release-skill 0.9.35 → 0.9.37

package/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.35"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.37"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "e14a5aba2f50cba3982bbe413cc9faebf0d45629e53f410e4942f562d7161754";
+const __bundleSourceDigest = "6eb7b6560da84252426dc5cfc81297a3d5d6d6101aecb1a8fbf3f35402892715";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -113912,6 +113912,66 @@ function normalizeCodeBuddySkillsRel(skillsRaw) {
   }
   return rel;
 }
+async function resolveCodexEntrySkillFile(pluginRoot, entrySkill, pluginName) {
+  const { normalizeGenericSkillsRel: normalizeGenericSkillsRel2 } = await init_surface_host_bindings().then(() => surface_host_bindings_exports);
+  if (!entrySkill || typeof entrySkill !== "string" || !SAFE_ID_RE.test(entrySkill)) {
+    throw new Error(`unsafe entrySkill: "${entrySkill}"`);
+  }
+  const platform = getPlatform("codex");
+  const manifestPath = await resolveContained(pluginRoot, platform.manifestPaths.plugin);
+  let manifest;
+  try {
+    manifest = JSON.parse(await readFile26(manifestPath, "utf8"));
+  } catch (err) {
+    throw new Error(`Codex plugin manifest cannot be read: ${err.message}`);
+  }
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+    throw new Error("Codex plugin manifest must be an object");
+  }
+  const skillsRel = Object.hasOwn(manifest, "skills") ? normalizeGenericSkillsRel2(manifest.skills) : "skills";
+  const skillsRoot = await resolveContained(pluginRoot, skillsRel);
+  let skillsRootStat;
+  try {
+    skillsRootStat = await lstat37(skillsRoot);
+  } catch {
+    throw new Error(`Codex manifest skills root does not exist: ${manifest.skills ?? skillsRel}`);
+  }
+  if (skillsRootStat.isSymbolicLink() || !skillsRootStat.isDirectory()) {
+    throw new Error(`Codex manifest skills root must be a real directory: ${manifest.skills ?? skillsRel}`);
+  }
+  const findCandidate = /* @__PURE__ */ __name(async (skillDirName) => {
+    const skillDir = await resolveContained(pluginRoot, `${skillsRel}/${skillDirName}`);
+    let skillDirStat;
+    try {
+      skillDirStat = await lstat37(skillDir);
+    } catch (err) {
+      if (err?.code === "ENOENT") return null;
+      throw err;
+    }
+    if (skillDirStat.isSymbolicLink() || !skillDirStat.isDirectory()) {
+      throw new Error(`Codex entry skill directory must be a real directory: ${skillsRel}/${skillDirName}`);
+    }
+    const skillFile = await resolveContained(pluginRoot, `${skillsRel}/${skillDirName}/SKILL.md`);
+    let skillStat;
+    try {
+      skillStat = await lstat37(skillFile);
+    } catch (err) {
+      if (err?.code === "ENOENT") return null;
+      throw err;
+    }
+    if (skillStat.isSymbolicLink() || !skillStat.isFile()) {
+      throw new Error(`Codex entry skill must be a regular non-symlink file: ${skillsRel}/${skillDirName}/SKILL.md`);
+    }
+    return skillFile;
+  }, "findCandidate");
+  const shortNameEntry = await findCandidate(entrySkill);
+  if (shortNameEntry) return shortNameEntry;
+  if (pluginName && SAFE_ID_RE.test(pluginName)) {
+    const prefixedEntry = await findCandidate(`${pluginName}-${entrySkill}`);
+    if (prefixedEntry) return prefixedEntry;
+  }
+  throw new Error(`Codex entry skill not found: ${skillsRel}/${entrySkill}/SKILL.md`);
+}
 async function resolveCodeBuddyEntrySkillFile(pluginRootReal, manifest, entrySkill) {
   if (!entrySkill || typeof entrySkill !== "string" || !SAFE_ID_RE.test(entrySkill)) {
     throw new Error(`unsafe entrySkill: "${entrySkill}"`);
@@ -115067,6 +115127,17 @@ function createPluginMarketplaceAdapter(deps = {}) {
                 error: `entry skill not resolvable in snapshot: ${entryErr.message}`
               });
             }
+          } else if (consumer === "codex") {
+            const pluginRootForSkill = pluginRootForEntrySkill || snapshotDirReal;
+            try {
+              await resolveCodexEntrySkillFile(pluginRootForSkill, action.entrySkill, action.plugin);
+            } catch (entryErr) {
+              return createResult({
+                actionType,
+                status: ActionStatus.PREFLIGHT_FAILED,
+                error: `entry skill not resolvable in snapshot: ${entryErr.message}`
+              });
+            }
           } else {
             const pluginRootForSkill = pluginRootForEntrySkill || snapshotDirReal;
             let entrySkillFile = resolve22(pluginRootForSkill, "skills", action.entrySkill, "SKILL.md");
@@ -116181,42 +116252,59 @@ function createPluginMarketplaceAdapter(deps = {}) {
               }
             });
           }
-          let entrySkillPath = resolve22(installPath, "skills", action.entrySkill, "SKILL.md");
-          let entrySkillFound = false;
-          try {
-            const skillStat = await lstat37(entrySkillPath);
-            if (skillStat.isFile() && !skillStat.isSymbolicLink()) {
-              entrySkillFound = true;
+          if (consumer === "codex") {
+            try {
+              await resolveCodexEntrySkillFile(installPath, action.entrySkill, action.plugin);
+            } catch (entryErr) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: {
+                  installed: true,
+                  installPath,
+                  entrySkillFound: false,
+                  error: `entry skill not resolvable in installed plugin: ${entryErr.message}`
+                }
+              });
             }
-          } catch {
-          }
-          if (!entrySkillFound && action.plugin) {
-            const prefixedPath = resolve22(
-              installPath,
-              "skills",
-              `${action.plugin}-${action.entrySkill}`,
-              "SKILL.md"
-            );
+          } else {
+            let entrySkillPath = resolve22(installPath, "skills", action.entrySkill, "SKILL.md");
+            let entrySkillFound = false;
             try {
-              const skillStat = await lstat37(prefixedPath);
+              const skillStat = await lstat37(entrySkillPath);
               if (skillStat.isFile() && !skillStat.isSymbolicLink()) {
-                entrySkillPath = prefixedPath;
                 entrySkillFound = true;
               }
             } catch {
             }
-          }
-          if (!entrySkillFound) {
-            return createResult({
-              actionType,
-              status: ActionStatus.OBSERVED,
-              observation: {
-                installed: true,
+            if (!entrySkillFound && action.plugin) {
+              const prefixedPath = resolve22(
                 installPath,
-                entrySkillFound: false,
-                error: `entry skill not found: skills/${action.entrySkill}/SKILL.md`
+                "skills",
+                `${action.plugin}-${action.entrySkill}`,
+                "SKILL.md"
+              );
+              try {
+                const skillStat = await lstat37(prefixedPath);
+                if (skillStat.isFile() && !skillStat.isSymbolicLink()) {
+                  entrySkillPath = prefixedPath;
+                  entrySkillFound = true;
+                }
+              } catch {
               }
-            });
+            }
+            if (!entrySkillFound) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: {
+                  installed: true,
+                  installPath,
+                  entrySkillFound: false,
+                  error: `entry skill not found: skills/${action.entrySkill}/SKILL.md`
+                }
+              });
+            }
           }
           let manifestDigest;
           let manifestError = null;
@@ -116418,6 +116506,7 @@ var init_plugin_marketplace = __esm({
     __name(normalizeKimiSkillsRel, "normalizeKimiSkillsRel");
     __name(resolveKimiEntrySkillFile, "resolveKimiEntrySkillFile");
     __name(normalizeCodeBuddySkillsRel, "normalizeCodeBuddySkillsRel");
+    __name(resolveCodexEntrySkillFile, "resolveCodexEntrySkillFile");
     __name(resolveCodeBuddyEntrySkillFile, "resolveCodeBuddyEntrySkillFile");
     SUPPORTED_TYPES = [
       ActionType.PLUGIN_MANIFEST_VALIDATE,
@@ -116458,6 +116547,14 @@ var init_plugin_marketplace = __esm({
 });
 
