等既有事实；本版修复 Qoder 本机更新的路径处理：从已验证摘要的冻结清单读取skills路径，支持既有`./adapters/qoder/skills/`和`./skills/`布局，仍核对安装name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
42
+ release-skill 0.9.30 保留 Foundation 0.25.0 精确依赖、可选宿主覆盖诊断输入 `--host-coverage <file>` 与 `--observe-hosts`、Codex 0.154.0 静态加载规则检查 11 份真实生成 Skill 的原字节等既有事实；本版修复私有 Hub 的 postVerify 钩子：通过既有 `envAllowlist` 传递 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE`，其值为原始描述符所指向的已有普通文件绝对路径（拒绝符号链接），交由 Hub `npm run release:check -- --release-evidence <file>` 验证。Qoder 本机更新路径处理维持既有能力，支持 `./adapters/qoder/skills/` 与 `./skills/` 两种布局，仍核对安装 name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
43
43
 
44
44
  在冻结前，`prepare` 或新建 `ship` 状态时可重复传入 `--unit <id>`；未传入则默认选择全部单元。延期单元不进入发布计划，亦不获得发布状态。完整配置、生成物新鲜度检查及顶层 Hook 仍作用于全项目范围。`publicSourceAuthorityReceipt` 的 coordinator 与全部 subjects 必须共同选择。
45
45
 
package/adapters/qoder/.qoder-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "release-skill",
3
- "version": "0.9.29",
3
+ "version": "0.9.30",
4
4
  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
5
5
  "author": {
6
6
  "name": "广州市风荷科技有限公司"
package/adapters/qoder/bin/release-skill.bundle.mjs CHANGED
@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
9
9
  // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
10
10
  const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
11
11
  // Package identity injected at build time — closure-independent --version probe.
12
- const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.29"});
12
+ const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.30"});
13
13
  // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
14
- const __bundleSourceDigest = "4b1d1fa4db3d1788009a6035816d59dfa1298cba9c5d691ae3aa36e49067d145";
14
+ const __bundleSourceDigest = "52acbaddf4e589b42b49defb03ff5dfa59e0306f37a3ce0e8e3aaa240b9cfba4";
15
15
 
16
16
  var __create = Object.create;
17
17
  var __defProp = Object.defineProperty;
package/adapters/qoder/skills/release-help/SKILL.md CHANGED
@@ -37,9 +37,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
37
37
 
38
38
  治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
39
39
 
40
- ## 0.9.29 能力与证据边界
40
+ ## 0.9.30 能力与证据边界
41
41
 
42
- release-skill 0.9.29 保留 Foundation 0.25.0精确依赖、可选宿主覆盖诊断输入`--host-coverage <file>`与`--observe-hosts`、Codex 0.154.0静态加载规则检查11份真实生成Skill的原字节等既有事实；本版修复 Qoder 本机更新的路径处理：从已验证摘要的冻结清单读取skills路径，支持既有`./adapters/qoder/skills/`和`./skills/`布局，仍核对安装name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
42
+ release-skill 0.9.30 保留 Foundation 0.25.0 精确依赖、可选宿主覆盖诊断输入 `--host-coverage <file>` 与 `--observe-hosts`、Codex 0.154.0 静态加载规则检查 11 份真实生成 Skill 的原字节等既有事实；本版修复私有 Hub 的 postVerify 钩子：通过既有 `envAllowlist` 传递 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE`，其值为原始描述符所指向的已有普通文件绝对路径（拒绝符号链接），交由 Hub `npm run release:check -- --release-evidence <file>` 验证。Qoder 本机更新路径处理维持既有能力，支持 `./adapters/qoder/skills/` 与 `./skills/` 两种布局，仍核对安装 name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
43
43
 
