release-skill 0.9.32 → 0.9.34

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.32",
+  "version": "0.9.34",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.32",
+  "version": "0.9.34",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.32",
+  "version": "0.9.34",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.32.",
+      "Prepare a release plan for version 0.9.34.",
       "Help me understand the release workflow."
     ]
   }

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.32",
+  "version": "0.9.34",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.32",
+  "version": "0.9.34",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.qoder-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.32",
+  "version": "0.9.34",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.9.34 locale=en baseline=sha256:d00e9ecca9e64593103a20119972dbfb025fd8e73b1de2f850e3838d965170ce -->
+## [0.9.34] - 2026-10-22
+
+0.9.34 introduces optional test result integration. Projects declaring `testIntake` can specify test requirements and results files, enabling external test orchestration and validation against defined criteria. Foundation remains at exact version 0.25.0. This release note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- Skill Family Hub remains the unified market, continuing to use GitHub Git Data API. Updates are bound to observed branch heads and written via compare-and-swap. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten. These mechanisms remain unchanged; remote authorization is not modified in this release.
+
+### Added
+
+- Configurable test intake: Projects declaring `testIntake` can specify test requirements and results files via `testIntake.requirementsFile` and `testIntake.resultFile`. The first `production` `prepare` saves a non-final candidate and returns `NEEDS_INPUT` with the candidate path. Evidence must be provided before freezing; otherwise, no formal release plan is created. Subsequent `prepare --candidate <path>` resumes the same candidate without rebuilding public payloads. The candidate itself cannot be approved or published.
+- Test orchestration and acceptance: The TEST skill orchestrates test execution, determines whether to reuse or re-run tests, and aggregates business-level judgment on whether requirements are met. release-skill validates submitted materials against requirements, candidate bindings, and applicable stages, but does not replace the semantic acceptance by the domain or independent validators.
+- Post-freeze responsibilities: Requirements after freeze are handled by declared consumers via `consumer-verify`, `postverify`, or `finish` stages. Passing pre-freeze tests does not substitute for post-freeze validation.
+- Approval and artifact verification: Test acceptance is included in the release plan summary. Actions like `approve`, `publish`, and `reconcile` verify original artifacts before execution. Changes to results, criteria, scope, or allowed constraints invalidate prior approvals.
+
+### Fixed
+
+- An unreadable or unparsable formal authority now raises an explicit error rather than being silently ignored.
+- `prepare` now rejects execution if `--candidate` is provided without a valid path.
+- New candidate modules after packaging use existing build version information; source mode uses trusted package identities.
+
+### Upgrade Notes
+
+Projects not declaring `testIntake` retain the original full gate and release path, with no requirement to adopt TEST or artifact-graph. Only `production` prepare is supported for `testIntake`-declared projects; non-production prepare is not allowed. Foundation dependencies remain at exact version 0.25.0. TEST must be invoked through the real Skill entry point. No new TEST CLI is introduced, and no automatic resolution of all domain acceptances is provided. This does not imply validation of all hosts or models. History of `PARTIAL`, `PUBLISHED`, and `VERIFIED` states is preserved even if tests are re-run. The release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub` instead.
+<!-- release-skill:changelog:end version=0.9.34 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.9.33 locale=en baseline=sha256:af9d9faf59d67db851b0161430803a4e2ab6752f9979f83bd0a01b0df17bbeed -->
