release-skill 0.9.34 → 0.9.36

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.36",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.36",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.36",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.34.",
+      "Prepare a release plan for version 0.9.36.",
       "Help me understand the release workflow."
     ]
   }

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.36",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.36",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.qoder-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.36",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.9.36 locale=en baseline=sha256:704d09597e835404867409d99c9b8d674751ef145a9e0855d6e2182d768bb3a2 -->
+## [0.9.36] - 2026-10-22
+
+0.9.36 fixes incorrect rejection of valid dual-projection plugin directories in Qoder, ensures correct validation of market sources via both URL and GitHub-based manifests, and corrects Codex entry root detection to respect manifest-declared paths instead of hardcoding `skills/`. This release note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance. Foundation dependencies remain pinned to 0.25.0.
+
+### Security
+
+- Foundation 0.25.0 remains unchanged; the source, scope, commit/digest, and full payload are preserved. The frozen snapshot is re-verified before writing, and the full payload is compared after installation. No new market, first-install, host strategy, framework, dependency, or tier has been introduced. 0.9.35 is immutable. Skill Family Hub remains the unified marketplace, using GitHub Git Data API and compare-and-swap bound to the observed branch head. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten.
+
+### Fixed
+
+- In 0.9.35, Qoder plugins incorrectly rejected valid dual-projection directories. The `name` and `version` in `.qoder-plugin/plugin.json` and `.claude-plugin/plugin.json` must bind to the same frozen target, though individual `skills` can differ. Each present candidate must be a valid JSON object, match the target identity, have non-empty `skills`, and resolve to a real directory within the plugin root. Native takes precedence; compatibility is only used when native is missing. If any candidate is invalid, installation fails immediately without fallback. After installation, the selected path and `skills` must exactly match the frozen choice, and full payload validation is retained.
+- Qoder now also accepts existing markets that provide `.claude-plugin/marketplace.json` instead of a root `marketplace.json`. The system supports two existing locations: a URL-based `marketplace.json` at the root, and a GitHub-based `marketplace.json` in `.claude-plugin/`. At least one must exist. Each present index must be valid and contain exactly one entry for the target plugin, bound to the same frozen identity; other plugin entries remain allowed. A bad source is not ignored just because another is valid. URL sources require exact repository and SHA verification, and any explicit `version` or `ref` must match. GitHub sources require exact verification of `repo`, `ref`, `sha`, and `entry.version`. Only confirmed missing files are considered absent. Validation occurs after market refresh and before plugin update. `ALREADY_CURRENT` remains read-only with zero update commands.
+- The Codex entry root check previously hardcoded `skills/`, rejecting valid paths like `.agents/skills/` declared in the manifest. Installation pre-check and post-install observation now respect the `skills` directory declared in the plugin manifest. When the field is missing, the default `skills/` path is retained, and existing prefix behavior is preserved. Explicitly invalid, out-of-bounds, or non-directory paths are rejected without fallback. Post-install observation and full payload verification must bind to the same frozen installation contract.
+
+### Upgrade Notes
+
+The release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and the updated `release-skill@skill-family-hub`, `release-finish`, and public CLI. Unmodified plugins need not be republished. Byte changes require a new frozen plan and matching approval. Installation does not imply loading — if actual loading is not observed, the state remains `reload-pending`. Local completion failure does not alter the remote `VERIFIED` status.
+<!-- release-skill:changelog:end version=0.9.36 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.9.35 locale=en baseline=sha256:d6b5bc6f37e83b5ac692f09dc175c61441598caa2f12679a2ffb2a11593b8bca -->
+## [0.9.35] - 2026-10-22
+
+0.9.35 enables successful Qoder finish checks for already installed plugins using a valid Claude-compatible manifest. It detects and blocks invalid or conflicting manifest candidates. This release note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance. Foundation dependencies remain pinned to `0.25.0`.
+
+### Security
+
+- The frozen snapshot is reverified before any host write operation. Existing controls—approval, Hub authorization, path containment, and complete payload validation—remain in force. Foundation dependencies are pinned to `0.25.0`. Skill Family Hub remains the unified marketplace, with publication using GitHub Git Data API and compare-and-swap bound to the observed branch head. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten. These mechanisms and remote authorization are unchanged in 0.9.35. The checker does not perform first-time installation, add marketplaces, or generate manifests. Generic release tiers and other host update policies are unchanged.
+
+### Fixed
+
+- The checker independently reads `.qoder-plugin/plugin.json` and `.claude-plugin/plugin.json` from both the frozen snapshot and the installed plugin. If the native Qoder manifest is missing, a valid Claude-compatible manifest is accepted. If either present manifest is invalid, verification fails without fallback. When both manifests exist, `name`, `version`, and `skills` must match exactly; otherwise, verification fails.
+- The installed manifest selection, its associated relative path, and `skills` are compared against the frozen selection. This closes gaps caused by competing manifest additions or changes in selected relative paths. Original plugin identity and complete payload checks remain enforced.
+
+### Upgrade Notes
+
+Use the updated `release-finish` entry from the public `release-skill@skill-family-hub` to finish an existing installed compatible plugin using its applicable frozen plan. Updating the checker alone does not require republishing the plugin. New plugin bytes still require a new frozen plan and matching approval. `UPDATED` or `ALREADY_CURRENT` indicates installed payload status only—not that the running host has loaded it. Preserve `reload-pending` when loading has not been observed. A local finish failure does not erase a remote `VERIFIED` result. The release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub`.
+<!-- release-skill:changelog:end version=0.9.35 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.9.34 locale=en baseline=sha256:d00e9ecca9e64593103a20119972dbfb025fd8e73b1de2f850e3838d965170ce -->
 ## [0.9.34] - 2026-10-22
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.34 -->
+<!-- release-skill:release-version: 0.9.36 -->
 ## Prerequisites
 
