release-skill 0.9.34 → 0.9.35

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.34.",
+      "Prepare a release plan for version 0.9.35.",
       "Help me understand the release workflow."
     ]
   }

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.qoder-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.9.35 locale=en baseline=sha256:d6b5bc6f37e83b5ac692f09dc175c61441598caa2f12679a2ffb2a11593b8bca -->
+## [0.9.35] - 2026-10-22
+
+0.9.35 enables successful Qoder finish checks for already installed plugins using a valid Claude-compatible manifest. It detects and blocks invalid or conflicting manifest candidates. This release note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance. Foundation dependencies remain pinned to `0.25.0`.
+
+### Security
+
+- The frozen snapshot is reverified before any host write operation. Existing controls—approval, Hub authorization, path containment, and complete payload validation—remain in force. Foundation dependencies are pinned to `0.25.0`. Skill Family Hub remains the unified marketplace, with publication using GitHub Git Data API and compare-and-swap bound to the observed branch head. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten. These mechanisms and remote authorization are unchanged in 0.9.35. The checker does not perform first-time installation, add marketplaces, or generate manifests. Generic release tiers and other host update policies are unchanged.
+
+### Fixed
+
+- The checker independently reads `.qoder-plugin/plugin.json` and `.claude-plugin/plugin.json` from both the frozen snapshot and the installed plugin. If the native Qoder manifest is missing, a valid Claude-compatible manifest is accepted. If either present manifest is invalid, verification fails without fallback. When both manifests exist, `name`, `version`, and `skills` must match exactly; otherwise, verification fails.
+- The installed manifest selection, its associated relative path, and `skills` are compared against the frozen selection. This closes gaps caused by competing manifest additions or changes in selected relative paths. Original plugin identity and complete payload checks remain enforced.
+
+### Upgrade Notes
+
+Use the updated `release-finish` entry from the public `release-skill@skill-family-hub` to finish an existing installed compatible plugin using its applicable frozen plan. Updating the checker alone does not require republishing the plugin. New plugin bytes still require a new frozen plan and matching approval. `UPDATED` or `ALREADY_CURRENT` indicates installed payload status only—not that the running host has loaded it. Preserve `reload-pending` when loading has not been observed. A local finish failure does not erase a remote `VERIFIED` result. The release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub`.
+<!-- release-skill:changelog:end version=0.9.35 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.9.34 locale=en baseline=sha256:d00e9ecca9e64593103a20119972dbfb025fd8e73b1de2f850e3838d965170ce -->
 ## [0.9.34] - 2026-10-22
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.34 -->
+<!-- release-skill:release-version: 0.9.35 -->
 ## Prerequisites
 
 - Node.js `>=22.22.2 <23` (22.22.2 or newer, and below 23)
@@ -125,7 +125,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.34
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.35
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.34 -->
+<!-- release-skill:release-version: 0.9.35 -->
 ## 前置条件
 
 - Node.js `>=22.22.2 <23`（22.22.2 及以上，且低于 23）
@@ -113,7 +113,7 @@ release-skill 当前只采用并验证 Kimi Code 的交互式 TUI 路径，**无
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.34
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.35
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.34 -->
+<!-- release-skill:release-version: 0.9.35 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,34 +14,26 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.34** (2026-10-22)
+**0.9.35** (2026-10-22)
 
-0.9.34 introduces optional test result integration. Projects declaring `testIntake` can specify test requirements and results files, enabling external test orchestration and validation against defined criteria. Foundation remains at exact version 0.25.0. This release note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+0.9.35 enables successful Qoder finish checks for already installed plugins using a valid Claude-compatible manifest. It detects and blocks invalid or conflicting manifest candidates. This release note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance. Foundation dependencies remain pinned to `0.25.0`.
 
 **Security**
 
-- Skill Family Hub remains the unified market, continuing to use GitHub Git Data API. Updates are bound to observed branch heads and written via compare-and-swap. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten. These mechanisms remain unchanged; remote authorization is not modified in this release.
-
-**Added**
-
-- Configurable test intake: Projects declaring `testIntake` can specify test requirements and results files via `testIntake.requirementsFile` and `testIntake.resultFile`. The first `production` `prepare` saves a non-final candidate and returns `NEEDS_INPUT` with the candidate path. Evidence must be provided before freezing; otherwise, no formal release plan is created. Subsequent `prepare --candidate <path>` resumes the same candidate without rebuilding public payloads. The candidate itself cannot be approved or published.
-- Test orchestration and acceptance: The TEST skill orchestrates test execution, determines whether to reuse or re-run tests, and aggregates business-level judgment on whether requirements are met. release-skill validates submitted materials against requirements, candidate bindings, and applicable stages, but does not replace the semantic acceptance by the domain or independent validators.
-- Post-freeze responsibilities: Requirements after freeze are handled by declared consumers via `consumer-verify`, `postverify`, or `finish` stages. Passing pre-freeze tests does not substitute for post-freeze validation.
-- Approval and artifact verification: Test acceptance is included in the release plan summary. Actions like `approve`, `publish`, and `reconcile` verify original artifacts before execution. Changes to results, criteria, scope, or allowed constraints invalidate prior approvals.
+- The frozen snapshot is reverified before any host write operation. Existing controls—approval, Hub authorization, path containment, and complete payload validation—remain in force. Foundation dependencies are pinned to `0.25.0`. Skill Family Hub remains the unified marketplace, with publication using GitHub Git Data API and compare-and-swap bound to the observed branch head. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten. These mechanisms and remote authorization are unchanged in 0.9.35. The checker does not perform first-time installation, add marketplaces, or generate manifests. Generic release tiers and other host update policies are unchanged.
 