+## [0.9.33] - 2026-10-20
+
+0.9.33 maps four engineering material roles onto existing release-project fields, distinguishes first-time setup from incremental wiring, and checks payload channels through those fields while retaining exact Foundation 0.25.0 dependencies. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- This round does not change remote-write authorization. Existing confirmation boundaries and frozen install URL/ref/sha remain in force. Hub gate failure prevents GitHub Git Data API write. Writes bind the observed branch head through `compare-and-swap`. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten. Independent checkpoint approval, no replay of historical frozen plans, and `ALREADY_CURRENT` remain enforced.
+
+### Changed
+
+- Public formal materials are written to `publicFiles` (`sourceScope` / `from` / `to` / `mode`). Runtime-required resources are written to `requiredPublicFiles` and must be covered exactly by the same unit's `publicFiles[].to`. Private formal materials and informal runtime materials are omitted from `publicFiles`; when they must be blocked, use `forbiddenPaths` / `forbiddenContentPatterns`. Formal does not mean public. Whether a formal artifact enters the public snapshot is decided by whether it is listed in `publicFiles`. npm is a payload channel. `package.json` `files` and entry closure apply together with the public map. `delivery.include` / `delivery.exclude` select hosts and are not file include or exclude rules. Exclusion must not drop required resources. Conflicting configuration fails closed.
+- First-time wiring uses `release-setup`. An existing `.release-skill/project.yaml` returns `ALREADY_CONFIGURED` / `CONFIG_EXISTS` and is not overwritten. Incremental changes are diagnosed by `release-assess` and handled by the existing `release-config` skill; `release-config` is not a new CLI. Route first, then run `prepare --workflow config` only when the actual workflow is `config-only`; `full-happy-end` or mixed changes follow the ordinary full path. Do not unconditionally trigger `prepare --workflow config`.
+- Skill guidance for setup, assess, config, prepare, and verify now describes these material roles through the existing fields. `REQUIRED_PUBLIC_FILE_MISSING` belongs only to `setup --assess-adoption`. Ordinary `assess` and `verify-records` do not use that code. prepare keeps its native errors such as `PUBLIC_FILE_MISSING` and `CONFIG_INVALID`. `LICENSE_MISSING` does not substitute for required runtime resources. Foundation suggestions cannot serve as publication approval.
+- Skill Family Hub remains the unified market. GitHub Git Data API integration continues with `compare-and-swap` write semantics; no automatic rollback or overwrite of completed steps. This is the existing mechanism, not a new Hub implementation in this version, and it is not evidence that publication has completed.
+
+### Fixed
+
+- On `setup --assess-adoption`, adoption assessment locates the `publicFiles[].to` that covers each `requiredPublicFiles` snapshot target, then checks that the repository-relative `from` exists. Absence is recorded as `REQUIRED_PUBLIC_FILE_MISSING`. That code does not enter ordinary `assess`, `verify-records`, or prepare.
+
+### Upgrade Notes
+
+Keep exact Foundation 0.25.0 dependencies; do not upgrade because a sibling workspace is newer. Blank projects use `release-setup`. Configured projects keep their legal fields and use `release-assess` / `release-config` for increments. Route first; do not unconditionally run `prepare --workflow config`. A forbidden-path-only `config-only` increment may finish offline non-production prepare as `PREPARED` with `workflowDecision` `indeterminable` / `publish-needed`; that result is legal. npm is a payload channel; a missing entry fails closed with `GATE_FAILED` / `npm-entry-closure` / `entry_missing`. The old release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub`.
+<!-- release-skill:changelog:end version=0.9.33 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.9.32 locale=en baseline=sha256:760080f3cd309b1d75cc9f41fe29c9ac5dc80f228f9946db9e6d0cf303954f42 -->
 ## [0.9.32] - 2026-10-17
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.32 -->
+<!-- release-skill:release-version: 0.9.34 -->
 ## Prerequisites
 