 - Node.js `>=22.22.2 <23` (22.22.2 or newer, and below 23)
@@ -125,7 +125,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.34
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.36
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.34 -->
+<!-- release-skill:release-version: 0.9.36 -->
 ## 前置条件
 
 - Node.js `>=22.22.2 <23`（22.22.2 及以上，且低于 23）
@@ -113,7 +113,7 @@ release-skill 当前只采用并验证 Kimi Code 的交互式 TUI 路径，**无
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.34
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.36
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.34 -->
+<!-- release-skill:release-version: 0.9.36 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,34 +14,27 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.34** (2026-10-22)
+**0.9.36** (2026-10-22)
 
-0.9.34 introduces optional test result integration. Projects declaring `testIntake` can specify test requirements and results files, enabling external test orchestration and validation against defined criteria. Foundation remains at exact version 0.25.0. This release note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+0.9.36 fixes incorrect rejection of valid dual-projection plugin directories in Qoder, ensures correct validation of market sources via both URL and GitHub-based manifests, and corrects Codex entry root detection to respect manifest-declared paths instead of hardcoding `skills/`. This release note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance. Foundation dependencies remain pinned to 0.25.0.
 
 **Security**
 
-- Skill Family Hub remains the unified market, continuing to use GitHub Git Data API. Updates are bound to observed branch heads and written via compare-and-swap. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten. These mechanisms remain unchanged; remote authorization is not modified in this release.
-
-**Added**
-
-- Configurable test intake: Projects declaring `testIntake` can specify test requirements and results files via `testIntake.requirementsFile` and `testIntake.resultFile`. The first `production` `prepare` saves a non-final candidate and returns `NEEDS_INPUT` with the candidate path. Evidence must be provided before freezing; otherwise, no formal release plan is created. Subsequent `prepare --candidate <path>` resumes the same candidate without rebuilding public payloads. The candidate itself cannot be approved or published.
-- Test orchestration and acceptance: The TEST skill orchestrates test execution, determines whether to reuse or re-run tests, and aggregates business-level judgment on whether requirements are met. release-skill validates submitted materials against requirements, candidate bindings, and applicable stages, but does not replace the semantic acceptance by the domain or independent validators.
-- Post-freeze responsibilities: Requirements after freeze are handled by declared consumers via `consumer-verify`, `postverify`, or `finish` stages. Passing pre-freeze tests does not substitute for post-freeze validation.
-- Approval and artifact verification: Test acceptance is included in the release plan summary. Actions like `approve`, `publish`, and `reconcile` verify original artifacts before execution. Changes to results, criteria, scope, or allowed constraints invalidate prior approvals.
+- Foundation 0.25.0 remains unchanged; the source, scope, commit/digest, and full payload are preserved. The frozen snapshot is re-verified before writing, and the full payload is compared after installation. No new market, first-install, host strategy, framework, dependency, or tier has been introduced. 0.9.35 is immutable. Skill Family Hub remains the unified marketplace, using GitHub Git Data API and compare-and-swap bound to the observed branch head. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten.
 