 **Fixed**
 
-- An unreadable or unparsable formal authority now raises an explicit error rather than being silently ignored.
-- `prepare` now rejects execution if `--candidate` is provided without a valid path.
-- New candidate modules after packaging use existing build version information; source mode uses trusted package identities.
+- The checker independently reads `.qoder-plugin/plugin.json` and `.claude-plugin/plugin.json` from both the frozen snapshot and the installed plugin. If the native Qoder manifest is missing, a valid Claude-compatible manifest is accepted. If either present manifest is invalid, verification fails without fallback. When both manifests exist, `name`, `version`, and `skills` must match exactly; otherwise, verification fails.
+- The installed manifest selection, its associated relative path, and `skills` are compared against the frozen selection. This closes gaps caused by competing manifest additions or changes in selected relative paths. Original plugin identity and complete payload checks remain enforced.
 
 **Upgrade Notes**
 
-Projects not declaring `testIntake` retain the original full gate and release path, with no requirement to adopt TEST or artifact-graph. Only `production` prepare is supported for `testIntake`-declared projects; non-production prepare is not allowed. Foundation dependencies remain at exact version 0.25.0. TEST must be invoked through the real Skill entry point. No new TEST CLI is introduced, and no automatic resolution of all domain acceptances is provided. This does not imply validation of all hosts or models. History of `PARTIAL`, `PUBLISHED`, and `VERIFIED` states is preserved even if tests are re-run. The release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub` instead.
+Use the updated `release-finish` entry from the public `release-skill@skill-family-hub` to finish an existing installed compatible plugin using its applicable frozen plan. Updating the checker alone does not require republishing the plugin. New plugin bytes still require a new frozen plan and matching approval. `UPDATED` or `ALREADY_CURRENT` indicates installed payload status only—not that the running host has loaded it. Preserve `reload-pending` when loading has not been observed. A local finish failure does not erase a remote `VERIFIED` result. The release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub`.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.9.34: this README records capabilities and verification boundaries;
+> **Current boundary:** v0.9.35: this README records capabilities and verification boundaries;
 > it is not evidence of
 > publication, consumer-installation verification, or independent acceptance.
 > Release availability must be established from the corresponding release records
@@ -65,7 +57,7 @@ Projects not declaring `testIntake` retain the original full gate and release pa
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; for v0.9.34,
+> **Production path verified since the v0.1.1 milestone; for v0.9.35,
 > publication, consumer-installation verification, and independent acceptance
 > require version-specific release records and verification results.**
 > The npm-installed CLI is the supported user entry. Source checkout

package/README.zh-CN.md

@@ -2,40 +2,32 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.34 -->
+<!-- release-skill:release-version: 0.9.35 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.34** (2026-10-22)
+**0.9.35** (2026-10-22)
 
-0.9.34 引入可选的测试结果接入功能。声明 `testIntake` 的项目可通过 `testIntake.requirementsFile` 和 `testIntake.resultFile` 指定测试要求与测试结果文件，实现与外部测试编排的集成，并依据定义准则进行验证。Foundation 保持精确版本 0.25.0。本发布说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
+0.9.35 修复 Qoder 收尾检查逻辑，使已安装的、使用有效 Claude 兼容清单的插件可通过检查；同时识别并阻止无效或冲突的候选清单。本发布说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。Foundation 依赖保持精确锁定为 `0.25.0`。
 