 // src/core/surface-host-bindings.mjs
+var surface_host_bindings_exports = {};
+__export(surface_host_bindings_exports, {
+  deriveSurfaceHostBinding: () => deriveSurfaceHostBinding,
+  groupSurfaceHostBindings: () => groupSurfaceHostBindings,
+  normalizeGenericSkillsRel: () => normalizeGenericSkillsRel,
+  normalizeSurfacePath: () => normalizeSurfacePath,
+  pluginRootFromManifestRelativePath: () => pluginRootFromManifestRelativePath
+});
 import { dirname as dirname10, isAbsolute as isAbsolute18, join as join19, normalize as normalize3, resolve as resolve23, sep as sep9 } from "node:path";
 import { lstat as lstat38 } from "node:fs/promises";
 function normalizeSurfacePath(rawPath) {
@@ -116586,6 +116683,49 @@ import { dirname as dirname11, join as join20, relative as relative18, isAbsolut
 import { tmpdir as tmpdir3 } from "node:os";
 import { execFile as execFileCb7 } from "node:child_process";
 import { promisify as promisify7 } from "node:util";
+function transportIdentityEntries(entries) {
+  return entries.map(({ path: path43, type, mode, size, contentDigest }) => ({
+    path: path43,
+    type,
+    mode: mode & ~WRITE_BITS,
+    size,
+    contentDigest
+  }));
+}
+function compareInstallToFrozenTransport(frozenEntries, installedEntries) {
+  const frozen = transportIdentityEntries(frozenEntries);
+  const installed = transportIdentityEntries(installedEntries);
+  const installedByPath = new Map(installed.map((entry) => [entry.path, entry]));
+  const conflicts = [];
+  for (const frozenEntry of frozen) {
+    const installedEntry = installedByPath.get(frozenEntry.path);
+    if (!installedEntry) {
+      conflicts.push(`missing: ${frozenEntry.path}`);
+      continue;
+    }
+    if (installedEntry.type !== frozenEntry.type) {
+      conflicts.push(`type mismatch: ${frozenEntry.path}`);
+    } else if (installedEntry.size !== frozenEntry.size || installedEntry.contentDigest !== frozenEntry.contentDigest) {
+      conflicts.push(`content mismatch: ${frozenEntry.path}`);
+    } else if (installedEntry.mode !== frozenEntry.mode) {
+      conflicts.push(`mode mismatch: ${frozenEntry.path}`);
+    }
+  }
+  const frozenPaths = new Set(frozen.map((entry) => entry.path));
+  for (const installedEntry of installed) {
+    if (!frozenPaths.has(installedEntry.path)) {
+      conflicts.push(`extra: ${installedEntry.path}`);
+    }
+  }
+  return conflicts;
+}
+function frozenSnapshotRelativePath(unit, actions, unitId) {
+  if (typeof unit?.frozenSnapshot?.path === "string" && unit.frozenSnapshot.path.length > 0) {
+    return unit.frozenSnapshot.path;
+  }
+  const action = (actions ?? []).find((item) => item.unitId === unitId && typeof item.parameters?.snapshotPath === "string" && item.parameters.snapshotPath.length > 0);
+  return action?.parameters?.snapshotPath ?? null;
+}
 async function verifyCursorHostDistributions({
   plan,
   root,
@@ -118161,16 +118301,65 @@ async function verifyRelease(options) {
           }
           const pluginDistCount = (surface.unit?.distributions ?? []).filter((d) => d.type !== "npm").length;
           if (pluginDistCount === 1 && surface.frozenPluginRoot === ".") {
-            const observedReceipt = createSkillResourceClosureReceipt(closureResult, {
-              unitId: surface.unitId,
-              preparedAt: expectedUnitReceipt.preparedAt ?? null,
-              exitCode: expectedUnitReceipt.exitCode ?? 0
-            });
-            assertSkillResourceClosureReceipt(
-              expectedUnitReceipt,
-              observedReceipt,
-              `unit "${surface.unitId}"`
-            );
+            const frozenRel = frozenSnapshotRelativePath(surface.unit, actions, surface.unitId);
+            if (frozenRel) {
+              const frozenDir = await resolveFrozenPath(root, frozenRel, "frozen snapshot path");
+              const frozenClosure = await checkSkillResourceClosure({
+                snapshotDir: frozenDir,
+                host: surface.host,
+                surfaceHostBindings: [{ surfaceId: surface.surfaceId, host: surface.host }]
+              });
+              const frozenReceipt = createSkillResourceClosureReceipt(frozenClosure, {
+                unitId: surface.unitId,
+                preparedAt: expectedUnitReceipt.preparedAt ?? null,
+                exitCode: expectedUnitReceipt.exitCode ?? 0
+              });
+              assertSkillResourceClosureReceipt(
+                expectedUnitReceipt,
+                frozenReceipt,
+                `unit "${surface.unitId}"`