 - Node.js `>=22.22.2 <23` (22.22.2 or newer, and below 23)
@@ -125,7 +125,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.32
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.34
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.32 -->
+<!-- release-skill:release-version: 0.9.34 -->
 ## 前置条件
 
 - Node.js `>=22.22.2 <23`（22.22.2 及以上，且低于 23）
@@ -113,7 +113,7 @@ release-skill 当前只采用并验证 Kimi Code 的交互式 TUI 路径，**无
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.32
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.34
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.32 -->
+<!-- release-skill:release-version: 0.9.34 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,32 +14,34 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.32** (2026-10-17)
+**0.9.34** (2026-10-22)
 
-0.9.32 fixes the adapter failure caused by waiting for a complete title after selection movement in the Kimi 2.2.0 removal menu while retaining exact Foundation 0.25.0 dependencies. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+0.9.34 introduces optional test result integration. Projects declaring `testIntake` can specify test requirements and results files, enabling external test orchestration and validation against defined criteria. Foundation remains at exact version 0.25.0. This release note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
 
 **Security**
 
-- Maintains strict confirmation boundaries: exact plugin ID and selection must be verified before removal. No changes to frozen install URL/ref/sha or post-install payload validation. Hub gate failure prevents GitHub Git Data API write. Writes bind the observed branch head through `compare-and-swap`. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten. Existing `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` environment variable continues to require an existing regular file at an absolute path (not a symlink), validated via `npm run release:check -- --release-evidence <file>`. Independent checkpoint approval, no replay of historical frozen plans, and `ALREADY_CURRENT` gate remain enforced.
+- Skill Family Hub remains the unified market, continuing to use GitHub Git Data API. Updates are bound to observed branch heads and written via compare-and-swap. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten. These mechanisms remain unchanged; remote authorization is not modified in this release.
 
-**Changed**
+**Added**
 
-- Skill Family Hub remains the unified market. GitHub Git Data API integration continues with `compare-and-swap` write semantics; no automatic rollback or overwrite of completed steps.
+- Configurable test intake: Projects declaring `testIntake` can specify test requirements and results files via `testIntake.requirementsFile` and `testIntake.resultFile`. The first `production` `prepare` saves a non-final candidate and returns `NEEDS_INPUT` with the candidate path. Evidence must be provided before freezing; otherwise, no formal release plan is created. Subsequent `prepare --candidate <path>` resumes the same candidate without rebuilding public payloads. The candidate itself cannot be approved or published.
+- Test orchestration and acceptance: The TEST skill orchestrates test execution, determines whether to reuse or re-run tests, and aggregates business-level judgment on whether requirements are met. release-skill validates submitted materials against requirements, candidate bindings, and applicable stages, but does not replace the semantic acceptance by the domain or independent validators.
+- Post-freeze responsibilities: Requirements after freeze are handled by declared consumers via `consumer-verify`, `postverify`, or `finish` stages. Passing pre-freeze tests does not substitute for post-freeze validation.
+- Approval and artifact verification: Test acceptance is included in the release plan summary. Actions like `approve`, `publish`, and `reconcile` verify original artifacts before execution. Changes to results, criteria, scope, or allowed constraints invalidate prior approvals.
 
 **Fixed**
 
-- Handle Kimi 2.2.0 menu redraws that omit the plugin title and final newline after selection movement. The adapter must re-observe the selection after movement and confirm unique selection of `Remove plugin` before proceeding.
-- Initial exact plugin ID is verified before frame reading. Direction key is sent only after reading the frame, followed by a full incremental frame to confirm unique selection. Full title redraw still validates exact ID. Unknown, ambiguous, un-moved, incomplete frame, timeout, or EOF all stop the update before installation.
+- An unreadable or unparsable formal authority now raises an explicit error rather than being silently ignored.
+- `prepare` now rejects execution if `--candidate` is provided without a valid path.
+- New candidate modules after packaging use existing build version information; source mode uses trusted package identities.
 