 **安全**
 
-- Skill Family Hub 仍为统一市场，沿用 GitHub Git Data API。更新操作绑定已观察分支头并比较后写入（compare-and-swap）。部分发布不回滚、不覆盖已完成步骤、不自动强推；这些机制保持不变，本轮未修改远端授权。
-
-**新增**
-
-- 可配置测试接入：声明 `testIntake` 的项目可通过 `testIntake.requirementsFile` 和 `testIntake.resultFile` 指定测试要求文件与测试结果文件。首次 `production` `prepare` 保存非正式候选并返回 `NEEDS_INPUT` 及候选路径；冻结前证据未补齐则不生成正式发布计划。后续执行 `prepare --candidate <path>` 可续接同一候选，不重建公开载荷。候选本身不可用于批准或发布。
-- 测试组织与验收：TEST技能负责组织测试执行、判断是否复用或重跑，并汇总业务是否达标的判断。release-skill 核对提交材料与要求、候选对象、适用阶段的绑定关系，但不代替领域或独立验收者的语义验收。
-- 冻结后职责：冻结后的要求由已声明的消费者通过 `consumer-verify`（消费者安装验证）、`postverify`（发布后校验）、`finish`（本机收尾）阶段处理，冻结前通过不替代冻结后验证。
-- 批准前复核原始材料：测试验收已纳入发布计划摘要。`approve`、`publish`、`reconcile` 等操作在执行前复核原始材料。修改结果、准则、范围或允许的限制将导致原批准失效。
+- 在写入宿主前重新核验冻结快照；既有批准、Hub 授权、路径收容与完整载荷边界检查机制保持不变。Foundation 依赖精确锁定为 `0.25.0`。Skill Family Hub 仍为统一市场，沿用 GitHub Git Data API，更新操作绑定已观察分支头并比较后写入（compare-and-swap）。部分发布不回滚、不覆盖已完成步骤、不自动强推；本轮未修改这些机制与远端授权。检查器不执行首次安装、新增市场或伪造清单，通用发布层级和其他宿主更新策略保持不变。
 
 **修复**
 
-- 正式计划无法读取或解析时返回明确错误，不再静默忽略。
-- 显式传入 `--candidate` 但未提供路径时，`prepare` 在执行前即拒绝。
-- 打包后的新候选模块使用现有构建版本信息，源码模式使用可信包身份。
+- 检查器分别读取冻结快照与已安装插件中的 `.qoder-plugin/plugin.json` 和 `.claude-plugin/plugin.json`。若原生 Qoder 清单不存在，可接受有效的 Claude 兼容清单；清单存在但无效时，不降级接受。当两份清单均存在时，`name`、`version`、`skills` 必须完全一致，否则验证失败。
+- 安装侧选定的清单及其相对路径与 `skills`，与冻结侧对应项进行比对，补上额外候选清单和所选路径变化的检查缺口。原有插件身份与完整载荷检查机制持续生效。
 