+              );
+              const frozenSnap = await computeFrozenSnapshot(frozenDir, {
+                excludeRootEntries: TRANSPORT_EXCLUSIONS
+              });
+              const installedSnap = await computeFrozenSnapshot(surface.installPath, {
+                excludeRootEntries: TRANSPORT_EXCLUSIONS
+              });
+              const conflicts = compareInstallToFrozenTransport(
+                frozenSnap.entries,
+                installedSnap.entries
+              );
+              await evidence.append({
+                phase: "verify",
+                step: "skill-resource-closure",
+                status: "install-comparison",
+                unitId: surface.unitId,
+                frozenInputDigest: frozenSnap.digest,
+                installedInputDigest: installedSnap.digest,
+                frozenModes: frozenSnap.entries.map((entry) => ({ path: entry.path, mode: entry.mode })),
+                installedModes: installedSnap.entries.map((entry) => ({ path: entry.path, mode: entry.mode }))
+              });
+              if (conflicts.length > 0) {
+                const listed = conflicts.slice(0, PAYLOAD_CONFLICT_REPORT_CAP2).join("; ");
+                const overflow = conflicts.length > PAYLOAD_CONFLICT_REPORT_CAP2 ? `; and ${conflicts.length - PAYLOAD_CONFLICT_REPORT_CAP2} more conflicting path(s)` : "";
+                throw new ReleaseError(
+                  POST_PUBLISH_VERIFY_FAILED,
+                  `installed plugin root differs in path, bytes, size, or non-write mode bits for unit "${surface.unitId}": ${listed}${overflow}`,
+                  { unitId: surface.unitId, conflicts }
+                );
+              }
+            } else {
+              const observedReceipt = createSkillResourceClosureReceipt(closureResult, {
+                unitId: surface.unitId,
+                preparedAt: expectedUnitReceipt.preparedAt ?? null,
+                exitCode: expectedUnitReceipt.exitCode ?? 0
+              });
+              assertSkillResourceClosureReceipt(
+                expectedUnitReceipt,
+                observedReceipt,
+                `unit "${surface.unitId}"`
+              );
+            }
           }
         }
         skillResourceClosureReceipts.push(createSkillResourceClosureReceipt(
@@ -118381,7 +118570,7 @@ async function verifyRelease(options) {
     throw err;
   }
 }
-var execFile6, VERIFICATION_RESOLVED_TYPES, ADAPTER_ACTION_TYPE_MAP2, FIRST_RELEASE_BOOTSTRAP_MODE, EXTERNAL_MARKETPLACE_SHA_RE2, defaultNpmExecutor;
+var execFile6, VERIFICATION_RESOLVED_TYPES, WRITE_BITS, PAYLOAD_CONFLICT_REPORT_CAP2, ADAPTER_ACTION_TYPE_MAP2, FIRST_RELEASE_BOOTSTRAP_MODE, EXTERNAL_MARKETPLACE_SHA_RE2, defaultNpmExecutor;
 var init_verify = __esm({
   async "src/commands/verify.mjs"() {
     init_src2();
@@ -118419,6 +118608,11 @@ var init_verify = __esm({
       PASSED_MANUAL: "PASSED_MANUAL",
       NOT_REQUIRED_UNCHANGED: "NOT_REQUIRED_UNCHANGED"
     });
+    WRITE_BITS = 146;
+    PAYLOAD_CONFLICT_REPORT_CAP2 = 10;
+    __name(transportIdentityEntries, "transportIdentityEntries");
+    __name(compareInstallToFrozenTransport, "compareInstallToFrozenTransport");
+    __name(frozenSnapshotRelativePath, "frozenSnapshotRelativePath");
     __name(verifyCursorHostDistributions, "verifyCursorHostDistributions");
     __name(verifyPublicSourceAuthorityReceiptOffline, "verifyPublicSourceAuthorityReceiptOffline");
     ADAPTER_ACTION_TYPE_MAP2 = {
@@ -139649,7 +139843,7 @@ async function observeQoderPlugin(target, command2, env, run6) {
     found
   };
 }
-async function readQoderManifest(root, label) {
+async function readQoderManifest(root, label, target) {
   const candidates = [];
   for (const manifestPath of [".qoder-plugin/plugin.json", ".claude-plugin/plugin.json"]) {
     let text;
@@ -139663,10 +139857,11 @@ async function readQoderManifest(root, label) {
     if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
       throw new Error(`${label} (${manifestPath}) did not return an object`);
     }
+    await assertQoderPluginManifest(target, manifest, `${label} (${manifestPath})`, root);
     candidates.push({ manifestPath, manifest });
   }
   if (candidates.length === 0) throw new Error(`${label} has no native or compatible plugin manifest`);
-  if (candidates.length === 2 && ["name", "version", "skills"].some((field) => candidates[0].manifest[field] !== candidates[1].manifest[field])) {