44
44
  在冻结前，`prepare` 或新建 `ship` 状态时可重复传入 `--unit <id>`；未传入则默认选择全部单元。延期单元不进入发布计划，亦不获得发布状态。完整配置、生成物新鲜度检查及顶层 Hook 仍作用于全项目范围。`publicSourceAuthorityReceipt` 的 coordinator 与全部 subjects 必须共同选择。
45
45
 
package/adapters/workbuddy/.codebuddy-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "release-skill",
3
- "version": "0.9.29",
3
+ "version": "0.9.30",
4
4
  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
5
5
  "author": {
6
6
  "name": "广州市风荷科技有限公司"
package/adapters/workbuddy/bin/release-skill.bundle.mjs CHANGED
@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
9
9
  // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
10
10
  const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
11
11
  // Package identity injected at build time — closure-independent --version probe.
12
- const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.29"});
12
+ const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.30"});
13
13
  // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
14
- const __bundleSourceDigest = "4b1d1fa4db3d1788009a6035816d59dfa1298cba9c5d691ae3aa36e49067d145";
14
+ const __bundleSourceDigest = "52acbaddf4e589b42b49defb03ff5dfa59e0306f37a3ce0e8e3aaa240b9cfba4";
15
15
 
16
16
  var __create = Object.create;
17
17
  var __defProp = Object.defineProperty;
package/adapters/workbuddy/skills/release-help/SKILL.md CHANGED
@@ -29,9 +29,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
29
29
 
30
30
  治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
31
31
 
32
- ## 0.9.29 能力与证据边界
32
+ ## 0.9.30 能力与证据边界
33
33
 
34
- release-skill 0.9.29 保留 Foundation 0.25.0精确依赖、可选宿主覆盖诊断输入`--host-coverage <file>`与`--observe-hosts`、Codex 0.154.0静态加载规则检查11份真实生成Skill的原字节等既有事实；本版修复 Qoder 本机更新的路径处理：从已验证摘要的冻结清单读取skills路径，支持既有`./adapters/qoder/skills/`和`./skills/`布局，仍核对安装name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
34
+ release-skill 0.9.30 保留 Foundation 0.25.0 精确依赖、可选宿主覆盖诊断输入 `--host-coverage <file>` 与 `--observe-hosts`、Codex 0.154.0 静态加载规则检查 11 份真实生成 Skill 的原字节等既有事实；本版修复私有 Hub 的 postVerify 钩子：通过既有 `envAllowlist` 传递 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE`，其值为原始描述符所指向的已有普通文件绝对路径（拒绝符号链接），交由 Hub `npm run release:check -- --release-evidence <file>` 验证。Qoder 本机更新路径处理维持既有能力，支持 `./adapters/qoder/skills/` 与 `./skills/` 两种布局，仍核对安装 name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
35
35
 
36
36
  在冻结前，`prepare` 或新建 `ship` 状态时可重复传入 `--unit <id>`；未传入则默认选择全部单元。延期单元不进入发布计划，亦不获得发布状态。完整配置、生成物新鲜度检查及顶层 Hook 仍作用于全项目范围。`publicSourceAuthorityReceipt` 的 coordinator 与全部 subjects 必须共同选择。
37
37
 
package/bin/release-skill.bundle.mjs CHANGED
@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
9
9
  // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
10
10
  const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
11
11
  // Package identity injected at build time — closure-independent --version probe.
12
- const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.29"});
12
+ const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.30"});
13
13
  // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
14
- const __bundleSourceDigest = "4b1d1fa4db3d1788009a6035816d59dfa1298cba9c5d691ae3aa36e49067d145";
14
+ const __bundleSourceDigest = "52acbaddf4e589b42b49defb03ff5dfa59e0306f37a3ce0e8e3aaa240b9cfba4";
15
15
 
16
16
  var __create = Object.create;
17
17
  var __defProp = Object.defineProperty;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "release-skill",
3
- "version": "0.9.29",
3
+ "version": "0.9.30",
4
4
  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
5
5
  "author": {
6
6
  "name": "广州市风荷科技有限公司"
package/platform-manifest.json CHANGED
@@ -2,11 +2,11 @@
2
2
  "schemaVersion": "1.0.0",
3
3
  "platformId": "release-skill",
4
4
  "platformName": "release-skill Plugin Platform",
5
- "version": "0.9.29",
5
+ "version": "0.9.30",
6
6
  "logicalRoot": "skills-src/",
7
- "logicalRootDigest": "43cd83c28d266c0d96e964a19c0ea410f1a24f66db336694028baab139a53bab",
8
- "projectionDigest": "3b21f7746613a0751047b6733cc7b68dd1517af3868c12486fc6b9af872b6cc9",
9
- "projectionId": "release-skill:platform:0.9.29",
7
+ "logicalRootDigest": "1ea3c60db0fbc3c3943d2103f76730500886d0994d5e406e4438d6479df86b62",
8
+ "projectionDigest": "77fdc2b733c05475ee6784e049ff4ce6b09dcd01f3d4391b3d264603827f1cfa",
9
+ "projectionId": "release-skill:platform:0.9.30",
10
10
  "manifestRequired": true,
11
11
  "projectionSources": {
12
12
  "skills-src-root": {
package/skills/release-help/SKILL.md CHANGED
@@ -29,9 +29,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
29
29
 