 **升级说明**
 
-未声明 `testIntake` 的项目保留原有完整门禁与发布路径，不强制接入 TEST 或 artifact-graph。仅支持 `testIntake` 声明项目使用 `production` prepare，非生产 prepare 不被允许。Foundation 三个依赖保持精确版本 0.25.0。TEST 必须通过真实 Skill 入口调用，不新增 TEST CLI，不自动解决全部业务验收，也不表示已验证所有宿主或模型。历史 `PARTIAL`、`PUBLISHED`、`VERIFIED` 状态不因测试重跑被清除。旧版独立的 `release-skill` 市场已弃用，使用 `ifoohoo/skill-family-hub` 和 `release-skill@skill-family-hub`。
+使用 `release-skill@skill-family-hub` 提供的更新版 `release-finish` 入口，配合适用的冻结计划完成已有兼容插件的收尾。仅升级检查器无需重新发布该插件；若插件内容变更，仍需新冻结计划与匹配批准。`UPDATED` 或 `ALREADY_CURRENT` 仅表示安装载荷已通过检查，不表示运行中的宿主已加载。未观察到加载时，保留 `reload-pending` 状态。本机收尾失败不覆盖远端 `VERIFIED` 结果。旧版独立的 `release-skill` 市场已弃用，使用 `ifoohoo/skill-family-hub` 与 `release-skill@skill-family-hub`。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.9.34 的能力范围与验证边界见本 README，
+> **当前边界：** v0.9.35 的能力范围与验证边界见本 README，
 > 不代表已经发布、完成消费者安装验证或通过独立验收。
 > 版本可用性以对应发布记录及发布后验证结果为准。
 > v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
@@ -51,7 +43,7 @@ release-skill 帮助维护者回答三个问题：准备发布什么、还有哪
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.34 的发布、消费者安装验证和独立验收状态须由该版本的发布记录及验证结果确认。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.35 的发布、消费者安装验证和独立验收状态须由该版本的发布记录及验证结果确认。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.34"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.35"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "218550cf2d3009ab588c7a6a20d1898281fec7adf2a1e694affc7eda2642a277";
+const __bundleSourceDigest = "e14a5aba2f50cba3982bbe413cc9faebf0d45629e53f410e4942f562d7161754";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -139650,14 +139650,26 @@ async function observeQoderPlugin(target, command2, env, run6) {
   };
 }
 async function readQoderManifest(root, label) {
-  const manifest = parseJson2(
-    await readFileContained(root, ".qoder-plugin/plugin.json", { encoding: "utf8" }),
-    label
-  );
-  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
-    throw new Error(`${label} did not return an object`);
+  const candidates = [];
+  for (const manifestPath of [".qoder-plugin/plugin.json", ".claude-plugin/plugin.json"]) {
+    let text;
+    try {
+      text = await readFileContained(root, manifestPath, { encoding: "utf8" });
+    } catch (error) {
+      if (error?.code === "SFC2004" && error?.details?.kind === "missing-resource") continue;
+      throw error;
+    }
+    const manifest = parseJson2(text, `${label} (${manifestPath})`);
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+      throw new Error(`${label} (${manifestPath}) did not return an object`);
+    }
+    candidates.push({ manifestPath, manifest });
   }
-  return manifest;
+  if (candidates.length === 0) throw new Error(`${label} has no native or compatible plugin manifest`);
+  if (candidates.length === 2 && ["name", "version", "skills"].some((field) => candidates[0].manifest[field] !== candidates[1].manifest[field])) {
+    throw new Error(`${label} does not match the frozen Qoder plugin identity and projection path: conflicting native and compatible manifests`);
+  }
+  return candidates[0];
 }
 async function assertQoderPluginManifest(target, manifest, label, pluginRoot, frozenSkills) {
   if (manifest.name !== target.plugin || manifest.version !== target.version || typeof manifest.skills !== "string" || manifest.skills.length === 0 || frozenSkills !== void 0 && manifest.skills !== frozenSkills) {
@@ -139675,8 +139687,9 @@ async function assertFrozenQoderManifest(target, root) {
     snapshotPath: target.snapshotPath,
     expectedDigest: target.manifestDigest
   });
-  const manifest = await readQoderManifest(snapshotRoot, "frozen Qoder plugin manifest");
-  return assertQoderPluginManifest(target, manifest, "frozen Qoder plugin manifest", snapshotRoot);
+  const { manifestPath, manifest } = await readQoderManifest(snapshotRoot, "frozen Qoder plugin manifest");
+  const skills = await assertQoderPluginManifest(target, manifest, "frozen Qoder plugin manifest", snapshotRoot);
+  return { manifestPath, skills };
 }
 async function assertQoderHubEntry(target, marketplaceRoot) {
   const marketplace = parseJson2(
@@ -139699,11 +139712,14 @@ async function verifyQoderInstalledPayload({
   target,
   root,
   installPath,
-  frozenSkills,
+  frozenManifest,
   verifyInstalledPayload
 }) {
-  const manifest = await readQoderManifest(installPath, "installed Qoder plugin manifest");
-  await assertQoderPluginManifest(target, manifest, "installed Qoder plugin manifest", installPath, frozenSkills);
+  const { manifestPath, manifest } = await readQoderManifest(installPath, "installed Qoder plugin manifest");
+  if (manifestPath !== frozenManifest.manifestPath) {
+    throw new Error("installed Qoder plugin manifest path differs from the frozen manifest selection");
+  }
+  await assertQoderPluginManifest(target, manifest, "installed Qoder plugin manifest", installPath, frozenManifest.skills);
   await verifyInstalledPayload({
     snapshotPath: target.snapshotPath,
     manifestDigest: target.manifestDigest,
@@ -139716,7 +139732,7 @@ async function runQoderUpdate(target, detected, run6, {
   verifyInstalledPayload
 }) {
   const env = hostEnvironment("qoder");
-  const frozenSkills = await assertFrozenQoderManifest(target, root);
+  const frozenManifest = await assertFrozenQoderManifest(target, root);
   const marketplace = await observeQoderMarketplace(target, detected.command, env, run6);
   if (!marketplace.installed) {
     return {
@@ -139737,7 +139753,7 @@ async function runQoderUpdate(target, detected, run6, {
       target,
       root,
       installPath: before.installPath,
-      frozenSkills,
+      frozenManifest,
       verifyInstalledPayload
     });
     return { status: "ALREADY_CURRENT", version: target.version };
@@ -139764,7 +139780,7 @@ async function runQoderUpdate(target, detected, run6, {
     target,
     root,
     installPath: after.installPath,
-    frozenSkills,
+    frozenManifest,
     verifyInstalledPayload
   });
   return {