+  if (candidates.length === 2 && ["name", "version"].some((field) => candidates[0].manifest[field] !== candidates[1].manifest[field])) {
     throw new Error(`${label} does not match the frozen Qoder plugin identity and projection path: conflicting native and compatible manifests`);
   }
   return candidates[0];
@@ -139687,26 +139882,43 @@ async function assertFrozenQoderManifest(target, root) {
     snapshotPath: target.snapshotPath,
     expectedDigest: target.manifestDigest
   });
-  const { manifestPath, manifest } = await readQoderManifest(snapshotRoot, "frozen Qoder plugin manifest");
+  const { manifestPath, manifest } = await readQoderManifest(snapshotRoot, "frozen Qoder plugin manifest", target);
   const skills = await assertQoderPluginManifest(target, manifest, "frozen Qoder plugin manifest", snapshotRoot);
   return { manifestPath, skills };
 }
 async function assertQoderHubEntry(target, marketplaceRoot) {
-  const marketplace = parseJson2(
-    await readFileContained(marketplaceRoot, "marketplace.json", { encoding: "utf8" }),
-    "Qoder Hub marketplace manifest"
-  );
-  if (marketplace?.name !== target.marketplace || !Array.isArray(marketplace.plugins)) {
-    throw new Error("Qoder Hub marketplace manifest does not match the frozen marketplace");
-  }
-  const matches = marketplace.plugins.filter((entry) => entry?.name === target.plugin);
-  if (matches.length !== 1) {
-    throw new Error(`Qoder Hub marketplace manifest must contain exactly one ${target.plugin} entry`);
-  }
-  const source = matches[0]?.source;
-  if (source?.source !== "url" || normalizeHubGitSource(source.url, target.hub.githubHost) !== target.pluginRepo || source.sha !== target.pluginCommit) {
-    throw new Error("Qoder Hub entry does not match the frozen public source identity");
+  let found = false;
+  for (const indexPath of ["marketplace.json", ".claude-plugin/marketplace.json"]) {
+    let text;
+    try {
+      text = await readFileContained(marketplaceRoot, indexPath, { encoding: "utf8" });
+    } catch (error) {
+      if (error?.code === "SFC2004" && error?.details?.kind === "missing-resource") continue;
+      throw error;
+    }
+    found = true;
+    const marketplace = parseJson2(text, `Qoder Hub marketplace manifest (${indexPath})`);
+    if (!marketplace || typeof marketplace !== "object" || Array.isArray(marketplace) || marketplace.name !== target.marketplace || !Array.isArray(marketplace.plugins)) {
+      throw new Error("Qoder Hub marketplace manifest does not match the frozen marketplace");
+    }
+    if (indexPath === ".claude-plugin/marketplace.json") {
+      if (target.hub.githubHost !== "github.com" || typeof target.frozenTag !== "string" || target.frozenTag.length === 0) {
+        throw new Error("Qoder compatible Hub entry requires a frozen GitHub tag identity");
+      }
+      await assertHubHostEntry({ ...target, host: "claude", pluginTag: target.frozenTag, githubHost: target.hub.githubHost }, marketplaceRoot);
+      continue;
+    }
+    const matches = marketplace.plugins.filter((entry2) => entry2?.name === target.plugin);
+    if (matches.length !== 1) {
+      throw new Error(`Qoder Hub marketplace manifest must contain exactly one ${target.plugin} entry`);
+    }
+    const entry = matches[0];
+    const source = entry.source;
+    if (source?.source !== "url" || normalizeHubGitSource(source.url, target.hub.githubHost) !== target.pluginRepo || source.sha !== target.pluginCommit || entry.version !== void 0 && entry.version !== target.version || source.ref !== void 0 && (typeof target.frozenTag !== "string" || source.ref !== target.frozenTag)) {
+      throw new Error("Qoder Hub entry does not match the frozen public source identity");
+    }
   }
+  if (!found) throw new Error("Qoder Hub has no native or compatible marketplace manifest");
 }
 async function verifyQoderInstalledPayload({
   target,
@@ -139715,7 +139927,7 @@ async function verifyQoderInstalledPayload({
   frozenManifest,
   verifyInstalledPayload
 }) {
-  const { manifestPath, manifest } = await readQoderManifest(installPath, "installed Qoder plugin manifest");
+  const { manifestPath, manifest } = await readQoderManifest(installPath, "installed Qoder plugin manifest", target);
   if (manifestPath !== frozenManifest.manifestPath) {
     throw new Error("installed Qoder plugin manifest path differs from the frozen manifest selection");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.35",
+  "version": "0.9.37",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/platform-manifest.json