30
30
  治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
31
31
 
32
- ## 0.9.29 能力与证据边界
32
+ ## 0.9.30 能力与证据边界
33
33
 
34
- release-skill 0.9.29 保留 Foundation 0.25.0精确依赖、可选宿主覆盖诊断输入`--host-coverage <file>`与`--observe-hosts`、Codex 0.154.0静态加载规则检查11份真实生成Skill的原字节等既有事实；本版修复 Qoder 本机更新的路径处理：从已验证摘要的冻结清单读取skills路径，支持既有`./adapters/qoder/skills/`和`./skills/`布局，仍核对安装name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
34
+ release-skill 0.9.30 保留 Foundation 0.25.0 精确依赖、可选宿主覆盖诊断输入 `--host-coverage <file>` 与 `--observe-hosts`、Codex 0.154.0 静态加载规则检查 11 份真实生成 Skill 的原字节等既有事实；本版修复私有 Hub 的 postVerify 钩子：通过既有 `envAllowlist` 传递 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE`，其值为原始描述符所指向的已有普通文件绝对路径（拒绝符号链接），交由 Hub `npm run release:check -- --release-evidence <file>` 验证。Qoder 本机更新路径处理维持既有能力，支持 `./adapters/qoder/skills/` 与 `./skills/` 两种布局，仍核对安装 name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
35
35
 
36
36
  在冻结前，`prepare` 或新建 `ship` 状态时可重复传入 `--unit <id>`；未传入则默认选择全部单元。延期单元不进入发布计划，亦不获得发布状态。完整配置、生成物新鲜度检查及顶层 Hook 仍作用于全项目范围。`publicSourceAuthorityReceipt` 的 coordinator 与全部 subjects 必须共同选择。
37
37
 
package/skills-src/release-help/SKILL.md CHANGED
@@ -29,9 +29,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
29
29
 
30
30
  治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
31
31
 
32
- ## 0.9.29 能力与证据边界
32
+ ## 0.9.30 能力与证据边界
33
33
 
34
- release-skill 0.9.29 保留 Foundation 0.25.0精确依赖、可选宿主覆盖诊断输入`--host-coverage <file>`与`--observe-hosts`、Codex 0.154.0静态加载规则检查11份真实生成Skill的原字节等既有事实；本版修复 Qoder 本机更新的路径处理：从已验证摘要的冻结清单读取skills路径，支持既有`./adapters/qoder/skills/`和`./skills/`布局，仍核对安装name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
34
+ release-skill 0.9.30 保留 Foundation 0.25.0 精确依赖、可选宿主覆盖诊断输入 `--host-coverage <file>` 与 `--observe-hosts`、Codex 0.154.0 静态加载规则检查 11 份真实生成 Skill 的原字节等既有事实；本版修复私有 Hub 的 postVerify 钩子：通过既有 `envAllowlist` 传递 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE`，其值为原始描述符所指向的已有普通文件绝对路径（拒绝符号链接），交由 Hub `npm run release:check -- --release-evidence <file>` 验证。Qoder 本机更新路径处理维持既有能力，支持 `./adapters/qoder/skills/` 与 `./skills/` 两种布局，仍核对安装 name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
35
35
 
36
36
  在冻结前，`prepare` 或新建 `ship` 状态时可重复传入 `--unit <id>`；未传入则默认选择全部单元。延期单元不进入发布计划，亦不获得发布状态。完整配置、生成物新鲜度检查及顶层 Hook 仍作用于全项目范围。`publicSourceAuthorityReceipt` 的 coordinator 与全部 subjects 必须共同选择。
37
37