 **Upgrade Notes**
 
-This fix applies to real update workflows, not limited to offline testing. Retain Kimi 0.40.1’s actual prompt `Confirm remove plugin "<id>"?`, bracketed paste, and CSI Enter input method. Frozen install URL/ref/sha, post-install name/version, and payload verification rules unchanged. Shared setup for same `unitId/plugin/version` is merged by unit, plugin, and version; different physical `skillFile` paths in Claude/Codex no longer count as separate setups, as per 0.9.31. Each host’s installation, loading, and configuration must still be verified separately, with feedback bound to `host/unit/path/plan/config/root`. Failure does not alter `VERIFIED`/`DISTRIBUTED` state. `Foundation 0.25.0` exact dependencies remain in use. The old release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub`. Provider upgrades do not republish domain plugins or expand host authorization.
-
-Real Kimi 2.2.0 was observed through exact identity checks, selection movement, and selection verification, then canceled with Esc and exited without removal, installation, or update. All 47 focused tests passed, and independent code review found no issues. Full real-consumer update and loading acceptance remains pending.
+Projects not declaring `testIntake` retain the original full gate and release path, with no requirement to adopt TEST or artifact-graph. Only `production` prepare is supported for `testIntake`-declared projects; non-production prepare is not allowed. Foundation dependencies remain at exact version 0.25.0. TEST must be invoked through the real Skill entry point. No new TEST CLI is introduced, and no automatic resolution of all domain acceptances is provided. This does not imply validation of all hosts or models. History of `PARTIAL`, `PUBLISHED`, and `VERIFIED` states is preserved even if tests are re-run. The release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub` instead.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.9.32: this README records capabilities and verification boundaries;
+> **Current boundary:** v0.9.34: this README records capabilities and verification boundaries;
 > it is not evidence of
 > publication, consumer-installation verification, or independent acceptance.
 > Release availability must be established from the corresponding release records
@@ -63,7 +65,7 @@ Real Kimi 2.2.0 was observed through exact identity checks, selection movement,
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; for v0.9.32,
+> **Production path verified since the v0.1.1 milestone; for v0.9.34,
 > publication, consumer-installation verification, and independent acceptance
 > require version-specific release records and verification results.**
 > The npm-installed CLI is the supported user entry. Source checkout
@@ -604,6 +606,22 @@ a shell command. After host updates, release-finish runs that setup entry
 against the current release project root passed through `--root`; it does not
 request a separate project directory. The two settings are independent.
 
+Optional `testIntake` names a requirements file and a result file. It is
+accepted only by production prepare. The first production prepare stores one
+non-plan candidate and returns `NEEDS_INPUT` (`GATE_FAILED`, exit 13) with
+`candidatePath`, `candidateSha256`, and `subjectDigest`. It does not write a
+formal plan. Reattach that same candidate with `prepare --candidate <path>`;
+the formal plan and `PREPARED` are written only after the applicable pre-freeze
+requirements pass. A candidate cannot be approved or published, and it cannot
+clear `PARTIAL`, `PUBLISHED`, or `VERIFIED`. A project that does not declare
+`testIntake` keeps its existing hooks, full gate, and publish path. A docs,
+config, or marketplace workflow, a unit selection, or a no-publish-needed
+config does not waive project-level requirements. Non-production prepare
+rejects `testIntake` with `CONFIG_INVALID`. Optional `testAcceptance` is part
+of the current plan digest. Replacing the result, criterion, scope, or allowed
+limitation invalidates the previous approval. Approve, publish, and reconcile
+re-check those originals before acting.
+
 Use `release-skill post-release --finish` for the complete local finish. It
 always reports merge, host update, actual host loading, setup, and source-branch
 steps. Exit 0 means every applicable step completed or was explicitly skipped;

package/README.zh-CN.md

@@ -2,38 +2,40 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.32 -->
+<!-- release-skill:release-version: 0.9.34 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.32** (2026-10-17)
+**0.9.34** (2026-10-22)
 
-0.9.32 修复 Kimi 2.2.0 移除菜单移动后，适配器因等待完整标题而失败的问题，继续采用精确的 Foundation 0.25.0 依赖。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
+0.9.34 引入可选的测试结果接入功能。声明 `testIntake` 的项目可通过 `testIntake.requirementsFile` 和 `testIntake.resultFile` 指定测试要求与测试结果文件，实现与外部测试编排的集成，并依据定义准则进行验证。Foundation 保持精确版本 0.25.0。本发布说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
 