@@ -2,11 +2,11 @@
   "schemaVersion": "1.0.0",
   "platformId": "release-skill",
   "platformName": "release-skill Plugin Platform",
-  "version": "0.9.35",
+  "version": "0.9.37",
   "logicalRoot": "skills-src/",
-  "logicalRootDigest": "05adb1b81257f99a74b7736f13a174095f79b0745f4c1a5947bb7d95ee9cf8ad",
-  "projectionDigest": "9ae26428567a5d7eaf2586626dcd503e0035205e99c3ec3c335f13b94ffa58c4",
-  "projectionId": "release-skill:platform:0.9.35",
+  "logicalRootDigest": "b76c623a055c6998a6909fc041b2646356f0d69cace4a43cb8edacefc248fb97",
+  "projectionDigest": "0d4b9972ee2ce6ce8eadfb075a90e89752a8f2b5f2becd53a6ae034029da8bad",
+  "projectionId": "release-skill:platform:0.9.37",
   "manifestRequired": true,
   "projectionSources": {
     "skills-src-root": {

package/references/.render-manifest.json

@@ -10,8 +10,8 @@
       "bytes": 16742
     },
     "02-project-config.md": {
-      "digest": "95ef58bcf788636c2b0300955e095a050829b51f6e5b4fc1a8d618d6b8a18021",
-      "bytes": 34314
+      "digest": "3e19eedbabb7e17d8afd4d9efc6a43309b7cc04e72866d44bd1afac787c8b462",
+      "bytes": 34998
     },
     "03-readme-quality.md": {
       "digest": "d74e41052592443ebbd450d0ace5f9b9b19c7a94db50f952b17c1c5a4c5dc230",