 **Fixed**
 
-- An unreadable or unparsable formal authority now raises an explicit error rather than being silently ignored.
-- `prepare` now rejects execution if `--candidate` is provided without a valid path.
-- New candidate modules after packaging use existing build version information; source mode uses trusted package identities.
+- In 0.9.35, Qoder plugins incorrectly rejected valid dual-projection directories. The `name` and `version` in `.qoder-plugin/plugin.json` and `.claude-plugin/plugin.json` must bind to the same frozen target, though individual `skills` can differ. Each present candidate must be a valid JSON object, match the target identity, have non-empty `skills`, and resolve to a real directory within the plugin root. Native takes precedence; compatibility is only used when native is missing. If any candidate is invalid, installation fails immediately without fallback. After installation, the selected path and `skills` must exactly match the frozen choice, and full payload validation is retained.
+- Qoder now also accepts existing markets that provide `.claude-plugin/marketplace.json` instead of a root `marketplace.json`. The system supports two existing locations: a URL-based `marketplace.json` at the root, and a GitHub-based `marketplace.json` in `.claude-plugin/`. At least one must exist. Each present index must be valid and contain exactly one entry for the target plugin, bound to the same frozen identity; other plugin entries remain allowed. A bad source is not ignored just because another is valid. URL sources require exact repository and SHA verification, and any explicit `version` or `ref` must match. GitHub sources require exact verification of `repo`, `ref`, `sha`, and `entry.version`. Only confirmed missing files are considered absent. Validation occurs after market refresh and before plugin update. `ALREADY_CURRENT` remains read-only with zero update commands.
+- The Codex entry root check previously hardcoded `skills/`, rejecting valid paths like `.agents/skills/` declared in the manifest. Installation pre-check and post-install observation now respect the `skills` directory declared in the plugin manifest. When the field is missing, the default `skills/` path is retained, and existing prefix behavior is preserved. Explicitly invalid, out-of-bounds, or non-directory paths are rejected without fallback. Post-install observation and full payload verification must bind to the same frozen installation contract.
 
 **Upgrade Notes**
 
-Projects not declaring `testIntake` retain the original full gate and release path, with no requirement to adopt TEST or artifact-graph. Only `production` prepare is supported for `testIntake`-declared projects; non-production prepare is not allowed. Foundation dependencies remain at exact version 0.25.0. TEST must be invoked through the real Skill entry point. No new TEST CLI is introduced, and no automatic resolution of all domain acceptances is provided. This does not imply validation of all hosts or models. History of `PARTIAL`, `PUBLISHED`, and `VERIFIED` states is preserved even if tests are re-run. The release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub` instead.
+The release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and the updated `release-skill@skill-family-hub`, `release-finish`, and public CLI. Unmodified plugins need not be republished. Byte changes require a new frozen plan and matching approval. Installation does not imply loading — if actual loading is not observed, the state remains `reload-pending`. Local completion failure does not alter the remote `VERIFIED` status.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.9.34: this README records capabilities and verification boundaries;
+> **Current boundary:** v0.9.36: this README records capabilities and verification boundaries;
 > it is not evidence of
 > publication, consumer-installation verification, or independent acceptance.
 > Release availability must be established from the corresponding release records
@@ -65,7 +58,7 @@ Projects not declaring `testIntake` retain the original full gate and release pa
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; for v0.9.34,
+> **Production path verified since the v0.1.1 milestone; for v0.9.36,
 > publication, consumer-installation verification, and independent acceptance
 > require version-specific release records and verification results.**
 > The npm-installed CLI is the supported user entry. Source checkout

package/README.zh-CN.md

@@ -2,40 +2,33 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.34 -->
+<!-- release-skill:release-version: 0.9.36 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.34** (2026-10-22)
+**0.9.36** (2026-10-22)
 
-0.9.34 引入可选的测试结果接入功能。声明 `testIntake` 的项目可通过 `testIntake.requirementsFile` 和 `testIntake.resultFile` 指定测试要求与测试结果文件，实现与外部测试编排的集成，并依据定义准则进行验证。Foundation 保持精确版本 0.25.0。本发布说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
+0.9.36 修复 Qoder 插件清单对合法双投影目录的误拒，确保市场来源在 URL 与 GitHub 两种路径下均正确校验，修正 Codex 入口目录检测逻辑以尊重 manifest 声明路径而非硬编码 skills/。本发布说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。Foundation 依赖保持精确锁定为 0.25.0。
 