 **安全**
 
-- 保持严格确认边界：移除前必须精确核对插件ID与选择。冻结的安装URL/ref/sha与安装后载荷验证规则未变。Hub门禁失败将阻止GitHub Git Data API写入。写入采用 `compare-and-swap`，绑定已观察的分支头并比较后写入；部分发布不回滚、不覆盖已完成步骤、不自动强推。现有 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` 环境变量仍须指定已有普通文件的绝对路径（拒绝符号链接），交由 `npm run release:check -- --release-evidence <file>` 验证。独立检查点批准、历史冻结计划不重放、ALREADY_CURRENT 门禁仍强制执行。
+- Skill Family Hub 仍为统一市场，沿用 GitHub Git Data API。更新操作绑定已观察分支头并比较后写入（compare-and-swap）。部分发布不回滚、不覆盖已完成步骤、不自动强推；这些机制保持不变，本轮未修改远端授权。
 
-**变更**
+**新增**
 
-- Skill Family Hub 保持统一市场。GitHub Git Data API 机制延续，写入采用 compare-and-swap 语义；不自动回滚或覆盖已完成步骤。
+- 可配置测试接入：声明 `testIntake` 的项目可通过 `testIntake.requirementsFile` 和 `testIntake.resultFile` 指定测试要求文件与测试结果文件。首次 `production` `prepare` 保存非正式候选并返回 `NEEDS_INPUT` 及候选路径；冻结前证据未补齐则不生成正式发布计划。后续执行 `prepare --candidate <path>` 可续接同一候选，不重建公开载荷。候选本身不可用于批准或发布。
+- 测试组织与验收：TEST技能负责组织测试执行、判断是否复用或重跑，并汇总业务是否达标的判断。release-skill 核对提交材料与要求、候选对象、适用阶段的绑定关系，但不代替领域或独立验收者的语义验收。
+- 冻结后职责：冻结后的要求由已声明的消费者通过 `consumer-verify`（消费者安装验证）、`postverify`（发布后校验）、`finish`（本机收尾）阶段处理，冻结前通过不替代冻结后验证。
+- 批准前复核原始材料：测试验收已纳入发布计划摘要。`approve`、`publish`、`reconcile` 等操作在执行前复核原始材料。修改结果、准则、范围或允许的限制将导致原批准失效。
 
 **修复**
 
-- 适配 Kimi 2.2.0 在方向键移动后只输出菜单增量重绘、不重发插件标题且最后一行没有换行的行为。适配器在移动后必须重新观察选中项，确认唯一选中 `Remove plugin` 后才允许提交操作。
-- 读取帧前先核实初始精确插件 ID，读完该帧后才发送方向键，再读取完整增量帧并核对唯一选中项，完整标题重绘时仍核对精确 ID。未知、歧义、未移动、帧未完成、timeout、EOF 均导致失败关闭。
+- 正式计划无法读取或解析时返回明确错误，不再静默忽略。
+- 显式传入 `--candidate` 但未提供路径时，`prepare` 在执行前即拒绝。
+- 打包后的新候选模块使用现有构建版本信息，源码模式使用可信包身份。
 