package/references/02-project-config.md

@@ -124,19 +124,100 @@ policy:                     # 可选，安全策略
 
 ### 2.0 显式测试接入
 
-`testIntake` 可选。只含两个项目相对普通文件路径：`requirementsFile` 与 `resultFile`。两者归一化后必须不同；`a/./b` 与 `a/b` 视为同一路径。未知字段、绝对路径、`..` 和结尾斜杠在配置加载时拒绝。
+`testIntake` 为可选配置项，仅包含两个项目相对普通文件路径字段：`requirementsFile` 与 `resultFile`。路径经归一化后必须互异；`a/./b` 与 `a/b` 视为同一路径。配置加载时拒绝以下内容：
+- 未知字段；
+- 绝对路径；
+- 包含 `..` 路径组件的路径；
+- 以斜杠结尾的路径。
 
-未声明 `testIntake` 的项目保持原有 hook、完整门、缓存和发布路径，不因此增加 TEST、Graph 或 Registry 依赖。`--test-selection incremental` 仍在冻结时拒绝。
+未声明 `testIntake` 的项目维持原有 hook 机制、完整门控、缓存策略与发布路径，不引入 TEST、Graph 或 Registry 依赖。
 
-声明之后只允许生产 `prepare`。非生产 prepare 返回 `CONFIG_INVALID`，原因 `TEST_INTAKE_NON_PRODUCTION`。assess 等其他命令仍可加载这份配置。docs、config、marketplace 轻量工作流、`selectedUnits` 和无需发布的配置分支都不免除项目级要求：未选中单元的单元级要求可以不进入本轮，项目级要求始终适用。
+`--test-selection incremental` 在 `prepare` 或冻结过程中均被拒绝，不得在任何准备阶段启用。该拒绝行为不延迟至冻结完成后。
 
-要求文件与结果文件的字段以 `schemas/test-intake.schema.json` 为准。release 只核收原件：预冻结项必须有一条可核验结果，处置为 `executed`、`reused`，或由 owner 确认的 `not-applicable`；结论为 `passed`；`acceptedBy` 与声明的 acceptor 一致，`not-applicable` 时与 owner 一致；引用文件可读且摘要一致；结果里的 `subjectDigest` 与 `requirementsSha256` 绑定当前对象。退出码 0、全局 PASS、空证据、`failed` / `incomplete` / `uncovered`、未知字段，或把后续阶段项提前标成完成，都不能通过。未知失败原因保持 `unknown`。安装、加载和业务证据继续分开保存，不合并成一个类别。
+#### 交互式 Skill 的接入职责
 
-首次生产 prepare 生成适用快照和 tarball 后，只保存一份非正式候选 `.release-skill/runs/<run>/test-candidate.json`，返回 `NEEDS_INPUT`（`GATE_FAILED`，退出码 13），并给出 `candidatePath`、`candidateSha256`、`subjectDigest`。此时不写正式计划，也不进入 `PREPARED` 或 `FROZEN`。之后用 `prepare --candidate <path>` 续接：新的运行目录，不覆盖旧运行目录、旧证据或旧候选。结果补齐并核验通过后才写正式计划。对象、配置、权威要求或其他实质输入变化时返回 `TEST_CANDIDATE_REPREPARE`，原候选字节保持不变。只往结果文件补入仍绑定该对象的有效内容，不算输入漂移。
+生产准备前，Skill 必须核对接入状态。若未声明 `testIntake`，系统默认触发公开 TEST 0.1.0 的 `skill-family-test:skill-family-test-plan`，随后在授权范围内调用 `skill-family-test:skill-family-test-run`。
 
-候选不能传给 approve 或 publish，也不能把 `PARTIAL`、`PUBLISHED`、`VERIFIED` 或任何已成功的外部检查点改成完成。`ship` 在接受前保持持久状态 `NEW` 与 `testCandidate`，不重建候选。没有 `testCandidate` 的 `NEW` 记录仍走原来的准备路径。
+跳过接入须满足以下条件：
+- 基于本轮适用且范围匹配的明确同意；
+- 必须先明确征询再作决定；
+- 沉默、拒绝、仅普通发布预授权、旧轮次、其他项目、版本或范围不匹配均不可跳过；
+- 本轮匹配的答复可复用。
 