package/adapters/claude/skills/release-finish/SKILL.md

@@ -72,7 +72,11 @@ node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill-local-finish.mjs" \
 - Claude/Codex 的 Hub 目标只使用已经登记的同源市场。升级前先读取声明的 Hub 分支，并核对宿主专用索引中的插件仓库、标签、提交及存在的版本字段。刷新市场后再次核对实际目录和条目，再执行原有更新或重装命令。Claude 精确当前安装会离线核对真实载荷；Codex 列表不提供安装根时，仍须正式重装，从安装输出取得 `installedPath` 后核对载荷。旧安装动作继续使用冻结市场引用预检；远端不可达或引用不符时返回 `MANUAL_REQUIRED`。每个宿主单独保留结果，失败不会中断其他已选宿主。
 - Kimi 的精确当前安装会在返回 `ALREADY_CURRENT` 前核对真实载荷；发生安装或迁移时，只在操作完成后核对结果。配置根依次取显式 `kimiHome`、`KIMI_CODE_HOME`、用户主目录下的 `.kimi-code`，TUI 与安装后观察使用同一根。release-finish 当前只采用并验证 Kimi Code 的受控终端交互界面（TUI）路径，并把 TUI 工作目录固定为 `--root` 指定的当前发布项目。用户已确认冻结计划、显式选择更新且 `--hosts` 包含 `kimi` 时，流程读取完整的初始 `Trust this folder?` 对话框，要求其中只有一个正向项 `Trust this folder` 和一个选中项。正向项已经选中时不发送方向键，直接确认；已知拒绝项选中时，按它与正向项的相对位置移动一次，重新读取完整对话框并确认正向项已选中，然后才提交。插件命令发出后再次出现目录信任、界面或选中项未知、正向项缺失或重复、移动后无法确认、超时或提前退出时，该宿主失败并停止后续安装步骤。若后续 Kimi 版本出现新的可复现界面差异，先记录 Kimi 版本、可见选项、选中项及选项关系；这些事实足以唯一确认当前目录、正向信任项和选择结果时，在最近测试补回归与兼容并继续，目录身份或选项语义不明时仍停止并交回主会话。插件信任仍先清理 ANSI/OSC 控制序列和软换行，再分别核对冻结仓库与标签；只有选中 `Trust and install` 才提交并重新加载。包名、版本、发布标签、已安装修订号和受管安装根必须与冻结计划一致；`.git` 只提供附加诊断，不是通过条件。旧的本地路径安装会在同一 TUI 会话中先移除，再按发布标签安装。
 - CodeBuddy/WorkBuddy 只升级既有安装，不自动首装。CodeBuddy 仅探测全局 `codebuddy`/`cbc`，配置根固定为有效 `HOME` 下的 `.codebuddy`；WorkBuddy 仅在 macOS 探测应用内嵌 CLI，配置根固定为有效 `HOME` 下的 `.workbuddy`，两者不互作回退。Hub 目标先核对各自 `plugins/marketplaces/<hub>` 的远端和分支，再核对 `.codebuddy-plugin/marketplace.json` 条目。刷新市场后确认远端分支未漂移，才更新插件；最后核对列表中的版本、`gitCommitSha` 和 `plugins/cache/<hub>/<plugin>/<version>` 的完整载荷。旧 bundled-family 目标继续要求插件标签和市场分支均指向冻结提交。非 macOS 的 WorkBuddy 返回 `SKIPPED_UNSUPPORTED_PLATFORM`。
-- Qoder 先用 `qoder plugins marketplace list --json` 核对计划声明的 Hub 名称、仓库、分支和本机 checkout，再用 `qoder plugins list --json` 核对唯一插件条目的市场、`scope=user`、版本与 `installPath`。目标市场或插件未安装时返回 `MANUAL_REQUIRED`，不添加市场，也不执行首次安装。旧版已安装时，只运行 `qoder plugins marketplace update <name>` 和 `qoder plugins update <plugin@marketplace> --scope user`。市场刷新后、插件更新前，必须从 Hub 的 `marketplace.json` 核对目标条目的 `source.url` 和 `source.sha`；操作后从真实 `installPath` 核对 Qoder manifest、完整声明载荷和冻结来源。市场可能在检查与更新之间变化，事后身份不符时报告失败，不自动降级、卸载或覆盖。
+- Qoder 首先通过 `qoder plugins marketplace list --json` 验证目标 Hub 的名称、仓库地址、分支信息及本机 checkout 状态，随后使用 `qoder plugins list --json` 核对唯一插件条目的市场归属、`scope=user`、版本号与 `installPath`。若目标市场或插件未安装，返回 `MANUAL_REQUIRED`，禁止自动添加市场或执行首次安装。对于旧版已安装情况，仅执行 `qoder plugins marketplace update <name>` 与 `qoder plugins update <plugin@marketplace> --scope user`。在市场刷新后、插件更新前，必须从 Hub 的 `marketplace.json` 中校验目标条目的 `source.url` 与 `source.sha`。
+
+  冻结快照与真实 `installPath` 均需比对 `.qoder-plugin/plugin.json` 与 `.claude-plugin/plugin.json` 两个候选清单。仅当原生清单缺失时，方可启用兼容清单；原生清单存在但无效时不得回退。存在的清单均须可解析为有效对象，并满足插件身份与根内技能目录要求，双清单的 `name/version/skills` 必须完全一致，且以原生清单为优先。安装侧选择的相对清单路径及 `skills` 必须与冻结侧选择一致。安装侧额外出现的损坏或冲突清单不得忽略；允许宿主附加文件的 `external-marketplace-v1` 载荷完整比较，不可替代对清单的独立核验。
+
+  冻结快照摘要须在宿主写入前完成复验，安装后仍需复验完整声明载荷与冻结来源；即使版本已为目标版本，也必须完成全部复验后方可返回 `ALREADY_CURRENT`。市场在检查与更新之间可能发生变更，若事后身份校验失败，报告错误，不进行自动降级、卸载或覆盖。
 