 **升级说明**
 
-本修复用于真实更新流程，非仅限离线测试。保留 Kimi 0.40.1 实际措辞 `Confirm remove plugin "<id>"?`、括号粘贴与 CSI Enter 输入方式。冻结的安装 URL/ref/sha、安装后 name/version 与载荷核对规则不变。同一 `unitId/plugin/version` 的共享 setup 按单元、插件、版本归并，Claude/Codex 不同物理 `skillFile` 路径不再视为多个 setup 归属，沿用 0.9.31 已有逻辑。各宿主安装、加载及专属配置仍需分别核实，反馈绑定 `host/unit/path/plan/config/root`。失败不改 `VERIFIED`/`DISTRIBUTED` 状态。`Foundation 0.25.0` 精确依赖继续采用。旧版独立的 `release-skill` 市场已弃用，使用 `ifoohoo/skill-family-hub` 与 `release-skill@skill-family-hub`。获取新提供方后可继续原冻结计划，无需重发原领域插件，也不扩大宿主授权。
-
-真实 Kimi 2.2.0 已完成确认前的精确身份、移动及选中项观察，随后按 Esc 取消并退出，未执行移除、安装或更新。47 项聚焦测试通过，独立代码审阅无发现；真实消费者的完整更新与加载验收仍待执行。
+未声明 `testIntake` 的项目保留原有完整门禁与发布路径，不强制接入 TEST 或 artifact-graph。仅支持 `testIntake` 声明项目使用 `production` prepare，非生产 prepare 不被允许。Foundation 三个依赖保持精确版本 0.25.0。TEST 必须通过真实 Skill 入口调用，不新增 TEST CLI，不自动解决全部业务验收，也不表示已验证所有宿主或模型。历史 `PARTIAL`、`PUBLISHED`、`VERIFIED` 状态不因测试重跑被清除。旧版独立的 `release-skill` 市场已弃用，使用 `ifoohoo/skill-family-hub` 和 `release-skill@skill-family-hub`。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.9.32 的能力范围与验证边界见本 README，
+> **当前边界：** v0.9.34 的能力范围与验证边界见本 README，
 > 不代表已经发布、完成消费者安装验证或通过独立验收。
 > 版本可用性以对应发布记录及发布后验证结果为准。
 > v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
@@ -49,7 +51,7 @@ release-skill 帮助维护者回答三个问题：准备发布什么、还有哪
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.32 的发布、消费者安装验证和独立验收状态须由该版本的发布记录及验证结果确认。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.34 的发布、消费者安装验证和独立验收状态须由该版本的发布记录及验证结果确认。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
@@ -507,6 +509,8 @@ releaseUnits:
 release-finish 在 `--root` 指定的当前发布项目根目录调用该入口，不再要求另行提供项目目录。
 两个配置彼此独立。
 
+可选的 `testIntake` 只声明要求文件和结果文件，并且只在生产 prepare 中生效。首次生产 prepare 保存一份非正式候选，返回 `NEEDS_INPUT`（`GATE_FAILED`，退出码 13），并给出 `candidatePath`、`candidateSha256` 和 `subjectDigest`，此时不写正式计划。用 `prepare --candidate <path>` 续接同一候选；适用的冻结前要求通过后才写入正式计划和 `PREPARED`。候选不能用于批准或发布，也不能清除 `PARTIAL`、`PUBLISHED` 或 `VERIFIED`。未声明 `testIntake` 的项目保持原有 hook、完整门和发布路径。docs、config、marketplace 工作流、单元选择和无需发布的配置都不免除项目级要求。非生产 prepare 拒绝 `testIntake`，错误码为 `CONFIG_INVALID`。可选的 `testAcceptance` 进入当前计划摘要。替换结果、准则、范围或允许的限制会使原批准失效。approve、publish 和 reconcile 在动作前复核这些原件。
+
 完整的本地收尾使用 `release-skill post-release --finish`。命令固定报告分支决定、宿主更新、实际加载、setup 和源码分支检查：全部适用步骤完成或明确跳过时退出 0，仍有待办时退出 2，确定失败时退出 1。智能体通过绝对路径的 `--finish-feedback` JSON 文件回传观察，文件必须绑定当前计划摘要、配置摘要和规范项目根目录。反馈只作为数据：脚本不执行其中字符串，也不把反馈当成新的写入授权。`--skip-local-hosts` 显示跳过宿主更新、加载和 setup，不得与 `--hosts` 或 `--update-local-hosts` 同时使用。
 
 `distributions` 是必填字段，但可以显式设为空数组。使用

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.32",
+  "version": "0.9.34",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"