-正式计划上的可选 `testAcceptance` 进入当前计划版本的绑定摘要，记录层剥离不移除它。替换结果、准则、范围或允许的限制会改变 plan digest，原批准不再适用。不改变这些原件的注释不会使批准失效。没有 `testAcceptance` 的计划保持原摘要路径。approve、publish 和 reconcile 在动作前复核绑定原件；原件缺失或被改写时失败关闭，不重新批准，也不重放已经成功的外部检查点。
+不得将跳过表述为测试已达标，亦不得以跳过清除已声明的适用要求。
+
+以下请求不新增接入义务：
+- 只读请求；
+- 非生产路径；
+- marketplace-only 委托发布。
+- 已冻结计划的批准、发布、对账与正式验证不追加接入义务。
+
+直接非交互 CLI 支持可选 `testIntake`，不新增选择参数、同意文件 Schema 或身份认证。选择责任由实际交互的 Skill 承担，答复记入既有任务或执行计划。
+
+#### 声明后的命令与要求适用范围
+
+声明 `testIntake` 后，仅允许执行生产 `prepare` 命令。非生产 `prepare` 返回 `CONFIG_INVALID`，错误码为 `TEST_INTAKE_NON_PRODUCTION`。
+
+`assess` 等其他命令仍可加载该配置。
+
+轻量工作流（如 docs、config、marketplace）、`selectedUnits` 与无需发布的配置分支不免除项目级要求：未选中单元的单元级要求可不进入本轮，但项目级要求始终适用。
+
+#### 核收原件与失败条件
+
+`release` 仅核收原件，要求如下：
+- 预冻结项必须存在一条可核验结果；
+- 结果状态必须为 `executed`、`reused` 或由 owner 确认的 `not-applicable`；
+- 结论必须为 `passed`；
+- `acceptedBy` 与声明的 acceptor 一致；`not-applicable` 时与 owner 一致；
+- 引用文件可读且摘要一致；
+- 结果中的 `subjectDigest` 与 `requirementsSha256` 均必须绑定当前对象。
+
+以下情况均不通过核收：
+- 退出码为 0；
+- 全局 PASS；
+- 空证据；
+- 状态为 `failed`、`incomplete`、`uncovered`；
+- 未知字段；
+- 提前将后续阶段项标记为完成；
+- 未知失败原因（保持 `unknown`）。
+
+安装、加载与业务证据须分开保存，不得合并为单一类别。
+
+核收依据 `schemas/test-intake.schema.json` 定义的字段结构。
+
+#### 首次生产 prepare、候选续接和输入漂移
+
+首次生产 `prepare` 执行后，生成适用快照与 tarball，仅保存一份非正式候选：
+- 路径：`.release-skill/runs/<run>/test-candidate.json`；
+- 返回状态：`NEEDS_INPUT`（`GATE_FAILED`，退出码 13）；
+- 附带字段：`candidatePath`、`candidateSha256` 与 `subjectDigest`。
+
+此时不写正式计划，也不进入 `PREPARED` 或 `FROZEN` 状态。
+
+后续使用 `prepare --candidate <path>` 续接：
+- 创建新运行目录；
+- 不覆盖旧运行目录、旧证据或旧候选；
+- 结果补齐并核验通过后，才写入正式计划。
+
+当对象、配置、权威要求或其他实质输入发生变更时，返回 `TEST_CANDIDATE_REPREPARE`，原候选字节保持不变。
+
+**仅当向仍绑定原对象的 `resultFile` 补入有效结果内容时，不视为输入漂移。**
+
+首次候选、有效结果、正式计划与正式业务接受为不同阶段，不得将 `NEEDS_INPUT` 或工具成功改写为通过。
+
+#### 后续计划与批准绑定
+
+候选不可传给 `approve` 或 `publish`，亦不可将 `PARTIAL`、`PUBLISHED`、`VERIFIED` 或任何已成功的外部检查点修改为完成状态。
+
+`ship` 在接受前保持持久状态 `NEW` 与 `testCandidate`，不重建候选。无 `testCandidate` 的 `NEW` 记录仍沿用原有准备路径。
+
+正式计划中的可选字段 `testAcceptance` 进入当前计划版本的绑定摘要，记录层剥离不移除该字段。
+
+替换结果、准则、范围或允许的限制将改变 plan digest，原批准不再适用。未改变这些原件的注释不会使批准失效。
+
+无 `testAcceptance` 的计划保持原摘要路径。
+
+`approve`、`publish` 与 `reconcile` 在执行前复核绑定原件；原件缺失或被改写时，动作失败并关闭，不重新批准，也不重放已成功的外部检查点。
 