 Kimi 不使用只有仓库 URL 的 Hub 文件证明标签或提交。它先克隆冻结发布标签并核对提交，再进入既有终端交互流程；启动进程保留 `http_proxy`、`https_proxy` 和 `all_proxy`。
 

package/adapters/claude/skills/release-help/SKILL.md

@@ -29,7 +29,7 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.34 能力与证据边界
+## 0.9.35 能力与证据边界
 
 四类工程材料接到现有 `release-project` 字段。公开正式材料写入 `publicFiles`（`sourceScope` / `from` / `to` / `mode`）。运行必需资源写入 `requiredPublicFiles`，必须被同一单元 `publicFiles[].to` 精确覆盖。私有正式材料与非正式运行材料不列入 `publicFiles`，需要挡住时使用 `forbiddenPaths` / `forbiddenContentPatterns`。正式不等于公开。是否进入公开快照由 `publicFiles` 是否列出决定。npm 是载荷渠道。`package.json` 的 `files` 与入口闭包和公开映射同时约束。`delivery.include` / `delivery.exclude` 只选择宿主，不是文件包含或排除。排除不得拿掉运行必需资源。互相冲突的配置必须失败关闭。
 

package/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.34.",
+      "Prepare a release plan for version 0.9.35.",
       "Help me understand the release workflow."
     ]
   }

package/adapters/codex/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.34"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.35"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "218550cf2d3009ab588c7a6a20d1898281fec7adf2a1e694affc7eda2642a277";
+const __bundleSourceDigest = "e14a5aba2f50cba3982bbe413cc9faebf0d45629e53f410e4942f562d7161754";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -139650,14 +139650,26 @@ async function observeQoderPlugin(target, command2, env, run6) {
   };
 }
 async function readQoderManifest(root, label) {
-  const manifest = parseJson2(
-    await readFileContained(root, ".qoder-plugin/plugin.json", { encoding: "utf8" }),
-    label
-  );
-  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
-    throw new Error(`${label} did not return an object`);
+  const candidates = [];
+  for (const manifestPath of [".qoder-plugin/plugin.json", ".claude-plugin/plugin.json"]) {
+    let text;
+    try {
+      text = await readFileContained(root, manifestPath, { encoding: "utf8" });
+    } catch (error) {
+      if (error?.code === "SFC2004" && error?.details?.kind === "missing-resource") continue;
+      throw error;
+    }
+    const manifest = parseJson2(text, `${label} (${manifestPath})`);
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+      throw new Error(`${label} (${manifestPath}) did not return an object`);
+    }
+    candidates.push({ manifestPath, manifest });
   }
-  return manifest;
+  if (candidates.length === 0) throw new Error(`${label} has no native or compatible plugin manifest`);
+  if (candidates.length === 2 && ["name", "version", "skills"].some((field) => candidates[0].manifest[field] !== candidates[1].manifest[field])) {
+    throw new Error(`${label} does not match the frozen Qoder plugin identity and projection path: conflicting native and compatible manifests`);
+  }
+  return candidates[0];
 }
 async function assertQoderPluginManifest(target, manifest, label, pluginRoot, frozenSkills) {
   if (manifest.name !== target.plugin || manifest.version !== target.version || typeof manifest.skills !== "string" || manifest.skills.length === 0 || frozenSkills !== void 0 && manifest.skills !== frozenSkills) {
@@ -139675,8 +139687,9 @@ async function assertFrozenQoderManifest(target, root) {
     snapshotPath: target.snapshotPath,
     expectedDigest: target.manifestDigest
   });
-  const manifest = await readQoderManifest(snapshotRoot, "frozen Qoder plugin manifest");
-  return assertQoderPluginManifest(target, manifest, "frozen Qoder plugin manifest", snapshotRoot);
+  const { manifestPath, manifest } = await readQoderManifest(snapshotRoot, "frozen Qoder plugin manifest");
+  const skills = await assertQoderPluginManifest(target, manifest, "frozen Qoder plugin manifest", snapshotRoot);
+  return { manifestPath, skills };
 }
 async function assertQoderHubEntry(target, marketplaceRoot) {
   const marketplace = parseJson2(
@@ -139699,11 +139712,14 @@ async function verifyQoderInstalledPayload({
   target,
   root,
   installPath,
-  frozenSkills,
+  frozenManifest,
   verifyInstalledPayload
 }) {
-  const manifest = await readQoderManifest(installPath, "installed Qoder plugin manifest");
-  await assertQoderPluginManifest(target, manifest, "installed Qoder plugin manifest", installPath, frozenSkills);
+  const { manifestPath, manifest } = await readQoderManifest(installPath, "installed Qoder plugin manifest");
+  if (manifestPath !== frozenManifest.manifestPath) {
+    throw new Error("installed Qoder plugin manifest path differs from the frozen manifest selection");
+  }
+  await assertQoderPluginManifest(target, manifest, "installed Qoder plugin manifest", installPath, frozenManifest.skills);
   await verifyInstalledPayload({
     snapshotPath: target.snapshotPath,
     manifestDigest: target.manifestDigest,
@@ -139716,7 +139732,7 @@ async function runQoderUpdate(target, detected, run6, {
   verifyInstalledPayload
 }) {
   const env = hostEnvironment("qoder");
-  const frozenSkills = await assertFrozenQoderManifest(target, root);
+  const frozenManifest = await assertFrozenQoderManifest(target, root);
   const marketplace = await observeQoderMarketplace(target, detected.command, env, run6);
   if (!marketplace.installed) {
     return {
@@ -139737,7 +139753,7 @@ async function runQoderUpdate(target, detected, run6, {
       target,
       root,
       installPath: before.installPath,
-      frozenSkills,
+      frozenManifest,
       verifyInstalledPayload
     });
     return { status: "ALREADY_CURRENT", version: target.version };
@@ -139764,7 +139780,7 @@ async function runQoderUpdate(target, detected, run6, {
     target,
     root,
     installPath: after.installPath,
-    frozenSkills,
+    frozenManifest,
     verifyInstalledPayload
   });
   return {