 **安全**
 
-- Skill Family Hub 仍为统一市场，沿用 GitHub Git Data API。更新操作绑定已观察分支头并比较后写入（compare-and-swap）。部分发布不回滚、不覆盖已完成步骤、不自动强推；这些机制保持不变，本轮未修改远端授权。
-
-**新增**
-
-- 可配置测试接入：声明 `testIntake` 的项目可通过 `testIntake.requirementsFile` 和 `testIntake.resultFile` 指定测试要求文件与测试结果文件。首次 `production` `prepare` 保存非正式候选并返回 `NEEDS_INPUT` 及候选路径；冻结前证据未补齐则不生成正式发布计划。后续执行 `prepare --candidate <path>` 可续接同一候选，不重建公开载荷。候选本身不可用于批准或发布。
-- 测试组织与验收：TEST技能负责组织测试执行、判断是否复用或重跑，并汇总业务是否达标的判断。release-skill 核对提交材料与要求、候选对象、适用阶段的绑定关系，但不代替领域或独立验收者的语义验收。
-- 冻结后职责：冻结后的要求由已声明的消费者通过 `consumer-verify`（消费者安装验证）、`postverify`（发布后校验）、`finish`（本机收尾）阶段处理，冻结前通过不替代冻结后验证。
-- 批准前复核原始材料：测试验收已纳入发布计划摘要。`approve`、`publish`、`reconcile` 等操作在执行前复核原始材料。修改结果、准则、范围或允许的限制将导致原批准失效。
+- Foundation 0.25.0 保持不变；Hub 来源、user-scope、冻结 commit/digest 与完整载荷校验机制保留。写入宿主前复验冻结快照摘要，安装后比较完整载荷。无新增市场、首装、新宿主策略、新框架、新依赖或 tier 变化。0.9.35 不可变。Skill Family Hub 仍为统一市场，沿用 GitHub Git Data API，以比较后写入绑定已观察的分支头；部分发布不回滚、不覆盖已完成步骤。
 
 **修复**
 
-- 正式计划无法读取或解析时返回明确错误，不再静默忽略。
-- 显式传入 `--candidate` 但未提供路径时，`prepare` 在执行前即拒绝。
-- 打包后的新候选模块使用现有构建版本信息，源码模式使用可信包身份。
+- 0.9.35 版本中，Qoder 插件误拒自身合法的双投影目录。`.qoder-plugin/plugin.json` 与 `.claude-plugin/plugin.json` 中的 name/version 必须绑定同一冻结目标，各自 skills 可不同。每个已存在候选必须是合法 JSON 对象、目标身份匹配、skills 非空且解析为插件根内真实目录。原生优先，仅原生缺失时才选兼容；任一候选无效即失败，不回退。安装后路径与 skills 必须精确匹配冻结选择，完整载荷检查保留。
+- Qoder 现可接受只提供 `.claude-plugin/marketplace.json`、未提供根 marketplace.json 的既有市场。支持两种既有位置：根 marketplace.json 的 URL 来源，以及 `.claude-plugin/marketplace.json` 的 GitHub 来源。至少一份存在，每份已存在清单均须合法，且目标插件恰有一条、绑定同一冻结身份；市场仍可包含其他插件。不因另一份有效而忽略坏清单。URL 来源保留仓库与 sha 精确校验，显式 version/ref 必须匹配；兼容 GitHub 来源校验 repo/ref/sha/entry.version。仅确定缺文件视为缺席。市场刷新后、插件更新前校验；ALREADY_CURRENT 保持只读且零更新命令。
+- Codex 入口目录原检查写死为 skills/，误拒 `.agents/skills/` 等合法 manifest 声明路径。安装前检查与安装后观察均采用 manifest 声明的 skills 目录。字段缺省时继续使用既有 skills/ 默认路径，入口名前缀行为保留。显式无效、越界或非目录路径拒绝，不回退。已安装入口观察与完整载荷验证须绑定同一冻结安装合同。
 
 **升级说明**
 
-未声明 `testIntake` 的项目保留原有完整门禁与发布路径，不强制接入 TEST 或 artifact-graph。仅支持 `testIntake` 声明项目使用 `production` prepare，非生产 prepare 不被允许。Foundation 三个依赖保持精确版本 0.25.0。TEST 必须通过真实 Skill 入口调用，不新增 TEST CLI，不自动解决全部业务验收，也不表示已验证所有宿主或模型。历史 `PARTIAL`、`PUBLISHED`、`VERIFIED` 状态不因测试重跑被清除。旧版独立的 `release-skill` 市场已弃用，使用 `ifoohoo/skill-family-hub` 和 `release-skill@skill-family-hub`。
+原独立的 `release-skill` 市场已弃用。使用更新后的 `release-skill@skill-family-hub` 入口、`release-finish` 与公共 CLI。未改插件无需重发，改字节须新冻结计划与匹配批准。安装 ≠ 加载，未观察实际加载则保留 reload-pending 状态。本机收尾失败不改变远端 VERIFIED 状态。统一使用 `ifoohoo/skill-family-hub` 和 `release-skill@skill-family-hub`。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.9.34 的能力范围与验证边界见本 README，
+> **当前边界：** v0.9.36 的能力范围与验证边界见本 README，
 > 不代表已经发布、完成消费者安装验证或通过独立验收。
 > 版本可用性以对应发布记录及发布后验证结果为准。
 > v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
@@ -51,7 +44,7 @@ release-skill 帮助维护者回答三个问题：准备发布什么、还有哪
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.34 的发布、消费者安装验证和独立验收状态须由该版本的发布记录及验证结果确认。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.36 的发布、消费者安装验证和独立验收状态须由该版本的发布记录及验证结果确认。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.34",
+  "version": "0.9.36",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"