 ### 2.1 本地发布收尾
 
@@ -247,7 +328,9 @@ releaseUnits:
 
 Qoder 保持 build-only 分发边界，不新增发布计划内的 distribution 或安装检查点。本机收尾更新 Qoder 有四个前提：冻结计划已声明、用户显式选择、Hub 来源匹配、既有用户范围安装核对通过。流程不添加市场或执行首次安装。更新完成仅表示安装载荷已变更，不表示当前会话已加载新版，后续仍须重新加载或新开会话，并完成一次真实的只读业务调用。
 
-冻结与安装两侧均核验原生 `.qoder-plugin/plugin.json` 与 Claude 兼容 `.claude-plugin/plugin.json`：原生清单缺失时方可启用兼容清单，原生清单存在但无效时不得回退；两清单同时存在时，均须可解析为有效对象，且 `name/version/skills` 完全一致，以原生清单为优先。安装侧结果须与冻结侧选定的相对清单路径及 `skills` 一致，不得忽略额外出现的损坏或冲突清单。写入前复验冻结快照摘要，安装后须完整比较声明载荷与冻结来源，现有 `external-marketplace-v1` 合同允许宿主额外文件，因此完整载荷比较不得替代双清单的独立核验。
+在已核对的市场安装根内，分别读取 `marketplace.json` 的 `url` 来源与 `.claude-plugin/marketplace.json` 的 `github` 来源；至少一个存在，且所有存在候选都须有效并绑定同一冻结目标。根目录来源核对 `source.url/source.sha`；兼容来源沿现有 Claude 断言核对仓库、冻结标签、提交和版本。任一损坏或冲突均拒绝，不猜测优先级。
+
+冻结与安装两侧均核验原生 `.qoder-plugin/plugin.json` 与 Claude 兼容 `.claude-plugin/plugin.json`：原生清单缺失时方可启用兼容清单，原生清单存在但无效时不得回退；两清单同时存在时，均须可解析为有效对象，以原生清单为优先。每个已存在候选（包括未选候选）都须核对目标 `name/version`；其 `skills` 必须为非空字符串，经 `Foundation 0.25.0` 的 `resolveContained` 解析为根内真实目录。跨候选只比较 `name/version`，允许各自合法 `skills` 不同；原生正常不能遮蔽兼容无效。安装侧结果须与冻结侧选定的相对清单路径及 `skills` 一致，不得忽略额外出现的损坏或冲突清单。写入前复验冻结快照摘要，安装后须完整比较声明载荷与冻结来源，现有 `external-marketplace-v1` 合同允许宿主额外文件，因此完整载荷比较不得替代双清单的独立核验。
 
 0.9.21 起，同一声明也能执行 Claude、Codex、Kimi、CodeBuddy 和 WorkBuddy 的本机更新，无需恢复旧宿主 distribution。插件仓库、标签、提交和快照摘要必须来自冻结 unit 与对应标签动作。Claude、Codex 和 CodeBuddy 家族使用已有同源 Hub 市场；刷新前后分别核对宿主专用条目，安装后比较完整冻结载荷。CodeBuddy/WorkBuddy 只升级已有插件，并在插件写入前再次确认 Hub 分支未漂移。Kimi 直接使用冻结 GitHub Release 和终端交互，其只有仓库 URL 的 Hub 文件不承担标签或提交证明。启动进程保留三个代理变量 `http_proxy`、`https_proxy`、`all_proxy`。
 

package/schemas/.render-manifest.json

@@ -17,6 +17,10 @@
       "digest": "86c9cab024ebe9c7f8ec3358fcc12d05b8ed246ab59da2b0acc6a517f31274ea",
       "bytes": 2488
     },
+    "evidence-event-v2.schema.json": {
+      "digest": "693430e636afc85bf4a79e3f7bf3fb87254cbd62f2e3f35c35d6f84e5e8e0be1",
+      "bytes": 6058
+    },
     "evidence-event.schema.json": {
       "digest": "b7e14522a5aba818cab191545f23d2323be0e4c80566e9d3e4da576103a00490",
       "bytes": 2390
@@ -34,8 +38,8 @@
       "bytes": 57111
     },
     "release-run.schema.json": {
-      "digest": "4a041b8f6488e7d61b7eb271ebdbc2e043731df41c4437783ef63e77f664c192",
-      "bytes": 19002
+      "digest": "26c44ddf1ed42f266a2ddee7f6132cee94c59593e37f24359c9c48f12612ec22",
+      "bytes": 21874
     },
     "test-intake.schema.json": {
       "digest": "654e91ce518cb2b8aca84947d0c3bb8c4262ab047d86081e7e93dc07a9c6c739",