package/adapters/codex/skills/release-finish/SKILL.md

@@ -79,7 +79,11 @@ node "$RELEASE_SKILL_LOCAL_FINISH_ENTRY" \
 - Claude/Codex 的 Hub 目标只使用已经登记的同源市场。升级前先读取声明的 Hub 分支，并核对宿主专用索引中的插件仓库、标签、提交及存在的版本字段。刷新市场后再次核对实际目录和条目，再执行原有更新或重装命令。Claude 精确当前安装会离线核对真实载荷；Codex 列表不提供安装根时，仍须正式重装，从安装输出取得 `installedPath` 后核对载荷。旧安装动作继续使用冻结市场引用预检；远端不可达或引用不符时返回 `MANUAL_REQUIRED`。每个宿主单独保留结果，失败不会中断其他已选宿主。
 - Kimi 的精确当前安装会在返回 `ALREADY_CURRENT` 前核对真实载荷；发生安装或迁移时，只在操作完成后核对结果。配置根依次取显式 `kimiHome`、`KIMI_CODE_HOME`、用户主目录下的 `.kimi-code`，TUI 与安装后观察使用同一根。release-finish 当前只采用并验证 Kimi Code 的受控终端交互界面（TUI）路径，并把 TUI 工作目录固定为 `--root` 指定的当前发布项目。用户已确认冻结计划、显式选择更新且 `--hosts` 包含 `kimi` 时，流程读取完整的初始 `Trust this folder?` 对话框，要求其中只有一个正向项 `Trust this folder` 和一个选中项。正向项已经选中时不发送方向键，直接确认；已知拒绝项选中时，按它与正向项的相对位置移动一次，重新读取完整对话框并确认正向项已选中，然后才提交。插件命令发出后再次出现目录信任、界面或选中项未知、正向项缺失或重复、移动后无法确认、超时或提前退出时，该宿主失败并停止后续安装步骤。若后续 Kimi 版本出现新的可复现界面差异，先记录 Kimi 版本、可见选项、选中项及选项关系；这些事实足以唯一确认当前目录、正向信任项和选择结果时，在最近测试补回归与兼容并继续，目录身份或选项语义不明时仍停止并交回主会话。插件信任仍先清理 ANSI/OSC 控制序列和软换行，再分别核对冻结仓库与标签；只有选中 `Trust and install` 才提交并重新加载。包名、版本、发布标签、已安装修订号和受管安装根必须与冻结计划一致；`.git` 只提供附加诊断，不是通过条件。旧的本地路径安装会在同一 TUI 会话中先移除，再按发布标签安装。
 - CodeBuddy/WorkBuddy 只升级既有安装，不自动首装。CodeBuddy 仅探测全局 `codebuddy`/`cbc`，配置根固定为有效 `HOME` 下的 `.codebuddy`；WorkBuddy 仅在 macOS 探测应用内嵌 CLI，配置根固定为有效 `HOME` 下的 `.workbuddy`，两者不互作回退。Hub 目标先核对各自 `plugins/marketplaces/<hub>` 的远端和分支，再核对 `.codebuddy-plugin/marketplace.json` 条目。刷新市场后确认远端分支未漂移，才更新插件；最后核对列表中的版本、`gitCommitSha` 和 `plugins/cache/<hub>/<plugin>/<version>` 的完整载荷。旧 bundled-family 目标继续要求插件标签和市场分支均指向冻结提交。非 macOS 的 WorkBuddy 返回 `SKIPPED_UNSUPPORTED_PLATFORM`。
-- Qoder 先用 `qoder plugins marketplace list --json` 核对计划声明的 Hub 名称、仓库、分支和本机 checkout，再用 `qoder plugins list --json` 核对唯一插件条目的市场、`scope=user`、版本与 `installPath`。目标市场或插件未安装时返回 `MANUAL_REQUIRED`，不添加市场，也不执行首次安装。旧版已安装时，只运行 `qoder plugins marketplace update <name>` 和 `qoder plugins update <plugin@marketplace> --scope user`。市场刷新后、插件更新前，必须从 Hub 的 `marketplace.json` 核对目标条目的 `source.url` 和 `source.sha`；操作后从真实 `installPath` 核对 Qoder manifest、完整声明载荷和冻结来源。市场可能在检查与更新之间变化，事后身份不符时报告失败，不自动降级、卸载或覆盖。
+- Qoder 首先通过 `qoder plugins marketplace list --json` 验证目标 Hub 的名称、仓库地址、分支信息及本机 checkout 状态，随后使用 `qoder plugins list --json` 核对唯一插件条目的市场归属、`scope=user`、版本号与 `installPath`。若目标市场或插件未安装，返回 `MANUAL_REQUIRED`，禁止自动添加市场或执行首次安装。对于旧版已安装情况，仅执行 `qoder plugins marketplace update <name>` 与 `qoder plugins update <plugin@marketplace> --scope user`。在市场刷新后、插件更新前，必须从 Hub 的 `marketplace.json` 中校验目标条目的 `source.url` 与 `source.sha`。
+
+  冻结快照与真实 `installPath` 均需比对 `.qoder-plugin/plugin.json` 与 `.claude-plugin/plugin.json` 两个候选清单。仅当原生清单缺失时，方可启用兼容清单；原生清单存在但无效时不得回退。存在的清单均须可解析为有效对象，并满足插件身份与根内技能目录要求，双清单的 `name/version/skills` 必须完全一致，且以原生清单为优先。安装侧选择的相对清单路径及 `skills` 必须与冻结侧选择一致。安装侧额外出现的损坏或冲突清单不得忽略；允许宿主附加文件的 `external-marketplace-v1` 载荷完整比较，不可替代对清单的独立核验。
+
+  冻结快照摘要须在宿主写入前完成复验，安装后仍需复验完整声明载荷与冻结来源；即使版本已为目标版本，也必须完成全部复验后方可返回 `ALREADY_CURRENT`。市场在检查与更新之间可能发生变更，若事后身份校验失败，报告错误，不进行自动降级、卸载或覆盖。
 
 Kimi 不使用只有仓库 URL 的 Hub 文件证明标签或提交。它先克隆冻结发布标签并核对提交，再进入既有终端交互流程；启动进程保留 `http_proxy`、`https_proxy` 和 `all_proxy`。
 

package/adapters/codex/skills/release-help/SKILL.md

@@ -37,7 +37,7 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.34 能力与证据边界
+## 0.9.35 能力与证据边界
 
 四类工程材料接到现有 `release-project` 字段。公开正式材料写入 `publicFiles`（`sourceScope` / `from` / `to` / `mode`）。运行必需资源写入 `requiredPublicFiles`，必须被同一单元 `publicFiles[].to` 精确覆盖。私有正式材料与非正式运行材料不列入 `publicFiles`，需要挡住时使用 `forbiddenPaths` / `forbiddenContentPatterns`。正式不等于公开。是否进入公开快照由 `publicFiles` 是否列出决定。npm 是载荷渠道。`package.json` 的 `files` 与入口闭包和公开映射同时约束。`delivery.include` / `delivery.exclude` 只选择宿主，不是文件包含或排除。排除不得拿掉运行必需资源。互相冲突的配置必须失败关闭。
 

package/adapters/cursor/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"